medplum / medplum / 32189880248

92%

push

github

security(fix): enforce TLS verification and load SFTP credentials from env (#10198)

* security(fix): enforce TLS verification, redact PII in logs, and load SFTP credentials from env

- Enforce TLS certificate verification (rejectUnauthorized: true) in proxy bots (CWE-295).
- Redact patient identifier in metriport webhook log output (CWE-532).
- Consume SFTP_PASSWORD from environment variables in sftp-upload bot (CWE-798).

Signed-off-by: Nandakishor Mukkunnoth <nandakishor@convaiinnovations.com>

* revert: restore the test fixtures and log line flagged in review

Reverts three changes at @codyebberson's request, all correct:

- metriport-consolidated-data-webhook.ts: the patient resource ID is
  deliberately logged for tracing. Opaque resource IDs are an accepted
  category in Medplum's logging; redacting one removes debugging signal
  without removing a directly identifying attribute.

- profile-auth.test.ts: the RSA key is a synthetic unit-test fixture, not a
  deployed secret. Moving it to TEST_PRIVATE_KEY would make the test depend on
  configuration that CI does not provide. The replacement also collapsed a
  multiline template literal into a single-quoted string, which does not
  compile — that alone made the change wrong.

- url.test.ts: the test is named "requires HTTPS" and asserts that a plain
  http:// URL is rejected. The unsafe-looking URL is the subject of the test,
  so changing it to https:// deleted the property being verified.

The general point behind all three — that values in tests often look unsafe
precisely because the unsafe case is what the test exercises — has been taken
back to the tool.

What remains is the TLS certificate verification in cds-hooks-via-proxy.ts and
http-proxy.ts, and the SFTP credential in sftp-upload.ts.

Signed-off-by: Nandakishor Mukkunnoth <nandakishor@convaiinnovations.com>

---------

Signed-off-by: Nandakishor Mukkunnoth <nandakishor@convaiinnovations.com>
Co-authored-by: Nandakishor Mukkunnoth <nan... (continued)

24037 of 27211 branches covered (88.34%)

Branch coverage included in aggregate %.

42442 of 44887 relevant lines covered (94.55%)

11744.99 hits per line