From 40939725e19f3b5bc6c522051ccce89c9e925734 Mon Sep 17 00:00:00 2001 From: kanishq-egov Date: Fri, 23 Aug 2024 13:59:45 +0530 Subject: [PATCH] HCMPRE: individual service: password sharing vulnerability fixed, removed roles field from individual persisters --- egov-persister/individual-persister.yml | 10 ++-------- health/egov-persister/individual-persister.yml | 10 ++-------- works/egov-persister/individual-persister.yml | 10 ++-------- 3 files changed, 6 insertions(+), 24 deletions(-) diff --git a/egov-persister/individual-persister.yml b/egov-persister/individual-persister.yml index 3e237c03a..2dac48109 100644 --- a/egov-persister/individual-persister.yml +++ b/egov-persister/individual-persister.yml @@ -33,7 +33,7 @@ serviceMaps: - jsonPath: $.*.address.*.street - jsonPath: $.*.address.*.locality.code - jsonPath: $.*.address.*.ward.code - - query: INSERT INTO individual(id, userId, userUuid, clientReferenceId, tenantId, givenName, familyName, otherNames, dateOfBirth, gender, bloodGroup, mobileNumber, altContactNumber, email, fatherName, husbandName, photo, additionalDetails, createdBy, lastModifiedBy, createdTime, lastModifiedTime, rowVersion, isDeleted, individualId, relationship, isSystemUser, isSystemUserActive, username, type, roles, clientCreatedTime, clientLastModifiedTime, clientCreatedBy, clientLastModifiedBy) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?); + - query: INSERT INTO individual(id, userId, userUuid, clientReferenceId, tenantId, givenName, familyName, otherNames, dateOfBirth, gender, bloodGroup, mobileNumber, altContactNumber, email, fatherName, husbandName, photo, additionalDetails, createdBy, lastModifiedBy, createdTime, lastModifiedTime, rowVersion, isDeleted, individualId, relationship, isSystemUser, isSystemUserActive, username, type, clientCreatedTime, clientLastModifiedTime, clientCreatedBy, clientLastModifiedBy) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?); basePath: $.* jsonMaps: - jsonPath: $.*.id @@ -69,9 +69,6 @@ serviceMaps: - jsonPath: $.*.isSystemUserActive - jsonPath: $.*.userDetails.username - jsonPath: $.*.userDetails.type - - jsonPath: $.*.userDetails.roles - type: JSON - dbType: JSONB - jsonPath: $.*.clientAuditDetails.createdTime - jsonPath: $.*.clientAuditDetails.lastModifiedTime - jsonPath: $.*.clientAuditDetails.createdBy @@ -121,7 +118,7 @@ serviceMaps: fromTopic: update-individual-topic isTransaction: true queryMaps: - - query: UPDATE individual SET userId=?, userUuid=?, tenantId=?, givenName=?, familyName=?, otherNames=?, dateOfBirth=?, Gender=?, bloodGroup=?, mobileNumber=?, altContactNumber=?, email=?, fatherName=?, husbandName=?, relationship=?, photo=?, isSystemUserActive=?, additionalDetails=?, lastModifiedBy=?, lastModifiedTime=?, rowVersion=?, username = ?, type = ?, roles = ?, clientLastModifiedTime = ?, clientLastModifiedBy = ? WHERE id=? AND isDeleted=false; + - query: UPDATE individual SET userId=?, userUuid=?, tenantId=?, givenName=?, familyName=?, otherNames=?, dateOfBirth=?, Gender=?, bloodGroup=?, mobileNumber=?, altContactNumber=?, email=?, fatherName=?, husbandName=?, relationship=?, photo=?, isSystemUserActive=?, additionalDetails=?, lastModifiedBy=?, lastModifiedTime=?, rowVersion=?, username = ?, type = ?, clientLastModifiedTime = ?, clientLastModifiedBy = ? WHERE id=? AND isDeleted=false; basePath: $.* jsonMaps: - jsonPath: $.*.userId @@ -150,9 +147,6 @@ serviceMaps: - jsonPath: $.*.rowVersion - jsonPath: $.*.userDetails.username - jsonPath: $.*.userDetails.type - - jsonPath: $.*.userDetails.roles - type: JSON - dbType: JSONB - jsonPath: $.*.clientAuditDetails.lastModifiedTime - jsonPath: $.*.clientAuditDetails.lastModifiedBy - jsonPath: $.*.id diff --git a/health/egov-persister/individual-persister.yml b/health/egov-persister/individual-persister.yml index 51264d540..0b9697b9c 100644 --- a/health/egov-persister/individual-persister.yml +++ b/health/egov-persister/individual-persister.yml @@ -33,7 +33,7 @@ serviceMaps: - jsonPath: $.*.address.*.street - jsonPath: $.*.address.*.locality.code - jsonPath: $.*.address.*.ward.code - - query: INSERT INTO health.individual(id, userId, userUuid, clientReferenceId, tenantId, givenName, familyName, otherNames, dateOfBirth, gender, bloodGroup, mobileNumber, altContactNumber, email, fatherName, husbandName, photo, additionalDetails, createdBy, lastModifiedBy, createdTime, lastModifiedTime, rowVersion, isDeleted, individualId, relationship, isSystemUser, isSystemUserActive, username, type, roles, clientCreatedTime, clientLastModifiedTime, clientCreatedBy, clientLastModifiedBy) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?); + - query: INSERT INTO health.individual(id, userId, userUuid, clientReferenceId, tenantId, givenName, familyName, otherNames, dateOfBirth, gender, bloodGroup, mobileNumber, altContactNumber, email, fatherName, husbandName, photo, additionalDetails, createdBy, lastModifiedBy, createdTime, lastModifiedTime, rowVersion, isDeleted, individualId, relationship, isSystemUser, isSystemUserActive, username, type, clientCreatedTime, clientLastModifiedTime, clientCreatedBy, clientLastModifiedBy) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?); basePath: $.* jsonMaps: - jsonPath: $.*.id @@ -69,9 +69,6 @@ serviceMaps: - jsonPath: $.*.isSystemUserActive - jsonPath: $.*.userDetails.username - jsonPath: $.*.userDetails.type - - jsonPath: $.*.userDetails.roles - type: JSON - dbType: JSONB - jsonPath: $.*.clientAuditDetails.createdTime - jsonPath: $.*.clientAuditDetails.lastModifiedTime - jsonPath: $.*.clientAuditDetails.createdBy @@ -128,7 +125,7 @@ serviceMaps: transactionCodeJsonPath: $.clientReferenceId auditAttributeBasePath: $.* queryMaps: - - query: UPDATE health.individual SET userId=?, userUuid=?, tenantId=?, givenName=?, familyName=?, otherNames=?, dateOfBirth=?, Gender=?, bloodGroup=?, mobileNumber=?, altContactNumber=?, email=?, fatherName=?, husbandName=?, relationship=?, photo=?, isSystemUserActive=?, additionalDetails=?, lastModifiedBy=?, lastModifiedTime=?, rowVersion=?, username = ?, type = ?, roles = ?, clientLastModifiedTime = ?, clientLastModifiedBy = ? WHERE id=? AND isDeleted=false; + - query: UPDATE health.individual SET userId=?, userUuid=?, tenantId=?, givenName=?, familyName=?, otherNames=?, dateOfBirth=?, Gender=?, bloodGroup=?, mobileNumber=?, altContactNumber=?, email=?, fatherName=?, husbandName=?, relationship=?, photo=?, isSystemUserActive=?, additionalDetails=?, lastModifiedBy=?, lastModifiedTime=?, rowVersion=?, username = ?, type = ?, clientLastModifiedTime = ?, clientLastModifiedBy = ? WHERE id=? AND isDeleted=false; basePath: $.* jsonMaps: - jsonPath: $.*.userId @@ -157,9 +154,6 @@ serviceMaps: - jsonPath: $.*.rowVersion - jsonPath: $.*.userDetails.username - jsonPath: $.*.userDetails.type - - jsonPath: $.*.userDetails.roles - type: JSON - dbType: JSONB - jsonPath: $.*.clientAuditDetails.lastModifiedTime - jsonPath: $.*.clientAuditDetails.lastModifiedBy - jsonPath: $.*.id diff --git a/works/egov-persister/individual-persister.yml b/works/egov-persister/individual-persister.yml index 488c26f6a..0f79f4b40 100644 --- a/works/egov-persister/individual-persister.yml +++ b/works/egov-persister/individual-persister.yml @@ -26,7 +26,7 @@ serviceMaps: - jsonPath: $.*.address.*.street - jsonPath: $.*.address.*.locality.code - jsonPath: $.*.address.*.ward.code - - query: INSERT INTO individual(id, userId, userUuid, clientReferenceId, tenantId, givenName, familyName, otherNames, dateOfBirth, gender, bloodGroup, mobileNumber, altContactNumber, email, fatherName, husbandName, photo, additionalDetails, createdBy, lastModifiedBy, createdTime, lastModifiedTime, rowVersion, isDeleted, individualId, relationship, isSystemUser, isSystemUserActive, username, type, roles) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?); + - query: INSERT INTO individual(id, userId, userUuid, clientReferenceId, tenantId, givenName, familyName, otherNames, dateOfBirth, gender, bloodGroup, mobileNumber, altContactNumber, email, fatherName, husbandName, photo, additionalDetails, createdBy, lastModifiedBy, createdTime, lastModifiedTime, rowVersion, isDeleted, individualId, relationship, isSystemUser, isSystemUserActive, username, type) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?); basePath: $.* jsonMaps: - jsonPath: $.*.id @@ -62,9 +62,6 @@ serviceMaps: - jsonPath: $.*.isSystemUserActive - jsonPath: $.*.userDetails.username - jsonPath: $.*.userDetails.type - - jsonPath: $.*.userDetails.roles - type: JSON - dbType: JSONB - query: INSERT INTO individual_address(individualId, addressId, type, createdBy, lastModifiedBy, createdTime, lastModifiedTime, isDeleted) VALUES (?, ?, ?, ?, ?, ?, ?, ?); basePath: $.*.address.* jsonMaps: @@ -109,7 +106,7 @@ serviceMaps: fromTopic: update-individual-topic isTransaction: true queryMaps: - - query: UPDATE individual SET userId=?, userUuid=?, tenantId=?, givenName=?, familyName=?, otherNames=?, dateOfBirth=?, Gender=?, bloodGroup=?, mobileNumber=?, altContactNumber=?, email=?, fatherName=?, husbandName=?, relationship=?, photo=?, isSystemUserActive=?, additionalDetails=?, lastModifiedBy=?, lastModifiedTime=?, rowVersion=?, username = ?, type = ?, roles = ? WHERE id=? AND isDeleted=false; + - query: UPDATE individual SET userId=?, userUuid=?, tenantId=?, givenName=?, familyName=?, otherNames=?, dateOfBirth=?, Gender=?, bloodGroup=?, mobileNumber=?, altContactNumber=?, email=?, fatherName=?, husbandName=?, relationship=?, photo=?, isSystemUserActive=?, additionalDetails=?, lastModifiedBy=?, lastModifiedTime=?, rowVersion=?, username = ?, type = ?, WHERE id=? AND isDeleted=false; basePath: $.* jsonMaps: - jsonPath: $.*.userId @@ -138,9 +135,6 @@ serviceMaps: - jsonPath: $.*.rowVersion - jsonPath: $.*.userDetails.username - jsonPath: $.*.userDetails.type - - jsonPath: $.*.userDetails.roles - type: JSON - dbType: JSONB - jsonPath: $.*.id - query: INSERT INTO address(id, clientReferenceId, tenantId, doorNo, latitude, longitude, locationAccuracy, type, addressLine1, addressLine2, landmark, city, pincode, buildingName, street, localityCode, wardCode) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT (id) DO UPDATE SET doorno=?, latitude=?, longitude=?, locationaccuracy=?, type=?, addressline1=?, addressline2=?, landmark=?, city=?, pincode=?, buildingname=?, street=?, localitycode=?, wardCode=?; basePath: $.*.address.*