Skip to content

Commit

Permalink
Merge branch '3.7.x'
Browse files Browse the repository at this point in the history
  • Loading branch information
nardil committed Jun 22, 2023
2 parents be2e17d + 06f38dd commit 7be9658
Show file tree
Hide file tree
Showing 76 changed files with 795 additions and 333 deletions.
7 changes: 4 additions & 3 deletions docs/validazione/index.rst
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ Di seguito le segnalazioni emerse dagli strumenti utilizzati nel processo di val
CVE-2022-45688
==============

file name: json-20230227.jar
file name: json-20230618.jar

La vulnerabilità indicata viene descritta come segue: `A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.`

Expand All @@ -35,7 +35,7 @@ La vulnerabilità 'CVE-2022-40152' è relativa alla dipendenza transitiva 'woods
CVE-2020-5408
=============

file name: spring-security-crypto-5.8.1.jar
file name: spring-security-crypto-5.8.3.jar

La vulnerabilità indicata viene descritta come segue: `Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.`

Expand All @@ -44,7 +44,7 @@ La versione utilizzata è superiore alla '5.3.2' quindi risulta un falso positiv
CVE-2016-1000027
================

file name: spring-web-5.3.25.jar
file name: spring-web-5.3.28.jar

La vulnerabilità indicata viene descritta come segue: `Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.`

Expand Down Expand Up @@ -78,6 +78,7 @@ Le seguenti segnalazioni riguardano le librerie utilizzate dall'installer di Gov
- CVE-2019-20445
- CVE-2020-1945
- CVE-2020-7238
- CVE-2020-11612
- CVE-2021-4277
- CVE-2021-20318
- CVE-2021-21290
Expand Down
2 changes: 1 addition & 1 deletion ear/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
<parent>
<artifactId>bom</artifactId>
<groupId>it.govpay</groupId>
<version>3.7.2</version>
<version>3.7.3</version>
</parent>

<artifactId>ear</artifactId>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ Background:
* def intermediarioBasicAuth = read('classpath:test/api/backoffice/v1/intermediari/put/msg/intermediarioBasicAuth.json')
* def intermediarioClientAuth = read('classpath:test/api/backoffice/v1/intermediari/put/msg/intermediarioClientAuth.json')
* def intermediarioServerAuth = read('classpath:test/api/backoffice/v1/intermediari/put/msg/intermediarioServerAuth.json')
* def loremIpsum = 'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Phasellus non neque vestibulum, porta eros quis, fringilla enim. Nam sit amet justo sagittis, pretium urna et, convallis nisl. Proin fringilla consequat ex quis pharetra. Nam laoreet dignissim leo. Ut pulvinar odio et egestas placerat. Quisque tincidunt egestas orci, feugiat lobortis nisi tempor id. Donec aliquet sed massa at congue. Sed dictum, elit id molestie ornare, nibh augue facilisis ex, in molestie metus enim finibus arcu. Donec non elit dictum, dignissim dui sed, facilisis enim. Suspendisse nec cursus nisi. Ut turpis justo, fermentum vitae odio et, hendrerit sodales tortor. Aliquam varius facilisis nulla vitae hendrerit. In cursus et lacus vel consectetur.'

Scenario Outline: <field> non valida

Expand All @@ -32,6 +33,8 @@ Examples:
| urlRPT | intermediario.servizioPagoPa.urlRPT | 'htttttttp://aaa.it' | 'urlRPT' |
| abilitato | intermediario.abilitato | 'boh' | 'abilitato' |
| abilitato | intermediario.abilitato | null | 'abilitato' |
| subscriptionKey | intermediario.servizioPagoPa.subscriptionKey | '' | 'subscriptionKey' |
| subscriptionKey | intermediario.servizioPagoPa.subscriptionKey | loremIpsum | 'subscriptionKey' |

Scenario Outline: <field> non valida

Expand All @@ -51,7 +54,8 @@ Examples:
| field | fieldRequest | fieldValue | fieldResponse |
| username | intermediarioBasicAuth.servizioPagoPa.auth.username | null | 'username' |
| password | intermediarioBasicAuth.servizioPagoPa.auth.password | null | 'password' |

| subscriptionKey | intermediarioBasicAuth.servizioPagoPa.subscriptionKey | '' | 'subscriptionKey' |
| subscriptionKey | intermediarioBasicAuth.servizioPagoPa.subscriptionKey | loremIpsum | 'subscriptionKey' |
| denominazione | intermediarioBasicAuth.denominazione | null | 'denominazione' |

Scenario Outline: <field> non valida
Expand Down Expand Up @@ -83,6 +87,8 @@ Examples:
| ksType | intermediarioClientAuth.servizioPagoPa.auth.ksType | null | 'ksType' |
| ksType | intermediarioClientAuth.servizioPagoPa.auth.ksType | 'XXX' | 'ksType' |
| ksPKeyPasswd | intermediarioClientAuth.servizioPagoPa.auth.ksPKeyPasswd | null | 'ksPKeyPasswd' |
| subscriptionKey | intermediarioClientAuth.servizioPagoPa.subscriptionKey | '' | 'subscriptionKey' |
| subscriptionKey | intermediarioClientAuth.servizioPagoPa.subscriptionKey | loremIpsum | 'subscriptionKey' |

Scenario Outline: <field> non valida

Expand All @@ -108,4 +114,6 @@ Examples:
| tsType | intermediarioServerAuth.servizioPagoPa.auth.tsType | 'XXX' | 'tsType' |
| sslType | intermediarioServerAuth.servizioPagoPa.auth.sslType | null | 'sslType' |
| sslType | intermediarioServerAuth.servizioPagoPa.auth.sslType | 'XXX' | 'sslType' |
| subscriptionKey | intermediarioServerAuth.servizioPagoPa.subscriptionKey | '' | 'subscriptionKey' |
| subscriptionKey | intermediarioServerAuth.servizioPagoPa.subscriptionKey | loremIpsum | 'subscriptionKey' |

Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ Background:
* def intermediarioBasicAuth = read('classpath:test/api/backoffice/v1/intermediari/put/msg/intermediarioBasicAuth.json')
* def intermediarioServerAuth = read('classpath:test/api/backoffice/v1/intermediari/put/msg/intermediarioServerAuth.json')
* def intermediarioClientAuth = read('classpath:test/api/backoffice/v1/intermediari/put/msg/intermediarioClientAuth.json')
* def intermediarioSubscriptionKeyAuth = read('classpath:test/api/backoffice/v1/intermediari/put/msg/intermediarioSubscriptionKeyAuth.json')

Scenario: Configurazione intermediario senza autenticazione verso pagoPA

Expand Down Expand Up @@ -88,25 +87,26 @@ When method get
Then status 200
And match response == intermediarioClientAuth

Scenario: Configurazione intermediario con autenticazione subscription key verso pagoPA
@test1
Scenario: Configurazione subscriptionKey intermediario senza autenticazione verso pagoPA

* def intermediario = read('classpath:test/api/backoffice/v1/intermediari/put/msg/intermediario.json')
* set intermediario.servizioPagoPa.subscriptionKey = '8daebdf9-558c-4203-aade-0dee45bfc08d'

Given url backofficeBaseurl
And path 'intermediari', idIntermediario
And headers basicAutenticationHeader
And request intermediarioSubscriptionKeyAuth
And request intermediario
When method put
Then assert responseStatus == 200 || responseStatus == 201

* set intermediarioSubscriptionKeyAuth.idIntermediario = idIntermediario
* set intermediarioSubscriptionKeyAuth.stazioni = '#ignore'
* set intermediario.idIntermediario = idIntermediario
* set intermediario.stazioni = '#ignore'

Given url backofficeBaseurl
And path 'intermediari', idIntermediario
And headers basicAutenticationHeader
When method get
Then status 200
And match response == intermediarioSubscriptionKeyAuth



And match response == intermediario

This file was deleted.

Original file line number Diff line number Diff line change
@@ -0,0 +1,68 @@
Feature: Creazione Tracciato GovPay

Background:

* callonce read('classpath:utils/workflow/modello1/v1/modello1-bunch-pagamenti-v2.feature')
* callonce read('classpath:utils/api/v1/ragioneria/bunch-riconciliazioni-v2.feature')
* def basicAutenticationHeader = getBasicAuthenticationHeader( { username: govpay_backoffice_user, password: govpay_backoffice_password } )
* def dominio = read('classpath:test/api/backoffice/v1/domini/put/msg/dominio-connettore-govpay.json')

* set dominio.servizioGovPay.tipoConnettore = 'EMAIL'
* set dominio.servizioGovPay.emailIndirizzi = ['pintori@link.it']
* set dominio.servizioGovPay.emailAllegato = false
* set dominio.servizioGovPay.downloadBaseUrl = "http://localhost:8080/govpay/backend/api/backoffice/rs/form/v1/tracciatiNotificaPagamenti"
* set dominio.servizioGovPay.versioneZip = '1.0'
* set dominio.servizioGovPay.contenuti = ['RPP', 'SINTESI_PAGAMENTI', 'SINTESI_FLUSSI_RENDICONTAZIONE', 'FLUSSI_RENDICONTAZIONE']
* set dominio.servizioGovPay.tipiPendenza = [ '*' ]

* def patchRequest =
"""
[
{
"op": "REPLACE",
"path": "/mailBatch",
"value": {
"abilitato": true,
"mailserver": {
"host": "smtp.link.it",
"port": "25",
"username": "govcloud",
"password": "G65trw%$3we",
"from": "govcloud@link.it",
"readTimeout": 180000,
"connectionTimeout": 20000,
"sslConfig": {
"abilitato": false
},
"startTls" : false
}
}
}
]
"""

Scenario: Configurazione Dominio per spedizione tracciati govpay via rest e invocazione delle operazioni di creazione e spedizione tracciato

Given url backofficeBaseurl
And path 'configurazioni'
And headers basicAutenticationHeader
And request patchRequest
When method patch
Then assert responseStatus == 200

Given url backofficeBaseurl
And path 'domini', idDominio
And headers basicAutenticationHeader
And request dominio
When method put
Then assert responseStatus == 200 || responseStatus == 201

* call read('classpath:configurazione/v1/operazioni-resetCache.feature')

* call read('classpath:utils/govpay-op-elaborazione-tracciati-notifica-pagamenti.feature')

# * call sleep(30000)

* call read('classpath:utils/govpay-op-spedizione-tracciati-notifica-pagamenti.feature')

* call sleep(60000)
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
Feature: Simulazione login alla console gui.

Background:

* callonce read('classpath:utils/common-utils.feature')
* callonce read('classpath:configurazione/v1/anagrafica.feature')

Scenario: Acquisizione del profilo autenticato basic

* def gpAdminBasicAutenticationHeader = getBasicAuthenticationHeader( { username: govpay_backoffice_user, password: govpay_backoffice_password } )
* def backofficeBaseurl = getGovPayApiBaseUrl({api: 'backoffice', versione: 'v1', autenticazione: 'form'})

* configure cookies = null

Given url backofficeBaseurl
And path '/profilo'
And headers gpAdminBasicAutenticationHeader
When method get
Then status 200

# Karate mette sempre il cookie quindi usiamo un loop di curl
# for i in {1..10}; do curl -s -k 'GET' -H 'Authorization: Basic Z3BhZG1pbjpQYXNzd29yZDEh' 'http://localhost:8080/govpay/backend/api/backoffice/rs/form/v1/profilo'; done
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
"data":"#notnull",
"sct":"#notnull",
"idFlusso":"#notnull",
"stato":"#notnull",
"riscossioni":[
{
"idDominio":"#notnull",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
"sct":"#notnull",
"iuv":"##string",
"idFlusso":"##string",
"stato":"#notnull",
"riscossioni":[
{
"idDominio":"#notnull",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
"sct":"#notnull",
"iuv":"##string",
"idFlusso":"##string",
"stato":"#notnull",
"riscossioni":[
{
"idDominio":"#notnull",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
"sct":"#notnull",
"iuv":"##string",
"idFlusso":"##string",
"stato":"#notnull",
"riscossioni":[
{
"idDominio":"#notnull",
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,108 @@
Feature: Validazione sintattica filtri di ricerca per stato

Background:

* callonce read('classpath:utils/common-utils.feature')
* callonce read('classpath:configurazione/v1/anagrafica.feature')
* def backofficeBaseurl = getGovPayApiBaseUrl({api: 'backoffice', versione: 'v1', autenticazione: 'basic'})
* def nomeAPI = '/incassi'

Scenario: Validazione sintattica filtri per stato

# No filtri

Given url backofficeBaseurl
And path nomeAPI
And headers gpAdminBasicAutenticationHeader
When method get
Then status 200
And match response ==
"""
{
maxRisultati: '#number',
numRisultati: '#number',
numPagine: '#number',
risultatiPerPagina: 25,
pagina: 1,
prossimiRisultati: '#ignore',
risultati: '#array'
}
"""

# Filtro stato = 'IN_ELABORAZIONE'

Given url backofficeBaseurl
And path nomeAPI
And param stato = 'IN_ELABORAZIONE'
And headers gpAdminBasicAutenticationHeader
When method get
Then status 200
And match response ==
"""
{
maxRisultati: '#number',
numRisultati: '#number',
numPagine: '#number',
risultatiPerPagina: 25,
pagina: 1,
prossimiRisultati: '#ignore',
risultati: '#array'
}
"""

# Filtro stato = 'ACQUISITO'

Given url backofficeBaseurl
And path nomeAPI
And param stato = 'ACQUISITO'
And headers gpAdminBasicAutenticationHeader
When method get
Then status 200
And match response ==
"""
{
maxRisultati: '#number',
numRisultati: '#number',
numPagine: '#number',
risultatiPerPagina: 25,
pagina: 1,
prossimiRisultati: '#ignore',
risultati: '#array'
}
"""

# Filtro stato = 'ERRORE'

Given url backofficeBaseurl
And path nomeAPI
And param stato = 'ERRORE'
And headers gpAdminBasicAutenticationHeader
When method get
Then status 200
And match response ==
"""
{
maxRisultati: '#number',
numRisultati: '#number',
numPagine: '#number',
risultatiPerPagina: 25,
pagina: 1,
prossimiRisultati: '#ignore',
risultati: '#array'
}
"""

# Filtro stato non valido

* def dataDaNonValida = 'STATO_NON_VALIDO'
* def dataDaParamName = 'stato'

Given url backofficeBaseurl
And path nomeAPI
And param dataDa = dataDaNonValida
And headers gpAdminBasicAutenticationHeader
When method get
Then status 400

* match response == { categoria: 'RICHIESTA', codice: 'SINTASSI', descrizione: 'Richiesta non valida', dettaglio: '#notnull' }
* match response.dettaglio contains 'STATO_NON_VALIDO'
Loading

0 comments on commit 7be9658

Please sign in to comment.