improved CI/CD github workflows to make security checks & fixed security holes

.github/workflows/CD-Pipeline.yml

@@ -0,0 +1,13 @@
+name: Continuous Deployment Pipeline
+
+on:
+    push:
+        branches: [main]
+
+jobs:
+    Web_Deploy:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+            - name: Trigger Deployment
+              run: curl https://api.render.com/deploy/srv-${{ secrets.RENDER_SERVICE_ID }}?key=${{ secrets.RENDER_API_KEY }}

.github/workflows/Deployment-Pipeline.yml → .github/workflows/CI-Pipeline.yml

@@ -1,10 +1,6 @@
-name: FullStack Deployment Pipeline
+name: Continuous Integration Pipeline
 
-on:
-  push:
-    branches:
-      - main
-
+on:    
   pull_request:
     branches: [main]
     types: [opened, synchronize]
@@ -28,6 +24,9 @@ jobs:
       - name: Check style
         run: npm run lint
 
+      - name: Check Security
+        run: npx eslint .
+
   Backend-Pipeline:
     runs-on: ubuntu-latest
     defaults:
@@ -46,6 +45,9 @@ jobs:
       - name: Check style
         run: npm run lint
 
+      - name: Check security
+        run: npx eslint .
+
       - name: Run tests
         run: npm run test
 
@@ -100,12 +102,4 @@ jobs:
         with:
           name: playwright-report
           path: playwright-report/
-          retention-days: 30
-
-  Web_Deploy:
-    runs-on: ubuntu-latest
-    needs: [Frontend-Pipeline,Backend-Pipeline,Playwright-E2E-Tests]
-    steps:
-      - uses: actions/checkout@v4
-      - name: Trigger Deployment
-        run: curl https://api.render.com/deploy/srv-${{ secrets.RENDER_SERVICE_ID }}?key=${{ secrets.RENDER_API_KEY }}
+          retention-days: 30

back/eslint.config.mjs

@@ -1,16 +1,12 @@
 // @ts-check
 import eslint from '@eslint/js';
-import eslintPluginPrettierRecommended from 'eslint-plugin-prettier/recommended';
 import globals from 'globals';
 import tseslint from 'typescript-eslint';
+import pluginSecurity from 'eslint-plugin-security';
 
 export default tseslint.config(
-  {
-    ignores: ['eslint.config.mjs'],
-  },
   eslint.configs.recommended,
   ...tseslint.configs.recommendedTypeChecked,
-  eslintPluginPrettierRecommended,
   {
     languageOptions: {
       globals: {
@@ -23,12 +19,17 @@ export default tseslint.config(
         tsconfigRootDir: import.meta.dirname,
       },
     },
+    plugins: {
+      security: pluginSecurity,
+    }
   },
   {
     rules: {
       '@typescript-eslint/no-explicit-any': 'off',
       '@typescript-eslint/no-floating-promises': 'warn',
-      '@typescript-eslint/no-unsafe-argument': 'warn'
+      '@typescript-eslint/no-unsafe-argument': 'warn',
+      ...pluginSecurity.configs.recommended.rules,
     },
   },
+  { ignores: ['eslint.config.mjs', "node_modules", "dist", "bonsai", "coverage", "public"], },
 );

back/package.json

@@ -62,6 +62,7 @@
     "eslint": "^9.39.3",
     "eslint-config-prettier": "^10.0.1",
     "eslint-plugin-prettier": "^5.2.2",
+    "eslint-plugin-security": "^4.0.0",
     "globals": "^16.0.0",
     "jest": "^29.7.0",
     "prettier": "^3.4.2",

back/src/types/verify.ts

@@ -18,8 +18,8 @@ export const isString = (text: unknown): text is string => {
 };
 
 export const isNumber = (value: unknown): value is number => {
-  if (typeof value === 'string')
-    return value.trim() !== '' && /^-?\d+(\.\d+)?$/.test(value.trim());
+  if (typeof value === 'string') 
+    return value.trim() !== '' && !isNaN(Number(value.trim()));
   return (
     value !== null &&
     value !== undefined &&

front/eslint.config.js

@@ -3,11 +3,12 @@ import globals from 'globals'
 import reactHooks from 'eslint-plugin-react-hooks'
 import reactRefresh from 'eslint-plugin-react-refresh'
 import tseslint from 'typescript-eslint'
+import pluginSecurity from 'eslint-plugin-security';
 
 export default tseslint.config(
-  { ignores: ['dist'] },
+  js.configs.recommended, 
+  ...tseslint.configs.recommended,
   {
-    extends: [js.configs.recommended, ...tseslint.configs.recommended],
     files: ['**/*.{ts,tsx}'],
     languageOptions: {
       ecmaVersion: 2020,
@@ -16,13 +17,16 @@ export default tseslint.config(
     plugins: {
       'react-hooks': reactHooks,
       'react-refresh': reactRefresh,
+      'security': pluginSecurity
     },
     rules: {
       ...reactHooks.configs.recommended.rules,
+      ...pluginSecurity.configs.recommended.rules,
       'react-refresh/only-export-components': [
         'warn',
         { allowConstantExport: true },
       ],
     },
   },
+  { ignores: ["node_modules", "build", 'dist'] },
 )