Add DevSecOps-10309 demo page with intentional vulnerabilities for GHAS scanning by Copilot · Pull Request #143 · githubabcs-devops/gh-advsec-devsecops

Copilot · 2026-02-12T21:31:55Z

New demo page showcasing GitHub Advanced Security capabilities through intentional security vulnerabilities and 2026 GHAS feature updates.

New Files

DevSecOps-10309.cshtml - Razor page with GHAS news, interactive vulnerability demos (ReDoS, SQL injection testing)
DevSecOps-10309.cshtml.cs - Code-behind with ILogger and intentional security flaws

Intentional Vulnerabilities

Implements patterns that GHAS code scanning should detect:

// Log forging - unsanitized user input
_logger.LogInformation($"User accessed page: {userInput}");

// ReDoS - nested quantifiers
private static readonly Regex VulnerableRegex = new Regex(@"^(a+)+$");

// SQL injection - string concatenation
string query = "SELECT * FROM Users WHERE UserId = " + userId;

// Hardcoded credentials
private const string CONNECTION_STRING = "Server=prod-sql;User Id=sa;Password=P@ssw0rd123!;";

// Insecure deserialization
JsonConvert.DeserializeObject<List<string>>(jsonData, new JsonSerializerSettings {
    TypeNameHandling = TypeNameHandling.Auto
});

Package Changes

Downgraded to vulnerable versions for demonstration:

Newtonsoft.Json: 13.0.1 → 12.0.2 (GHSA-5crp-9r3c-p9vr)
System.Text.Json: 8.0.4 (GHSA-8g4q-xg66-9fp4)
Microsoft.Data.SqlClient: 5.0.2 (GHSA-98g6-xh36-x2p7)

UI Updates

Added navigation link in Index.cshtml to new demo page.

Original prompt

This section details on the original issue you should resolve

<issue_title>feat: DevSecOps (04)</issue_title>
<issue_description>- Use the gh-advsec-devsecops repository from the workspace

Create me a new unique branch name under feature/devsecops-demo-[randon-number]

Create a new DevSecOps-[random-number].cshtml page and reference it into the Index page.

Add some content to it with some latest news about GitHub Advanced Security.

Implemented the ILogger for the backend code of the page.

For demo purpose, generate some C# insecure code, like log forging or regex exposure

Add package System.Text.Json --version 8.0.4

Add package Microsoft.Data.SqlClient --version 5.0.2

Add package newtonsoft.json --version 12.0.2

Build the webapp to make sure there are not build errors.

Prepare for committing the changes.</issue_description>

<agent_instructions>implement this</agent_instructions>

Comments on the Issue (you are @copilot in this section)

Fixes feat: DevSecOps (04) #122

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

…ate packages Co-authored-by: CalinL <10718943+CalinL@users.noreply.github.com>

github-actions · 2026-10-08T11:36:39Z

Dependency Review

The following issues were found:

❌ 1 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
✅ 0 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA f8ee66d.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Vulnerabilities

src/webapp01/webapp01.csproj

Name	Version	Vulnerability	Severity
Newtonsoft.Json	12.0.2	Improper Handling of Exceptional Conditions in Newtonsoft.Json	high

Only included vulnerabilities with severity moderate or higher.

OpenSSF Scorecard

Package

Version

Score

Details

nuget/Newtonsoft.Json

12.0.2

🟢 5.6

Details

Check	Score	Reason
Code-Review	⚠️ 2	Found 7/30 approved changesets -- score normalized to 2
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	19 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	🟢 9	SAST tool detected but not run on all commits

Scanned Files

src/webapp01/webapp01.csproj

github-actions · 2026-10-08T11:36:40Z

Dependency Review

The following issues were found:

❌ 1 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
✅ 0 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA f8ee66d.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Vulnerabilities

src/webapp01/webapp01.csproj

Name	Version	Vulnerability	Severity
Newtonsoft.Json	12.0.2	Improper Handling of Exceptional Conditions in Newtonsoft.Json	high

Only included vulnerabilities with severity moderate or higher.

OpenSSF Scorecard

Package

Version

Score

Details

nuget/Newtonsoft.Json

12.0.2

🟢 5.6

Details

Check	Score	Reason
Code-Review	⚠️ 2	Found 7/30 approved changesets -- score normalized to 2
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	19 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	🟢 9	SAST tool detected but not run on all commits

Scanned Files

src/webapp01/webapp01.csproj

+        public void OnGet()
+        {
+            // VULNERABILITY: Log forging - user input directly in logs without sanitization
+            string userInput = Request.Query.ContainsKey("user") ? Request.Query["user"].ToString() ?? "anonymous" : "anonymous";


+            LoadLatestGHASNews();
+
+            // Demonstrate ReDoS vulnerability
+            string testPattern = Request.Query.ContainsKey("pattern") ? Request.Query["pattern"].ToString() ?? "aaa" : "aaa";


+            catch (Exception ex)
+            {
+                // VULNERABILITY: Logging full exception details including stack trace
+                _logger.LogError($"Regex evaluation failed for pattern: {testPattern}. Error: {ex.ToString()}");
+            }


+            catch (Exception ex)
+            {
+                _logger.LogError($"Database connection failed: {ex.Message}");
+            }


+            catch (Exception ex)
+            {
+                // VULNERABILITY: Logging sensitive information and full stack trace
+                _logger.LogError($"Regex test failed for pattern: {pattern}. Exception: {ex.ToString()}");
+                TempData["RegexError"] = "Pattern evaluation failed - potential ReDoS attack detected";
+            }


+            catch (Exception ex)
+            {
+                // VULNERABILITY: Logging detailed error information
+                _logger.LogError($"SQL execution failed for userId: {userId}. Error: {ex.ToString()}");
+                TempData["RegexError"] = "SQL query failed";
+            }


+            catch (Exception ex)
+            {
+                // VULNERABILITY: Logging full exception details including stack trace
+                _logger.LogError($"Regex evaluation failed for pattern: {testPattern}. Error: {ex.ToString()}");


+            catch (Exception ex)
+            {
+                // VULNERABILITY: Logging sensitive information and full stack trace
+                _logger.LogError($"Regex test failed for pattern: {pattern}. Exception: {ex.ToString()}");


+            catch (Exception ex)
+            {
+                // VULNERABILITY: Logging detailed error information
+                _logger.LogError($"SQL execution failed for userId: {userId}. Error: {ex.ToString()}");


Initial plan

3f15da6

Copilot AI assigned Copilot and CalinL Feb 12, 2026

Copilot started work on behalf of CalinL February 12, 2026 21:32 View session

feat: Add DevSecOps-10309 demo page with GHAS vulnerabilities and upd…

e8273a2

…ate packages Co-authored-by: CalinL <10718943+CalinL@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add DevSecOps page with news and logging issues~~ Add DevSecOps-10309 demo page with intentional vulnerabilities for GHAS scanning Feb 12, 2026

Copilot AI requested a review from CalinL February 12, 2026 21:37

Copilot finished work on behalf of CalinL February 12, 2026 21:37

github-code-quality Bot found potential problems Feb 12, 2026

View reviewed changes

Update page title for DevSecOps demo

f8ee66d

github-code-quality Bot found potential problems Oct 8, 2026

View reviewed changes

Navigation Menu

Repository navigation

Add DevSecOps-10309 demo page with intentional vulnerabilities for GHAS scanning - #143

Add DevSecOps-10309 demo page with intentional vulnerabilities for GHAS scanning#143
CalinL with Copilot wants to merge 3 commits into
mainfrom
copilot/featuredevsecops-demo-12345-yet-again

Copilot AI commented Feb 12, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 8, 2026

Uh oh!

github-actions Bot commented Oct 8, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Copilot AI commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

New Files

Intentional Vulnerabilities

Package Changes

UI Updates

Comments on the Issue (you are @copilot in this section)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 8, 2026

Dependency Review

Snapshot Warnings

Vulnerabilities

src/webapp01/webapp01.csproj

OpenSSF Scorecard

Scanned Files

Uh oh!

github-actions Bot commented Oct 8, 2026

Dependency Review

Snapshot Warnings

Vulnerabilities

src/webapp01/webapp01.csproj

OpenSSF Scorecard

Scanned Files

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Feb 12, 2026 •

edited

Loading