Skip to content

[PM-33889] Innovation Sprint Bitwarden Receive#7383

Draft
harr1424 wants to merge 14 commits intomainfrom
PM-33889-Innovation-sprint-Bitwarden-Receive
Draft

[PM-33889] Innovation Sprint Bitwarden Receive#7383
harr1424 wants to merge 14 commits intomainfrom
PM-33889-Innovation-sprint-Bitwarden-Receive

Conversation

@harr1424
Copy link
Copy Markdown
Contributor

@harr1424 harr1424 commented Apr 2, 2026

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-33889

📔 Objective

Bitwarden Receive

harr1424 and others added 14 commits March 26, 2026 10:11
* introduce new files for changes

* add Receive entity

* add migrations - EF do not add the table

* correct migration files

* remove comments from Receive.sql

* remove MaxUploadCount

* service with test coverage

* address review comments

* remove unused validation method - UserId not nullable

* azure storage service initial impl

* respond to review comments

* update code comment ref Validated default

* auth service with initial dapper repo

* generate repo SPs and add test coverage

* review suggested changes
* introduce new files for changes

* add Receive entity

* add migrations - EF do not add the table

* correct migration files

* remove comments from Receive.sql

* remove MaxUploadCount

* service with test coverage

* address review comments

* remove unused validation method - UserId not nullable

* azure storage service initial impl

* respond to review comments

* update code comment ref Validated default

* auth service with initial dapper repo

* generate repo SPs and add test coverage

* review suggested changes

* fully register services implemented so far for MSSQL/Dapper
* introduce new files for changes

* add Receive entity

* add migrations - EF do not add the table

* correct migration files

* remove comments from Receive.sql

* remove MaxUploadCount

* service with test coverage

* address review comments

* remove unused validation method - UserId not nullable

* azure storage service initial impl

* respond to review comments

* update code comment ref Validated default

* auth service with initial dapper repo

* generate repo SPs and add test coverage

* review suggested changes

* fully register services implemented so far for MSSQL/Dapper

* initial req/resp models and empty controller

* introduce ReceiveFileModel and connect to request response flow

* ExpirationDate not nullable & add public key to file model

---------

Co-authored-by: Alex Dragovich <46065570+itsadrago@users.noreply.github.com>
* Add create endpoint

* Add endpoint for update and add name column

* Fix tests
* [PM-34245] adding receive shared data endpoint

* [PM-34245] fixing encoding issue

* [PM-34245] shared receive response model obtains receive name properly
* endpoints, sync updates, and AI bug-fixes

* fix merge conflict resolution
* [PM-34271] Receives file upload endpoint

* [PM-34271] consistancy in placeholder naming for endpoint

* [PM-34271] fixing injection issue

* [PM-34271] removing length restriction from UserKeyWrappedPrivateKey
* initial implementation of file download

* fix single file logic, support multi-upload

* fix test and add EncapsulatedFileContentEncryptionKey  to file upload flow

* Remove Name from JSON data and update tests
* Add receive owner email to share response

* Fix tests
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud bot commented Apr 2, 2026

@codecov
Copy link
Copy Markdown

codecov bot commented Apr 2, 2026

Codecov Report

❌ Patch coverage is 52.62484% with 370 lines in your changes missing coverage. Please review.
✅ Project coverage is 62.41%. Comparing base (e7f6d64) to head (5d7b898).
⚠️ Report is 66 commits behind head on main.

Files with missing lines Patch % Lines
...ceiveFeatures/Commands/UploadReceiveFileCommand.cs 0.00% 74 Missing ⚠️
...endFeatures/Services/AzureReceiveStorageService.cs 2.66% 73 Missing ⚠️
...ure.Dapper/Tools/Repositories/ReceiveRepository.cs 47.36% 69 Missing and 1 partial ⚠️
src/Api/Tools/Controllers/ReceivesController.cs 58.65% 41 Missing and 2 partials ⚠️
...yFramework/Tools/Repositories/ReceiveRepository.cs 56.52% 20 Missing ⚠️
...rastructure.Dapper/Tools/Helpers/ReceiveHelpers.cs 0.00% 18 Missing ⚠️
...s/ReceiveFeatures/Commands/UpdateReceiveCommand.cs 0.00% 17 Missing ⚠️
...opImplementations/NoopReceiveFileStorageService.cs 0.00% 16 Missing ⚠️
...s/ReceiveFeatures/Commands/CreateReceiveCommand.cs 0.00% 10 Missing ⚠️
src/Notifications/HubHelpers.cs 0.00% 9 Missing ⚠️
... and 7 more
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #7383      +/-   ##
==========================================
+ Coverage   57.84%   62.41%   +4.56%     
==========================================
  Files        2043     2088      +45     
  Lines       89879    91890    +2011     
  Branches     7989     8150     +161     
==========================================
+ Hits        51992    57354    +5362     
+ Misses      36029    32562    -3467     
- Partials     1858     1974     +116     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 2, 2026

Logo
Checkmarx One – Scan Summary & Details30035e5e-e966-4b06-81b3-6c68d7360537


New Issues (121) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 CRITICAL Stored_XSS /src/SharedWeb/Health/HealthCheckServiceExtensions.cs: 61
detailsThe method embeds untrusted data in generated output with WriteAsync, at line 60 of /src/SharedWeb/Health/HealthCheckServiceExtensions.cs. This ...
Attack Vector
2 CRITICAL Stored_XSS /util/Server/Startup.cs: 57
detailsThe method embeds untrusted data in generated output with WriteAsync, at line 59 of /util/Server/Startup.cs. This untrusted data is embedded int...
Attack Vector
3 MEDIUM CSRF /src/Api/Tools/Controllers/ReceivesController.cs: 127
detailsMethod at line 127 of /src/Api/Tools/Controllers/ReceivesController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
4 MEDIUM CSRF /src/Api/Tools/Controllers/ReceivesController.cs: 182
detailsMethod at line 182 of /src/Api/Tools/Controllers/ReceivesController.cs gets a parameter from a user request from request. This parameter value f...
Attack Vector
5 MEDIUM CSRF /src/Api/Tools/Controllers/ReceivesController.cs: 182
detailsMethod at line 182 of /src/Api/Tools/Controllers/ReceivesController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
6 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 145
detailsMethod at line 145 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from request. T...
Attack Vector
7 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 145
detailsMethod at line 145 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from request. T...
Attack Vector
8 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 97
detailsMethod at line 97 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. This...
Attack Vector
9 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 97
detailsMethod at line 97 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. This...
Attack Vector
10 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 229
detailsMethod at line 229 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. Thi...
Attack Vector
11 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1592
detailsMethod at line 1592 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
12 MEDIUM CSRF /src/Api/Tools/Controllers/SendsController.cs: 73
detailsMethod at line 73 of /src/Api/Tools/Controllers/SendsController.cs gets a parameter from a user request from id. This parameter value flows thro...
Attack Vector
13 MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 307
detailsMethod at line 307 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from organizationUser...
Attack Vector
14 MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 307
detailsMethod at line 307 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from model. This par...
Attack Vector
15 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 217
detailsMethod at line 217 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
16 MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 91
detailsMethod at line 91 of /src/Api/Public/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value ...
Attack Vector
17 MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 91
detailsMethod at line 91 of /src/Api/Public/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value ...
Attack Vector
18 MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 91
detailsMethod at line 91 of /src/Api/Public/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value ...
Attack Vector
19 MEDIUM CSRF /src/Api/Public/Controllers/CollectionsController.cs: 91
detailsMethod at line 91 of /src/Api/Public/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value ...
Attack Vector
20 MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 176
detailsMethod at line 176 of /src/Api/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value flows ...
Attack Vector
21 MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 176
detailsMethod at line 176 of /src/Api/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value flows ...
Attack Vector
22 MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 176
detailsMethod at line 176 of /src/Api/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value flows ...
Attack Vector
23 MEDIUM CSRF /src/Api/Controllers/CollectionsController.cs: 176
detailsMethod at line 176 of /src/Api/Controllers/CollectionsController.cs gets a parameter from a user request from model. This parameter value flows ...
Attack Vector
24 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 173
detailsMethod at line 173 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. Thi...
Attack Vector
25 MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 452
detailsMethod at line 452 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow...
Attack Vector
26 MEDIUM CSRF /src/Api/Dirt/Controllers/OrganizationReportsController.cs: 189
detailsMethod at line 189 of /src/Api/Dirt/Controllers/OrganizationReportsController.cs gets a parameter from a user request from request. This paramet...
Attack Vector
27 MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 531
detailsMethod at line 531 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from model. This par...
Attack Vector
28 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 87
detailsMethod at line 87 of /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs gets a parameter from a user request from user. This pa...
Attack Vector
29 MEDIUM CSRF /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs: 107
detailsMethod at line 107 of /src/Api/Billing/Controllers/VNext/OrganizationBillingVNextController.cs gets a parameter from a user request from organiza...
Attack Vector
30 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1451
detailsMethod at line 1451 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
31 MEDIUM CSRF /src/Api/Dirt/Controllers/OrganizationReportsController.cs: 286
detailsMethod at line 286 of /src/Api/Dirt/Controllers/OrganizationReportsController.cs gets a parameter from a user request from request. This paramet...
Attack Vector
32 MEDIUM CSRF /src/Api/Dirt/Controllers/OrganizationReportsController.cs: 233
detailsMethod at line 233 of /src/Api/Dirt/Controllers/OrganizationReportsController.cs gets a parameter from a user request from request. This paramet...
Attack Vector
33 MEDIUM CSRF /src/Api/Dirt/Controllers/OrganizationReportsController.cs: 189
detailsMethod at line 189 of /src/Api/Dirt/Controllers/OrganizationReportsController.cs gets a parameter from a user request from request. This paramet...
Attack Vector
34 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1451
detailsMethod at line 1451 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
35 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1451
detailsMethod at line 1451 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
36 MEDIUM CSRF /src/Api/AdminConsole/Controllers/GroupsController.cs: 289
detailsMethod at line 289 of /src/Api/AdminConsole/Controllers/GroupsController.cs gets a parameter from a user request from orgUserId. This parameter ...
Attack Vector
37 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1419
detailsMethod at line 1419 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
38 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1480
detailsMethod at line 1480 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector

More results are available on the CxOne platform


Fixed Issues (6) Great job! The following issues were fixed in this Pull Request
Severity Issue Source File / Package
MEDIUM CSRF /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 55
MEDIUM CSRF /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 534
MEDIUM CSRF /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 145
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 721
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 385
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 412

@harr1424 harr1424 added the hold Hold this PR or item until later; DO NOT MERGE label Apr 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

hold Hold this PR or item until later; DO NOT MERGE

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants