Repository navigation
feat: Third Party About page; About pages show product identity, not framework versions - #248
Merged
Merged
Conversation
…framework versions - Third Party: new public /about (AboutController + about.html on the shared GBA layout), linked from the footer, permitted anonymously. - Data Custodian and Third Party About pages now show the same fields: implementation, version, build time, the standard (NAESB REQ.21 ESPI 4.1) and a release status derived from the version (a SNAPSHOT is "Pre-release: not for production use"), plus links to GBA, the API docs, the source and SECURITY.md. - The Java and Spring Boot versions are no longer shown to anonymous visitors: exact framework versions help attackers pick known CVEs, and they stay available to admins via /actuator/info (#240). - Version and build time come from BuildProperties (spring-boot-maven-plugin:build-info, added to both apps) instead of the jar manifest, which is absent under spring-boot:run ("(development build)"). - Removed the legacy VersionRESTController (/about-version) from both apps. It read a servlet-context MANIFEST.MF that a Spring Boot jar does not have, and it filled a model key the DC template never read (DC) or rendered a template that did not exist (TP). - Tests: AboutControllerTest in both apps. GbaLayoutPagesTest now renders under the real /ThirdParty context path and asserts that every internal href/src carries it. With MockMvc's empty context path, a correct th:href="@{/about}" and a broken href="/about" rendered identically, so the previous #235 guard could not catch the bug. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a public About page to the Third Party and makes the Data Custodian's match it. Neither page discloses framework versions any more.
/aboutSECURITY.mdDetails
-SNAPSHOT(or unknown) build shows "Pre-release: not for production use", and a released version shows "Release". It will flip at the v4.0.0 release without a code change.BuildProperties: thespring-boot-maven-plugin:build-infogoal, now added to both apps. The jar manifest used before is absent underspring-boot:run, which is why the DC showed "(development build)"./actuator/infoadmin-only for the same reason. Admins can still read them there.VersionRESTController(/about-version) from both apps. It read/META-INF/MANIFEST.MFfrom the servlet context, which a Spring Boot jar doesn't have. In the DC it filled a model key (aboutInfo) thatabout.htmlnever read; in the TP it rendered anabouttemplate that didn't exist.Test fix: the #235 regression guard couldn't fail
GbaLayoutPagesTest(from #246) asserted that pages didn't containhref="/about". But MockMvc runs with an empty context path, so a correctth:href="@{/about}"and a brokenhref="/about"render the same HTML. The new footer link tripped that assertion even though it's correct. The test now renders under the real/ThirdPartycontext path and asserts that every internalhref/srccarries it. The pattern was checked against broken forms (/about,/,/images/x.png,/ThirdPartyX/a), which it flags, and correct ones (/ThirdParty/...,//cdn...,https://...), which it passes.Test plan
AboutControllerTestin DC (3) and TP (4):/about→ 200 anonymously; shows implementation, standard, status andSECURITY.md; shows the realBuildPropertiesversion and build time; does not contain "Java version", the running Java version, or the Spring Boot version. Also coversreleaseStatusfor SNAPSHOT, null and release, and the TP footer link.mvn verifyDC: 181 tests pass; TP: 56 pass (2 skipped, pre-existing)localprofile): both About pages render4.0.0-SNAPSHOT, the build time and "Pre-release: not for production use";/about-versionis gone from both apps🤖 Generated with Claude Code