Skip to content

Story #15751: Manage specials characters in MongoDB passwords.#3571

Draft
GiooDev wants to merge 1 commit intodevelopfrom
bug_15751
Draft

Story #15751: Manage specials characters in MongoDB passwords.#3571
GiooDev wants to merge 1 commit intodevelopfrom
bug_15751

Conversation

@GiooDev
Copy link
Contributor

@GiooDev GiooDev commented Feb 20, 2026

@GiooDev GiooDev added this to the IT 166 milestone Feb 20, 2026
@GiooDev GiooDev self-assigned this Feb 20, 2026
@GiooDev GiooDev added bug Something isn't working small pr embarquant peu de changements et à review rapide, ne nécessitant qu'un reviewer Security Modules update OPS REVIEW Mandatory if deployment/ directory is modified. labels Feb 20, 2026
@vitam-prg
Copy link
Collaborator

vitam-prg commented Feb 20, 2026

Logo
Checkmarx One – Scan Summary & Detailsc60d7db2-2a62-4c23-ac6e-87629ece6f7f


New Issues (5) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 HIGH CVE-2026-27903 Npm-minimatch-9.0.5
detailsRecommended version: 9.0.7
Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. All versions starting from 3.0.0 and prior ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
2 HIGH CVE-2026-27903 Npm-minimatch-3.1.2
detailsRecommended version: 3.1.4
Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. All versions starting from 3.0.0 and prior ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
3 HIGH CVE-2026-27904 Npm-minimatch-9.0.5
detailsRecommended version: 9.0.7
Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. All versions starting from 3.0.0 and prior ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
4 HIGH CVE-2026-27904 Npm-minimatch-3.1.2
detailsRecommended version: 3.1.4
Description: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. All versions starting from 3.0.0 and prior ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
5 HIGH CVE-2026-27970 Npm-@angular/core-19.2.18
detailsRecommended version: 19.2.19
Description: Angular is a development platform for building mobile and desktop web applications using TypeScript, JavaScript, and other languages. Versions prio...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package

Fixed Issues (246) Great job! The following issues were fixed in this Pull Request
Severity Issue Source File / Package
MEDIUM Privacy_Violation /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java: 117
MEDIUM Privacy_Violation /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java: 85
MEDIUM Privacy_Violation /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java: 175
MEDIUM Privacy_Violation /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java: 117
MEDIUM Privacy_Violation /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java: 117
MEDIUM Privacy_Violation /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java: 117
MEDIUM Privacy_Violation /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java: 85
MEDIUM Privacy_Violation /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java: 85
MEDIUM Privacy_Violation /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java: 85
MEDIUM Privacy_Violation /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java: 85
MEDIUM Privacy_Violation /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java: 175
MEDIUM Privacy_Violation /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java: 175
MEDIUM Privacy_Violation /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java: 175
LOW Log_Forging /api/api-archive-search/archive-search/src/main/java/fr/gouv/vitamui/archives/search/server/rest/ArchivesSearchController.java: 308
LOW Log_Forging /api/api-archive-search/archive-search/src/main/java/fr/gouv/vitamui/archives/search/server/rest/ArchivesSearchController.java: 308
LOW Log_Forging /api/api-archive-search/archive-search/src/main/java/fr/gouv/vitamui/archives/search/server/rest/ArchivesSearchController.java: 308
LOW Log_Forging /api/api-archive-search/archive-search/src/main/java/fr/gouv/vitamui/archives/search/server/rest/ArchivesSearchController.java: 308
LOW Log_Forging /api/api-archive-search/archive-search/src/main/java/fr/gouv/vitamui/archives/search/server/rest/ArchivesSearchController.java: 308
LOW Log_Forging /api/api-archive-search/archive-search/src/main/java/fr/gouv/vitamui/archives/search/server/rest/ArchivesSearchController.java: 308
LOW Log_Forging /api/api-archive-search/archive-search/src/main/java/fr/gouv/vitamui/archives/search/server/rest/ArchivesSearchController.java: 308
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/TransactionController.java: 168
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/TransactionController.java: 166
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/TransactionController.java: 166
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/TransactionController.java: 166
LOW Log_Forging /api/api-referential/referential/src/main/java/fr/gouv/vitamui/referential/server/rest/LogbookManagementOperationController.java: 80
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 216
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 215
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 216
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 216
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 194
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 193
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 192
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 195
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 193
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 195
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 193
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 195
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/TransactionController.java: 201
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/TransactionController.java: 201
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/TransactionController.java: 201
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/TransactionController.java: 201
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 287
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 236
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 253
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 287
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 236
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 253
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 270
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 288
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 287
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 254
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 253
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 237
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 236
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 288
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 254
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 237
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 270
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 271
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 270
LOW Log_Forging /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 271

More results are available on the CxOne platform


Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

@GiooDev GiooDev force-pushed the bug_15751 branch 2 times, most recently from 6b81c00 to cd90d4a Compare February 23, 2026 16:47
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

C'est lié aux caractères spéciaux du mot de passe ?
Et je ne vois pas de modification de code pour le décoder (b64decode) au moment où on en a besoin.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ouep exactement, c'est pour "gérer" les caractères spéciaux si un utilisateur souhaite en définir car le format attendu de ce fichier est du base64.

https://www.mongodb.com/docs/manual/tutorial/deploy-replica-set-with-keyfile-access-control/#create-a-keyfile

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mais avant c'était pas en base64 ?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK, les caractères autorisés sont restreints. Donc pour laisser la possibilité de choisir n'importe quel caractère, tu décides finalement de ne pas mettre le mot de passe renseigné, mais sa version base64 ?
Mais du coup, impact sur les install existantes ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nop avant c'était pas en base64 mais on limitait les caractères à du alphanumérique sans caractères spéciaux.

Normalement en cas de montée de réapplication sur une installation existante, on va venir mettre à jour le fichier sur l'ensemble des machines donc ça devrait passer.

Mais tu as raison, ça fait parti des points que je m'étais noté dans un coin à contre-tester. Je le note dans le ticket pour pas l'oublier.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bon ça semble pas si simple, je la passe en Draft le temps de trouver une solution adéquate ;)

@GiooDev GiooDev changed the title Bug #15751: Manage specials characters in MongoDB passwords. Story #15751: Manage specials characters in MongoDB passwords. Feb 27, 2026
@GiooDev GiooDev marked this pull request as draft February 27, 2026 19:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working OPS REVIEW Mandatory if deployment/ directory is modified. Security Modules update small pr embarquant peu de changements et à review rapide, ne nécessitant qu'un reviewer

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants