Boards demo by pwalsh-snyk · Pull Request #158 · dylansnyk/nodejs-goof

pwalsh-snyk · 2025-11-06T17:21:14Z

No description provided.

updates

adding pod

- Add comprehensive Snyk CLI workflow for SCA, Code, and Container scanning - Include automatic results publishing to Snyk Web UI - Add PR integration with security summaries - Include detailed setup documentation - Configure for main/develop branches with daily scheduled scans

- Keep only Snyk monitor for open source vulnerabilities - Keep only Snyk code report for custom code analysis - Remove complex PR commenting and artifact uploads - Remove container scanning and scheduled runs - Streamline to main branch only

This workflow tests the reachability of SBOMs using Snyk.

Updated the Snyk SBOM reachability test command to handle exit codes more gracefully.

Added detailed parsing and reporting for reachable vulnerabilities in Snyk SBOM analysis.

Updated the Snyk SBOM reachability test to improve output parsing and summary reporting.

Improved error handling and output parsing in Snyk SBOM reachability analysis workflow.

- Fixed shell redirection operator causing YAML parsing issue on line 24 - Changed from single-line run command to multiline format with proper indentation - Resolves GitHub Actions workflow validation error

Updated the Snyk Open Source reachability analysis workflow to reflect changes in echo statements and commented out the artifact upload step.

Added SNYK_API environment variable for Snyk authentication and SBOM generation.

…t for function key)

…oad formatting

…ch - avoids 401 auth issues

…personal tokens)

…oads

dylansnyk · 2025-11-06T17:21:24Z

⛔ Snyk checks have failed. 1 issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (1)
⛔	Open Source Security	1	0	0	0	1 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

dylansnyk · 2025-11-06T17:21:25Z

⛔ Snyk checks have failed. 1 issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (1)
⛔	Open Source Security	1	0	0	0	1 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

dylansnyk · 2025-11-06T17:21:26Z

⛔ Snyk checks have failed. 1 issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (1)
⛔	Open Source Security	1	0	0	0	1 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

dylansnyk · 2025-11-06T17:21:27Z

⛔ Snyk checks have failed. 7 issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (7)
⛔	Code Security	0	6	0	0	6 issues
⛔	Open Source Security	1	0	0	0	1 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

snyk-io · 2025-11-06T17:21:28Z

⛔ Snyk checks have failed. 1 issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (1)
⛔	Open Source Security	1	0	0	0	1 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

dylansnyk · 2025-11-06T17:21:39Z

+    if (err) return res.status(500).send(err);
+
+
+    cp.exec(`node ${uploadPath}`, (error, stdout, stderr) => {


Command Injection

Unsanitized input from an uploaded file flows into child_process.exec, where it is used to build a shell command. This may result in a Command Injection vulnerability.

Line 77 | CWE-78 | Priority score 808 | Learn more about this vulnerability

Data flow: 13 steps

Step 1 - 5

nodejs-goof/app.js

Line 69 in 0a45fd6

let uploadedFile = req.files.file;

Step 6 - 10 app.js#L70

Step 11 - 13

nodejs-goof/app.js

Line 77 in 0a45fd6

cp.exec(`node ${uploadPath}`, (error, stdout, stderr) => {

dylansnyk · 2025-11-06T17:21:39Z

  name: 'connect.sid',
-  cookie: { path: '/' }
-}))
+  cookie: { path: '/', httpOnly: false, secure: false } 


Sensitive Cookie with 'Secure' Attribute Set to False

Cookie has the Secure attribute set to false. Set it to true to protect the cookie from man-in-the-middle attacks.

Line 47 | CWE-614 | Priority score 408

Data flow: 2 steps

Step 1 - 2

nodejs-goof/app.js

Line 47 in 0a45fd6

cookie: { path: '/', httpOnly: false, secure: false }

dylansnyk · 2025-11-06T17:21:39Z

+
+  // **Save the file without validating its type**
+  uploadedFile.mv(uploadPath, function (err) {
+    if (err) return res.status(500).send(err);


Cross-site Scripting (XSS)

Unsanitized input from an uploaded file flows into send, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

Line 74 | CWE-79 | Priority score 815 | Learn more about this vulnerability

Data flow: 9 steps

Step 1 - 5

nodejs-goof/app.js

Line 69 in 0a45fd6

let uploadedFile = req.files.file;

Step 6 - 7 app.js#L73

Step 8 - 9

nodejs-goof/app.js

Line 74 in 0a45fd6

if (err) return res.status(500).send(err);

dylansnyk · 2025-11-06T17:21:39Z

+  let username = req.query.username || 'Guest';
+
+
+  res.send(`<h1>Welcome, ${username}</h1><script>alert('XSS!');</script>`);


Cross-site Scripting (XSS)

Unsanitized input from an HTTP parameter flows into send, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

Line 91 | CWE-79 | Priority score 815 | Learn more about this vulnerability

Data flow: 10 steps

Step 1 - 7

nodejs-goof/app.js

Line 88 in 0a45fd6

let username = req.query.username || 'Guest';

Step 8 - 10

nodejs-goof/app.js

Line 91 in 0a45fd6

res.send(`<h1>Welcome, ${username}</h1><script>alert('XSS!');</script>`);

dylansnyk · 2025-11-06T17:21:40Z

+  let uploadPath = './uploads/' + uploadedFile.name;
+
+  // **Save the file without validating its type**
+  uploadedFile.mv(uploadPath, function (err) {


Path Traversal

Unsanitized input from an uploaded file flows into mv, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to delete arbitrary files.

Line 73 | CWE-23 | Priority score 808 | Learn more about this vulnerability

Data flow: 12 steps

Step 1 - 5

nodejs-goof/app.js

Line 69 in 0a45fd6

let uploadedFile = req.files.file;

Step 6 - 10 app.js#L70

Step 11 - 12

nodejs-goof/app.js

Line 73 in 0a45fd6

uploadedFile.mv(uploadPath, function (err) {

dylansnyk · 2025-11-06T17:21:40Z

+  let url = req.body.url;
+
+
+  require('http').get(url, (response) => {


Server-Side Request Forgery (SSRF)

Unsanitized input from the HTTP request body flows into http.get, where it is used as an URL to perform a request. This may result in a Server-Side Request Forgery vulnerability.

Line 105 | CWE-918 | Priority score 808 | Learn more about this vulnerability

Data flow: 7 steps

Step 1 - 5

nodejs-goof/app.js

Line 102 in 0a45fd6

let url = req.body.url;

Step 6 - 7

nodejs-goof/app.js

Line 105 in 0a45fd6

require('http').get(url, (response) => {

pwalsh-snyk added 30 commits March 4, 2025 16:47

updates

95d4ca2

Merge pull request #19 from pwalsh-snyk/demo-testing

b9b4929

updates

adding pod

f99b09a

Merge pull request #27 from pwalsh-snyk/pod-testing.yaml

628eb8c

adding pod

Delete pod-testing.yaml

b3dadb0

mcp & rules config

c00d74d

mcp config

8a6fffe

updating folder name

53584da

adding cursor rules

ca0bd9e

adding cursorrules file

a9e16d2

updating mcp

8db86dd

updating mcp

16bc670

updating instructions

10df105

Add Snyk SBOM reachability test workflow

bfdf143

This workflow tests the reachability of SBOMs using Snyk.

Update snyk-sbom-reachability.yml

e048067

Update organization ID in Snyk SBOM workflow

a025c00

Update SNYK SBOM workflow with new org ID

fc1c7ce

Update SNYK organization ID in workflow

4cdbfff

Improve exit code handling in Snyk SBOM test

3c8b400

Updated the Snyk SBOM reachability test command to handle exit codes more gracefully.

Enhance Snyk SBOM reachability reporting

06f04af

Added detailed parsing and reporting for reachable vulnerabilities in Snyk SBOM analysis.

Enhance Snyk SBOM reachability analysis output

11cf469

Updated the Snyk SBOM reachability test to improve output parsing and summary reporting.

Enhance Snyk SBOM reachability analysis script

5306103

Improved error handling and output parsing in Snyk SBOM reachability analysis workflow.

Rename Snyk job and update workflow name

180eef3

Rename snyk-sbom-reachability.yml to snyk-open-source-reachability.yml

6073fce

Fix YAML syntax error in snyk-open-source-reachability workflow

a47b5ce

- Fixed shell redirection operator causing YAML parsing issue on line 24 - Changed from single-line run command to multiline format with proper indentation - Resolves GitHub Actions workflow validation error

Modify Snyk workflow for reachability analysis

7504ba3

Updated the Snyk Open Source reachability analysis workflow to reflect changes in echo statements and commented out the artifact upload step.

Add SNYK_API environment variable to workflow

cd1009f

Added SNYK_API environment variable for Snyk authentication and SBOM generation.

Add Snyk webhook integration workflow for Azure DevOps Boards

7458791

pwalsh-snyk added 14 commits October 31, 2025 19:29

Fix: Remove invalid description fields from workflow steps

e69f9d0

Update: Use --report for Snyk Code to enable webhook triggers

0f698b0

Add step to fetch ALL issues and create work items (uses GitHub secre…

ffd1311

…t for function key)

Fix: Expand project name filter to find Snyk projects

9d2da9d

Improve project discovery: show all projects and use fallback

b9fc915

Update snyk-webhook-integration.yml

7e5ef10

Change authorization header from token to bearer

f258974

Fix Azure Boards webhook integration - improve issue parsing and payl…

cf79ff3

…oad formatting

Fix workflow to use project IDs from monitor steps instead of API fet…

74d735d

…ch - avoids 401 auth issues

Add CLI fallback for fetching issues when REST API fails (works with …

e0144a0

…personal tokens)

Fix 'Argument list too long' error by using temp files for large payl…

6252829

…oads

Test workflow run after fixing argument list issue

28dac9a

Trigger workflow test run

03d29e3

adding libary

0a45fd6

dylansnyk reviewed Nov 6, 2025

View reviewed changes

Navigation Menu

Boards demo - #158

Boards demo#158
pwalsh-snyk wants to merge 44 commits into
dylansnyk:mainfrom
pwalsh-snyk:boards-demo

pwalsh-snyk commented Nov 6, 2025

Uh oh!

dylansnyk commented Nov 6, 2025

Uh oh!

dylansnyk commented Nov 6, 2025

Uh oh!

dylansnyk commented Nov 6, 2025

Uh oh!

dylansnyk commented Nov 6, 2025 •

edited

Loading

Uh oh!

snyk-io Bot commented Nov 6, 2025

Uh oh!

dylansnyk Nov 6, 2025

Uh oh!

dylansnyk Nov 6, 2025

Uh oh!

dylansnyk Nov 6, 2025

Uh oh!

dylansnyk Nov 6, 2025

Uh oh!

dylansnyk Nov 6, 2025

Uh oh!

dylansnyk Nov 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		if (err) return res.status(500).send(err);


		cp.exec(`node ${uploadPath}`, (error, stdout, stderr) => {

		let username = req.query.username \|\| 'Guest';


		res.send(`<h1>Welcome, ${username}</h1><script>alert('XSS!');</script>`);

		let url = req.body.url;


		require('http').get(url, (response) => {

Conversation

pwalsh-snyk commented Nov 6, 2025

Uh oh!

dylansnyk commented Nov 6, 2025

⛔ Snyk checks have failed. 1 issues have been found so far.

Uh oh!

dylansnyk commented Nov 6, 2025

⛔ Snyk checks have failed. 1 issues have been found so far.

Uh oh!

dylansnyk commented Nov 6, 2025

⛔ Snyk checks have failed. 1 issues have been found so far.

Uh oh!

dylansnyk commented Nov 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⛔ Snyk checks have failed. 7 issues have been found so far.

Uh oh!

snyk-io Bot commented Nov 6, 2025

⛔ Snyk checks have failed. 1 issues have been found so far.

Uh oh!

dylansnyk Nov 6, 2025

Choose a reason for hiding this comment

Command Injection

Line 77 | CWE-78 | Priority score 808 | Learn more about this vulnerability

Uh oh!

dylansnyk Nov 6, 2025

Choose a reason for hiding this comment

Sensitive Cookie with 'Secure' Attribute Set to False

Line 47 | CWE-614 | Priority score 408

Uh oh!

dylansnyk Nov 6, 2025

Choose a reason for hiding this comment

Cross-site Scripting (XSS)

Line 74 | CWE-79 | Priority score 815 | Learn more about this vulnerability

Uh oh!

dylansnyk Nov 6, 2025

Choose a reason for hiding this comment

Cross-site Scripting (XSS)

Line 91 | CWE-79 | Priority score 815 | Learn more about this vulnerability

Uh oh!

dylansnyk Nov 6, 2025

Choose a reason for hiding this comment

Path Traversal

Line 73 | CWE-23 | Priority score 808 | Learn more about this vulnerability

Uh oh!

dylansnyk Nov 6, 2025

Choose a reason for hiding this comment

Server-Side Request Forgery (SSRF)

Line 105 | CWE-918 | Priority score 808 | Learn more about this vulnerability

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dylansnyk commented Nov 6, 2025 •

edited

Loading