Member 2: Repair CI workflows and IDOR regression test

.dockerignore

@@ -4,3 +4,10 @@ docker-compose.yml
 .git
 .github
 .gitignore
+.semgrep-env/
+trivy-*.txt
+.env
+.env.*
+artifacts/cert/server.key
+node_modules
+artifacts/cert/server.key.backup

.env.example

@@ -0,0 +1,2 @@
+MONGODB_URI=mongodb://USERNAME:PASSWORD@HOST:27017/nodegoat
+SESSION_SECRET=replace-with-real-secret

.github/workflows/devsecops.yml

@@ -0,0 +1,113 @@
+name: DevSecOps Pipeline
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  build-and-test:
+    name: Build and Unit Test
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run unit tests
+        run: npm test
+
+  dependency-security:
+    name: Dependency Security Audit (report only)
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Dependency Security Audit
+        continue-on-error: true
+        run: npm audit --omit=dev --audit-level=high
+
+  sast-semgrep:
+    name: SAST - Semgrep
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install Semgrep
+        run: python -m pip install semgrep
+
+      - name: Run Semgrep SAST
+        run: |
+          semgrep scan \
+            --config auto \
+            --config .semgrep.yml \
+            --json \
+            --output semgrep-results.json .
+
+          python - <<'PY'
+          import json
+          with open("semgrep-results.json") as f:
+              data = json.load(f)
+          print(f"Semgrep findings: {len(data.get('results', []))}")
+          PY
+
+  gitleaks:
+    name: Secret Scanning - Gitleaks
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Run Gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  trivy:
+    name: Container Security - Trivy
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Build Docker image
+        run: docker build -t nodegoat-member4-web:${{ github.sha }} .
+
+      - name: Run Trivy vulnerability scan
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: nodegoat-member4-web:${{ github.sha }}
+          format: table
+          vuln-type: os,library
+          severity: HIGH,CRITICAL
+          exit-code: '1'

.github/workflows/e2e-test.yml

@@ -1,4 +1,5 @@
 name: E2E Test
+
 on: [push, pull_request]
 
 jobs:
@@ -9,21 +10,21 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: ["10.x", "12.x", "14.x"]
+        node-version: ["22.x"]
 
     steps:
       - name: Checkout https://github.com/${{ github.repository }}@${{ github.ref }}
-        uses: actions/checkout@v2
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 
       - name: Set up Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
 
       - name: Use cache
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         with:
           path: |
             ~/.npm
@@ -37,15 +38,37 @@ jobs:
 
       - name: Start MongoDB
         run: |
-          docker run -d -p 27017:27017 mongo:4.0
-          timeout 60s bash -c 'until nc -z -w 2 localhost 27017 && echo MongoDB ready; do sleep 2; done'
+          docker run -d --name nodegoat-mongo -p 27017:27017 mongo:4.4
+          for attempt in {1..30}; do
+            if docker exec nodegoat-mongo mongo --quiet --eval 'db.adminCommand({ ping: 1 }).ok' | grep -qx 1; then
+              echo "MongoDB ready"
+              exit 0
+            fi
+            sleep 2
+          done
+          docker logs nodegoat-mongo
+          exit 1
+
+      - name: Seed test database
+        run: npm run db:seed
 
       - name: Run E2E test suite
         id: test-suite
         run: |
-          NODE_ENV=test npm start -- --silent &
+          NODE_ENV=test npm start -- --silent > /tmp/nodegoat.log 2>&1 &
+          for attempt in $(seq 1 30); do
+            if curl --silent --fail http://localhost:4000/login >/dev/null; then
+              break
+            fi
+            sleep 2
+          done
+          curl --silent --fail http://localhost:4000/login >/dev/null || { cat /tmp/nodegoat.log; exit 1; }
           npm run test:ci -- --config video=true
 
+      - name: Show application logs on failure
+        if: failure() && (steps.test-suite.outcome == 'failure')
+        run: cat /tmp/nodegoat.log
+
       - name: Prepare cypress artifacts
         if: failure() && (steps.test-suite.outcome == 'failure')
         working-directory: ./test/e2e
@@ -55,7 +78,7 @@ jobs:
 
       - name: Upload cypress artifacts
         if: failure() && (steps.test-suite.outcome == 'failure')
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v4
         with:
           name: cypress-artifacts-node${{ matrix.node-version }}
-          path: test/e2e/screenshots
+          path: test/e2e/screenshots

.github/workflows/lint.yml

@@ -9,18 +9,21 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: ["14.x"]
+        node-version: ["22.x"]
 
     steps:
       - name: Checkout https://github.com/${{ github.repository }}@${{ github.ref }}
-        uses: actions/checkout@v2
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 
       - name: Set up Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
 
+      - name: Install dependencies
+        run: npm ci
+
       - name: Run linter
-        run: npx --no-install jshint@2.12.0 .
+        run: npx --no-install jshint .

.gitignore

@@ -24,8 +24,12 @@ test/e2e/screenshots/
 test/e2e/videos/
 
 # ignore sensitive files
-.env.local
 .env
+.env.*
+!.env.example
+artifacts/cert/server.key.backup
 
 # ignore Snyk Code scanner files
 .dccache
+
+/scan-comparison/

.semgrep.yml

@@ -0,0 +1,7 @@
+rules:
+  - id: nodegoat-eval-user-input
+    languages:
+      - javascript
+    message: "User-controlled input is passed to eval(). Use numeric parsing instead."
+    severity: ERROR
+    pattern: eval(req.body.$FIELD)