fix: GEO-1237, GEO-1238 - fixed critical security issues identified in WAVA scan

[banders]

Description

Fixed two scenarios where SQL injection attacks on the backend public API were possible. The affected endpoints are:

• POST api/auth/refresh
• POST api/v1/file-upload

Both endpoints now perform additional validation on the request body to ensure parameters are of the right type.

Also explicitly set the cookie "samesite" policy for the public app to "lax". Lax provides some protection against Cross Site Request Forgery attacks. This is one step down from "strict", which would be preferable, but our use of a third party site for login means we cannot use "strict" without some other changes to the login process. We were probably using the "lax" policy previously because it may have been enabled by default, but not it is enabled explicitly for the public site.

Fixes # GEO-1237

Also applied the same cookie "samesite" policy as noted above to the admin site.

Fixes # GEO-1238

Type of change

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

Updated unit tests

Checklist

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have already been accepted and merged

---

Thanks for the PR!

Deployments, as required, will be available below:

• Frontend
• Admin Frontend
• Backend external API console

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are deployed in:

• Merge Workflow

---

Thanks for the PR!

Deployments, as required, will be available below:

• Frontend
• Admin Frontend
• Backend external API console

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are deployed in:

• Merge Workflow

---

Thanks for the PR!

Deployments, as required, will be available below:

• Frontend
• Admin Frontend
• Backend external API console

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are deployed in:

• Merge Workflow

[sonarqubecloud]

Quality Gate passed for 'Pay Transparency backend-external'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed for 'Pay Transparency Frontend'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate failed for 'Pay Transparency Backend'

Failed conditions
70.8% Coverage on New Code (required ≥ 80%)
35.0% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed for 'Pay Transparency admin-frontend'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed for 'Pay Transparency doc-gen-service'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud