@hoanghainh/komagu 2.6.0 → 2.6.1

package/remediate/edge/tests/test_edge_security.py

@@ -186,7 +186,7 @@ class TestMockBackendTraffic(unittest.TestCase):
                 "X-Custom-Header": "safe-value-unredacted",
             }
         )
-        with urllib.request.urlopen(req, timeout=3) as resp:
+        with urllib.request.urlopen(req, timeout=3) as resp:  # nosec B310  # local test server or KOMAGU_GATEWAY_URL under test
             self.assertEqual(resp.status, 200)
             data = json.loads(resp.read().decode("utf-8"))
 
@@ -388,7 +388,7 @@ class TestCorazaWafContainer(unittest.TestCase):
             data = form.encode("ascii")
         req = urllib.request.Request(f"http://127.0.0.1:{cls.port}{path}", data=data, headers=headers)
         try:
-            with urllib.request.urlopen(req, timeout=5) as resp:
+            with urllib.request.urlopen(req, timeout=5) as resp:  # nosec B310  # local test server or KOMAGU_GATEWAY_URL under test
                 return resp.status
         except urllib.error.HTTPError as e:
             return e.code
@@ -505,7 +505,7 @@ class TestLiveEdgeSecurity(unittest.TestCase):
     def setUpClass(cls):
         try:
             req = urllib.request.Request(f"{cls.BASE_URL}/api/v1/health")
-            with urllib.request.urlopen(req, timeout=1) as resp:
+            with urllib.request.urlopen(req, timeout=1) as resp:  # nosec B310  # local test server or KOMAGU_GATEWAY_URL under test
                 cls.live_available = True
         except Exception:
             cls.live_available = False
@@ -516,7 +516,7 @@ class TestLiveEdgeSecurity(unittest.TestCase):
 
     def test_live_legitimate_request_returns_200(self):
         req = urllib.request.Request(f"{self.BASE_URL}/api/v1/orders")
-        with urllib.request.urlopen(req, timeout=3) as resp:
+        with urllib.request.urlopen(req, timeout=3) as resp:  # nosec B310  # local test server or KOMAGU_GATEWAY_URL under test
             self.assertEqual(resp.status, 200)
             self.assertIn("X-Correlation-ID", resp.headers)
 
@@ -524,7 +524,7 @@ class TestLiveEdgeSecurity(unittest.TestCase):
         sqli_url = f"{self.BASE_URL}/api/v1/orders?id=1%27+OR+1%3D1--"
         req = urllib.request.Request(sqli_url)
         try:
-            with urllib.request.urlopen(req, timeout=3) as resp:
+            with urllib.request.urlopen(req, timeout=3) as resp:  # nosec B310  # local test server or KOMAGU_GATEWAY_URL under test
                 self.fail(f"Expected 403 Forbidden but received {resp.status}")
         except urllib.error.HTTPError as e:
             self.assertEqual(e.code, 403)

package/remediate/ekyc/requirements.txt

@@ -1 +1 @@
-cryptography>=41.0.0
+cryptography>=50.0.0

package/remediate/identity/dotnet/src/Komagu.Security.Identity/OidcServiceCollectionExtensions.cs

@@ -11,7 +11,7 @@ using Microsoft.IdentityModel.Tokens;
 /// <summary>
 /// Service collection extension methods for configuring Komagu OIDC / JWT authentication.
 /// </summary>
-public static class OidcServiceCollectionExtensions
+public static partial class OidcServiceCollectionExtensions
 {
     /// <summary>
     /// Configures strict JWT Bearer token authentication conforming to RFC 9700 and Boilerplate 1 standards.
@@ -79,11 +79,14 @@ public static class OidcServiceCollectionExtensions
                     var logger = context.HttpContext.RequestServices.GetService<ILoggerFactory>()
                         ?.CreateLogger("Komagu.Security.Identity.Authentication");
 
-                    logger?.LogWarning(
-                        context.Exception,
-                        "[AUTH FAILURE] Token validation failed: {Message} | RemoteIP: {RemoteIp}",
-                        context.Exception.Message,
-                        context.HttpContext.Connection.RemoteIpAddress);
+                    if (logger is not null)
+                    {
+                        LogTokenValidationFailed(
+                            logger,
+                            context.Exception,
+                            context.Exception.Message,
+                            context.HttpContext.Connection.RemoteIpAddress);
+                    }
 
                     return Task.CompletedTask;
                 },
@@ -105,4 +108,14 @@ public static class OidcServiceCollectionExtensions
             };
         });
     }
+
+    [LoggerMessage(
+        EventId = 1,
+        Level = LogLevel.Warning,
+        Message = "[AUTH FAILURE] Token validation failed: {Message} | RemoteIP: {RemoteIp}")]
+    private static partial void LogTokenValidationFailed(
+        ILogger logger,
+        Exception exception,
+        string message,
+        System.Net.IPAddress? remoteIp);
 }

package/remediate/identity/python/requirements.txt

@@ -1,3 +1,3 @@
 # Python dependencies for Komagu OIDC Identity Token Validation (D2)
-pyjwt>=2.8.0
-cryptography>=42.0.0
+pyjwt>=2.15.0
+cryptography>=50.0.0

package/remediate/identity/spring/src/main/kotlin/io/komagu/security/identity/KomaguIdentityAutoConfiguration.kt

@@ -47,46 +47,12 @@ class KomaguIdentityAutoConfiguration {
             else -> ""
         }
 
-        if (properties.audience.isBlank()) {
-            throw IllegalStateException("komagu.security.oidc.audience must not be blank")
+        check(properties.audience.isNotBlank()) { "komagu.security.oidc.audience must not be blank" }
+        check(properties.clockSkewSeconds in 0L..120L) {
+            "komagu.security.oidc.clock-skew-seconds must be between 0 and 120 (got ${properties.clockSkewSeconds})"
         }
 
-        if (properties.clockSkewSeconds < 0L || properties.clockSkewSeconds > 120L) {
-            throw IllegalStateException(
-                "komagu.security.oidc.clock-skew-seconds must be between 0 and 120 (got ${properties.clockSkewSeconds})"
-            )
-        }
-
-        val jwkUri = properties.jwkSetUri?.trim()
-        val decoder: NimbusJwtDecoder = when {
-            !jwkUri.isNullOrBlank() -> {
-                if (effectiveIssuer.isBlank()) {
-                    throw IllegalStateException("komagu.security.oidc.issuer must not be blank")
-                }
-                if (!properties.allowInsecureHttpJwks && !jwkUri.lowercase().startsWith("https://")) {
-                    throw IllegalStateException(
-                        "komagu.security.oidc.jwk-set-uri must use HTTPS ($jwkUri). " +
-                        "Set komagu.security.oidc.allow-insecure-http-jwks=true only for testing."
-                    )
-                }
-                NimbusJwtDecoder.withJwkSetUri(jwkUri).build()
-            }
-            effectiveIssuer.isNotBlank() -> {
-                if (!properties.allowInsecureHttpJwks && !effectiveIssuer.lowercase().startsWith("https://")) {
-                    throw IllegalStateException(
-                        "OIDC issuer URI must use HTTPS ($effectiveIssuer). " +
-                        "Set komagu.security.oidc.allow-insecure-http-jwks=true only for testing."
-                    )
-                }
-                NimbusJwtDecoder.withIssuerLocation(effectiveIssuer).build()
-            }
-            else -> {
-                throw IllegalStateException(
-                    "Either komagu.security.oidc.jwk-set-uri or komagu.security.oidc.issuer " +
-                    "(or spring.security.oauth2.resourceserver.jwt.issuer-uri) must be configured"
-                )
-            }
-        }
+        val decoder = buildDecoder(properties, effectiveIssuer)
 
         val expirationValidator = KomaguExpirationValidator()
         val timestampValidator = JwtTimestampValidator(Duration.ofSeconds(properties.clockSkewSeconds))
@@ -106,6 +72,33 @@ class KomaguIdentityAutoConfiguration {
         return decoder
     }
 
+    private fun buildDecoder(properties: KomaguOidcProperties, effectiveIssuer: String): NimbusJwtDecoder {
+        val jwkUri = properties.jwkSetUri?.trim()
+        return when {
+            !jwkUri.isNullOrBlank() -> {
+                check(effectiveIssuer.isNotBlank()) { "komagu.security.oidc.issuer must not be blank" }
+                check(properties.allowInsecureHttpJwks || isHttps(jwkUri)) {
+                    "komagu.security.oidc.jwk-set-uri must use HTTPS ($jwkUri). " +
+                        "Set komagu.security.oidc.allow-insecure-http-jwks=true only for testing."
+                }
+                NimbusJwtDecoder.withJwkSetUri(jwkUri).build()
+            }
+            effectiveIssuer.isNotBlank() -> {
+                check(properties.allowInsecureHttpJwks || isHttps(effectiveIssuer)) {
+                    "OIDC issuer URI must use HTTPS ($effectiveIssuer). " +
+                        "Set komagu.security.oidc.allow-insecure-http-jwks=true only for testing."
+                }
+                NimbusJwtDecoder.withIssuerLocation(effectiveIssuer).build()
+            }
+            else -> error(
+                "Either komagu.security.oidc.jwk-set-uri or komagu.security.oidc.issuer " +
+                    "(or spring.security.oauth2.resourceserver.jwt.issuer-uri) must be configured"
+            )
+        }
+    }
+
+    private fun isHttps(uri: String): Boolean = uri.lowercase().startsWith("https://")
+
     @Bean
     @ConditionalOnMissingBean(SecurityFilterChain::class)
     fun komaguSecurityFilterChain(

package/remediate/legacy_shims/tests/test_legacy_shims.py

@@ -222,23 +222,23 @@ public class OwnershipEnforcerBehaviouralTest {
     def test_php_shim_behavioural_execution(self) -> None:
         """Verify PHP shim behavioral normalization and denial with SQLite in-memory PDO."""
         php_file = SHIMS_ROOT / "php" / "komagu_authz_shim.php"
-        php_test_script = f"""
-        require_once '{php_file}';
+        php_test_script = """
+        require_once '__PHP_FILE__';
 
         // 1. Test komagu_normalize_id
         assert(komagu_normalize_id(1) === 1);
         assert(komagu_normalize_id('42') === 42);
         
         $invalidIds = [null, '', false, true, 0, '0', -1, '-5', '007', '1e2', '0x5', '1.5'];
-        foreach ($invalidIds as $inv) {{
-            try {{
+        foreach ($invalidIds as $inv) {
+            try {
                 komagu_normalize_id($inv);
                 echo "FAIL: Expected exception for " . var_export($inv, true) . "\\n";
                 exit(1);
-            }} catch (InvalidArgumentException $e) {{
+            } catch (InvalidArgumentException $e) {
                 // Expected
-            }}
-        }}
+            }
+        }
 
         // 2. Test komagu_check_ownership with SQLite in-memory PDO
         $pdo = new PDO('sqlite::memory:');
@@ -258,7 +258,7 @@ public class OwnershipEnforcerBehaviouralTest {
         assert(komagu_check_ownership($pdo, 'orders', 'id', '', 'user_id', 100, $allowed) === false);
 
         echo "ALL_PHP_BEHAVIOURAL_TESTS_PASSED\\n";
-        """
+        """.replace("__PHP_FILE__", str(php_file))  # nosec B608  # PHP test script with a fixed repo path, not a query
         proc = subprocess.run(
             ["php", "-r", php_test_script],
             capture_output=True,

package/remediate/query/dotnet/src/Komagu.Security.Query/SafeSortAllowList.cs

@@ -16,9 +16,9 @@ public enum SortDirection
 /// Strict allow-list validator for dynamic column names and sort clauses.
 /// Prevents SQL injection via dynamic ORDER BY clauses.
 /// </summary>
-public sealed class SafeSortAllowList
+public sealed partial class SafeSortAllowList
 {
-    private static readonly Regex SafeIdentifierRegex = new("^[a-zA-Z_][a-zA-Z0-9_]*$", RegexOptions.Compiled);
+    private static readonly Regex SafeIdentifierRegex = SafeIdentifier();
     private readonly HashSet<string> _allowedColumns;
 
     public SafeSortAllowList(IEnumerable<string> allowedColumns)
@@ -73,4 +73,7 @@ public sealed class SafeSortAllowList
         var dirString = direction == SortDirection.Descending ? "DESC" : "ASC";
         return $"{validColumn} {dirString}";
     }
+
+    [GeneratedRegex("^[a-zA-Z_][a-zA-Z0-9_]*$")]
+    private static partial Regex SafeIdentifier();
 }

package/remediate/query/spring/src/main/kotlin/io/komagu/security/query/SafeSortAllowList.kt

@@ -25,18 +25,17 @@ class SafeSortAllowList(allowedColumns: Collection<String>) {
      * Throws SecurityException on validation failure.
      */
     fun validateColumnName(columnName: String?): String {
-        if (columnName.isNullOrBlank()) {
-            throw SecurityException("Sort column name cannot be null or blank")
-        }
-
-        val trimmed = columnName.trim()
-
-        if (!safeIdentifierRegex.matches(trimmed)) {
-            throw SecurityException("Potential SQL injection detected in sort column: '$columnName'. Illegal characters detected.")
-        }
+        val trimmed = columnName?.trim().orEmpty()
+        val isIdentifier = trimmed.isNotEmpty() && safeIdentifierRegex.matches(trimmed)
+        val canonical = if (isIdentifier) allowedMap[trimmed.lowercase()] else null
+        return canonical ?: throw SecurityException(rejectionReason(columnName, trimmed))
+    }
 
-        return allowedMap[trimmed.lowercase()]
-            ?: throw SecurityException("Unauthorized sort column requested: '$columnName'. Column is not in allowed list.")
+    private fun rejectionReason(columnName: String?, trimmed: String): String = when {
+        trimmed.isEmpty() -> "Sort column name cannot be null or blank"
+        !safeIdentifierRegex.matches(trimmed) ->
+            "Potential SQL injection detected in sort column: '$columnName'. Illegal characters detected."
+        else -> "Unauthorized sort column requested: '$columnName'. Column is not in allowed list."
     }
 
     /**

package/remediate/query/spring/src/main/kotlin/io/komagu/security/query/detekt/StringBuiltSqlQueryRule.kt

@@ -1,6 +1,12 @@
 package io.komagu.security.query.detekt
 
-import io.gitlab.arturbosch.detekt.api.*
+import io.gitlab.arturbosch.detekt.api.CodeSmell
+import io.gitlab.arturbosch.detekt.api.Config
+import io.gitlab.arturbosch.detekt.api.Debt
+import io.gitlab.arturbosch.detekt.api.Entity
+import io.gitlab.arturbosch.detekt.api.Issue
+import io.gitlab.arturbosch.detekt.api.Rule
+import io.gitlab.arturbosch.detekt.api.Severity
 import org.jetbrains.kotlin.lexer.KtTokens
 import org.jetbrains.kotlin.psi.KtBinaryExpression
 import org.jetbrains.kotlin.psi.KtCallExpression
@@ -33,37 +39,26 @@ class StringBuiltSqlQueryRule(config: Config = Config.empty) : Rule(config) {
     override fun visitCallExpression(expression: KtCallExpression) {
         super.visitCallExpression(expression)
 
-        val callee = expression.calleeExpression?.text ?: return
-        if (!targetSqlMethods.contains(callee)) {
+        val callee = expression.calleeExpression?.text
+        val firstArg = expression.valueArguments.firstOrNull()?.getArgumentExpression()
+        if (callee == null || callee !in targetSqlMethods || firstArg == null) {
             return
         }
 
-        val arguments = expression.valueArguments
-        if (arguments.isEmpty()) {
-            return
-        }
-
-        val firstArg = arguments[0].getArgumentExpression() ?: return
-
-        // 1. String template with variable interpolation: "SELECT * FROM orders WHERE id = $orderId"
-        if (firstArg is KtStringTemplateExpression && firstArg.hasInterpolation()) {
-            report(
-                CodeSmell(
-                    issue = issue,
-                    entity = Entity.from(firstArg),
-                    message = "SQL/JPQL query in '$callee' uses string template interpolation. All parameters must be passed as parameterized bindings."
-                )
-            )
-            return
+        val construction = when {
+            // 1. String template with variable interpolation: "SELECT * FROM orders WHERE id = $orderId"
+            firstArg is KtStringTemplateExpression && firstArg.hasInterpolation() -> "uses string template interpolation"
+            // 2. Binary string concatenation: "SELECT * FROM orders WHERE id = " + orderId
+            firstArg is KtBinaryExpression && firstArg.operationToken == KtTokens.PLUS ->
+                "is built using binary string concatenation (+)"
+            else -> null
         }
-
-        // 2. Binary string concatenation: "SELECT * FROM orders WHERE id = " + orderId
-        if (firstArg is KtBinaryExpression && firstArg.operationToken == KtTokens.PLUS) {
+        if (construction != null) {
             report(
                 CodeSmell(
                     issue = issue,
                     entity = Entity.from(firstArg),
-                    message = "SQL/JPQL query in '$callee' is built using binary string concatenation (+). All parameters must be passed as parameterized bindings."
+                    message = "SQL/JPQL query in '$callee' $construction. All parameters must be passed as parameterized bindings."
                 )
             )
         }