Story #16471: use standalone components

[marob]

No description provided.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[vitam-prg]

Checkmarx One – Scan Summary & Details – f38dc946-136f-4af2-9175-7280081fd4f8

---

New Issues (93)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		Container Capabilities Unrestricted	/docker-compose.yml: 3	details Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnec...
2		Healthcheck Not Set	/docker-compose.yml: 3	details Check containers periodically to see if they are running properly.
3		Memory Not Limited	/docker-compose.yml: 3	details Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than ...
4		Security Opt Not Set	/docker-compose.yml: 3	details Attribute 'security_opt' should be defined.
5		Shared Host Network Namespace	/docker-compose.yml: 5	details Container should not share the host network namespace
6		Use_Of_Hardcoded_Password	ui/ui-frontend/proxy.conf.js: 21	details The application uses the hard-coded password "changeme" for authentication purposes, either using it to verify users' identities, or to access ano... Attack Vector
7		Cpus Not Limited	/docker-compose.yml: 3	details CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests
8		Log_Forging	api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 217	details Method streamingUploadSip at line 217 of /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java gets u... Attack Vector
9		Log_Forging	api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 216	details Method streamingUploadSip at line 216 of /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java gets u... Attack Vector
10		Log_Forging	api/api-archive-search/archive-search/src/main/java/fr/gouv/vitamui/archives/search/server/rest/ArchivesSearchController.java: 459	details Method launchPreservation at line 459 of /api/api-archive-search/archive-search/src/main/java/fr/gouv/vitamui/archives/search/server/rest/Archiv... Attack Vector
11		Log_Forging	api/api-archive-search/archive-search/src/main/java/fr/gouv/vitamui/archives/search/server/rest/ArchivesSearchController.java: 467	details Method countObjectGroups at line 467 of /api/api-archive-search/archive-search/src/main/java/fr/gouv/vitamui/archives/search/server/rest/Archive... Attack Vector
12		Log_Forging	api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/UserController.java: 148	details Method signedExportUsers at line 148 of /api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/UserController.java gets user input from e... Attack Vector
13		Log_Forging	api/api-archive-search/archive-search/src/main/java/fr/gouv/vitamui/archives/search/server/rest/ArchivesSearchController.java: 217	details Method signedDownloadObjectFromUnit at line 217 of /api/api-archive-search/archive-search/src/main/java/fr/gouv/vitamui/archives/search/server/r... Attack Vector
14		Log_Forging	api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java: 382	details Method signedDownloadReport at line 382 of /api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java gets user input ... Attack Vector
15		Log_Forging	api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java: 380	details Method signedDownloadReport at line 380 of /api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java gets user input ... Attack Vector
16		Log_Forging	api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java: 437	details Method signedDownloadManifest at line 437 of /api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java gets user inpu... Attack Vector
17		Log_Forging	api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java: 410	details Method signedDownloadAtr at line 410 of /api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java gets user input fro... Attack Vector
18		Log_Forging	api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/OperationController.java: 342	details Method signedExportProbativeValue at line 342 of /api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/OperationC... Attack Vector
19		Log_Forging	api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java: 438	details Method signedDownloadManifest at line 438 of /api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java gets user inpu... Attack Vector
20		Log_Forging	api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java: 438	details Method signedDownloadManifest at line 438 of /api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java gets user inpu... Attack Vector
21		Log_Forging	api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java: 410	details Method signedDownloadAtr at line 410 of /api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java gets user input fro... Attack Vector
22		Log_Forging	api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/OperationController.java: 343	details Method signedExportProbativeValue at line 343 of /api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/OperationC... Attack Vector
23		Log_Forging	api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/GroupController.java: 301	details Method signedExportProfileGroups at line 301 of /api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/GroupController.java gets user inp... Attack Vector
24		Log_Forging	api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java: 380	details Method signedDownloadReport at line 380 of /api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java gets user input ... Attack Vector
25		Log_Forging	api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java: 382	details Method signedDownloadReport at line 382 of /api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java gets user input ... Attack Vector
26		Log_Forging	api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/UserController.java: 148	details Method signedExportUsers at line 148 of /api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/UserController.java gets user input from e... Attack Vector
27		Log_Forging	api/api-archive-search/archive-search/src/main/java/fr/gouv/vitamui/archives/search/server/rest/ArchivesSearchController.java: 287	details Method signedExportCsvArchiveUnitsByCriteria at line 287 of /api/api-archive-search/archive-search/src/main/java/fr/gouv/vitamui/archives/search... Attack Vector
28		Log_Forging	api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/OperationController.java: 343	details Method signedExportProbativeValue at line 343 of /api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/OperationC... Attack Vector
29		Log_Forging	api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java: 411	details Method signedDownloadAtr at line 411 of /api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java gets user input fro... Attack Vector
30		Log_Forging	api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java: 411	details Method signedDownloadAtr at line 411 of /api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java gets user input fro... Attack Vector
31		Log_Forging	api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/TransactionArchiveUnitController.java: 190	details Method signedExportCsvArchiveUnitsByCriteria at line 190 of /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/Transaction... Attack Vector
32		Log_Forging	api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java: 437	details Method signedDownloadManifest at line 437 of /api/api-iam/iam/src/main/java/fr/gouv/vitamui/iam/server/rest/LogbookController.java gets user inpu... Attack Vector
33		Log_Forging	api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/AccessContractController.java: 232	details Method signedExportAccessContracts at line 232 of /api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/AccessCon... Attack Vector
34		Log_Forging	api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/OperationController.java: 166	details Method findHistoryById at line 166 of /api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/OperationController.... Attack Vector
35		Log_Forging	api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/RuleController.java: 267	details Method importRules at line 267 of /api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/RuleController.java gets... Attack Vector
36		Log_Forging	api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/TransactionController.java: 142	details Method validateTransaction at line 142 of /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/TransactionController.java g... Attack Vector
37		Log_Forging	api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/TransactionController.java: 141	details Method validateTransaction at line 141 of /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/TransactionController.java g... Attack Vector

More results are available on the CxOne platform

---

Fixed Issues (8)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	Passwords And Secrets - Generic Password	/docker-compose.yml: 37
	Container Capabilities Unrestricted	/docker-compose.test.yml: 2
	Container Capabilities Unrestricted	/docker-compose.yml: 2
	Healthcheck Not Set	/docker-compose.test.yml: 2
	Security Opt Not Set	/docker-compose.yml: 2
	Security Opt Not Set	/docker-compose.test.yml: 2
	Shared Host Network Namespace	/docker-compose.test.yml: 5
	Shared Host Network Namespace	/docker-compose.yml: 7

---

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR