Fix CodeQL security vulnerabilities in CORS, JWT, logging, and GitHub Actions (#53)

* Initial plan

* Fix critical security issues in CORS and JWT configuration

Co-authored-by: PhantomDave <34485699+PhantomDave@users.noreply.github.com>

* Fix potential token exposure in GitHub Actions workflow

Co-authored-by: PhantomDave <34485699+PhantomDave@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: PhantomDave <34485699+PhantomDave@users.noreply.github.com>

Author: Copilot

.github/workflows/deploy-tailscale.yml

@@ -120,8 +120,8 @@ jobs:
 
       - name: Log in to GitHub Container Registry
         run: |
-          tailscale ssh "${{ steps.ssh.outputs.target }}" \
-            "echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin"
+          echo "${{ secrets.GITHUB_TOKEN }}" | tailscale ssh "${{ steps.ssh.outputs.target }}" \
+            "docker login ghcr.io -u ${{ github.actor }} --password-stdin"
 
       - name: Clean up old Docker images
         run: |

PhantomDave.BankTracking.Api/Program.cs

@@ -58,7 +58,9 @@ public static void Main(string[] args)
             })
             .AddJwtBearer(options =>
             {
-                options.RequireHttpsMetadata = false; // enable HTTPS in production
+                // WARNING: RequireHttpsMetadata should be true in production environments
+                // Set to false only for local development
+                options.RequireHttpsMetadata = builder.Environment.IsDevelopment() == false;
                 options.SaveToken = true;
                 options.TokenValidationParameters = new TokenValidationParameters
                 {
@@ -79,7 +81,7 @@ public static void Main(string[] args)
         {
             options.AddDefaultPolicy(policy =>
                 policy
-                    .WithOrigins("http://localhost:4200", "http://localhost:5095/graphql", "*")
+                    .WithOrigins("http://localhost:4200", "http://localhost:5095")
                     .AllowAnyHeader()
                     .AllowAnyMethod()
                     .AllowCredentials());

PhantomDave.BankTracking.Api/Services/FileImportService.cs

@@ -2,6 +2,7 @@
 using System.Text;
 using CsvHelper;
 using CsvHelper.Configuration;
+using Microsoft.Extensions.Logging;
 using OfficeOpenXml;
 using PhantomDave.BankTracking.Api.Types.ObjectTypes;
 using PhantomDave.BankTracking.Library.Models;
@@ -24,8 +25,10 @@ public class ParsedFileData
     public FileType FileTypeExt { get; set; } = FileType.Xlsx;
     public int HeaderRowIndex { get; set; } = 1;
 }
-public class FileImportService
+public class FileImportService(ILogger<FileImportService> logger)
 {
+    private readonly ILogger<FileImportService> _logger = logger;
+
     public async Task<ParsedFileData> ParseFileAsync(IFile file)
     {
         await using var reader = file.OpenReadStream();
@@ -239,8 +242,9 @@ private static Encoding DetectEncoding(Stream stream)
             Encoding.UTF8.GetString(buffer, 0, bytesRead);
             return Encoding.UTF8;
         }
-        catch
+        catch (DecoderFallbackException)
         {
+            // If UTF-8 decoding fails, fall back to ISO-8859-1
             return Encoding.GetEncoding("ISO-8859-1");
         }
     }
@@ -283,11 +287,13 @@ public IEnumerable<FinanceRecord> FromParsedData(int accountId, ParsedFileData p
 
                 records.Add(record);
             }
-            catch
+            catch (Exception ex)
             {
                 failedCount++;
+                _logger.LogWarning(ex, "Failed to parse row {RowIndex} during import", records.Count + failedCount);
             }
-            Console.WriteLine($"Processed {records.Count + failedCount} / {parsedData.Rows.Count}, Failed: {failedCount}");
+            _logger.LogDebug("Processed {ProcessedRows} / {TotalRows}, Failed: {FailedRows}", 
+                records.Count + failedCount, parsedData.Rows.Count, failedCount);
         }
 
         return records;