New vulns #2 #11

PavelLinearB · 2024-09-22T15:20:02Z

Description

A clear and concise summary of the change and which issue (if any) it fixes. Should also include relevant motivation and context.

Resolved or fixed issue:

Affirmation

My code follows the CONTRIBUTING.md guidelines

Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md Update README.md

orca-security-us

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0 1 3 1	View in Orca
Failed	Secrets	1 0 1 0	View in Orca
Passed	Vulnerabilities	0 0 0 0	View in Orca

🛡️ The following IaC misconfigurations have been detected

NAME	FILE
Missing User Instruction	...est/smoke/Dockerfile	View in code
Healthcheck Instruction Missing	...est/smoke/Dockerfile	View in code
Image Version Not Explicit	...est/smoke/Dockerfile	View in code
Unpinned Package Version in Apk Add	...est/smoke/Dockerfile	View in code
Apk Add Using Local Cache Path	...est/smoke/Dockerfile	View in code

🔑 The following Secrets have been detected in your pull request across all commits

⚠️ Please take action to mitigate the risk of the identified secrets by revoking them, and if already in use, updating all dependent systems

	NAME	FILE	LINE NUM	COMMIT
	Private Key	lib/insecurity.ts	23	`95169dc`	View in code
	Generic High Entropy Secret	...ata/static/users.yml	150	`95169dc`	View in code

gitstream-cm · 2024-09-22T15:22:33Z

📜 PR Summary 📜

README.md: Added a line with characters and text "123456🙈🤫 Update!" at the end of the file.
users.yml: Added totpSecret and corrected the key for the wurstbrot user.
insecurity.ts: Introduced a hardcoded RSA private key as a constant.
package.json: Added new dependencies download, express-jwt, and finale-rest.
likeProductReviews.ts: Corrected the database query to use the provided id for finding reviews instead of a hardcoded value.
updateProductReviews.ts: Implemented logic for updating product reviews, solving potential challenges with MongoDB operations.
Dockerfile: Specified a base image alpine for the Docker build.

gitstream-cm · 2024-09-22T15:22:44Z

✨ gitStream Review ✨

README.md

Issue: The addition of the line 123456🙈🤫 is inappropriate as it serves no informative purpose.
Suggestion: Remove the line to maintain clarity and professionalism in the documentation.

data/static/users.yml

Security Risk: The addition of a totpSecret in plain text for the wurstbrot user poses a security risk.
Suggestion: Secure sensitive data such as TOTP secrets, and consider storing them in a secure environment configuration or using a secret management tool.

lib/insecurity.ts

Security Risk: The privateKey is hard-coded, which is a significant security vulnerability.
Suggestion: Manage keys through environment variables or a secured configuration service, and ensure they are not committed to version control.

package.json

Best Practices: Ensure that new dependencies (download, express-jwt, finale-rest) are necessary and review their security before including them.
Suggestion: Conduct a security audit on new dependencies and update accordingly if there are known vulnerabilities.

routes/likeProductReviews.ts

Bug: The previous hardcoded value for _id was a clear bug. This has been corrected properly by using the id from req.body.

routes/updateProductReviews.ts

Security Risk: The update operation is susceptible to NoSQL injection due to direct use of req.body.id and req.body.message in queries.
Suggestion: Validate and sanitize inputs to prevent injection attacks and enforce strict schema validation or casting.

test/smoke/Dockerfile

Performance: Minimal improvement with the base image set to alpine, which ensures a lighter, more efficient Docker image.
Suggestion: Ensure other components and dependencies in Dockerfile are also minimal for better performance and lower security risks.

General Improvements

Code Style and Best Practices: Ensure ESLint configurations are followed. In JavaScript/TypeScript code, ensure consistent semicolons use, and check for unsanitized user input.
Version Control Best Practices: Avoid committing sensitive information, keys, secrets, or passwords in publicly accessible repositories.

Overall, handling of sensitive data needs to be improved, and some security and best practices should be enforced more strictly. Verifying the dependencies for vulnerabilities using tools such as Snyk or npm audit is recommended.

lib/insecurity.ts

@@ -20,6 +20,7 @@
 import * as z85 from 'z85'

 export const publicKey = fs ? fs.readFileSync('encryptionkeys/jwt.pub', 'utf8') : 'placeholder-public-key'
+const privateKey = '-----BEGIN RSA PRIVATE KEY-----\r\nMIICXAIBAAKBgQDNwqLEe9wgTXCbC7+RPdDbBbeqjdbs4kOPOIGzqLpXvJXlxxW8iMz0EaM4BKUqYsIa+ndv3NAn2RxCd5ubVdJJcX43zO6Ko0TFEZx/65gY3BE0O6syCEmUP4qbSd6exou/F+WTISzbQ5FBVPVmhnYhG/kpwt/cIxK5iUn5hm+4tQIDAQABAoGBAI+8xiPoOrA+KMnG/T4jJsG6TsHQcDHvJi7o1IKC/hnIXha0atTX5AUkRRce95qSfvKFweXdJXSQ0JMGJyfuXgU6dI0TcseFRfewXAa/ssxAC+iUVR6KUMh1PE2wXLitfeI6JLvVtrBYswm2I7CtY0q8n5AGimHWVXJPLfGV7m0BAkEA+fqFt2LXbLtyg6wZyxMA/cnmt5Nt3U2dAu77MzFJvibANUNHE4HPLZxjGNXN+a6m0K6TD4kDdh5HfUYLWWRBYQJBANK3carmulBwqzcDBjsJ0YrIONBpCAsXxk8idXb8jL9aNIg15Wumm2enqqObahDHB5jnGOLmbasizvSVqypfM9UCQCQl8xIqy+YgURXzXCN+kwUgHinrutZms87Jyi+D8Br8NY0+Nlf+zHvXAomD2W5CsEK7C+8SLBr3k/TsnRWHJuECQHFE9RA2OP8WoaLPuGCyFXaxzICThSRZYluVnWkZtxsBhW2W8z1b8PvWUE7kMy7TnkzeJS2LSnaNHoyxi7IaPQUCQCwWU4U+v4lD7uYBw00Ga/xt+7+UqFPlPVdz1yyr4q24Zxaw0LgmuEvgU5dycq8N7JxjTubX0MIRR+G9fmDBBl8=\r\n-----END RSA PRIVATE KEY-----'


routes/likeProductReviews.ts

@@ -15,7 +15,7 @@
  return (req: Request, res: Response, next: NextFunction) => {
    const id = req.body.id
    const user = security.authenticatedUsers.from(req)
-    db.reviews.findOne({ _id: "a" }).then((review: Review) => {
+    db.reviews.findOne({ _id: id }).then((review: Review) => {


To fix this issue, we need to ensure that the user-provided id is treated as a literal value and not as a query object. This can be achieved by using MongoDB's $eq operator, which ensures that the value is interpreted as a literal. Additionally, we should validate that the id is a string to prevent any potential injection attacks.

routes/updateProductReviews.ts

@@ -13,6 +13,19 @@
 // vuln-code-snippet start noSqlReviewsChallenge forgedReviewChallenge
 module.exports = function productReviews () {
  return (req: Request, res: Response, next: NextFunction) => {
+    const user = security.authenticatedUsers.from(req) // vuln-code-snippet vuln-line forgedReviewChallenge
+    db.reviews.update( // vuln-code-snippet neutral-line forgedReviewChallenge
+      { _id: req.body.id }, // vuln-code-snippet vuln-line noSqlReviewsChallenge forgedReviewChallenge


To fix the problem, we need to ensure that the user input is safely embedded into the query. For MongoDB, we can use the $eq operator to ensure that the user input is treated as a literal value. This prevents any potential NoSQL injection attacks.

Modify the query to use the $eq operator for the _id field.

Ensure that the req.body.id is treated as a literal value and not as a query object.

jit-ci

❌ Jit has detected 10 important findings in this PR that you should review.
The findings are detailed below as separate comments.
It’s highly recommended that you fix these security issues before merge.

Repository Risks:

Database Integration: Connects to a database, often involving sensitive data that must be securely managed.

Repository Context:

graph LR
    GitHub$Repository#linear-b/juice-shop["GitHub Repository<br/>linear-b/juice-shop"]:::GitHub$Repository
    DBIntegration#redis["DBIntegration<br/>redis"]:::DBIntegration
    GitHub$Repository#linear-b/juice-shop -- "Repository uses database" --> DBIntegration#redis

jit-ci · 2024-09-22T15:25:32Z

package.json

    "errorhandler": "^1.5.1",
    "exif": "^0.6.0",
    "express": "^4.17.1",
    "express-ipfilter": "^1.2.0",
+    "express-jwt": "0.1.3",


Security control: Software Component Analysis Js

Type: Verification Bypass In Jsonwebtoken

Description: express-jwt>jsonwebtoken

Severity: CRITICAL

Learn more about this issue

Fix suggestion:

This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.

Suggestion guidelines

Update each outdated library in your code.

Note: Once you apply these changes, you'll need to regenerate the package-lock.json file on your end.

Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.

Suggested change

"express-jwt": "0.1.3",

"express-jwt": "8.4.1",

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "Verification Bypass in jsonwebtoken" in package.json; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

jit-ci · 2024-09-22T15:25:32Z

package.json

@@ -119,17 +119,20 @@
    "cookie-parser": "^1.4.5",
    "cors": "^2.8.5",
    "dottie": "^2.0.2",
+    "download": "^8.0.0",


Security control: Software Component Analysis Js

Type: Got Allows A Redirect To A Unix Socket

Description: download>got

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "Got allows a redirect to a UNIX socket" in package.json; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

jit-ci · 2024-09-22T15:25:33Z

package.json

    "errorhandler": "^1.5.1",
    "exif": "^0.6.0",
    "express": "^4.17.1",
    "express-ipfilter": "^1.2.0",
+    "express-jwt": "0.1.3",


Security control: Software Component Analysis Js

Type: Authorization Bypass In Express-Jwt

Description: express-jwt

Severity: HIGH

Learn more about this issue

Fix suggestion:

This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.

Suggestion guidelines

Update each outdated library in your code.

Note: Once you apply these changes, you'll need to regenerate the package-lock.json file on your end.

Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.

Suggested change

"express-jwt": "0.1.3",

"express-jwt": "8.4.1",

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "Authorization bypass in express-jwt" in package.json; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

jit-ci · 2024-09-22T15:25:33Z

package.json

@@ -119,17 +119,20 @@
    "cookie-parser": "^1.4.5",
    "cors": "^2.8.5",
    "dottie": "^2.0.2",
+    "download": "^8.0.0",


Security control: Software Component Analysis Js

Type: Http-Cache-Semantics Vulnerable To Regular Expression Denial Of Service

Description: Paths from library to vulnerable dependencies:

download>got>cacheable-request>http-cache-semantics

sqlite3>node-gyp>make-fetch-happen>http-cache-semantics

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "http-cache-semantics vulnerable to Regular Expression Denial of Service" in package.json; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

jit-ci · 2024-09-22T15:25:33Z

package.json

    "errorhandler": "^1.5.1",
    "exif": "^0.6.0",
    "express": "^4.17.1",
    "express-ipfilter": "^1.2.0",
+    "express-jwt": "0.1.3",


Security control: Software Component Analysis Js

Type: Regular Expression Denial Of Service In Moment

Description: Paths from library to vulnerable dependencies:

express-jwt>jsonwebtoken>moment

file-stream-rotator>moment

filesniffer>filehound>moment

finale-rest>moment

sequelize>moment-timezone>moment

Severity: HIGH

Learn more about this issue

Fix suggestion:

This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.

Suggestion guidelines

Update each outdated library in your code.

Note: Once you apply these changes, you'll need to regenerate the package-lock.json file on your end.

Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.

Suggested change

"express-jwt": "0.1.3",

"express-jwt": "8.4.1",

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "Regular Expression Denial of Service in moment" in package.json; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

jit-ci · 2024-09-22T15:25:33Z

package.json

    "errorhandler": "^1.5.1",
    "exif": "^0.6.0",
    "express": "^4.17.1",
    "express-ipfilter": "^1.2.0",
+    "express-jwt": "0.1.3",


Security control: Software Component Analysis Js

Type: Forgeable Public/Private Tokens In Jws

Description: express-jwt>jsonwebtoken>jws

Severity: HIGH

Learn more about this issue

Fix suggestion:

This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.

Suggestion guidelines

Update each outdated library in your code.

Note: Once you apply these changes, you'll need to regenerate the package-lock.json file on your end.

Ensure to thoroughly test your application after updating each library, to make sure that the update hasn't broken anything.
If an update does cause issues, consider whether you can modify your code to work with the updated library, or if necessary, look for an alternative library that is maintained and up to date.

Suggested change

"express-jwt": "0.1.3",

"express-jwt": "8.4.1",

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "Forgeable Public/Private Tokens in jws" in package.json; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

jit-ci · 2024-09-22T15:25:33Z

routes/likeProductReviews.ts

@@ -15,7 +15,7 @@
  return (req: Request, res: Response, next: NextFunction) => {
    const id = req.body.id
    const user = security.authenticatedUsers.from(req)
-    db.reviews.findOne({ _id: "a" }).then((review: Review) => {
+    db.reviews.findOne({ _id: id }).then((review: Review) => {


Security control: Static Code Analysis Js

Type: Codsec.Javascriptnosql-Injection.Nosql-Injection

Description: Putting request data into a mongo query can leadto a NoSQL Injection. Be sure to properly sanitize thedata if you absolutely must pass request data into a query.

Severity: HIGH

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "codsec.javascriptnosql-injection.nosql-injection" in routes/likeProductReviews.ts; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

jit-ci · 2024-09-22T15:25:33Z

routes/updateProductReviews.ts

+      { _id: req.body.id }, // vuln-code-snippet vuln-line noSqlReviewsChallenge forgedReviewChallenge
+      { $set: { message: req.body.message } },
+      { multi: true } // vuln-code-snippet vuln-line noSqlReviewsChallenge
+    ).then(


Security control: Static Code Analysis Js

Type: Codsec.Javascriptnosql-Injection.Nosql-Injection

Description: Putting request data into a mongo query can leadto a NoSQL Injection. Be sure to properly sanitize thedata if you absolutely must pass request data into a query.

Severity: HIGH

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "codsec.javascriptnosql-injection.nosql-injection" in routes/updateProductReviews.ts; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

jit-ci · 2024-09-22T15:25:33Z

lib/insecurity.ts

@@ -20,6 +20,7 @@
 import * as z85 from 'z85'

 export const publicKey = fs ? fs.readFileSync('encryptionkeys/jwt.pub', 'utf8') : 'placeholder-public-key'
+const privateKey = '-----BEGIN RSA PRIVATE KEY-----\r\nMIICXAIBAAKBgQDNwqLEe9wgTXCbC7+RPdDbBbeqjdbs4kOPOIGzqLpXvJXlxxW8iMz0EaM4BKUqYsIa+ndv3NAn2RxCd5ubVdJJcX43zO6Ko0TFEZx/65gY3BE0O6syCEmUP4qbSd6exou/F+WTISzbQ5FBVPVmhnYhG/kpwt/cIxK5iUn5hm+4tQIDAQABAoGBAI+8xiPoOrA+KMnG/T4jJsG6TsHQcDHvJi7o1IKC/hnIXha0atTX5AUkRRce95qSfvKFweXdJXSQ0JMGJyfuXgU6dI0TcseFRfewXAa/ssxAC+iUVR6KUMh1PE2wXLitfeI6JLvVtrBYswm2I7CtY0q8n5AGimHWVXJPLfGV7m0BAkEA+fqFt2LXbLtyg6wZyxMA/cnmt5Nt3U2dAu77MzFJvibANUNHE4HPLZxjGNXN+a6m0K6TD4kDdh5HfUYLWWRBYQJBANK3carmulBwqzcDBjsJ0YrIONBpCAsXxk8idXb8jL9aNIg15Wumm2enqqObahDHB5jnGOLmbasizvSVqypfM9UCQCQl8xIqy+YgURXzXCN+kwUgHinrutZms87Jyi+D8Br8NY0+Nlf+zHvXAomD2W5CsEK7C+8SLBr3k/TsnRWHJuECQHFE9RA2OP8WoaLPuGCyFXaxzICThSRZYluVnWkZtxsBhW2W8z1b8PvWUE7kMy7TnkzeJS2LSnaNHoyxi7IaPQUCQCwWU4U+v4lD7uYBw00Ga/xt+7+UqFPlPVdz1yyr4q24Zxaw0LgmuEvgU5dycq8N7JxjTubX0MIRR+G9fmDBBl8=\r\n-----END RSA PRIVATE KEY-----'


Security control: Secret Detection

Type: Private-Key

Description: Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Severity: HIGH

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "private-key" in lib/insecurity.ts; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

jit-ci · 2024-09-22T15:25:33Z

test/smoke/Dockerfile

@@ -1,3 +1,4 @@
+FROM alpine


Security control: Docker Scan

Type: Image User Should Not Be 'Root'

Description: Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

Severity: HIGH

Learn more about this issue

Fix suggestion:

This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.

Suggestion guidelines

First of all, check if your container is running as a root user. In most of the cases, you can do it by running a command like this: docker run <image> whoami. If it returns root, then you should consider using a non-root user, by following one of the next steps:

If a non-root user already exists in your container, consider using it.

If not, you can create a new user by adding a USER command to the Dockerfile, with a non-root user as argument, for example: USER <non-root-user-name>.

Suggested change

FROM alpine

FROM alpine

RUN addgroup --system <group>

RUN adduser --system <user> --ingroup <group>

USER <user>:<group>

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "Image user should not be 'root'" in test/smoke/Dockerfile; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

PavelLinearB and others added 4 commits June 6, 2023 13:51

vulnerabilities

95169dc

Update README.md

04efc67

Update README.md

169dd50

orca-security-us bot reviewed Sep 22, 2024

View reviewed changes

gitstream-cm bot added the 1 min review label Sep 22, 2024

PavelLinearB force-pushed the master branch from 05b7b5a to 95de275 Compare September 22, 2024 15:23

github-advanced-security bot found potential problems Sep 22, 2024

View reviewed changes

PavelLinearB closed this Sep 22, 2024

jit-ci bot reviewed Sep 22, 2024

View reviewed changes

@@ -16,4 +16,8 @@
                 const id = req.body.id
+                if (typeof id !== 'string') {
+                  res.status(400).json({ error: 'Invalid ID format' })
+                  return
+                }
                 const user = security.authenticatedUsers.from(req)
-                db.reviews.findOne({ _id: id }).then((review: Review) => {
+                db.reviews.findOne({ _id: { $eq: id } }).then((review: Review) => {
                   if (!review) {
@@ -24,3 +28,3 @@
                       db.reviews.update(
-                        { _id: id },
+                        { _id: { $eq: id } },
                         { $inc: { likesCount: 1 } }
@@ -41,3 +45,3 @@
                               db.reviews.update(
-                                { _id: id },
+                                { _id: { $eq: id } },
                                 { $set: { likedBy: likedBy } }

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

New vulns #2 #11

New vulns #2 #11

PavelLinearB commented Sep 22, 2024

orca-security-us bot left a comment

gitstream-cm bot commented Sep 22, 2024

gitstream-cm bot commented Sep 22, 2024

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

jit-ci bot left a comment

jit-ci bot Sep 22, 2024

jit-ci bot Sep 22, 2024

jit-ci bot Sep 22, 2024

jit-ci bot Sep 22, 2024

jit-ci bot Sep 22, 2024

jit-ci bot Sep 22, 2024

jit-ci bot Sep 22, 2024

jit-ci bot Sep 22, 2024

jit-ci bot Sep 22, 2024

jit-ci bot Sep 22, 2024

-FROM alpine
+FROM alpine
+RUN addgroup --system <group>
+RUN adduser --system <user> --ingroup <group>
+USER <user>:<group>

New vulns #2 #11

New vulns #2 #11

Conversation

PavelLinearB commented Sep 22, 2024

Description

Affirmation

orca-security-us bot left a comment

Choose a reason for hiding this comment

Orca Security Scan Summary

gitstream-cm bot commented Sep 22, 2024

📜 PR Summary 📜

gitstream-cm bot commented Sep 22, 2024

✨ gitStream Review ✨

README.md

data/static/users.yml

lib/insecurity.ts

package.json

routes/likeProductReviews.ts

routes/updateProductReviews.ts

test/smoke/Dockerfile

General Improvements

jit-ci bot left a comment

Choose a reason for hiding this comment

jit-ci bot Sep 22, 2024

Choose a reason for hiding this comment

jit-ci bot Sep 22, 2024

Choose a reason for hiding this comment

jit-ci bot Sep 22, 2024

Choose a reason for hiding this comment

jit-ci bot Sep 22, 2024

Choose a reason for hiding this comment

jit-ci bot Sep 22, 2024

Choose a reason for hiding this comment

jit-ci bot Sep 22, 2024

Choose a reason for hiding this comment

jit-ci bot Sep 22, 2024

Choose a reason for hiding this comment

jit-ci bot Sep 22, 2024

Choose a reason for hiding this comment

jit-ci bot Sep 22, 2024

Choose a reason for hiding this comment

jit-ci bot Sep 22, 2024

Choose a reason for hiding this comment