Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 0 additions & 50 deletions .github/workflows/cd.yml

This file was deleted.

36 changes: 34 additions & 2 deletions .github/workflows/ci.yml β†’ .github/workflows/ci-cd.yml
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,6 @@ name: CI
on:
push:
branches: [ "main" ]
pull_request:
branches: [ "main" ]

permissions:
contents: read
Expand Down Expand Up @@ -77,3 +75,37 @@ jobs:
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max

# .env 생성
- name: Create .env file
run: echo "${{ secrets.ENV_FILE }}" > .env

# EC2둜 파일 전솑
- name: Copy files to EC2
uses: appleboy/scp-action@master
with:
host: ${{ secrets.SSH_HOST }}
username: ${{ secrets.SSH_USERNAME }}
key: ${{ secrets.SSH_KEY }}
port: 22
source: "docker/*,.env,nginx/,deploy.sh"
target: "/home/ubuntu/tinybite/"

# EC2μ—μ„œ 도컀 μ»¨ν…Œμ΄λ„ˆ 재배포
- name: Deploy to EC2
uses: appleboy/ssh-action@master
with:
host: ${{ secrets.SSH_HOST }}
username: ${{ secrets.SSH_USERNAME }}
key: ${{ secrets.SSH_KEY }}
port: 22
script: |
cd /home/ubuntu/tinybite
mv /home/ubuntu/tinybite/docker/* /home/ubuntu/tinybite/

export GHCR_TOKEN=${{ secrets.GHCR_TOKEN }}
export GHCR_USERNAME=${{ github.actor }}
echo $GHCR_TOKEN | docker login ghcr.io -u $GHCR_USERNAME --password-stdin

chmod +x deploy.sh
./deploy.sh
6 changes: 5 additions & 1 deletion build.gradle
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,6 @@ dependencies {
// spring starter
implementation 'org.springframework.boot:spring-boot-starter-web'
implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
implementation 'org.springframework.boot:spring-boot-starter-security'
implementation 'org.springframework.boot:spring-boot-starter-thymeleaf'

//security
Expand Down Expand Up @@ -63,6 +62,11 @@ dependencies {

// sms
implementation 'com.solapi:sdk:1.0.3'

// google login
implementation 'com.google.api-client:google-api-client:2.7.2'
// firebase
implementation 'com.google.firebase:firebase-admin:9.1.1'
Comment on lines +66 to +69
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | πŸ”΄ Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check latest versions and information about these dependencies on Maven Central

# Check Google API Client
echo "=== Checking google-api-client ==="
curl -s "https://repo1.maven.org/maven2/com/google/api-client/google-api-client/maven-metadata.xml" | grep -oP '(?<=<version>)[^<]+' | tail -5

echo ""
echo "=== Checking firebase-admin ==="
# Check Firebase Admin
curl -s "https://repo1.maven.org/maven2/com/google/firebase/firebase-admin/maven-metadata.xml" | grep -oP '(?<=<version>)[^<]+' | tail -5

Repository: tinybite-2025/tinybite-server

Length of output: 200


🌐 Web query:

google-api-client 2.7.2 security vulnerabilities CVE

πŸ’‘ Result:

Short answer: google-api-client 2.7.2 itself has no direct CVE entries, but published metadata and vulnerability databases show it can be affected by vulnerabilities in third‑party dependencies β€” notably CVE‑2024‑7254 (Protocol Buffers stack‑overflow / DoS via specially nested protobufs) and CVE‑2025‑27820 (Apache HttpClient PSL validation / hostname/cookie check bug). Upgrade or remediate the affected dependencies (or upgrade the library) to fixed versions. [1][2][3][4]

Sources

  • google-api-client 2.7.2 artifact page (shows vulnerabilities from dependencies). [1]
  • CVE‑2024‑7254 details (Protocol Buffers unbounded recursion / stack overflow). [2]
  • CVE‑2025‑27820 details (Apache HttpClient PSL validation bug). [3]
  • Google Java client release history (2.7.2 β†’ newer releases available). [4]

If you want, I can:

  • list which transitive packages/versions in your build are vulnerable, and the exact fixed versions to target, or
  • produce a small command (Maven/Gradle/OWASP Dependency‑Check/Snyk) to detect these in your project.

🌐 Web query:

firebase-admin 9.1.1 security vulnerabilities CVE

πŸ’‘ Result:

Short answer: firebase-admin 9.1.1 itself has no recorded direct CVE, but the 9.1.1 artifact pulls in Netty components that are known to contain multiple CVEs (e.g. CVE-2025-58056, CVE-2024-29025, CVE-2023-34462, CVE-2022-41915), so a project using firebase‑admin 9.1.1 can be transitively exposed via those dependency vulnerabilities. [1][2][3][4][5]

Sources:

  • Dependency / vulnerability listing for com.google.firebase:firebase-admin:9.1.1. [Maven Central / mvnrepository]. [1]
  • CVE-2025-58056 (Netty request smuggling / chunk parsing). [2]
  • CVE-2024-29025 (Netty HttpPostRequestDecoder resource exhaustion). [3]
  • CVE-2023-34462 (Netty SniHandler allocation issue). [4]
  • CVE-2022-41915 (Netty DefaultHttpHeaders header validation / response splitting). [5]

If you want, I can:

  • show which exact Netty artifact/version in firebase‑admin 9.1.1 is affected and the minimum patched version, or
  • suggest concrete upgrade or mitigation steps.

Google API ν΄λΌμ΄μ–ΈνŠΈ 및 Firebase Admin SDK 버전 μ—…κ·Έλ ˆμ΄λ“œ ν•„μˆ˜

μΆ”κ°€λœ μ˜μ‘΄μ„±λ“€μ΄ μ‹¬κ°ν•˜κ²Œ κ΅¬λ²„μ „μž…λ‹ˆλ‹€:

μ¦‰μ‹œ μ΅œμ‹  λ²„μ „μœΌλ‘œ μ—…κ·Έλ ˆμ΄λ“œν•˜μ„Έμš”.

πŸ€– Prompt for AI Agents
In build.gradle around lines 66 to 69, the google-api-client (2.7.2) and
firebase-admin (9.1.1) dependencies are outdated and must be bumped to the
latest safe versions; update google-api-client to 2.8.1 and firebase-admin to
9.7.0 in the implementation lines, then refresh/resolve Gradle dependencies
(gradle --refresh-dependencies or via IDE), run the test suite and build to
catch any API/compatibility issues, and update any lockfiles or CI caches
accordingly.

}

tasks.named('test') {
Expand Down
2 changes: 2 additions & 0 deletions src/main/java/ita/tinybite/TinyBiteApplication.java
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,11 @@
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.data.jpa.repository.config.EnableJpaAuditing;
import org.springframework.scheduling.annotation.EnableScheduling;

@SpringBootApplication
@EnableJpaAuditing
@EnableScheduling
public class TinyBiteApplication {
public static void main(String[] args) {
SpringApplication.run(TinyBiteApplication.class, args);
Expand Down
Original file line number Diff line number Diff line change
@@ -1,8 +1,6 @@
package ita.tinybite.domain.auth.controller;

import ita.tinybite.domain.auth.dto.request.KakaoLoginRequest;
import ita.tinybite.domain.auth.dto.request.KakaoSignupRequest;
import ita.tinybite.domain.auth.dto.request.RefreshTokenRequest;
import ita.tinybite.domain.auth.dto.request.*;
import ita.tinybite.domain.auth.dto.response.AuthResponse;
import ita.tinybite.domain.auth.service.AuthService;
import ita.tinybite.global.response.APIResponse;
Expand All @@ -18,6 +16,8 @@
import org.springframework.web.bind.annotation.*;
import org.springframework.web.util.UriComponentsBuilder;

import static ita.tinybite.global.response.APIResponse.success;

@Slf4j
@RestController
@RequestMapping("/api/v1/auth")
Expand Down Expand Up @@ -55,31 +55,63 @@ public ResponseEntity<APIResponse<AuthResponse>> kakaoSignup(
) {
AuthResponse response = authService.kakaoSignup(request);
return ResponseEntity.status(HttpStatus.CREATED)
.body(APIResponse.success(response));
.body(success(response));
}

@PostMapping("/kakao/login")
public ResponseEntity<APIResponse<AuthResponse>> kakaoLogin(
@Valid @RequestBody KakaoLoginRequest request
) {
AuthResponse response = authService.kakaoLogin(request);
return ResponseEntity.ok(APIResponse.success(response));
return ResponseEntity.ok(success(response));
}

@PostMapping("/google/signup")
public ResponseEntity<APIResponse<AuthResponse>> googleSignup(
@Valid @RequestBody GoogleAndAppleSignupRequest req
) {
return ResponseEntity
.status(HttpStatus.CREATED)
.body(success(authService.googleSignup(req)));
}

@PostMapping("/google/login")
public APIResponse<AuthResponse> googleLogin(
@Valid @RequestBody GoogleAndAppleLoginReq req
) {
return success(authService.googleLogin(req));
}

@PostMapping("/apple/signup")
public ResponseEntity<APIResponse<AuthResponse>> appleSignup(
@Valid @RequestBody GoogleAndAppleSignupRequest req
) {
return ResponseEntity
.status(HttpStatus.CREATED)
.body(success(authService.appleSignup(req)));
}

@PostMapping("/apple/login")
public APIResponse<AuthResponse> appleLogin(
@Valid @RequestBody GoogleAndAppleLoginReq req
) {
return success(authService.appleLogin(req));
}

@PostMapping("/refresh")
public ResponseEntity<APIResponse<AuthResponse>> refreshToken(
@Valid @RequestBody RefreshTokenRequest request
) {
AuthResponse response = authService.refreshToken(request);
return ResponseEntity.ok(APIResponse.success(response));
return ResponseEntity.ok(success(response));
}

@PostMapping("/logout")
public ResponseEntity<APIResponse<Void>> logout(
@RequestAttribute("userId") Long userId
) {
authService.logout(userId);
return ResponseEntity.ok(APIResponse.success(null));
return ResponseEntity.ok(success(null));
}
}

Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
package ita.tinybite.domain.auth.dto.request;

import ita.tinybite.domain.user.constant.PlatformType;

public record GoogleAndAppleLoginReq(String idToken,
PlatformType platformType) {
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
package ita.tinybite.domain.auth.dto.request;

import ita.tinybite.domain.user.constant.PlatformType;
import jakarta.validation.constraints.NotBlank;

public record GoogleAndAppleSignupRequest(
@NotBlank(message = "idToken은 ν•„μˆ˜μž…λ‹ˆλ‹€")
String idToken,
@NotBlank(message = "μ „ν™”λ²ˆν˜ΈλŠ” ν•„μˆ˜μž…λ‹ˆλ‹€")
String phone,
@NotBlank(message = "λ‹‰λ„€μž„μ€ ν•„μˆ˜μž…λ‹ˆλ‹€")
String nickname,
@NotBlank(message = "μœ„μΉ˜ 정보 ν•„μˆ˜μž…λ‹ˆλ‹€")
String location,
@NotBlank(message = "ν”Œλž«νΌμ •λ³΄λŠ” ν•„μˆ˜μž…λ‹ˆλ‹€")
PlatformType platform
Comment on lines +15 to +16
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

@NotBlankλŠ” enum νƒ€μž…μ— μ ν•©ν•˜μ§€ μ•ŠμŒ

PlatformType은 enum νƒ€μž…μ΄λ―€λ‘œ @NotBlank λŒ€μ‹  @NotNull을 μ‚¬μš©ν•΄μ•Ό ν•©λ‹ˆλ‹€. @NotBlankλŠ” CharSequence νƒ€μž…(String λ“±)μ—λ§Œ 적용 κ°€λŠ₯ν•˜λ©°, enum에 μ‚¬μš©ν•˜λ©΄ μ˜ˆμƒμΉ˜ λͺ»ν•œ λ™μž‘μ΄ λ°œμƒν•  수 μžˆμŠ΅λ‹ˆλ‹€.

+import jakarta.validation.constraints.NotNull;

-        @NotBlank(message = "ν”Œλž«νΌμ •λ³΄λŠ” ν•„μˆ˜μž…λ‹ˆλ‹€")
-        PlatformType platform
+        @NotNull(message = "ν”Œλž«νΌμ •λ³΄λŠ” ν•„μˆ˜μž…λ‹ˆλ‹€")
+        PlatformType platform
πŸ“ Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
@NotBlank(message = "ν”Œλž«νΌμ •λ³΄λŠ” ν•„μˆ˜μž…λ‹ˆλ‹€")
PlatformType platform
@NotNull(message = "ν”Œλž«νΌμ •λ³΄λŠ” ν•„μˆ˜μž…λ‹ˆλ‹€")
PlatformType platform
πŸ€– Prompt for AI Agents
In
src/main/java/ita/tinybite/domain/auth/dto/request/GoogleAndAppleSignupRequest.java
around lines 15-16, the field PlatformType platform is annotated with @NotBlank
which is inappropriate for an enum; replace @NotBlank with @NotNull to validate
presence of the enum value, import javax.validation.constraints.NotNull if
missing, and run tests/lint to ensure no other String-only annotations remain on
non-CharSequence types.

) {
}
Loading