[PM-22696] send enumeration protection

[ike-kottlowski]

🎟️ Tracking

PM-22696

📔 Objective

To prevent enumerating of send GUIDs we return deterministic errors for sends that do not exist, expired, or maximum count has been reached.

This pseudo-random error generation hopefully will disuade enumeration attacks.

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[github-actions]

Checkmarx One – Scan Summary & Details – cf928b30-ffab-4a95-a709-79102ac463d1

New Issues (3)

Checkmarx found the following issues in this Pull Request

Severity	Issue	Source File / Package	Checkmarx Insight
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1506	details Method at line 1506 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ... ID: uaZJpiJ78LRBNDwwZkUWmcWIWQg%3D Attack Vector
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1387	details Method at line 1387 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ... ID: 1xLfiRwN9lkroucCvbONJ53Q3OQ%3D Attack Vector
	Use_Of_Hardcoded_Password	/src/Identity/IdentityServer/RequestValidators/SendAccess/SendAccessConstants.cs: 115	details The application uses the hard-coded password Password for authentication purposes, either using it to verify users' identities, or to access anoth... ID: AYjjFBMS%2BbuvspbJ4w0%2Be8Bnxk4%3D Attack Vector

Fixed Issues (1)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 299

[codecov]

Codecov Report

❌ Patch coverage is 97.46835% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 50.10%. Comparing base (d384c0c) to head (f072576).
⚠️ Report is 7 commits behind head on main.

Files with missing lines	Patch %	Lines
...endAccess/SendNeverAuthenticateRequestValidator.cs	96.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6352      +/-   ##
==========================================
+ Coverage   50.04%   50.10%   +0.06%     
==========================================
  Files        1832     1834       +2     
  Lines       81531    81561      +30     
  Branches     7226     7225       -1     
==========================================
+ Hits        40800    40864      +64     
+ Misses      39162    39127      -35     
- Partials     1569     1570       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[eliykat]

The only change to AC code is some formatting, approved.

[JaredSnider-Bitwarden]

Some really small things, but this is stellar work overall!

[sonarqubecloud]

Quality Gate passed

Issues
8 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[JaredSnider-Bitwarden]

Nice work! Thank you for your patience with all the naming tweaks!

[eliykat]

AC Team is no longer a code owner, no review needed from me :)