Add semgrep, detect-secrets, and boilerplate code

catawiki · Sep 27, 2024 · ba85f6e · ba85f6e
1 parent 8a2e76e
commit ba85f6e
Show file tree

Hide file tree

Showing 7 changed files with 316 additions and 40 deletions.
diff --git a/.github/workflows/detect-secrets.yml b/.github/workflows/detect-secrets.yml
@@ -0,0 +1,27 @@
+name: Detect Secrets Scan
+
+on:
+  workflow_dispatch:
+  pull_request:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  detect-secrets:
+    name: Detect Secrets Scan
+    runs-on: ubuntu-latest
+    container:
+      image: python:latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+      - name: Change Owner of Container Working Directory
+        run: chown root:root .
+      - name: Install detect-secrets
+        run: pip install detect-secrets
+      - name: Run detect-secrets-hook
+        shell: bash
+        run: |
+          git ls-files -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline *
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
@@ -0,0 +1,41 @@
+name: Semgrep scan
+
+on:
+  workflow_dispatch:
+  pull_request:
+env:
+  configs: "rules/ p/ci p/security-audit p/owasp-top-ten"
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  semgrep:
+    name: Run Semgrep
+    runs-on: ubuntu-latest
+    container:
+      image: returntocorp/semgrep:1.86
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Fetch the entire history
+      - name: Mark the Git repository as safe
+        run: |
+          git config --global --add safe.directory $GITHUB_WORKSPACE
+      - name: Fetch all branches and tags
+        run: |
+          git fetch --all
+          git fetch --tags
+      - name: run semgrep
+        id: run_semgrep
+        env:
+          SEMGREP_RULES: ${{ env.configs }}
+          SEMGREP_ENABLE_VERSION_CHECK: 0
+          SEMGREP_SEND_METRICS: off
+        shell: bash
+        run: |
+          semgrep scan . --error --gitlab-sast -o /tmp/semgrep.json
+      - name: Show Semgrep report
+        if: success() || failure()
+        run: cat /tmp/semgrep.json 
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -0,0 +1,24 @@
+repos:
+  - repo: https://github.com/semgrep/semgrep
+    rev: '768d0f4c3ccb4b1740eef22bbbd57fc936450df2'  # frozen: v1.84.1
+    hooks:
+      - id: semgrep
+        args:
+          - --config
+          - rules/
+          - --error
+          - --skip-unknown-extensions
+          - --metrics
+          - 'off'
+        stages:
+          - pre-push
+  - repo: https://github.com/Yelp/detect-secrets
+    rev: '68e8b45440415753fff70a312ece8da92ba85b4a'  # frozen: v1.5.0
+    hooks:
+      - id: detect-secrets
+        args:
+          - --baseline
+          - .secrets.baseline
+        stages:
+          - pre-commit
+        exclude: package-lock.json
diff --git a/.secrets.baseline b/.secrets.baseline
@@ -0,0 +1,133 @@
+{
+  "version": "1.5.0",
+  "plugins_used": [
+    {
+      "name": "ArtifactoryDetector"
+    },
+    {
+      "name": "AWSKeyDetector"
+    },
+    {
+      "name": "AzureStorageKeyDetector"
+    },
+    {
+      "name": "Base64HighEntropyString",
+      "limit": 4.5
+    },
+    {
+      "name": "BasicAuthDetector"
+    },
+    {
+      "name": "CloudantDetector"
+    },
+    {
+      "name": "DiscordBotTokenDetector"
+    },
+    {
+      "name": "GitHubTokenDetector"
+    },
+    {
+      "name": "HexHighEntropyString",
+      "limit": 3.0
+    },
+    {
+      "name": "IbmCloudIamDetector"
+    },
+    {
+      "name": "IbmCosHmacDetector"
+    },
+    {
+      "name": "JwtTokenDetector"
+    },
+    {
+      "name": "KeywordDetector",
+      "keyword_exclude": ""
+    },
+    {
+      "name": "MailchimpDetector"
+    },
+    {
+      "name": "NpmDetector"
+    },
+    {
+      "name": "PrivateKeyDetector"
+    },
+    {
+      "name": "SendGridDetector"
+    },
+    {
+      "name": "SlackDetector"
+    },
+    {
+      "name": "SoftlayerDetector"
+    },
+    {
+      "name": "SquareOAuthDetector"
+    },
+    {
+      "name": "StripeDetector"
+    },
+    {
+      "name": "TwilioKeyDetector"
+    }
+  ],
+  "filters_used": [
+    {
+      "path": "detect_secrets.filters.allowlist.is_line_allowlisted"
+    },
+    {
+      "path": "detect_secrets.filters.common.is_baseline_file",
+      "filename": ".secrets.baseline"
+    },
+    {
+      "path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
+      "min_level": 2
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_indirect_reference"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_likely_id_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_lock_file"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_potential_uuid"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_sequential_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_swagger_file"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_templated_secret"
+    }
+  ],
+  "results": {
+    ".pre-commit-config.yaml": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": ".pre-commit-config.yaml",
+        "hashed_secret": "23414c22063b86dd91d7570689f2da10d72ec4f8",
+        "is_verified": false,
+        "line_number": 3
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": ".pre-commit-config.yaml",
+        "hashed_secret": "86242b7a7b67c1fd83514757a6b319602d648e94",
+        "is_verified": false,
+        "line_number": 16
+      }
+    ]
+  },
+  "generated_at": "2024-09-23T17:27:01Z"
+}
diff --git a/pages/comments.js b/pages/comments.js
@@ -0,0 +1,52 @@
+// pages/comments.js
+
+import { useState, useEffect } from 'react';
+
+export default function Comments() {
+  const [comments, setComments] = useState([]);
+  const [newComment, setNewComment] = useState('');
+
+  useEffect(() => {
+    // Load comments from local storage when the component mounts
+    const savedComments = JSON.parse(localStorage.getItem('comments')) || [];
+    setComments(savedComments);
+  }, []);
+
+  const handleAddComment = () => {
+    if (newComment.trim() === '') return;
+
+    const updatedComments = [...comments, newComment];
+    setComments(updatedComments);
+    setNewComment('');
+    localStorage.setItem('comments', JSON.stringify(updatedComments));
+  };
+
+  const handleRemoveComment = (index) => {
+    const updatedComments = comments.filter((_, i) => i !== index);
+    setComments(updatedComments);
+    localStorage.setItem('comments', JSON.stringify(updatedComments));
+  };
+
+  return (
+    <div>
+      <h1>Comments</h1>
+      <div>
+        <input
+          type="text"
+          value={newComment}
+          onChange={(e) => setNewComment(e.target.value)}
+          placeholder="Add a comment"
+        />
+        <button onClick={handleAddComment}>Submit</button>
+      </div>
+      <ul>
+        {comments.map((comment, index) => (
+          <li key={index}>
+            {comment}
+            <button onClick={() => handleRemoveComment(index)}>Remove</button>
+          </li>
+        ))}
+      </ul>
+    </div>
+  );
+}
diff --git a/pages/index.js b/pages/index.js
@@ -1,7 +1,18 @@
 import Head from 'next/head';
+import Link from 'next/link';
+import { useState, useEffect } from 'react';
+
 import styles from '../styles/Home.module.css';
 
 export default function Home() {
+  const [comments, setComments] = useState([]);
+
+  useEffect(() => {
+    // Load comments from local storage when the component mounts
+    const savedComments = JSON.parse(localStorage.getItem('comments')) || [];
+    setComments(savedComments);
+  }, []);
+
   return (
     <div className={styles.container}>
       <Head>
@@ -11,53 +22,31 @@ export default function Home() {
 
       <main>
         <h1 className={styles.title}>
-          Welcome to <a href="https://nextjs.org">Next.js!</a>
+          Playground project
         </h1>
-
-        <p className={styles.description}>
-          Get started by editing <code>pages/index.js</code>
-        </p>
+        <nav>
+          <ul>
+            <li>
+              <Link href="/comments">
+                Add a comment            
+              </Link>
+            </li>
+          </ul>
+        </nav>
 
         <div className={styles.grid}>
-          <a href="https://nextjs.org/docs" className={styles.card}>
-            <h3>Documentation &rarr;</h3>
-            <p>Find in-depth information about Next.js features and API.</p>
-          </a>
-
-          <a href="https://nextjs.org/learn" className={styles.card}>
-            <h3>Learn &rarr;</h3>
-            <p>Learn about Next.js in an interactive course with quizzes!</p>
-          </a>
-
-          <a
-            href="https://github.com/vercel/next.js/tree/canary/examples"
-            className={styles.card}
-          >
-            <h3>Examples &rarr;</h3>
-            <p>Discover and deploy boilerplate example Next.js projects.</p>
-          </a>
-
-          <a
-            href="https://vercel.com/import?filter=next.js&utm_source=create-next-app&utm_medium=default-template&utm_campaign=create-next-app"
-            className={styles.card}
-          >
-            <h3>Deploy &rarr;</h3>
-            <p>
-              Instantly deploy your Next.js site to a public URL with Vercel.
-            </p>
-          </a>
+        </div>
+          <h2>Comments</h2>
+          <ul>
+            {comments.map((comment, index) => (
+              <li key={`${index}-comment`}>{comment}</li>
+            ))}
+          </ul>
+        <div>
         </div>
       </main>
 
       <footer>
-        <a
-          href="https://vercel.com?utm_source=create-next-app&utm_medium=default-template&utm_campaign=create-next-app"
-          target="_blank"
-          rel="noopener noreferrer"
-        >
-          Powered by{' '}
-          <img src="/vercel.svg" alt="Vercel" className={styles.logo} />
-        </a>
       </footer>
 
       <style jsx>{`

diff --git a/rules/dangerous_innerhtml.yaml b/rules/dangerous_innerhtml.yaml
@@ -0,0 +1,10 @@
+rules:
+  - id: detect-dangerous-innerhtml
+    pattern: |
+      <$_ dangerouslySetInnerHTML={ { __html: $VAL } } />
+    message: "Usage of 'dangerouslySetInnerHTML' can lead to XSS vulnerabilities. Avoid using it unless absolutely necessary."
+    severity: ERROR
+    languages: [javascript, typescript]
+    metadata:
+      category: security
+      technology: react