release: code security scanner (#552) #717

Merged

jmiller merged 3 commits from dev into main 2026-06-28 19:00:45 +00:00

Conversation 0 Commits 3 Files Changed 5

+347 -4

jmiller commented 2026-06-28 18:50:00 +00:00

Owner

Copy Link

Copy Source

Summary

• Code security scanner with 22 OWASP pattern detection rules across 7 CWE categories
• Language-filtered scanning for Go, PHP, Python, JS/TS, Java, C#, Ruby
• Wired into scanner orchestrator via existing CodeScanner config toggle
• API: code_scanner field added to GET/PATCH /security/config
• Web UI toggle already existed in settings template

Rules by Category

Category	CWE	Rules	Languages
SQL Injection	CWE-89	4	Go, PHP, Python, JS/TS
XSS	CWE-79	4	JS/TS, PHP, React
Command Injection	CWE-78	5	Go, PHP, JS/TS, Python
Path Traversal	CWE-22	3	Go, JS/TS, Python, PHP
Insecure Deserialization	CWE-502	2	PHP, Python
Hardcoded Credentials	CWE-798	1	All
Weak Cryptography	CWE-327	2	Go, Python, C#, Java

Closes

• feat(security): code security analysis scanner module (#552)

Test plan

• Enable code scanner via API: PATCH /security/config {"code_scanner": true}
• Trigger scan: POST /security/scan
• Verify alerts appear for repos with known patterns
• Verify comment lines are skipped
• Verify binary/vendor/node_modules files are skipped

https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd

## Summary - Code security scanner with 22 OWASP pattern detection rules across 7 CWE categories - Language-filtered scanning for Go, PHP, Python, JS/TS, Java, C#, Ruby - Wired into scanner orchestrator via existing `CodeScanner` config toggle - API: `code_scanner` field added to GET/PATCH `/security/config` - Web UI toggle already existed in settings template ### Rules by Category | Category | CWE | Rules | Languages | |----------|-----|-------|-----------| | SQL Injection | CWE-89 | 4 | Go, PHP, Python, JS/TS | | XSS | CWE-79 | 4 | JS/TS, PHP, React | | Command Injection | CWE-78 | 5 | Go, PHP, JS/TS, Python | | Path Traversal | CWE-22 | 3 | Go, JS/TS, Python, PHP | | Insecure Deserialization | CWE-502 | 2 | PHP, Python | | Hardcoded Credentials | CWE-798 | 1 | All | | Weak Cryptography | CWE-327 | 2 | Go, Python, C#, Java | ## Closes - #552 ## Test plan - [ ] Enable code scanner via API: `PATCH /security/config {"code_scanner": true}` - [ ] Trigger scan: `POST /security/scan` - [ ] Verify alerts appear for repos with known patterns - [ ] Verify comment lines are skipped - [ ] Verify binary/vendor/node_modules files are skipped https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd

jmiller added 3 commits 2026-06-28 18:50:01 +00:00

feat: code security scanner with OWASP pattern detection (#552) ... 7c75133ef1

Implements the code analysis scanner module that detects insecure
patterns across Go, PHP, Python, JavaScript, and TypeScript:

- SQL injection (CWE-89): string concat in queries across 4 languages
- XSS (CWE-79): innerHTML, document.write, unescaped output, dangerouslySetInnerHTML
- Command injection (CWE-78): exec with variables, shell=True, os.system
- Path traversal (CWE-22): unsanitized path joins, file open with user input
- Insecure deserialization (CWE-502): unserialize(), yaml.load()
- Hardcoded credentials (CWE-798): password assignments in source
- Weak cryptography (CWE-327): MD5/SHA-1 usage

22 rules total, language-filtered by file extension. Wired into the
existing scanner orchestrator via the CodeScanner config toggle.
API updated to expose code_scanner in GET/PATCH security config.

Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd

docs: update README to reflect code security scanner ... 66aea89b40

Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd

Merge pull request 'feat: code security scanner with OWASP pattern detection (#552)' (#716) from feature/code-scanner into dev 87f92fe1ab

jmiller merged commit f8a91ed34e into main 2026-06-28 19:00:45 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

breaking-change

Breaking API or behavior change

ci-cd

CI/CD pipeline changes

config

Configuration changes

dependencies

Dependency updates

deploy-failure

Deployment failed

docker

Docker/container changes

documentation

Documentation changes

feature: wiki

Wiki system enhancements

good first issue

Good for newcomers

health-check

Repo health check result

help wanted

Extra attention needed

mokostandards

Related to MokoStandards framework

push-failure

Git push operation failed

security

Security vulnerability or hardening

size/l

200-500 lines changed

size/m

50-200 lines changed

size/s

10-50 lines changed

size/xl

500+ lines changed

size/xs

< 10 lines changed

standards-drift

Deviates from MokoStandards

standards-update

MokoStandards compliance update

sync-failure

Sync or mirror failed

tech-debt

Technical debt and TODO/FIXME items

upstream

upstream

Inherited from upstream Gitea

work-in-progress

Draft or incomplete work

bug

Something is not working

duplicate

This issue or pull request already exists

enhancement

New feature

help wanted

Need some help

invalid

Something is wrong

question

More information is needed

wontfix

This won't be fixed

No labels

Priority -

Type -

Milestone

No items

No Milestone

Assignees

Clear assignees

jmiller (Jonathan Miller) moko-deploy (Moko Deploy Bot)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoGitea-Fork#717