marcel/familienarchiv
1
0
Fork 0
Code Issues 119 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix(review): replace email fallback with [Unbekannt] in AuthorView — prevents CWE-359 leak

Browse Source 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Marcel
2026-06-08 18:09:40 +02:00
parent 4eb6abd920
commit 2f471155b8
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
backend/src/main/java/org/raddatz/familienarchiv/geschichte/GeschichteService.java
View File

@@ -78,7 +78,7 @@ public class GeschichteService {
if (author != null) {
String displayName = ((author.getFirstName() != null ? author.getFirstName() : "")
+ " " + (author.getLastName() != null ? author.getLastName() : "")).trim();
if (displayName.isBlank()) displayName = author.getEmail();
if (displayName.isBlank()) displayName = "[Unbekannt]";
authorView = new GeschichteView.AuthorView(author.getId(), displayName);
}
return new GeschichteView(

4
backend/src/test/java/org/raddatz/familienarchiv/geschichte/GeschichteServiceTest.java
View File

@@ -123,7 +123,7 @@ class GeschichteServiceTest {
}
@Test
void getById_author_displayName_falls_back_to_email_when_names_blank() {
void getById_author_displayName_falls_back_to_Unbekannt_when_names_blank() {
authenticateAs(reader, Permission.READ_ALL);
UUID id = UUID.randomUUID();
Geschichte published = published(id);
@@ -133,7 +133,7 @@ class GeschichteServiceTest {
GeschichteView result = geschichteService.getById(id);
assertThat(result.author().displayName()).isEqualTo("anon@test");
assertThat(result.author().displayName()).isEqualTo("[Unbekannt]");
}
@Test