Frogbot Configuration Refactor #993
Conversation
orto17
commented
Dec 10, 2025
orto17
commented
- All tests passed. If this feature is not already covered by the tests, I added new tests.
- This pull request is on the dev branch.
- I used gofmt for formatting the code before submitting the pull request.
- Update documentation about new features / new supported technologies
eranturgeman
left a comment
eranturgeman
left a comment
There was a problem hiding this comment.
See my comments, lets discuss on whatever needed
| } | ||
|
|
||
| // After fixing the current vulnerability, checkout to the base branch to start fixing the next vulnerability | ||
| if e := cfp.gitManager.Checkout(cfp.scanDetails.BaseBranch()); e != nil { |
There was a problem hiding this comment.
you cannot remove this. we must return to the base branch between fixes so we will keep the worktree clean between fixes. This causes a lot of trouble in the past
There was a problem hiding this comment.
we are always at the base branch, there are no different projects anymore that we are iterating
There was a problem hiding this comment.
but remember that each fix is made in its own branch. then we need to create and checkout another branch for the next fix when fixing one by one.
Dont you think it will be safer to move to the base branch between fixes?
There was a problem hiding this comment.
i will test it for multiple fixed to understand the correct behavior
orto17
force-pushed
the
adjust-configuration
branch
from
2d1e065 to
7091fe5
Compare
eranturgeman
requested a deployment
to
frogbot
GitHub Actions
Waiting
eranturgeman
added
the
safe to test
github-actions
bot
removed
the
safe to test
eranturgeman
requested a deployment
to
frogbot
GitHub Actions
Waiting
eranturgeman
added
the
safe to test
github-actions
bot
removed
the
safe to test
eranturgeman
requested a deployment
to
frogbot
GitHub Actions
Waiting
eranturgeman
added
the
safe to test
github-actions
bot
removed
the
safe to test
eranturgeman
requested a deployment
to
frogbot
GitHub Actions
Waiting
eranturgeman
added
the
safe to test
github-actions
bot
removed
the
safe to test
eranturgeman
requested a deployment
to
frogbot
GitHub Actions
Waiting
eranturgeman
added
the
safe to test
github-actions
bot
removed
the
safe to test
|
📗 Scan Summary
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewUnsafe deserialization in Go occurs when a program deserializes untrusted Vulnerable exampleimport (
"github.com/go-yaml/yaml"
"net/http"
)
func storeHandler(w http.ResponseWriter, r *http.Request) {
var data map[string]interface{}
yaml.Unmarshal([]byte(r.URL.Query().Get("data")), &data) // NOT OK
}This code uses Remediationimport (
"github.com/go-yaml/yaml"
"net/http"
)
func storeHandler(w http.ResponseWriter, r *http.Request) {
var data map[string]interface{}
yaml.UnmarshalStrict([]byte(r.URL.Query().Get("data")), &data) // SAFE
}Using Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
3 participants
