DependencyTrack / DependencyTrack/dependency-track

Allow (or document if I missed something) running of DT with minimal database privileges

Open
#2,377 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Looking through the documentation of the database connection settings and the information in [this old comment](https://github.com/DependencyTrack/dependency-track/issues/207#issuecomment-427377083) it appears to me that DT must be run with a highly privileged database user in order to execute DDL statements against the database for creating (and modifying) the database schema.

### Proposed Behavior

I expect DT to allow for running DDL statements with a separate privileged user on startup (alternatively provide a way to manually apply the schema outside of application lifecycle) then use a less priviledged user for regular operations.

As to why, this would be to adhere to OWASP recommendations for database access

> * Only grant the required permissions on the databases.
> * Most applications would only need SELECT, UPDATE and DELETE permissions.
> * The account should not be the owner of the database as this can lead to privilege escalation vulnerabilities.

Source: https://cheatsheetseries.owasp.org/cheatsheets/Database_Security_Cheat_Sheet.html#permissions

> Accounts with db_owner equivalent privileges such as schema modification or unlimited data access typically have far more access to the database than is required to implement application functionality. Web applications should use one or more lesser-privileged accounts that are prevented from making schema changes or sweeping changes to or requests for data.

Source: https://owasp.org/www-community/Access_Control

As an example of how this could look, in the Spring Boot + Liquibase ecosystem there are config parameters for an extra, single thread, thread pool exclusively for running migrations (with fallback to the primary connection pool details if not configured) e.g. https://gitlab.com/sharebear/spring-postgresql-hardening/-/blob/main/jdbcplayground/src/main/resources/application-v3.yaml

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.