Revert "Get rid of the redundant multiuser module (#691)" #806

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

vinokurig merged 1 commit into main from revertCleanUp

May 9, 2025

Merged

Revert "Get rid of the redundant multiuser module (#691)" #806

Revert "Get rid of the redundant multiuser module (#691)"

GitHub Advanced Security / CodeQL failed May 9, 2025 in 3s

11 new alerts including 2 critical severity security vulnerabilities

New alerts in code changed by this pull request

Security Alerts:

2 critical
3 high
6 medium

Alerts not introduced by this pull request might have been detected because the code changes were too large.

See annotations below for details.

View all branch alerts.

Annotations

Check warning on line 89 in multiuser/keycloak/che-multiuser-keycloak-server/src/main/java/org/eclipse/che/multiuser/keycloak/server/KeycloakConfigurationService.java

Code scanning / CodeQL

Cross-site scripting Medium

Cross-site scripting vulnerability due to a

.

Check warning on line 96 in multiuser/keycloak/che-multiuser-keycloak-server/src/main/java/org/eclipse/che/multiuser/keycloak/server/KeycloakConfigurationService.java

Code scanning / CodeQL

Cross-site scripting Medium

Cross-site scripting vulnerability due to a

.

Check failure on line 172 in multiuser/keycloak/che-multiuser-keycloak-server/src/main/java/org/eclipse/che/multiuser/keycloak/server/KeycloakServiceClient.java

Code scanning / CodeQL

Server-side request forgery Critical

Potential server-side request forgery due to a

.

Check failure on line 195 in multiuser/keycloak/che-multiuser-keycloak-server/src/main/java/org/eclipse/che/multiuser/keycloak/server/KeycloakServiceClient.java

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This

that depends on a

may run slow on strings starting with '' and with many repetitions of 'a'.

Check warning on line 66 in multiuser/keycloak/che-multiuser-keycloak-server/src/main/java/org/eclipse/che/multiuser/keycloak/server/oauth2/DelegatedOAuthAPI.java

Code scanning / CodeQL

URL redirection from remote source Medium

Untrusted URL redirection depends on a

.
Untrusted URL redirection depends on a

.

Check failure on line 78 in multiuser/keycloak/che-multiuser-keycloak-server/src/test/java/org/eclipse/che/multiuser/keycloak/server/KeycloakSigningKeyResolverTest.java

Code scanning / CodeQL

Use of a cryptographic algorithm with insufficient key size High test

This

is less than the recommended key size of 2048 bits.

Check warning on line 88 in multiuser/keycloak/che-multiuser-keycloak-token-provider/src/main/java/org/eclipse/che/multiuser/keycloak/token/provider/contoller/TokenController.java

Code scanning / CodeQL

Information exposure through an error message Medium

can be exposed to an external user.

Check warning on line 90 in multiuser/keycloak/che-multiuser-keycloak-token-provider/src/main/java/org/eclipse/che/multiuser/keycloak/token/provider/contoller/TokenController.java

Code scanning / CodeQL

Cross-site scripting Medium

Cross-site scripting vulnerability due to a

.

Check warning on line 103 in multiuser/keycloak/che-multiuser-keycloak-token-provider/src/main/java/org/eclipse/che/multiuser/keycloak/token/provider/contoller/TokenController.java

Code scanning / CodeQL

Information exposure through an error message Medium

can be exposed to an external user.

Check failure on line 64 in multiuser/machine-auth/che-multiuser-machine-authentication/src/test/java/org/eclipse/che/multiuser/machine/authentication/server/signature/SignatureKeyManagerTest.java

Code scanning / CodeQL

Use of a cryptographic algorithm with insufficient key size High test

This

is less than the recommended key size of 2048 bits.

Check failure on line 172 in multiuser/permission/che-multiuser-permission-workspace/src/main/java/org/eclipse/che/multiuser/permission/workspace/server/spi/jpa/MultiuserJpaWorkspaceDao.java

Code scanning / CodeQL

User-controlled data in numeric cast Critical

This cast to a narrower type depends on a

, potentially causing truncation.