Merge branch 'fix/security-scan-remediations' into 'main'

fix: correct scanner suppression comments and add remaining fixes

See merge request proserve/genaiid/reusable-assets/fullstack-agentcore-solution-template!43

Author: kaleko

docker/Dockerfile.frontend.dev

@@ -17,6 +17,9 @@ COPY . .
 # Expose port
 EXPOSE 3000
 
+# Run as non-root user (node user is built into node:20-alpine)
+USER node
+
 # Healthcheck for container orchestration (dev server)
 HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
   CMD wget -qO- http://localhost:3000/ || exit 1

infra-cdk/lambdas/zip-packager/index.py

@@ -60,7 +60,9 @@ def send_response(
         headers={"Content-Type": "application/json"},
         method="PUT",
     )
-    urllib.request.urlopen(req)  # nosec B310 B113 — URL is the CloudFormation pre-signed ResponseURL, not user-controlled
+    urllib.request.urlopen(  # nosemgrep: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected  # nosec B310 B113 — URL is the CloudFormation pre-signed ResponseURL, not user-controlled
+        req
+    )
 
 
 def download_wheels(requirements: list[str], download_dir: Path) -> None:

infra-cdk/lib/backend-stack.ts

@@ -122,8 +122,8 @@ export class BackendStack extends cdk.NestedStack {
 
     if (deploymentType === "zip") {
       // ZIP DEPLOYMENT: Use Lambda to package and upload to S3 (no Docker required)
-      const repoRoot = path.resolve(__dirname, "..", "..")
-      const patternDir = path.join(repoRoot, "patterns", pattern)
+      const repoRoot = path.resolve(__dirname, "..", "..") // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
+      const patternDir = path.join(repoRoot, "patterns", pattern) // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
 
       // Create S3 bucket for agent code
       const agentCodeBucket = new s3.Bucket(this, "AgentCodeBucket", {
@@ -137,7 +137,7 @@ export class BackendStack extends cdk.NestedStack {
       const packagerLambda = new lambda.Function(this, "ZipPackagerLambda", {
         runtime: lambda.Runtime.PYTHON_3_12,
         handler: "index.handler",
-        code: lambda.Code.fromAsset(path.join(__dirname, "..", "lambdas", "zip-packager")),
+        code: lambda.Code.fromAsset(path.join(__dirname, "..", "lambdas", "zip-packager")), // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
         timeout: cdk.Duration.minutes(10),
         memorySize: 1024,
         ephemeralStorageSize: cdk.Size.gibibytes(2),
@@ -151,21 +151,21 @@ export class BackendStack extends cdk.NestedStack {
       // Read pattern .py files
       for (const file of fs.readdirSync(patternDir)) {
         if (file.endsWith(".py")) {
-          const content = fs.readFileSync(path.join(patternDir, file))
+          const content = fs.readFileSync(path.join(patternDir, file)) // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
           agentCode[file] = content.toString("base64")
         }
       }
 
       // Read shared modules (gateway/, tools/)
       for (const module of ["gateway", "tools"]) {
-        const moduleDir = path.join(repoRoot, module)
+        const moduleDir = path.join(repoRoot, module) // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
         if (fs.existsSync(moduleDir)) {
           this.readDirRecursive(moduleDir, module, agentCode)
         }
       }
 
       // Read requirements
-      const requirementsPath = path.join(patternDir, "requirements.txt")
+      const requirementsPath = path.join(patternDir, "requirements.txt") // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
       const requirements = fs.readFileSync(requirementsPath, "utf-8")
         .split("\n")
         .map(line => line.trim())
@@ -209,7 +209,7 @@ export class BackendStack extends cdk.NestedStack {
     } else {
       // DOCKER DEPLOYMENT: Use container-based deployment
       agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromAsset(
-        path.resolve(__dirname, "..", ".."),
+        path.resolve(__dirname, "..", ".."), // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
         {
           platform: ecr_assets.Platform.LINUX_ARM64,
           file: `patterns/${pattern}/Dockerfile`,
@@ -499,7 +499,7 @@ export class BackendStack extends cdk.NestedStack {
       functionName: `${config.stack_name_base}-feedback`,
       runtime: lambda.Runtime.PYTHON_3_13,
       architecture: lambda.Architecture.ARM_64,
-      entry: path.join(__dirname, "..", "lambdas", "feedback"),
+      entry: path.join(__dirname, "..", "lambdas", "feedback"), // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
       handler: "handler",
       environment: {
         TABLE_NAME: feedbackTable.tableName,
@@ -601,7 +601,7 @@ export class BackendStack extends cdk.NestedStack {
     const toolLambda = new lambda.Function(this, "SampleToolLambda", {
       runtime: lambda.Runtime.PYTHON_3_13,
       handler: "sample_tool_lambda.handler",
-      code: lambda.Code.fromAsset(path.join(__dirname, "../../gateway/tools/sample_tool")),
+      code: lambda.Code.fromAsset(path.join(__dirname, "../../gateway/tools/sample_tool")), // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
       timeout: cdk.Duration.seconds(30),
       logGroup: new logs.LogGroup(this, "SampleToolLambdaLogGroup", {
         logGroupName: `/aws/lambda/${config.stack_name_base}-sample-tool`,
@@ -663,7 +663,7 @@ export class BackendStack extends cdk.NestedStack {
     )
 
     // Load tool specification from JSON file
-    const toolSpecPath = path.join(__dirname, "../../gateway/tools/sample_tool/tool_spec.json")
+    const toolSpecPath = path.join(__dirname, "../../gateway/tools/sample_tool/tool_spec.json") // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
     const apiSpec = JSON.parse(require("fs").readFileSync(toolSpecPath, "utf8"))
 
     // Cognito OAuth2 configuration for gateway
@@ -678,7 +678,7 @@ export class BackendStack extends cdk.NestedStack {
     const oauth2ProviderLambda = new lambda.Function(this, "OAuth2ProviderLambda", {
       runtime: lambda.Runtime.PYTHON_3_13,
       handler: "index.handler",
-      code: lambda.Code.fromAsset(path.join(__dirname, "..", "lambdas", "oauth2-provider")),
+      code: lambda.Code.fromAsset(path.join(__dirname, "..", "lambdas", "oauth2-provider")), // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
       timeout: cdk.Duration.minutes(5),
       logGroup: new logs.LogGroup(this, "OAuth2ProviderLambdaLogGroup", {
         logGroupName: `/aws/lambda/${config.stack_name_base}-oauth2-provider`,
@@ -995,9 +995,8 @@ export class BackendStack extends cdk.NestedStack {
    */
   private readDirRecursive(dirPath: string, prefix: string, output: Record<string, string>): void {
     for (const entry of fs.readdirSync(dirPath, { withFileTypes: true })) {
-      // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal — dirPath is derived from __dirname-relative CDK build paths, not user input
-      const fullPath = path.join(dirPath, entry.name)
-      const relativePath = path.join(prefix, entry.name)
+      const fullPath = path.join(dirPath, entry.name) // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
+      const relativePath = path.join(prefix, entry.name) // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
 
       if (entry.isDirectory()) {
         // Skip __pycache__ directories

infra-cdk/lib/utils/config-manager.ts

@@ -47,8 +47,7 @@ export class ConfigManager {
   }
 
   private _loadConfig(configFile: string): AppConfig {
-    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal — configFile is a hardcoded filename from the CDK app entry point, not user input
-    const configPath = path.join(__dirname, "..", "..", configFile)
+    const configPath = path.join(__dirname, "..", "..", configFile) // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
 
     if (!fs.existsSync(configPath)) {
       throw new Error(`Configuration file ${configPath} does not exist. Please create config.yaml file.`)
@@ -113,13 +112,13 @@ export class ConfigManager {
     return this.config
   }
 
-  // nosemgrep: javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop — iterates over a trusted local YAML config object, not user-controlled input
   public get(key: string, defaultValue?: any): any {
     const keys = key.split(".")
     let value: any = this.config
 
     for (const k of keys) {
       if (typeof value === "object" && value !== null && k in value) {
+        // nosemgrep: javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop — iterates over a trusted local YAML config object, not user-controlled input
         value = value[k]
       } else {
         return defaultValue

patterns/utils/auth.py

@@ -60,8 +60,9 @@ def extract_user_id_from_context(context: RequestContext) -> str:
 
     # Decode without signature verification — AgentCore Runtime already validated the token.
     # We use options to skip all verification since this is a trusted, pre-validated token.
-    claims = jwt.decode(  # nosec — signature verification intentionally skipped; AgentCore Runtime already validated the JWT
+    claims = jwt.decode(  # nosec B105
         jwt=token,
+        # nosemgrep: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode — signature verification intentionally skipped; AgentCore Runtime already validated the JWT
         options={"verify_signature": False},
         algorithms=["RS256"],
     )