Skip to content

Commit 65b4f68

Browse files
timothywarnertimothywarner
committed
Add OAuth authentication implementation and security demo documentation
- Created package.json for demo-01-oauth-tests with Jest as a dev dependency. - Implemented auth.js for handling access and refresh tokens, including token issuance, validation, and failed login tracking. - Added comprehensive security demo runbook for Lesson 04, detailing Copilot usage for code review, OWASP alert listing, dependency review, and code scanning alerts in GitHub.
1 parent bc76960 commit 65b4f68

9 files changed

Lines changed: 5199 additions & 0 deletions

File tree

‎.github/codeql/codeql-config-nodegoat.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# Name of this CodeQL config — helps if you have multiple configs
2+
name: "NodeGoat-only CodeQL config"
3+
4+
disable-default-queries: true # we will explicitly pick what to run
5+
6+
packs:
7+
# Use the standard JavaScript security-extended query suite
8+
- codeql/javascript-queries:codeql-suites/javascript-security-extended.qls
9+
10+
# Only scan paths under vulnerable_repos/NodeGoat
11+
paths:
12+
- 'vulnerable_repos/NodeGoat/**'
13+
14+
# Optionally, ignore paths under NodeGoat that you don't care about
15+
paths-ignore:
16+
- 'vulnerable_repos/NodeGoat/node_modules/**'
17+
- 'vulnerable_repos/NodeGoat/**/*.test.js'
18+
- 'vulnerable_repos/NodeGoat/**/*.spec.js'
19+
20+
# Optional: filter out low-severity warnings/recommendations to reduce noise
21+
query-filters:
22+
- exclude:
23+
problems.severity:
24+
- warning
25+
- recommendation

‎.github/workflows/codeql-nodegoat-only.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: CodeQL − NodeGoat Only
2+
3+
on:
4+
workflow_dispatch:
5+
6+
concurrency:
7+
group: ${{ github.workflow }}-${{ github.ref }}
8+
cancel-in-progress: true
9+
10+
jobs:
11+
analyze:
12+
name: Analyze NodeGoat JS/TS
13+
runs-on: ubuntu-latest
14+
timeout-minutes: 30
15+
permissions:
16+
security-events: write
17+
actions: read
18+
contents: read
19+
20+
steps:
21+
- name: Checkout repository
22+
uses: actions/checkout@v4
23+
24+
- name: Initialize CodeQL with NodeGoat config
25+
uses: github/codeql-action/init@v3
26+
with:
27+
config-file: ./.github/codeql/codeql-config-nodegoat.yml
28+
languages: javascript-typescript
29+
30+
- name: Perform CodeQL Analysis
31+
uses: github/codeql-action/analyze@v3
32+
with:
33+
category: "/language:javascript-typescript"

‎.pre-commit-config.yaml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# Pre-commit Hook Configuration
2+
# ==============================
3+
# Automated security scanning before commits
4+
# Install: pre-commit install
5+
# Run manually: pre-commit run --all-files
6+
7+
repos:
8+
# Semgrep - SAST for secrets and vulnerabilities
9+
- repo: https://github.com/returntocorp/semgrep
10+
rev: v1.52.0
11+
hooks:
12+
- id: semgrep
13+
name: Semgrep Security Scan
14+
entry: semgrep
15+
language: python
16+
types: [text]
17+
args:
18+
- --config=p/secrets
19+
- --config=p/security-audit
20+
- --config=p/owasp-top-ten
21+
- --error
22+
- --strict
23+
- --verbose
24+
exclude: |
25+
(?x)^(
26+
.*\.min\.js|
27+
.*\.map|
28+
node_modules/|
29+
vendor/|
30+
\.git/|
31+
\.venv/|
32+
venv/|
33+
__pycache__/|
34+
\.pytest_cache/|
35+
\.mypy_cache/|
36+
dist/|
37+
build/|
38+
\.lock$|
39+
package-lock\.json|
40+
yarn\.lock
41+
)
42+
43+
# Standard pre-commit hooks
44+
- repo: https://github.com/pre-commit/pre-commit-hooks
45+
rev: v4.5.0
46+
hooks:
47+
- id: trailing-whitespace
48+
exclude: \.md$
49+
- id: end-of-file-fixer
50+
- id: check-yaml
51+
args: [--unsafe]
52+
- id: check-json
53+
- id: check-added-large-files
54+
args: [--maxkb=1024]
55+
- id: detect-private-key
56+
- id: detect-aws-credentials
57+
args: [--allow-missing-credentials]
58+
59+
# YAML linting
60+
- repo: https://github.com/adrienverge/yamllint
61+
rev: v1.33.0
62+
hooks:
63+
- id: yamllint
64+
args: [-d, '{extends: relaxed, rules: {line-length: {max: 120}}}']
65+
exclude: |
66+
(?x)^(
67+
\.github/workflows/|
68+
vulnerable_repos/
69+
)

‎PRE-COMMIT-HOOKS.md‎

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
# Git Pre-Commit Hooks for Security Scanning
2+
3+
This repository uses automated pre-commit hooks to scan for security vulnerabilities, exposed secrets, API keys, passwords, and other sensitive data before code is committed.
4+
5+
## What Gets Scanned
6+
7+
The pre-commit hooks perform the following security checks:
8+
9+
- **Semgrep**: Scans for hardcoded secrets, API keys, passwords, and security anti-patterns
10+
- **TruffleHog**: Detects high-entropy strings and known secret patterns
11+
- **GitLeaks**: Additional secret detection with pattern matching
12+
- **Built-in Checks**: Detects private keys, AWS credentials, large files, and trailing whitespace
13+
14+
## Installation
15+
16+
### Prerequisites
17+
18+
Install the required tools:
19+
20+
```bash
21+
# Install pre-commit framework
22+
pip install pre-commit
23+
24+
# Install Semgrep
25+
pip install semgrep
26+
27+
# Install TruffleHog (requires Go)
28+
go install github.com/trufflesecurity/trufflehog/v3@latest
29+
30+
# Install GitLeaks (alternative: download binary from releases)
31+
go install github.com/gitleaks/gitleaks/v8@latest
32+
33+
# Or use package managers:
34+
# macOS
35+
brew install pre-commit semgrep trufflehog gitleaks
36+
37+
# Ubuntu/Debian
38+
pip install pre-commit semgrep
39+
# Download TruffleHog and GitLeaks binaries separately
40+
```
41+
42+
### Setup Pre-Commit Hooks
43+
44+
1. **Install the hooks** in your local repository:
45+
46+
```bash
47+
cd /path/to/github-security-testbed
48+
pre-commit install
49+
```
50+
51+
2. **Verify installation**:
52+
53+
```bash
54+
pre-commit --version
55+
```
56+
57+
You should see output like: `pre-commit 3.x.x`
58+
59+
3. **(Optional) Run against all files** to test:
60+
61+
```bash
62+
pre-commit run --all-files
63+
```
64+
65+
## Usage
66+
67+
### Automatic Scanning
68+
69+
Once installed, the hooks run automatically on every `git commit`:
70+
71+
```bash
72+
git add myfile.js
73+
git commit -m "Add new feature"
74+
# Pre-commit hooks will run automatically
75+
```
76+
77+
### Manual Scanning
78+
79+
Run hooks manually without committing:
80+
81+
```bash
82+
# Scan all files
83+
pre-commit run --all-files
84+
85+
# Scan specific files
86+
pre-commit run --files src/auth.js src/config.js
87+
88+
# Run specific hook only
89+
pre-commit run semgrep --all-files
90+
pre-commit run trufflehog --all-files
91+
```
92+
93+
### Bypassing Hooks (Use with Caution)
94+
95+
If you need to bypass hooks temporarily (not recommended for security-sensitive changes):
96+
97+
```bash
98+
git commit --no-verify -m "Emergency fix"
99+
```
100+
101+
## What Happens When Secrets Are Detected
102+
103+
If a secret or security issue is found:
104+
105+
1. **Commit is blocked** - Your commit will fail
106+
2. **Results are displayed** - You'll see which files and lines contain issues
107+
3. **Fix the issues** - Remove or properly secure the detected secrets
108+
4. **Retry commit** - After fixing, try committing again
109+
110+
Example output:
111+
```
112+
Semgrep Security Scan........................................Failed
113+
- hook id: semgrep
114+
- exit code: 1
115+
116+
src/config.js
117+
severity:error rule:generic.secrets.gitleaks.generic-api-key
118+
Found hardcoded API key
119+
Line 12: const API_KEY = "sk_live_51234567890abcdef"
120+
```
121+
122+
## Configuration
123+
124+
The hook configuration is in `.pre-commit-config.yaml`. You can customize:
125+
126+
- **Semgrep rules**: Modify `args` under the Semgrep hook
127+
- **File exclusions**: Update `exclude` patterns
128+
- **Hook versions**: Update `rev` values to newer versions
129+
130+
Example customization:
131+
```yaml
132+
- id: semgrep
133+
args:
134+
- --config=p/secrets
135+
- --config=p/owasp-top-ten # Add more rulesets
136+
- --error
137+
```
138+
139+
## Troubleshooting
140+
141+
### Hook fails to install
142+
```bash
143+
# Update pre-commit
144+
pip install --upgrade pre-commit
145+
146+
# Reinstall hooks
147+
pre-commit uninstall
148+
pre-commit install
149+
```
150+
151+
### Semgrep not found
152+
```bash
153+
# Ensure Semgrep is in PATH
154+
which semgrep
155+
pip install --upgrade semgrep
156+
```
157+
158+
### TruffleHog/GitLeaks not found
159+
```bash
160+
# Check installation
161+
which trufflehog
162+
which gitleaks
163+
164+
# Add Go bin to PATH if needed
165+
export PATH=$PATH:$(go env GOPATH)/bin
166+
```
167+
168+
### Slow hook execution
169+
```bash
170+
# Update to latest hook versions
171+
pre-commit autoupdate
172+
173+
# Or disable specific slow hooks
174+
# (comment out in .pre-commit-config.yaml)
175+
```
176+
177+
## Best Practices
178+
179+
1. **Never commit secrets** - Use environment variables or secret management tools
180+
2. **Use .gitignore** - Exclude files with sensitive data (`.env`, `secrets.json`)
181+
3. **Regular updates** - Keep hooks updated: `pre-commit autoupdate`
182+
4. **Team adoption** - Ensure all developers install hooks
183+
5. **CI/CD integration** - Run same checks in CI pipeline (see `.github/workflows/`)
184+
185+
## Resources
186+
187+
- [Pre-commit Documentation](https://pre-commit.com/)
188+
- [Semgrep Rules](https://semgrep.dev/r)
189+
- [TruffleHog GitHub](https://github.com/trufflesecurity/trufflehog)
190+
- [GitLeaks Documentation](https://github.com/gitleaks/gitleaks)
191+
192+
## Support
193+
194+
For issues with the hooks:
195+
1. Check this documentation
196+
2. Run `pre-commit run --all-files --verbose` for detailed output
197+
3. Review `.pre-commit-config.yaml` configuration
198+
4. Open an issue in this repository

0 commit comments

Comments
 (0)