KRYSTALM7 opened a new pull request, #78: URL: https://github.com/apache/fineract-loan-origination/pull/78
## Summary Implements comprehensive security hardening for the LOS backend. Addresses input validation gaps, tenant isolation enforcement, brute-force protection, XSS defense-in-depth, and security header hygiene across both Spring Security filter chains. --- JIRA: [FINERACT-2442](https://issues.apache.org/jira/browse/FINERACT-2442) ## Changes ### Input Validation - `CreateLoanApplicationRequest` — added `@NotNull`, `@Positive`, `@Size`, and `@Pattern` constraints on `requestedAmount`, `currency` (ISO 4217), `loanPurpose`, `fullName`, `nationalId`, `employmentStatus` - `ApprovalDecisionRequest` — `@Size(min=10, max=2000)` on `comments` to prevent DoS via unbounded input and enforce meaningful audit entries - `@ValidApplicationRef` — custom annotation enforcing `LOS-YYYY-NNNNN` format; applied to all `@PathVariable applicationRef` across `ApprovalController`, `LoanApplicationController`, `CustomerLoanApplicationController`, `DisbursementController` ### Tenant Isolation - `JwtAuthFilter` — validates `tenantId` JWT claim against `X-Fineract-Platform-TenantId` request header; returns HTTP 403 on mismatch; adds `tenantId` to MDC for audit logging - `CustomerPrincipal` — extended with `tenantId` field populated from JWT claims ### Rate Limiting - `RateLimitFilter` — Bucket4j token bucket algorithm with per-IP tracking via Caffeine in-memory cache - Auth endpoints: 5 req / 15 min (brute-force protection) - Admin endpoints: 20 req / min (privileged operation cap) - General endpoints: 100 req / min (fair usage) - Returns `429 Too Many Requests` with `Retry-After` header ### XSS Protection - `XssSanitizer` — OWASP Encoder-based utility; exposes `sanitizeHtml()`, `sanitizeHtmlAttribute()`, `sanitizeJavaScript()`, `sanitizeUrl()` for use at service layer before persistence ### Security Headers (both filter chains) - `X-Content-Type-Options: nosniff` - `X-Frame-Options: DENY` - `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload` - `Content-Security-Policy` — restricts resource origins, blocks `frame-ancestors`, scopes `form-action` to self - `Referrer-Policy: strict-origin-when-cross-origin` - `Permissions-Policy` — disables geolocation, microphone, camera, payment APIs - Note: `X-XSS-Protection` removed — deprecated by modern browsers; CSP provides equivalent protection and avoids the Spring Security 6.x `XXssProtectionHeaderWriter` API incompatibility ### Mock Service & Profile Fixes - `MockCustomerIdentityService` — restricted to `@Profile({"dev","test"})`; was unconditionally active including in production - `MockFineractAdapter` — removed `"default"` from `@Profile`; was silently swallowing disbursements in non-prod deployments ### Tests - `InputValidationTest` — 23 test cases covering all new constraints: 11 for `CreateLoanApplicationRequest`, 5 for `ApprovalDecisionRequest`, 7 for `@ValidApplicationRef` ### Dependencies Added (`pom.xml`) - `bucket4j-core:8.10.1` - `caffeine` (managed version) - `owasp-java-encoder:1.2.3` --- ## SQL Injection Status No changes required. All existing queries use JPA/Hibernate with parameterized `@Query` named parameters. No raw SQL string concatenation found in codebase. --- ## What Is NOT in This PR - Staff Login Endpoint --- ## Testing ```bash # Compile .\mvnw.cmd clean compile -DskipTests # Validation tests only .\mvnw.cmd test -Dtest=InputValidationTest # Full test suite .\mvnw.cmd test ``` --- ## Checklist - [x] `.\mvnw.cmd clean compile -DskipTests` passes - [x] `.\mvnw.cmd test -Dtest=InputValidationTest` — 23/23 pass - [x] `.\mvnw.cmd apache-rat:check` passes - [x] `.\mvnw.cmd spotless:apply` run before final commit - [x] Security headers verified against both filter chains - [x] Mock service profile restrictions confirmed in local dev run -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
