Merge branch 'main' into fix/scan-endpoint-auth

Signed-off-by: Tetiana Naumenko <t.naumenko@samsung.com>

Author: t-naumenko

.env.example

@@ -10,6 +10,11 @@ MYSQL_ROOT_PASSWORD=
 MYSQL_USER=lpvs
 MYSQL_PASSWORD=
 
+# Secret used to verify GitHub webhook signatures (X-Hub-Signature-256). Must match
+# the "Secret" configured in the GitHub webhook settings. Generate a strong random
+# value, e.g. `openssl rand -hex 32`.
+LPVS_GITHUB_SECRET=
+
 # Optional API key for the single scan endpoint `POST /scan/{org}/{repo}/{pr}`,
 # sent by callers in the `X-LPVS-Api-Key` header. Leave empty to disable the
 # endpoint. Generate a strong random value, e.g. `openssl rand -hex 32`.

doc/docs/quick-start-guide.md

@@ -23,7 +23,7 @@ This section explains how to download and run pre-built LPVS Docker image with n
 ### Set up LPVS Docker environment variables
 
 * Copy `.env.example` to `.env` in the same directory as `docker-compose-quick.yml`, and
-fill in strong, unique values for `MYSQL_ROOT_PASSWORD` and `MYSQL_PASSWORD` (refer to the
+fill in strong, unique values for `MYSQL_ROOT_PASSWORD`, `MYSQL_PASSWORD` and `LPVS_GITHUB_SECRET` (refer to the
 [guide](user-guide/service/docker.md#setting-up-lpvs-docker-environment-variables)). `docker compose`
 refuses to start if these are left empty.
 

doc/docs/user-guide/config/options.md

@@ -39,7 +39,7 @@ for more details.
 
 - `github.secret`: This setting specifies the secret string used for configuring webhooks. Please refer to the
 [Webhook configuration guide](../service/webhook.md#configure-the-webhook-in-your-github-repository-settings) 
-for more details. Default: `LPVS`.
+for more details. Required, no default: LPVS refuses to start if it is empty.
 
 - `lpvs.*`: These settings include various configurations specific to the LPVS application like core pool size, 
 number of scan attempts, and version.
@@ -115,7 +115,7 @@ Alternatively, you can provide the necessary values for several properties using
 - `LPVS_GITHUB_LOGIN`: Equivalent to the property `github.login`.
 - `LPVS_GITHUB_TOKEN`: Equivalent to the property `github.token`.
 - `LPVS_GITHUB_API_URL`: Equivalent to the property `github.api.url`.
-- `LPVS_GITHUB_SECRET`: Equivalent to the property `github.secret`.
+- `LPVS_GITHUB_SECRET`: Equivalent to the property `github.secret`. Takes precedence over the property if both are set.
 - `LPVS_LICENSE_CONFLICT`: Equivalent to the property `license_conflict`.
 - `LPVS_API_KEY`: Equivalent to the property `lpvs.api.key`. Takes precedence over the property if both are set.
 - `LPVS_DATASOURCE_USERNAME`: Equivalent to the property `spring.datasource.username`. Required — the

doc/docs/user-guide/service/docker.md

@@ -10,7 +10,7 @@ For the Docker deployment scenario, you need to provide database credentials and
 GitHub settings before starting the containers.
 
 * Copy `.env.example` to `.env` in the same directory as `docker-compose.yml`, and
-fill in strong, unique values for `MYSQL_ROOT_PASSWORD` and `MYSQL_PASSWORD`:
+fill in strong, unique values for `MYSQL_ROOT_PASSWORD`, `MYSQL_PASSWORD` and `LPVS_GITHUB_SECRET`:
 
     ```bash
     cp .env.example .env

doc/docs/user-guide/service/webhook.md

@@ -53,8 +53,9 @@ Follow the next steps:
     It will look like `https://50be-62-205-136-206.ngrok-free.app/`.
 
 - Specify the content type as `application/json`.
-- Fill in the `Secret` field with the passphrase: `LPVS`.
-- Save the same passphrase in `github.secret` of the LPVS backend `application.properties` or `docker-compose.yml` files.
+- Fill in the `Secret` field with a strong random passphrase, e.g. generated with `openssl rand -hex 32`.
+- Save the same passphrase as `LPVS_GITHUB_SECRET` in the `.env` file (Docker deployment), or in `github.secret`
+of the LPVS backend `application.properties` file. LPVS refuses to start if the secret is empty.
 
 ![step3](../../img/webhook/step_1_3.png)
 

docker-compose-quick.yml

@@ -21,7 +21,7 @@ services:
       - github.login=
       - github.token=
       - github.api.url=https://api.github.com
-      - github.secret=LPVS
+      - github.secret=${LPVS_GITHUB_SECRET:?Set LPVS_GITHUB_SECRET in .env (see .env.example)}
 
     depends_on:
       mysqldb:

docker-compose.yml

@@ -21,7 +21,7 @@ services:
       - github.login=
       - github.token=
       - github.api.url=https://api.github.com 
-      - github.secret=LPVS
+      - github.secret=${LPVS_GITHUB_SECRET:?Set LPVS_GITHUB_SECRET in .env (see .env.example)}
 
     depends_on:
       mysqldb:

src/main/java/com/lpvs/controller/GitHubController.java

@@ -61,22 +61,40 @@ public class GitHubController {
 
     /**
      * Initializes the GitHub secret from the LPVS_GITHUB_SECRET environment variable or the application property.
+     * The environment variable takes precedence over the property.
      * Exits the application if the secret is not set.
      */
     @PostConstruct
     public void initializeGitHubController() {
         this.GITHUB_SECRET =
-                Optional.ofNullable(this.GITHUB_SECRET)
-                        .filter(s -> !s.isEmpty())
-                        .orElse(
-                                Optional.ofNullable(System.getenv("LPVS_GITHUB_SECRET"))
-                                        .orElse(""));
-        if (this.GITHUB_SECRET.isEmpty()) {
-            log.error("LPVS_GITHUB_SECRET (github.secret) is not set.");
-            exitHandler.exit(-1);
+                Optional.ofNullable(System.getenv("LPVS_GITHUB_SECRET"))
+                        .filter(StringUtils::hasText)
+                        .orElse(Optional.ofNullable(this.GITHUB_SECRET).orElse(""));
+        if (!StringUtils.hasText(this.GITHUB_SECRET)) {
+            if (StringUtils.hasText(pullRequestTrigger) || StringUtils.hasText(localPath)) {
+                // Single scan (CLI) mode doesn't need webhooks: keep running, reject webhooks
+                log.warn(
+                        "LPVS_GITHUB_SECRET (github.secret) is not set. Webhook endpoint is disabled.");
+                this.GITHUB_SECRET = "";
+            } else {
+                log.error("LPVS_GITHUB_SECRET (github.secret) is not set.");
+                exitHandler.exit(-1);
+            }
         }
     }
 
+    /**
+     * Trigger value to start a single scan of a pull request (optional).
+     */
+    @Value("${github.pull.request:}")
+    private String pullRequestTrigger;
+
+    /**
+     * Trigger value to start a single scan of local files or folder (optional).
+     */
+    @Value("${local.path:}")
+    private String localPath;
+
     /**
      * LPVSQueueService for handling user-related business logic.
      */
@@ -107,6 +125,7 @@ public void initializeGitHubController() {
     private static final String SUCCESS = "Success";
     private static final String ERROR = "Error";
     private static final String ALGORITHM = "HmacSHA256";
+    private static final String SIGNATURE_PREFIX = "sha256=";
 
     /**
      * Constructor for GitHubController.
@@ -175,7 +194,7 @@ public ResponseEntity<LPVSResponseWrapper> gitHubWebhooks(
                     .headers(LPVSPayloadUtil.generateSecurityHeaders())
                     .body(new LPVSResponseWrapper(ERROR));
         }
-        if (!GITHUB_SECRET.trim().isEmpty() && wrongSecret(signature, payload)) {
+        if (!StringUtils.hasText(GITHUB_SECRET) || wrongSecret(signature, payload)) {
             log.error("Received empty or incorrect GITHUB_SECRET");
             return ResponseEntity.status(HttpStatus.FORBIDDEN)
                     .headers(LPVSPayloadUtil.generateSecurityHeaders())
@@ -310,16 +329,25 @@ public ResponseEntity<LPVSResponseWrapper> gitHubSingleScan(
      * @throws Exception if an error occurs during signature verification.
      */
     public boolean wrongSecret(String signature, String payload) throws Exception {
-        String lpvsSecret = signature.split("=", 2)[1];
+        if (signature == null || !signature.startsWith(SIGNATURE_PREFIX)) {
+            return true;
+        }
+        String lpvsSecret = signature.substring(SIGNATURE_PREFIX.length());
 
-        SecretKeySpec key = new SecretKeySpec(GITHUB_SECRET.getBytes("utf-8"), ALGORITHM);
+        SecretKeySpec key =
+                new SecretKeySpec(GITHUB_SECRET.getBytes(StandardCharsets.UTF_8), ALGORITHM);
         Mac mac = Mac.getInstance(ALGORITHM);
         mac.init(key);
-        String githubSecret = Hex.encodeHexString(mac.doFinal(payload.getBytes("utf-8")));
+        String githubSecret =
+                Hex.encodeHexString(
+                        mac.doFinal(
+                                Optional.ofNullable(payload)
+                                        .orElse("")
+                                        .getBytes(StandardCharsets.UTF_8)));
 
-        log.debug("lpvs   signature: " + lpvsSecret);
-        log.debug("github signature: " + githubSecret);
-
-        return !lpvsSecret.equals(githubSecret);
+        // Constant-time comparison to prevent timing attacks
+        return !MessageDigest.isEqual(
+                lpvsSecret.getBytes(StandardCharsets.UTF_8),
+                githubSecret.getBytes(StandardCharsets.UTF_8));
     }
 }

src/main/resources/application.properties

@@ -26,8 +26,10 @@ github.login=
 github.token=
 # Corresponding env. variable LPVS_GITHUB_API_URL
 github.api.url=https://api.github.com
-# Corresponding env. variable LPVS_GITHUB_SECRET
-github.secret=LPVS
+# Webhook secret (must match the "Secret" set in GitHub webhook settings). Required, no default.
+# Use a strong random value, e.g. `openssl rand -hex 32`.
+# Corresponding env. variable LPVS_GITHUB_SECRET (takes precedence over this property)
+github.secret=
 
 # API key for the single scan endpoint (X-LPVS-Api-Key header). If empty, the endpoint is disabled.
 # Use a strong random value, e.g. `openssl rand -hex 32`.