Skip to content

ci: integrate Bright CI pipeline for security testing and remediation#37

Open
tssbox wants to merge 591 commits intomasterfrom
bright/b24891c3-ab12-4737-9fcd-f8abd6c6800a
Open

ci: integrate Bright CI pipeline for security testing and remediation#37
tssbox wants to merge 591 commits intomasterfrom
bright/b24891c3-ab12-4737-9fcd-f8abd6c6800a

Conversation

@tssbox
Copy link
Copy Markdown

@tssbox tssbox commented Nov 30, 2025

Note

Fixed 1 of 2 vulnerabilities.
Please review the fixes before merging.

Fix Vulnerability Endpoint Affected Files Resolution
[Critical] SQL Injection GET /rest/products/search routes/search.ts Replaced dynamic SQL query with a parameterized query to prevent SQL injection.
[Medium] Unvalidated Redirect GET /ftp/acquisitions.md routes/redirect.ts Attempted fix: Added a check to ensure the URL is not an unintended redirect by using an allowlist before redirecting.
Workflow execution details
  • Repository Analysis: TypeScript, Express
  • Entrypoints Discovery: 161 entrypoints found
  • Attack Vectors Identification
  • E2E Security Tests Generation: 161 test files generated
  • E2E Security Tests Execution: 2 vulnerabilities found
  • Cleanup Irrelevant Test Files: 159 test files removed
  • Applying Security Fixes: 2 fixes generated
  • Workflow Wrap-Up

bkimminich and others added 30 commits September 2, 2025 18:21
[ci skip]
Signed-off-by: Björn Kimminich <[email protected]>
Updating the e2e with it to use the new processQuery syntax (had to be
renamed in the libary as process is a reserved keyword in js and was
causing problems in typescript)

Signed-off-by: Jannik Hollenbach <[email protected]>
Was conflicting with newer angular versions

Signed-off-by: Jannik Hollenbach <[email protected]>
Was still depending on some angular 18 stuff

Signed-off-by: Jannik Hollenbach <[email protected]>
overrides section to mark npm that it is acutally ok

Signed-off-by: Jannik Hollenbach <[email protected]>
…y-chat-bot-0-9-0

Update juicy-chat-bot version to 0.9.0
…ncy-mess-improvements

Update angular related frontend dependencies still forcing us to use legacy-peer-deps
[ci skip]
Signed-off-by: Björn Kimminich <[email protected]>
[ci skip]
Signed-off-by: Björn Kimminich <[email protected]>
… for default values:

- Updated various components and services to use shorthand syntax for variable declarations.
- Removed explicit type annotations for variables initialized with default values
- Added missing OnInit implementations
- Adjusted method signatures to use array types for better clarity in filter settings and difficulty selection.
[ci skip]
Signed-off-by: Björn Kimminich <[email protected]>
[ci skip]
Signed-off-by: Björn Kimminich <[email protected]>
[ci skip]
Signed-off-by: Björn Kimminich <[email protected]>
[ci skip]
Signed-off-by: Björn Kimminich <[email protected]>
[ci skip]
Signed-off-by: Björn Kimminich <[email protected]>
bogminic and others added 19 commits November 14, 2025 06:26
…sues

Adjust mat-card spacing on the basket page for smaller devices
Refactor Last Login IP and Complain pages markup and styles for better semantics
(and assume illegal activity in such
 a case. Resolves juice-shop#2676)
@tssbox tssbox force-pushed the bright/b24891c3-ab12-4737-9fcd-f8abd6c6800a branch 7 times, most recently from 8413d81 to c5bd2f5 Compare November 30, 2025 11:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.