From f9cd7d247874a8625913a9fcc5e1fa68bcc80233 Mon Sep 17 00:00:00 2001 From: bhavanakarwade Date: Fri, 20 Dec 2024 15:56:02 +0530 Subject: [PATCH 1/8] fix: Improve Handling of Sensitive Data in Browser Signed-off-by: bhavanakarwade --- .env.demo | 3 -- .env.sample | 2 -- .github/workflows/deploy-dev.yml | 47 ++++++++++++++++++++++++++++++-- .github/workflows/deploy.yml | 6 ++-- src/api/Auth.ts | 8 +++--- src/app/LayoutCommon.astro | 28 +++++++++++++++---- src/config/GetHeaderConfigs.ts | 4 +-- src/config/envConfig.ts | 11 ++------ src/env.d.ts | 22 +++++++++++++++ src/middleware.ts | 4 +-- src/pages/index.astro | 9 +++--- 11 files changed, 107 insertions(+), 37 deletions(-) diff --git a/.env.demo b/.env.demo index 859e6383f..db93d00f0 100644 --- a/.env.demo +++ b/.env.demo @@ -14,11 +14,8 @@ PUBLIC_PLATFORM_NAME=CREDEBL PUBLIC_PLATFORM_LOGO=/images/CREDEBL_ICON.png PUBLIC_POWERED_BY=Blockster Labs Pvt. Ltd. PUBLIC_PLATFORM_WEB_URL=https://credebl.id/ -PUBLIC_POWERED_BY_URL=https://blockster.global PUBLIC_PLATFORM_DOCS_URL=https://docs.credebl.id/en/intro/what-is-credebl/ PUBLIC_PLATFORM_GIT=https://github.com/credebl -PUBLIC_PLATFORM_SUPPORT_EMAIL=support@blockster.global -PUBLIC_PLATFORM_SUPPORT_INVITE= PUBLIC_PLATFORM_TWITTER_URL="https://twitter.com/i/flow/login?redirect_after_login=%2Fcredebl" PUBLIC_PLATFROM_DISCORD_SUPPORT="https://discord.gg/w4hnQT7NJG" PUBLIC_ALLOW_DOMAIN="http://your-ip:5000 http://localhost:5000 http://localhost:5001 http://your-ip:5001 https://cdnjs.cloudflare.com https://tailwindcss.com https://www.blockster.global https://www.ayanworks.com https://qaapi.credebl.id https://devapi.credebl.id https://api.credebl.id https://*.credebl.id https://fonts.googleapis.com https://fonts.gstatic.com https://avatars.githubusercontent.com https://dev-org-logo.s3.ap-south-1.amazonaws.com https://flowbite-admin-dashboard.vercel.app/ wss://devapi.credebl.id wss://qaapi.credebl.id wss://api.credebl.id wss://*.credebl.id https://qa.credebl.id https://dev.credebl.id https://credebl.id http://your-ip:3001 http://localhost:3001 http://localhost:3000/certificates ws://your-ip:5000 ws://localhost:5000 https://rpc-amoy.polygon.technology/" \ No newline at end of file diff --git a/.env.sample b/.env.sample index 66bf1ac28..77a7547d8 100644 --- a/.env.sample +++ b/.env.sample @@ -11,10 +11,8 @@ PUBLIC_PLATFORM_NAME= # Please specify your paltform name PUBLIC_PLATFORM_LOGO= # Please specify your logo file link PUBLIC_POWERED_BY= # Please specify your powered by org name PUBLIC_PLATFORM_WEB_URL= # Please specify your platform web URL -PUBLIC_POWERED_BY_URL= # Please specify your support URL PUBLIC_PLATFORM_DOCS_URL= # Please specify your documentation URL PUBLIC_PLATFORM_GIT= # Please specify your Github URL -PUBLIC_PLATFORM_SUPPORT_EMAIL= # Please specify your support email PUBLIC_PLATFORM_TWITTER_URL= # Please specify your twitter URL PUBLIC_PLATFROM_DISCORD_SUPPORT= # Please specify your discord support url diff --git a/.github/workflows/deploy-dev.yml b/.github/workflows/deploy-dev.yml index f202e9e7a..6067ac888 100644 --- a/.github/workflows/deploy-dev.yml +++ b/.github/workflows/deploy-dev.yml @@ -22,8 +22,51 @@ jobs: with: node-version: lts/* - - name: remove previous node module - run: rm -rf node_modules + - name: Create .env file + + run: | + + echo "PUBLIC_MODE=DEV" > .env + + echo "PUBLIC_BASE_URL=https://devapi.credebl.id" >> .env + + echo "PUBLIC_SHOW_NAME_AS_LOGO=true" >> .env + + echo "PUBLIC_PLATFORM_NAME=CREDEBL" >> .env + + echo "PUBLIC_PLATFORM_LOGO=/images/CREDEBL_ICON.png" >> .env + + echo "PUBLIC_POWERED_BY=Blockster Labs Pvt. Ltd" >> .env + + echo "PUBLIC_PLATFORM_DOCS_URL=https://docs.credebl.id/en/intro/what-is-credebl/" >> .env + + echo "PUBLIC_PLATFORM_GIT=https://github.com/credebl" >> .env + + echo "PUBLIC_PLATFORM_TWITTER_URL=https://twitter.com/i/flow/login?redirect_after_login=%2Fcredebl" >> .env + + echo "PUBLIC_PLATFROM_DISCORD_SUPPORT=https://discord.gg/w4hnQT7NJG" >> .env + + echo "PUBLIC_ALLOW_DOMAIN=${{ secrets.DEV_PUBLIC_ALLOW_DOMAIN }}" >> .env + + echo "PUBLIC_POLYGON_MAINNET_URL=https://polygon-rpc.com/" >> .env + + echo "PUBLIC_POLYGON_TESTNET_URL=https://rpc-amoy.polygon.technology" >> .env + + echo "PUBLIC_ECOSYSTEM_FRONT_END_URL=https://dev-ecosystem.credebl.id" >> .env + + echo "PUBLIC_ECOSYSTEM_BASE_URL=https://devecosystem-api.credebl.id" >> .env + + echo "PUBLIC_PLATFORM_DISCORD_URL=https://discord.gg/w4hnQT7NJG" >> .env + + echo "PUBLIC_REDIRECTION_TARGET_URL=https://social-share.credebl.id" >> .env + + echo "PUBLIC_CRYPTO_PRIVATE_KEY=${{ secrets.DEV_PUBLIC_CRYPTO_PRIVATE_KEY }}" >> .env + + echo "PUBLIC_KEYCLOAK_MANAGEMENT_CLIENT_ID=${{ secrets.DEV_PUBLIC_KEYCLOAK_MANAGEMENT_CLIENT_ID }}" >> .env + + echo "PUBLIC_KEYCLOAK_MANAGEMENT_CLIENT_SECRET=${{ secrets.DEV_PUBLIC_KEYCLOAK_MANAGEMENT_CLIENT_SECRET }}" >> .env + + echo "PUBLIC_REDIRECT_FROM_URL=https://dev.credebl.id" >> .env - name: Build step run: npm install && npm run build # 📝 Update the build command(s) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 67b4b3c7f..7fe0df0dc 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -1,9 +1,9 @@ name: Deploy on: push: - branches: develop-fixed-dco + branches: main pull_request: - branches: develop-fixed-dco + branches: main jobs: deploy: @@ -40,5 +40,3 @@ jobs: project: "credebl-dev-ui" entrypoint: "server/entry.mjs" root: "dist" - - diff --git a/src/api/Auth.ts b/src/api/Auth.ts index 45e158e80..f6ca57632 100644 --- a/src/api/Auth.ts +++ b/src/api/Auth.ts @@ -221,15 +221,15 @@ export const addPasskeyUserDetails = async(payload: AddPassword, email:string) = } export const passwordEncryption = (password: string): string => { - const CRYPTO_PRIVATE_KEY: string = `${envConfig.PUBLIC_CRYPTO_PRIVATE_KEY}` + const CRYPTO_PRIVATE_KEY: string = import.meta.env.PUBLIC_CRYPTO_PRIVATE_KEY; const encryptedPassword: string = CryptoJS.AES.encrypt(JSON.stringify(password), CRYPTO_PRIVATE_KEY).toString() return encryptedPassword } export const encryptData = (value: any): string => { - const CRYPTO_PRIVATE_KEY: string = `${envConfig.PUBLIC_CRYPTO_PRIVATE_KEY}` - + const CRYPTO_PRIVATE_KEY: string = import.meta.env.PUBLIC_CRYPTO_PRIVATE_KEY; + try { if (typeof (value) !== 'string') { value = JSON.stringify(value) @@ -243,7 +243,7 @@ export const encryptData = (value: any): string => { } export const decryptData = (value: any): string => { - const CRYPTO_PRIVATE_KEY: string = `${envConfig.PUBLIC_CRYPTO_PRIVATE_KEY}` + const CRYPTO_PRIVATE_KEY: string = import.meta.env.PUBLIC_CRYPTO_PRIVATE_KEY; try { let bytes = CryptoJS.AES.decrypt(value, CRYPTO_PRIVATE_KEY); diff --git a/src/app/LayoutCommon.astro b/src/app/LayoutCommon.astro index d3f99555e..8acefca63 100644 --- a/src/app/LayoutCommon.astro +++ b/src/app/LayoutCommon.astro @@ -8,9 +8,25 @@ const { class: clazz, metaData } = Astro.props; const initData: any = {}; -const envKeys = [...Object.keys(process.env), ...Object.keys(import.meta.env)]; -envKeys.forEach((item) => { - initData[item] = process.env[item] || import.meta.env[item]; +// Step 1: List of keys that should NOT be exposed to the frontend +const excludeKeys = ['PUBLIC_CRYPTO_PRIVATE_KEY', 'PUBLIC_KEYCLOAK_MANAGEMENT_CLIENT_ID', 'PUBLIC_KEYCLOAK_MANAGEMENT_CLIENT_SECRET', 'PUBLIC_ALLOW_DOMAIN']; + +// Step 2: Get all environment keys +const allEnvKeys = [...Object.keys(process.env), ...Object.keys(import.meta.env)]; + +// Step 3: Separate 'exposed' keys and 'excluded' keys +const exposedEnvKeys = allEnvKeys.filter((key) => !excludeKeys.includes(key)); +const excludedEnvKeys = allEnvKeys.filter((key) => excludeKeys.includes(key)); + +// Step 4: Store values for all keys in `initData` +exposedEnvKeys.forEach((item) => { + initData[item] = process.env[item] || import.meta.env[item]; +}); + +// Step 5: Store 'excluded keys' in a separate object (only for server-side use) +const excludedEnvData: any = {}; +excludedEnvKeys.forEach((item) => { + excludedEnvData[item] = process.env[item] || import.meta.env[item]; }); const sessionToken = getFromCookies(Astro.cookies, 'session'); @@ -68,9 +84,9 @@ const refreshToken = getFromCookies(Astro.cookies, 'refresh');