Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create JavaScript file #12

Open
wants to merge 17 commits into
base: master
Choose a base branch
from
Open

Create JavaScript file #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
e69f216
Separate javascript file
moulongzhang Jan 23, 2025
2a84d9b
Add few vulnerabilities
moulongzhang Jan 23, 2025
d6e2449
Modify codeQL
moulongzhang Jan 23, 2025
227873b
Add eslint
moulongzhang Jan 23, 2025
da61828
Merge branch 'master' into feature/separate_DOM
moulongzhang Jan 23, 2025
4293496
Update eslint.yml
moulongzhang Jan 23, 2025
94cc7ab
Update eslint.yml
moulongzhang Jan 23, 2025
340cba0
Add few linter errors
moulongzhang Jan 23, 2025
72e30ad
Merge branch 'feature/separate_DOM' of github.com:moulongzhang/moulon…
moulongzhang Jan 23, 2025
673b364
Remove unsupported error
moulongzhang Jan 23, 2025
00ffc82
Modify workflow
moulongzhang Jan 23, 2025
1c372d8
Rollback moment version
moulongzhang Jan 23, 2025
185e8ef
Add codeql files to gitignore
moulongzhang Jan 23, 2025
65410f1
Merge branch 'master' into feature/separate_DOM
moulongzhang Jan 23, 2025
0b9a9ef
Adding access to Clear text storage of sensitive information
moulongzhang Jan 24, 2025
47fb856
Modify title
moulongzhang Jan 24, 2025
a61337b
Modify text message
moulongzhang Jan 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 0 additions & 9 deletions .github/codeql-config.yml
View file
Open in desktop

This file was deleted.

38 changes: 0 additions & 38 deletions .github/workflows/codeql-analysis.yml
View file
Open in desktop

This file was deleted.

7 changes: 4 additions & 3 deletions .github/workflows/eslint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,8 +32,10 @@ jobs:

- name: Install ESLint
run: |
npm install eslint@8.10.0
npm install eslint@9.18.0
npm install @microsoft/[email protected]
npm install @eslint/[email protected]
npm install [email protected]

- name: Run ESLint
env:
Expand All @@ -43,8 +45,7 @@ jobs:
echo "Environment variables:"
echo "ESLINT_USE_FLAT_CONFIG: $ESLINT_USE_FLAT_CONFIG"
npx eslint . \
--config eslint.config.mjs \
--ext .js,.jsx,.ts,.tsx \
--config ./eslint.config.mjs \
--format @microsoft/eslint-formatter-sarif \
--output-file eslint-results.sarif
continue-on-error: true
Expand Down
22 changes: 22 additions & 0 deletions eslint.config.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
import globals from "globals";
import pluginJs from "@eslint/js";

/** @type {import('eslint').Linter.Config[]} */
export default [
{
languageOptions: {
globals: globals.browser,
parserOptions: {
ecmaVersion: 'latest',
}
},
rules: {
'semi': ['error', 'always'],
'no-unused-vars': 'warn',
'eqeqeq': 'error',
'space-before-function-paren': ['error', 'always'],
'space-infix-ops': 'error'
}
},
pluginJs.configs.recommended,
];
38 changes: 12 additions & 26 deletions index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,38 +4,24 @@
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Dependabot, CodeQL, and Secret Scanning Demo </title>

<!-- 外部ライブラリの参照 -->
<script src="https://code.jquery.com/jquery-3.5.0.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/lodash.js/4.17.15/lodash.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.24.0/moment.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.29.4/moment.min.js"></script>

Check warning

Code scanning / CodeQL

Inclusion of functionality from an untrusted source Medium

Script loaded from content delivery network with no integrity check.
<script src="https://cdnjs.cloudflare.com/ajax/libs/lodash.js/4.17.21/lodash.min.js"></script>

Check warning

Code scanning / CodeQL

Inclusion of functionality from an untrusted source Medium

Script loaded from content delivery network with no integrity check.
<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js"></script>

Check warning

Code scanning / CodeQL

Inclusion of functionality from an untrusted source Medium

Script loaded from content delivery network with no integrity check.
<script src="https://cdnjs.cloudflare.com/ajax/libs/axios/1.6.2/axios.min.js"></script>

Check warning

Code scanning / CodeQL

Inclusion of functionality from an untrusted source Medium

Script loaded from content delivery network with no integrity check.
</head>
<body>
<h1>Dependabot, CodeQL, and Secret Scanning Demo</h1>
<h1>GitHub Advanced Security Demo</h1>
<p id="demo"></p>
<input type="text" id="userInput" placeholder="Enter your name">
<button onclick="greetUser()">Greet</button>
<button id="greetButton">Greeting</button>
<div id="greeting"></div>
<div>
<input type="text" id="usernameInput" placeholder="Enter your username">
<input type="password" id="passwordInput" placeholder="Enter your password">
<button id="savePasswordButton">Save Password</button>
</div>

<script>
$(document).ready(function() {
var now = moment().format('MMMM Do YYYY, h:mm:ss a');
$('#demo').text('Current time: ' + now);
});

// XSS脆弱性 - ユーザー入力を直接DOMに挿入
function greetUser() {
var name = document.getElementById('userInput').value;
document.getElementById('greeting').innerHTML = 'Hello, ' + name + '!';
}

// パスワードを平文で保存
function savePassword(username, password) {
localStorage.setItem(username, password);
}
<script src="logic.js" type="module"></script>

// デモ用のシークレット一覧
const PLACEHOLDER_GITHUB_TOKEN = "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";
</script>
</body>
</html>
85 changes: 85 additions & 0 deletions logic.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,85 @@
const moment = window.moment;
const _ = window._;
const $ = window.jQuery;
const axios = window.axios;

$(document).ready(function () {
var now = moment().format('MMMM Do YYYY, h:mm:ss a');
$('#demo').text('Current time: ' + now);
$('#greetButton').on('click', greetUser);
$('#savePasswordButton').on('click', function() {

Check failure

Code scanning / ESLint

Enforce consistent spacing before `function` definition opening parenthesis Error

Missing space before function parentheses.
var username = $('#usernameInput').val();
var password = $('#passwordInput').val();
savePassword(username, password);
});
});

export function greetUser () {

Check warning

Code scanning / CodeQL

DOM text reinterpreted as HTML Medium

DOM text
Loading
is reinterpreted as HTML without escaping meta-characters.

Copilot Autofix AI about 1 month ago

To fix this issue, we need to ensure that the user input is properly escaped before being inserted into the DOM. Instead of using innerHTML, we should use textContent to avoid interpreting the input as HTML. This will ensure that any HTML characters in the user input are treated as text and not as HTML.

  • Replace the use of innerHTML with textContent for setting the greeting message.
  • This change should be made on line 22 of the provided code.
Suggested changeset 1
logic.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/logic.js b/logic.js
--- a/logic.js
+++ b/logic.js
@@ -21,3 +21,3 @@
     }
-    document.getElementById('greeting').innerHTML = 'Hello, ' + name + '!';
+    document.getElementById('greeting').textContent = 'Hello, ' + name + '!';
 }
EOF
@@ -21,3 +21,3 @@
}
document.getElementById('greeting').innerHTML = 'Hello, ' + name + '!';
document.getElementById('greeting').textContent = 'Hello, ' + name + '!';
}
Copilot is powered by AI and may make mistakes. Always verify output.
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
var name = document.getElementById('userInput').value;
if (name == "") {

Check failure

Code scanning / ESLint

Require the use of `===` and `!==` Error

Expected '===' and instead saw '=='.

Copilot Autofix AI about 1 month ago

Beta Copilot Autofix for ESLint

To fix the problem, we need to replace the == operator with the === operator on line 19. This ensures that the comparison checks both the value and the type, preventing any unintended type coercion.

  • Locate the comparison on line 19 in the greetUser function.
  • Replace == with ===.

No additional methods, imports, or definitions are needed to implement this change.

Suggested changeset 1
logic.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/logic.js b/logic.js
--- a/logic.js
+++ b/logic.js
@@ -18,3 +18,3 @@
     var name = document.getElementById('userInput').value;
-    if (name == "") {
+    if (name === "") {
         name = "guest";
EOF
@@ -18,3 +18,3 @@
var name = document.getElementById('userInput').value;
if (name == "") {
if (name === "") {
name = "guest";
Copilot is powered by AI and may make mistakes. Always verify output.
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
name = "guest";
}
document.getElementById('greeting').innerHTML = 'Hello, ' + name + '!';

Check failure

Code scanning / CodeQL

Clear text storage of sensitive information High

This stores sensitive data returned by
an access to password
Loading
as clear text.

Copilot Autofix AI about 1 month ago

To fix the problem, we need to ensure that the password is encrypted before being stored in localStorage. We can use the Node.js crypto module to encrypt the password. This will involve creating an encryption function and using it to encrypt the password before storing it. Additionally, we should avoid displaying the password in clear text in the DOM.

Suggested changeset 1
logic.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/logic.js b/logic.js
--- a/logic.js
+++ b/logic.js
@@ -4,2 +4,3 @@
 const axios = window.axios;
+const crypto = window.crypto || require('crypto');
 
@@ -26,4 +27,5 @@
     if (_.isEmpty(username) || _.isEmpty(password)) return;
-    localStorage.setItem(username, password);
-    $('#demo').text('Username: ' + username + ', Password: ' + password);
+    const encryptedPassword = encrypt(password);
+    localStorage.setItem(username, encryptedPassword);
+    $('#demo').text('Username: ' + username + ', Password: [encrypted]');
 }
@@ -33,2 +35,7 @@
 }
+
+function encrypt(text) {
+    const cipher = crypto.createCipher('aes-256-ctr', 'password');
+    return cipher.update(text, 'utf8', 'hex') + cipher.final('hex');
+}
 
EOF
@@ -4,2 +4,3 @@
const axios = window.axios;
const crypto = window.crypto || require('crypto');

@@ -26,4 +27,5 @@
if (_.isEmpty(username) || _.isEmpty(password)) return;
localStorage.setItem(username, password);
$('#demo').text('Username: ' + username + ', Password: ' + password);
const encryptedPassword = encrypt(password);
localStorage.setItem(username, encryptedPassword);
$('#demo').text('Username: ' + username + ', Password: [encrypted]');
}
@@ -33,2 +35,7 @@
}

function encrypt(text) {
const cipher = crypto.createCipher('aes-256-ctr', 'password');
return cipher.update(text, 'utf8', 'hex') + cipher.final('hex');
}

Copilot is powered by AI and may make mistakes. Always verify output.
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
}

export function savePassword (username, password) {
if (_.isEmpty(username) || _.isEmpty(password)) return;
localStorage.setItem(username, password);
$('#demo').text('Username: ' + username + ', Password: ' + password);
}

export function processData (data){

Check failure

Code scanning / CodeQL

Hard-coded credentials Critical

The hard-coded value "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" is used as
authorization header
Loading
.
return data + 1;
}

// GitHubのシークレット
const PLACEHOLDER_GITHUB_TOKEN = "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";
async function fetchGitHubUserData (username) {
const config = {
headers: {
'Authorization': `token ${PLACEHOLDER_GITHUB_TOKEN}`
}
};

try {
const response = await axios.get(`https://api.github.com/users/${username}`, config);
return response.data;
} catch (error) {
console.error('Error fetching GitHub user data:', error);
return null;
}
}

// Example usage
fetchGitHubUserData('octocat').then(data => {
if (data) {
console.log('GitHub User Data:', data);
} else {
console.log('Failed to fetch GitHub user data.');
}
});


// SQL Injection
export async function queryUserData (userId) {
const query = `SELECT * FROM users WHERE id = ${userId}`;
try {
const response = await axios.post('/api/query', { sql: query });
return response.data;
} catch (error) {
console.error('Query error:', error);
return null;
}
}

// Prototype pollution
export function mergeObjects (target, source) {
for (let key in source) {
if (typeof source[key] === 'object') {
target[key] = mergeObjects(target[key], source[key]);
} else {
target[key] = source[key];
}
}
return target;
}
17 changes: 12 additions & 5 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,21 @@
"description": "A demo for CodeQL and Dependabot",
"main": "index.js",
"scripts": {
"start": "http-server"
"start": "http-server"
},
"dependencies": {
"jquery": "3.5.0",
"lodash": "4.17.15",
"moment": "2.30.1"
"moment": "2.24.0"
},
"devDependencies": {
"http-server": "^0.12.3"
}
}
"@eslint/js": "^9.18.0",
"eslint": "^9.18.0",
"eslint-plugin-html": "^8.1.2",
"globals": "^15.14.0",
"http-server": "^0.12.3"
},
"keywords": [],
"author": "",
"license": "ISC"
}
Loading