Hi,
I got a list of security vulnerabilities from The EcoScanner check 3 weeks ago on my Atlassian app.
They all said the same message, which is:
Vulnerability Description
The EcoScanner check, Custom-Check-Authorization-<unique id here>, for FSRT has reported the following issue:
Authorization bypass detected through handler.<methodName> in "/tmp/forge-app/src/index.js".
The check provided the following proof:
Unauthorized API call via asApp() found via handler.<methodName>
Mitigation Recommendation
The following resource was provided as a remediation recommendation:
Use the authorize API https://developer.atlassian.com/platform/forge/runtime-reference/authorize-api/ or manually authorize the user via the product REST APIs.
I got around to addressing those vulnerabilities this week.
My understanding was that I’m using asApp instead of asUser so I changed all of my calls to asUser.
For example, here’s an example of a call to the Jira REST API that I do in my Atlassian app. I replaced asApp to asUser.
const response = await api
.asUser()
.requestJira(
route(`/rest/api/3/search`), {
method: "POST",
headers: {
accept: "application/json",
"content-type": "application/json",
},
body: JSON.stringify(data)
});
I pushed a version to development and staging to get a green light from the bot. It returned the same vulnerability check so I figured I would push my changes to production.
I pushed my changes to production but still go a response from the EcoScanner bot telling me the same message as above.
I’m stumped. I don’t know what to change.
I’ve looked at the Authorize API but my calls in the handler file named above are on reading boards, statuses, and doing JQL queries through the Jira REST API. The methods in the Authorize API do not allow me to do these kinds of checks.
Does any know how to fix this problem? What did I forget? Is my issue related to my manifest.yml file instead? Or is there an alternate solution I didn’t see?
Any help or guidance would be appreciated,
Louis-Philippe
