Platform components update

The OpenPaaS components now relies on RaabitMQ version 3.8.

The Summer libraries update ran this year again, and OpenPaaS Node server has updated dependencies, like for example Socket.io.

Addressbook

• Domain members addressbook

The members of an OpenPaaS domain are now exposed as a CardDAV addressbook. This allows the users to have the list of members synchronized on their mobile devices and desktop clients.

Platform

• People resolver API

There is now a clean and efficient Rest API to search for everything related to People objects: users, contacts, resources and groups. This API is used in the OpenPaaS web frontend.

• Domain aliases

The platform administrator can manage the email aliases of its domain.

Email

• ElasticSearch optimizations

The email search has been improved by a better indexing of email and attachments inside the ElasticSearch server.

Security check

We ran the software against the OWASP Zap Zed Attack Proxy software. You can find here the attack report. Below are the development team comments regarding the High and Medium vulnerabilities.

High (Medium) – SQL Injection

This is a false positive. Our calendaring and addressbook engine does not use an SQL backend. However, this test highlighted a lack of type validation in user input, having the side effect of the server answering a 500 error instead of a 400 error in case of malicious forged queries. We opened an issue on our internal issue tracker to enforce type check on incoming parameters.

High (Medium) – Path Traversal

This is a false positive. Our Calendar and ADdressbook engine respects the WebDAV based protocol, which is a filesystem representation. User navigation inside is filesystem is enforced by ACLs.

Medium (High) – Session ID in URL Rewrite

This is a false positive. Our frontend uses Socket.io to ensure websocket communication with the server. Socket.io has its implementation of session for progressive enhancement of the connection, from short polling to websocket. There is not, to our knowledge, a vulnerability opened on Socket.io website regarding a vulnerability linked to its token system. Moreover, we upgraded our Socket.io version durint the summer libraries updates sprint.

Medium (Medium) – X-Frame-Options Header Not Set

This is a positive alert. We opened an issue in our internal issue tracker to add this header in our deployment manifests.

Medium (Medium) – CSP Scanner: Wildcard Directive

This is a positive alert. We opened an issue in our internal issue tracker to add the correct Content-Security-Policy header in our deployment manifests.

Medium (Medium) – Format String Error

This is a false positive. However, this test highlighted a lack of type validation in user input, having the side effect of the server answering a 500 error instead of a 400 error in case of malicious forged queries. We opened an issue on our internal issue tracker to enforce type check on incoming parameters.

Medium (Low) – Directory Browsing

This is a false positive. All the data below the “/generated” path is generated by code and does not reflect of any filesystem on the underlying server. This is how the system sends concatenated JavaScript files to the frontend.