DP-43340 replace-feedback-api-backend

[dstorozhuk]

Description:
Explain the technical implementation of the work done.

Jira: (Skip unless you are MA staff)
DP-****

To Test:

• Add steps to test this feature

---

Peer Review Checklist

[prisma-cloud-devsecops]

Prisma Cloud has found errors in this PR ⬇️

[prisma-cloud-devsecops]

  Restrict unnecessarily powerful browser features
    File: mass-feedback-form.behaviors.js | Checkov ID: CKV3_SAST_78

How To Fix

// Only query for geolocation when a user action requires it
function getLocation() {
if ("geolocation" in navigator) {
navigator.geolocation.getCurrentPosition(position => {
// Use the position data
});
} else {
// Handle no geolocation scenario
}
}

// This function should only be triggered when the user explicitly requests a feature that needs geolocation
document.querySelector("#getLocationButton").addEventListener('click', getLocation);

Description

CWEs: CWE-250: Execution with Unnecessary Privileges, CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
OWASP: A01:2021-Broken Access Control

Browser features like geolocation, camera, and microphone offer vast functionalities but come with inherent security and privacy implications. These features are accessible through JavaScript APIs and often require user permissions. While these permissions might be essential for certain applications, they can be misused or exploited by attackers if not properly managed.

When unnecessary access to these features is allowed, it can lead to situations where sensitive information is exposed or where the application operates with more privileges than required, leading to potential security vulnerabilities.

Vulnerable code example:

javascript
// Querying for geolocation permission
navigator.permissions.query({name: "geolocation"}).then(response => {
  if (response.state == 'granted') {
    // Access granted
  } else {
    // Access denied
  }
});

[tfleming-ma]

@dstorozhuk Is it your understanding as well that we already are only calling the geolocation on form submit, so this issue is already addressed?

[tfleming-ma]

@dstorozhuk Overall looking good to me. I added some very minor comments and suggestions for a couple minor things. I also added a topic for discussion to the ticket.

[tfleming-ma]

@dstorozhuk Is it your understanding as well that we already are only calling the geolocation on form submit, so this issue is already addressed?