[UPDATE] 解決弱點Use of hard-coded cryptographic key , 把key移到設定檔

jack

2023-09-01 22a5ad3acef0bfb8353dac64d4cbe0d52f6d2a07

[UPDATE] 解決弱點Use of hard-coded cryptographic key , 把key移到設定檔

 pamapi/src/main/java/com/pollex/pam/config/ApplicationProperties.java

@@ -26,6 +26,7 @@
    private SendSMSProperties sms;
    private SendEmailProperties email;
    private String fileFolderPath;
    private String aesKey;

    public boolean isMockLogin() {
        return mockLogin;
@@ -114,5 +115,16 @@
    public void setFileFolderPath(String fileFolderPath) {
        this.fileFolderPath = fileFolderPath;
    }
	
    @Override
    public String getAesKey() {
        return aesKey;
    }

    public void setAesKey(String aesKey) {
        this.aesKey = aesKey;
    }
	
	

}

 pamapi/src/main/resources/config/application-dev.yml

@@ -140,3 +140,4 @@
    sender-email: noreply@pcalife.com.tw
    method: 'POLLEX_GMAIL'
  file-folder-path: C://pam_file
  aes-key: PAMKEY1234567890

 pamapi/src/main/resources/config/application-pollex.yml

@@ -32,9 +32,13 @@
      indent-output: true
  datasource:
    type: com.zaxxer.hikari.HikariDataSource
    url: jdbc:postgresql://dev.pollex.com.tw:5433/pam_p2
    #url: jdbc:postgresql://localhost:5432/omo?currentSchema=public
    username: pamadmin
    password: pamadmin
    hikari:
      poolName: Hikari
    jndi-name: Pam
      maximum-pool-size: 500
  jpa:
    database-platform: tech.jhipster.domain.util.FixedPostgreSQL10Dialect
  liquibase:
@@ -136,3 +140,4 @@
    sender-email: noreply@pcalife.com.tw
    method: 'POLLEX_GMAIL'
  file-folder-path: C://pam_file
  aes-key: PAMKEY1234567890

 pamapi/src/main/resources/config/application-prod.yml

@@ -153,3 +153,4 @@
    sender-email: noreply@pcalife.com.tw
    method: 'PAM_EMAIL_SERVICE'
  file-folder-path: /sfs_omo/AgentPhoto/
  aes-key: PAMKEY1234567890

 pamapi/src/main/resources/config/application-sit.yml

@@ -130,3 +130,4 @@
    sender-email: noreply@pcalife.com.tw
    method: 'PAM_EMAIL_SERVICE'
  file-folder-path: /sfs_omo/AgentPhoto/
  aes-key: PAMKEY1234567890

 pamapi/src/main/resources/config/application-uat.yml

@@ -130,3 +130,4 @@
    sender-email: noreply@pcalife.com.tw
    method: 'PAM_EMAIL_SERVICE'
  file-folder-path: /sfs_omo/AgentPhoto/
  aes-key: PAMKEY1234567890