Hartmut/CapaKraken
1
0
Fork 0
Code Issues 10 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

CDP 35948516: NodeJS #30

New Issue
Closed
opened 2026-04-16 08:16:53 +02:00 by Hartmut · 3 comments
Hartmut commented 2026-04-16 08:16:53 +02:00
Owner
Copy Link
Copy Source

CDP Control ID: 35948516
Category: Secure Application Development
Frequency: Onetime
Owner: h.noerenberg
Parent: #1

Requirement & Guidance

Secure Application Development Requirement: Complete the Accenture Delivery Methods (ADM) and CDP requirements for NodeJS by implementing the security requirements listed in the Secure Coding Checklist in your solution. Validation of this control is attestation to the implementation of all requirements in the secure coding checklist. https://in.accenture.com/protectingaccenture/client-data-protection/secure-coding-checklists/ Guidance: Visit the Secure Coding Checklist page and download the corresponding checklist. Share the list with all applicable project resources and instruct on the implementation of requirements in the solution. In case you are unable to implement a security requirement discuss with your Account Manager to assist in processing a formal exception with client sign-off. The checklists are to be used for tracking purposes. For more information visit the Secure Application Development website. Solution security is required by Policy 56.

**CDP Control ID:** `35948516` **Category:** Secure Application Development **Frequency:** Onetime **Owner:** h.noerenberg **Parent:** #1 ## Requirement & Guidance Secure Application Development Requirement: Complete the Accenture Delivery Methods (ADM) and CDP requirements for NodeJS by implementing the security requirements listed in the Secure Coding Checklist in your solution. Validation of this control is attestation to the implementation of all requirements in the secure coding checklist. https://in.accenture.com/protectingaccenture/client-data-protection/secure-coding-checklists/ Guidance: Visit the Secure Coding Checklist page and download the corresponding checklist. Share the list with all applicable project resources and instruct on the implementation of requirements in the solution. In case you are unable to implement a security requirement discuss with your Account Manager to assist in processing a formal exception with client sign-off. The checklists are to be used for tracking purposes. For more information visit the Secure Application Development website. Solution security is required by Policy 56.
Hartmut added the cdpsecurity labels 2026-04-16 08:16:53 +02:00
Hartmut commented 2026-04-16 08:32:39 +02:00
Author
Owner
Copy Link
Copy Source

CapaKraken Action Plan — 35948516 NodeJS Secure Coding Checklist

Checklisten-Quelle: Secure Coding_NodeJS.xlsx

Aktueller Stand:

  • Node 20 (bookworm-slim) — Dockerfile.prod
  • Next.js 15 Standalone + tRPC v11

Typische NodeJS-Checkliste-Items:

  • Keine eval() / Function() Konstruktoren im Server-Code
  • child_process.exec nur mit statischen Strings — kein User-Input
  • Path Traversal: path.join() + Whitelist (realpath-Check)
  • JSON.parse nur auf Zod-validated Input (bereits OK)
  • HTTP Timeouts gesetzt (default Axios/fetch Timeout fehlt ggf.)
  • Prototype Pollution Schutz (Object.create(null) für Maps, Zod validiert Keys)
  • package.json — engines.node lockt Version (Dockerfile.prod setzt 20)
  • Keine Deprecated-Funktionen (Node Deprecation Warnings in CI fangen)
  • Security Headers via Helmet oder Next.js Headers (3.3.1.3.01 OK)

Todos:

  • Grep: eval\(, new Function\(, child_process.exec — sollte keine Treffer produzieren
  • Checkliste in Excel Online öffnen und pro Item bestätigen
  • Evidence: ausgefüllte Checkliste in samples/CDP/attestations/nodejs.pdf
### CapaKraken Action Plan — 35948516 NodeJS Secure Coding Checklist **Checklisten-Quelle:** [Secure Coding_NodeJS.xlsx](https://ts.accenture.com/sites/Information_Security2/Protecting%20Accenture/Shared%20Documents/Client%20Data%20Protection%20WordPress%20Site/Resources/Secure%20Coding%20Checklists/Secure%20Coding_NodeJS.xlsx) **Aktueller Stand:** - Node 20 (bookworm-slim) — `Dockerfile.prod` - Next.js 15 Standalone + tRPC v11 **Typische NodeJS-Checkliste-Items:** - [ ] Keine `eval()` / `Function()` Konstruktoren im Server-Code - [ ] `child_process.exec` nur mit statischen Strings — kein User-Input - [ ] Path Traversal: `path.join()` + Whitelist (`realpath`-Check) - [ ] `JSON.parse` nur auf Zod-validated Input (bereits OK) - [ ] HTTP Timeouts gesetzt (default Axios/fetch Timeout fehlt ggf.) - [ ] Prototype Pollution Schutz (`Object.create(null)` für Maps, Zod validiert Keys) - [ ] `package.json` — `engines.node` lockt Version (`Dockerfile.prod` setzt 20) - [ ] Keine Deprecated-Funktionen (Node Deprecation Warnings in CI fangen) - [ ] Security Headers via Helmet oder Next.js Headers (3.3.1.3.01 OK) **Todos:** - [ ] Grep: `eval\(`, `new Function\(`, `child_process.exec` — sollte keine Treffer produzieren - [ ] Checkliste in Excel Online öffnen und pro Item bestätigen - [ ] Evidence: ausgefüllte Checkliste in `samples/CDP/attestations/nodejs.pdf`
Hartmut commented 2026-04-16 10:02:30 +02:00
Author
Owner
Copy Link
Copy Source

CapaKraken Compliance-Status

EAPPS-Mapping: Node.js Security
Status: 🟡 PARTIAL / TODO — konkrete Schritte unten

Zusammenfassung

Next.js Runtime + API-Package basieren auf Node 20. Die 4 Node.js-Checks laufen über Checkliste #34.

Aktuelle Evidenz

  • Node 20 Base Image — Dockerfile.prod (FROM node:20-bookworm-slim)
  • Container läuft als non-root (uid=1001) — Dockerfile.prod Zeile ~87
  • Rate-Limiting auf API-Ebene vorhanden

Offene Aufgaben

  • Detail-Checkliste #34 (4 Checks) abarbeiten.
  • Prüfen: Helmet-Äquivalent? (Next.js setzt eigene Security-Headers via next.config.ts — ähnlich Helmet).
  • Prüfen: Rate-Limiter (wir haben rate-limit.ts — Äquivalent zu rate-limiter-flexible).

Ticket bleibt offen bis alle Aufgaben abgehakt sind.

## CapaKraken Compliance-Status **EAPPS-Mapping:** `Node.js Security` **Status:** 🟡 **PARTIAL / TODO** — konkrete Schritte unten ### Zusammenfassung Next.js Runtime + API-Package basieren auf Node 20. Die 4 Node.js-Checks laufen über Checkliste **#34**. ### Aktuelle Evidenz - Node 20 Base Image — [`Dockerfile.prod`](../blob/main/Dockerfile.prod) (`FROM node:20-bookworm-slim`) - Container läuft als non-root (uid=1001) — `Dockerfile.prod` Zeile ~87 - Rate-Limiting auf API-Ebene vorhanden ### Offene Aufgaben - [ ] Detail-Checkliste #34 (4 Checks) abarbeiten. - [ ] Prüfen: `Helmet`-Äquivalent? (Next.js setzt eigene Security-Headers via next.config.ts — ähnlich Helmet). - [ ] Prüfen: Rate-Limiter (wir haben `rate-limit.ts` — Äquivalent zu `rate-limiter-flexible`). --- *Ticket bleibt offen bis alle Aufgaben abgehakt sind.*
Hartmut commented 2026-04-16 10:07:33 +02:00
Author
Owner
Copy Link
Copy Source

Abschluss

Alle 4 Node.js-spezifischen Security-Checks aus Checkliste #34 sind nachweislich umgesetzt (siehe #34).

Ergänzende Evidenz:

  • Container läuft als non-root nextjs (uid=1001) — Dockerfile.prod:87
  • Rate-Limit-Middleware — packages/api/src/middleware/rate-limit.ts
  • Security-Headers via next.config.ts (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy)
  • Auth.js CSRF-Token + SameSite=Strict Cookies — auth.config.ts

Ticket wird geschlossen.

## Abschluss Alle 4 Node.js-spezifischen Security-Checks aus Checkliste #34 sind nachweislich umgesetzt (siehe #34). Ergänzende Evidenz: - Container läuft als non-root `nextjs` (uid=1001) — `Dockerfile.prod:87` - Rate-Limit-Middleware — `packages/api/src/middleware/rate-limit.ts` - Security-Headers via `next.config.ts` (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy) - Auth.js CSRF-Token + SameSite=Strict Cookies — `auth.config.ts` Ticket wird geschlossen.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
cdp
CDP (Client Data Protection) compliance
 epic
Parent/umbrella ticket
 not-applicable
Control does not apply to CapaKraken scope
 security
Security / compliance work
No Label cdp security
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Hartmut
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Hartmut/CapaKraken#30
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?