Repository navigation
Fix CWE-798/CWE-862/CWE-400 in PhotoAlbum-Java - #26
Merged
Merged
Conversation
Externalize Oracle/PostgreSQL credentials to environment variables (.env), drop the DBA grant and over-broad ANY privileges in favor of least-privilege grants, generate a strong random password in azure-setup.ps1 instead of hard-coding, stop printing the password to stdout, and update README to the env-based setup. Adds .env.example and git-ignores .env.
Require authentication for state-changing endpoints (/upload, /detail/*/delete) via Spring Security with env-based admin credentials; read image dimensions from header with a max-pixel cap to prevent decompression-bomb DoS.
HaoZhang (haoozhang)
approved these changes
Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix CWE-798 / CWE-862 / CWE-400 in PhotoAlbum-Java
Addresses the findings (rule
d626e486-27bc-48fc-8717-d8af875737de).CWE-798 — Hard-coded credentials & DBA grant
oracle-init/01-create-user.sql: removed the hard-codedphotoalbum/photoalbumand theGRANT DBA; the app user is created by the container from env vars with least-privilege grants only.azure-setup.ps1: no longer hard-codes PostgreSQL passwords — reads from env or generates a strong random password per run, and stops printing the password to stdout..env.exampleand git-ignored.env.CWE-862 — Missing authorization on delete (
DetailController.java)SecurityConfig):POST /uploadandPOST /detail/*/deletenow require authentication; the gallery stays public. Admin credentials come fromAPP_ADMIN_USERNAME/APP_ADMIN_PASSWORDenv (fail-closed).CWE-400 — Image decompression bomb (
PhotoServiceImpl.java)ImageReader) with a max-pixel cap; removed the fullImageIO.readdecode of attacker-controlled bytes.Verification
mvn clean test(JDK 17) BUILD SUCCESS; Spring Security filter chain active.