servicecanada / cens Goto Github PK

@duboisp thanks for granting us access

After taking a quick look looks like the Notify API KEY is getting passed around and stored in a few spots:

Example:
https://github.com/ServiceCanada/x-notify/blob/5dea006de3e4d020aacf7a4318096822413050d6/controllers/subscriptions.js#L69

https://github.com/ServiceCanada/x-notify/blob/master/controllers/subscriptions.js#L79

The api key should be kept as secret (environment variable) and not stored. For example we may need to revoke the api key at our level or rotate the keys.

Also here:
https://github.com/ServiceCanada/x-notify/tree/master/test#database-command

I understand this might be used by multiple departs but we'll need to look at other ways of doing that.

Hey team,

Just wanted to raise this to your attention as we forgot to mention it yesterday in the check-in.

The code below that generates the confirmation link, is populating the recipients email address into the URL, which will create the potential for these pieces of PII to be registered in logs, browser caches, etc.

https://github.com/ServiceCanada/x-notify/blob/e282fc7752d4f6aa06c34570c81334b88ba54220/controllers/subscriptions.js#L512

I've linked to the relevant OWASP description of the issue below.

https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url

Proposed Solution:

Generate a UUID and replace email with that token in the url, using the UUID as a query/insertion key accordingly.

Hi @duboisp

I just tested using the live link.

After pressing the confirm link from my email I ended up with a few 302 redirect and than landed on https://www.canada.ca/home.html

There was no message saying if the email was confirmed or anything. What's the "expected" path?

Adding an OSS license like MIT would help clarify legal parameters for other jurisdictions interested in replicating the x-notify system.