Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BCDA-7991: Address sonarqube security issues #195

Merged
merged 2 commits into from
Apr 16, 2024
Merged

Conversation

alex-dzeda
Copy link
Contributor

@alex-dzeda alex-dzeda commented Apr 12, 2024

🎫 Ticket

https://jira.cms.gov/browse/BCDA-7991

🛠 Changes

Updated Dockerfile + problematic html file.

ℹ️ Context for reviewers

SonarQube had 8 "findings" related to the static site application: 2 related to the Dockerfile in the project, and 6 related to external link outs. 7 of those findings will be resolved with this PR, and one can remain ignored (the copying all files in a directory in the Dockerfile) as it's mitigated by addressing the second Dockerfile finding (ensuring that the docker container runs in user mode)

✅ Acceptance Validation

Addressed/mitigated each security issue by ensuring the Dockerfile specifies the use of a non-root user and adding rel="noopener" tags.

🔒 Security Implications

  • This PR adds a new software dependency or dependencies.
  • This PR modifies or invalidates one or more of our security controls.
  • This PR stores or transmits data that was not stored or transmitted before.
  • This PR requires additional review of its security implications for other reasons.

If any security implications apply, add Jason Ashbaugh (GitHub username: StewGoin) as a reviewer and do not merge this PR without his approval.

Copy link
Contributor

@laurenkrugen-navapbc laurenkrugen-navapbc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Thanks for addressing these.

@alex-dzeda alex-dzeda merged commit df1e294 into master Apr 16, 2024
1 check passed
@alex-dzeda alex-dzeda deleted the alex/bcda-7991 branch April 16, 2024 16:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants