feat: implement enforced Semgrep scanning with clean baseline (#2984)

.github/dependabot.yml

@@ -40,6 +40,11 @@ updates:
     schedule:
       interval: daily
 
+  - package-ecosystem: docker
+    directory: /docker/semgrep
+    schedule:
+      interval: daily
+
   - package-ecosystem: github-actions
     directory: /
     schedule:

.github/workflows/run-ci-cd.yaml

@@ -400,6 +400,30 @@ jobs:
           docker run --env-file frontend/.env.example owasp/nest:test-frontend-a11y-latest pnpm run test:a11y
     timeout-minutes: 5
 
+  run-security-scan:
+    name: Run security scan
+    needs:
+      - scan-code
+      - scan-ci-dependencies
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+
+      - name: Run Security CI Scan
+        run: make security-scan
+
+      - name: Upload security scan report
+        if: always()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
+        with:
+          name: semgrep-results-run-${{ github.run_number }}
+          path: semgrep-security-report.txt
+          retention-days: 14
+    timeout-minutes: 15
+
   set-release-version:
     name: Set release version
     outputs:
@@ -450,6 +474,7 @@ jobs:
       - run-frontend-e2e-tests
       - run-frontend-unit-tests
       - set-release-version
+      - run-security-scan
     permissions:
       contents: read
     runs-on: ubuntu-latest
@@ -820,6 +845,7 @@ jobs:
       - run-frontend-e2e-tests
       - run-frontend-unit-tests
       - set-release-version
+      - run-security-scan
     permissions:
       contents: read
     runs-on: ubuntu-latest

.gitignore

@@ -36,6 +36,8 @@ design/
 frontend/blob-report/
 frontend/coverage
 frontend/dist
+frontend/.next
+frontend/out
 frontend/npm-debug.log*
 frontend/playwright-report/
 frontend/playwright/.cache/
@@ -50,3 +52,4 @@ venv/
 
 # Snyk Security Extension - AI Rules (auto-generated)
 .cursor/rules/snyk_rules.mdc
+semgrep-security-report.txt

Makefile

@@ -58,6 +58,30 @@ scan-images: \
 	scan-backend-image \
 	scan-frontend-image
 
+security-scan:
+	@echo "Running Security Scan..."
+	@docker run --rm \
+		-v "$(PWD):/src" \
+		-w /src \
+		$$(grep -E '^FROM semgrep/semgrep:' docker/semgrep/Dockerfile | sed 's/^FROM //') \
+		semgrep \
+			--config p/ci \
+			--config p/javascript \
+			--config p/nginx \
+			--config p/owasp-top-ten \
+			--config p/python \
+			--config p/secrets \
+			--config p/security-audit \
+			--config p/sql-injection \
+			--config p/typescript \
+			--error \
+			--skip-unknown-extensions \
+			--timeout 10 \
+			--timeout-threshold 3 \
+			--text \
+			--text-output=semgrep-security-report.txt \
+			.
+
 test: \
 	test-nest-app
 
@@ -78,3 +102,5 @@ update-nest-app-dependencies: \
 
 update-pre-commit:
 	@pre-commit autoupdate
+
+.PHONY: build clean check pre-commit prune run scan-images security-scan test update

backend/apps/api/decorators/cache.py

@@ -13,7 +13,8 @@ def generate_key(
     prefix: str,
 ):
     """Generate a cache key for a request."""
-    return f"{prefix}:{request.get_full_path()}"
+    # Reason: This generates an internal cache key, not a user-facing HTML response.
+    return f"{prefix}:{request.get_full_path()}"  # nosemgrep: python.flask.security.audit.directly-returned-format-string.directly-returned-format-string  # noqa: E501
 
 
 def cache_response(

backend/apps/api/internal/mutations/api_key.py

@@ -77,7 +77,10 @@ def create_api_key(self, info: Info, name: str, expires_at: datetime) -> CreateA
                 message="API key created successfully.",
             )
         except IntegrityError as err:
-            logger.warning("Error creating API key: %s", err)
+            # Reason: Logging the error message string only, not the sensitive API key credential itself. # noqa: E501
+            logger.warning(  # nosemgrep: python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure  # noqa: E501
+                "Error creating API key: %s", err
+            )
             return CreateApiKeyResult(
                 ok=False,
                 code="ERROR",

backend/apps/github/admin/issue.py

@@ -1,7 +1,7 @@
 """GitHub app Issue model admin."""
 
 from django.contrib import admin
-from django.utils.safestring import mark_safe
+from django.utils.html import format_html
 
 from apps.github.models.issue import Issue
 
@@ -38,7 +38,7 @@ def custom_field_github_url(self, obj) -> str:
             str: A safe HTML link to the issue on GitHub.
 
         """
-        return mark_safe(f"<a href='{obj.url}' target='_blank'>↗️</a>")  # noqa: S308
+        return format_html("<a href='{}' target='_blank'>↗️</a>", obj.url)
 
     custom_field_github_url.short_description = "GitHub 🔗"
 

backend/apps/github/admin/pull_request.py

@@ -1,7 +1,7 @@
 """GitHub app PullRequest model admin."""
 
 from django.contrib import admin
-from django.utils.safestring import mark_safe
+from django.utils.html import format_html
 
 from apps.github.models.pull_request import PullRequest
 
@@ -44,7 +44,7 @@ def custom_field_github_url(self, obj: PullRequest) -> str:
             str: A safe HTML link to the pull request on GitHub.
 
         """
-        return mark_safe(f"<a href='{obj.url}' target='_blank'>↗️</a>")  # noqa: S308
+        return format_html("<a href='{}' target='_blank'>↗️</a>", obj.url)
 
     custom_field_github_url.short_description = "GitHub 🔗"
 

backend/apps/github/admin/repository.py

@@ -1,7 +1,7 @@
 """GitHub app Repository model admin."""
 
 from django.contrib import admin
-from django.utils.safestring import mark_safe
+from django.utils.html import format_html
 
 from apps.github.models.repository import Repository
 
@@ -46,8 +46,10 @@ def custom_field_github_url(self, obj) -> str:
             str: A safe HTML link to the repository on GitHub.
 
         """
-        return mark_safe(  # noqa: S308
-            f"<a href='https://github.com/{obj.owner.login}/{obj.name}' target='_blank'>↗️</a>"
+        return format_html(
+            "<a href='https://github.com/{}/{}' target='_blank'>↗️</a>",
+            obj.owner.login,
+            obj.name,
         )
 
     def custom_field_title(self, obj: Repository) -> str:

backend/apps/owasp/admin/mixins.py

@@ -2,7 +2,7 @@
 
 from django.contrib.contenttypes.admin import GenericTabularInline
 from django.contrib.contenttypes.models import ContentType
-from django.utils.html import escape
+from django.utils.html import format_html
 from django.utils.safestring import mark_safe
 
 from apps.owasp.admin.widgets import ChannelIdWidget
@@ -106,20 +106,18 @@ def custom_field_github_urls(self, obj):
                 return ""
             return self._format_github_link(obj.owasp_repository)
 
-        return mark_safe(  # noqa: S308
-            " ".join(
-                [self._format_github_link(repository) for repository in obj.repositories.all()]
-            )
+        links = [self._format_github_link(repository) for repository in obj.repositories.all()]
+        # Use mark_safe since links are already safely formatted HTML from format_html
+        return mark_safe(  # noqa: S308  # NOSEMGREP: python.django.security.audit.avoid-mark-safe.avoid-mark-safe
+            " ".join(links)
         )
 
     def custom_field_owasp_url(self, obj):
         """Entity OWASP URL with uniform formatting."""
         if not hasattr(obj, "key") or not obj.key:
             return ""
 
-        return mark_safe(  # noqa: S308
-            f"<a href='https://owasp.org/{escape(obj.key)}' target='_blank'>↗️</a>"
-        )
+        return format_html("<a href='https://owasp.org/{}' target='_blank'>↗️</a>", obj.key)
 
     def _format_github_link(self, repository):
         """Format a single GitHub repository link."""
@@ -130,9 +128,10 @@ def _format_github_link(self, repository):
         if not hasattr(repository, "key") or not repository.key:
             return ""
 
-        return mark_safe(  # noqa: S308
-            f"<a href='https://github.com/{escape(repository.owner.login)}/"
-            f"{escape(repository.key)}' target='_blank'>↗️</a>"
+        return format_html(
+            "<a href='https://github.com/{}/{}' target='_blank'>↗️</a>",
+            repository.owner.login,
+            repository.key,
         )
 
     custom_field_github_urls.short_description = "GitHub 🔗"

backend/apps/owasp/admin/widgets.py

@@ -21,4 +21,7 @@ def render(self, name, value, attrs=None, renderer=None):
             f"id='lookup_id_{name}' title='Look up related objects'></a>"
         )
 
-        return mark_safe(f"{widget_html}{search_button}")  # noqa: S308
+        # Use mark_safe since both widget_html and search_button are already HTML
+        return mark_safe(  # noqa: S308  # NOSEMGREP: python.django.security.audit.avoid-mark-safe.avoid-mark-safe
+            f"{widget_html} {search_button}"
+        )

backend/apps/slack/views.py

@@ -9,7 +9,7 @@
 slack_handler = SlackRequestHandler(SlackConfig.app)
 
 
-@csrf_exempt  # NOSONAR
+@csrf_exempt  # NOSEMGREP: python.django.security.audit.csrf-exempt.no-csrf-exempt  # NOSONAR
 @require_POST  # NOSONAR
 def slack_request_handler(request):
     """Handle Slack requests.
@@ -20,5 +20,10 @@ def slack_request_handler(request):
     Returns:
         HttpResponse: The response generated by the SlackRequestHandler.
 
+    Note:
+        CSRF exemption is required for webhook endpoints. Security is ensured through
+        Slack's request signature verification, which is automatically handled by
+        slack-bolt's SlackRequestHandler when signing_secret is configured in SlackConfig.app.
+
     """
     return slack_handler.handle(request)

cspell/Dockerfile

@@ -17,7 +17,8 @@ RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
     pnpm install --frozen-lockfile --ignore-scripts
 
 WORKDIR /nest
-
+# Reason: This is a dev-tool linter, not a production service. Root access is required for IO operations.
+# nosemgrep: dockerfile.security.missing-user-entrypoint.missing-user-entrypoint
 ENTRYPOINT ["/opt/node/node_modules/.bin/cspell"]
 
 USER node

cspell/custom-dict.txt

@@ -117,6 +117,7 @@ navlink
 nestbot
 ngx
 noinput
+nosemgrep
 nosniff
 nspname
 numfmt
@@ -147,6 +148,7 @@ saft
 sakanashi
 samm
 schemathesis
+semgrep
 seo
 skillstruck
 slackbot

docker/cspell/Dockerfile

@@ -17,7 +17,8 @@ RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
     pnpm install --frozen-lockfile --ignore-scripts
 
 WORKDIR /nest
-
+# Reason: This is a dev-tool linter, not a production service. Root access is required for IO operations.
+# nosemgrep: dockerfile.security.missing-user-entrypoint.missing-user-entrypoint
 ENTRYPOINT ["/opt/node/node_modules/.bin/cspell"]
 
 USER node

docker/semgrep/Dockerfile

@@ -0,0 +1 @@
+FROM semgrep/semgrep:1.148.0

frontend/nginx.conf

@@ -12,7 +12,8 @@ server {
         proxy_pass http://localhost:3000;
         proxy_http_version 1.1;
         proxy_set_header Connection 'upgrade';
-        proxy_set_header Host $host;
+        # Reason: Standard reverse proxy configuration; Host header forwarding is required for routing.
+        proxy_set_header Host $host; # nosemgrep: generic.nginx.security.request-host-used.request-host-used
         proxy_set_header Upgrade $http_upgrade;
         proxy_cache_bypass $http_upgrade;
     }

frontend/package.json

@@ -46,6 +46,7 @@
     "framer-motion": "^12.29.0",
     "graphql": "^16.12.0",
     "ics": "^3.8.1",
+    "isomorphic-dompurify": "^2.35.0",
     "leaflet": "^1.9.4",
     "leaflet.markercluster": "^1.5.3",
     "lodash": "^4.17.23",