Skip to content

feat: implement enforced Semgrep scanning with clean baseline (#2984) #3406

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kasya merged 19 commits into from
Jan 23, 2026
Merged

feat: implement enforced Semgrep scanning with clean baseline (#2984) #3406

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
8d4456c
feat: implement enforced Semgrep scanning with clean baseline (#2984)
SpruhaCK Jan 18, 2026
8cc47c8
chore: address CodeRabbit review (pin versions, optimize workflow, an…
SpruhaCK Jan 18, 2026
7dbe9cf
fix: resolve SonarCloud security hotspot by hardening permissions and…
SpruhaCK Jan 18, 2026
0a2d82b
fix: pin github actions to SHA hashes to resolve sonarcloud hotspot
SpruhaCK Jan 18, 2026
7a4b09a
Refactor semgrep and update CI/CD workflows
SpruhaCK Jan 19, 2026
a3f9287
Refactor semgrep and update CI workflows
SpruhaCK Jan 19, 2026
180901e
Merge branch 'main' of https://github.com/owasp/nest into semgrep-ref…
SpruhaCK Jan 19, 2026
c22ec83
backup: save all refactor work and formatting
SpruhaCK Jan 21, 2026
9ba1a8c
Merge branch 'main' into add-semgrep-checks
SpruhaCK Jan 21, 2026
65ab648
Merge branch 'semgrep-refactor' into add-semgrep-check
SpruhaCK Jan 21, 2026
4109040
chore: final cleanup
SpruhaCK Jan 21, 2026
56b3c69
chore: address CodeRabbit review (pin versions and fix redundant steps)
SpruhaCK Jan 21, 2026
ea7a930
chore: address CodeRabbit review
SpruhaCK Jan 21, 2026
a2bb8e3
Updated cspell/custom-dict.txt
SpruhaCK Jan 21, 2026
7b49f9a
Merge branch 'main' into add-semgrep-checks
SpruhaCK Jan 22, 2026
ba59528
refactor: add artifact archiving
SpruhaCK Jan 22, 2026
441b7f9
Consolidate ci/cd and local command run.
arkid15r Jan 23, 2026
491dfe3
Merge branch 'main' into add-semgrep-checks
arkid15r Jan 23, 2026
5da4042
Update code
arkid15r Jan 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions .github/workflows/semgrep.yml
View file
Open in desktop

@arkid15r arkid15r Jan 18, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need it to be part of the main ci/cd pipeline

@SpruhaCK SpruhaCK Jan 18, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Understood. I'll integrate the Semgrep job directly into the main CI/CD workflow i.e. run-ci-cd.yaml as a required dependency.

Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
name: Semgrep Scan

on:
pull_request:
branches:
- main
- "feature/**"
push:
branches:
- main
- "feature/**"

permissions:
contents: read
security-events: write

jobs:
semgrep:
name: Run Semgrep Security Scan
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- name: Checkout repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

- name: Run Semgrep
uses: semgrep/semgrep-action@2f647c0b06b515d0da467389a425a898668700a0
with:
config: >-
p/owasp-top-ten
p/python
p/javascript
continue-on-error: false
6 changes: 6 additions & 0 deletions .pre-commit-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,3 +87,9 @@ repos:
rev: v2.11.1
hooks:
- id: pyproject-fmt

- repo: https://github.com/semgrep/semgrep
rev: v1.148.0
hooks:
- id: semgrep
args: [--config=p/owasp-top-ten, --config=p/python, --config=p/javascript, --error]

@arkid15r arkid15r Jan 18, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use consistent syntax

@arkid15r arkid15r Jan 18, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's also use centralized configuration file for both pre-commit and ci/cd workflow.

@SpruhaCK SpruhaCK Jan 18, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, we can create a centralized .semgrep.yml file in the root directory to act as the single source of truth. I’ll then refactor the .pre-commit-config.yaml and the CI/CD workflow to point to it so the rules stay consistent everywhere. I'll get started on this refactor and push the changes for your review!

9 changes: 9 additions & 0 deletions .semgrepignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
.venv/
node_modules/
backend/static/
frontend/.next/
.git/
.github/
backend/data/
backend/poetry.lock
frontend/src/app/organizations/[organizationKey]/layout.tsx
Comment thread
SpruhaCK marked this conversation as resolved.
Outdated

@arkid15r arkid15r Jan 18, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This needs to be fixed -- not ignored. What's the exact issue with this file?

@SpruhaCK SpruhaCK Jan 18, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The issue Semgrep flagged in layout.tsx was a potential Client-Side Injection vulnerability. Because the organizationKey is a dynamic route parameter, Semgrep identified it as untrusted user input that was being used in a context (like a metadata field or a direct UI element) where it could lead to XSS if not handled carefully. I used .semgrepignore to keep the initial CI setup clean, but I'm now looking at implementing a proper fix either by ensuring the input is strictly validated or by using a safe React rendering pattern to neutralize the risk.

@SpruhaCK SpruhaCK Jan 18, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am thinking of using a strict regex validation for organizationKey prop or is there a centralized utility in the Nest codebase you'd prefer I use for sanitizing these route parameters?