Skip to content

Actions: COG-GTM/juice-shop

Actions

CI/CD Pipeline

Actions

Loading...
Loading

Show workflow options

Create status badge

Loading
ci.yml
648 workflow runs
648 workflow runs

Filter by Event

⌥ + click/return to exclude

Filter by Status

⌥ + click/return to exclude

Filter by Branch

⌥ + click/return to exclude

Filter by Actor

⌥ + click/return to exclude
bug: fix reflected DOM XSS in search results (q parameter) CI/CD Pipeline #648: Pull request #370 opened by mac-cg
12m 8s devin/1789471988-fix-reflected-dom-xss-develop
devin/1789471988-fix-reflected-dom-xss-develop
12m 8s
bug: assert search query renders escaped in the DOM CI/CD Pipeline #647: Commit f26551c pushed by devin-ai-integration Bot
9m 13s devin/1789471988-fix-reflected-dom-xss-develop
devin/1789471988-fix-reflected-dom-xss-develop
9m 13s
Fix: Mass assignment of role in unauthenticated POST /api/Users lets anyone register an admin account CI/CD Pipeline #646: Pull request #369 opened by WesternConcrete
10m 13s devin/1789456153-fix-role-mass-assignment
devin/1789456153-fix-role-mass-assignment
10m 13s
Fix: strip client-supplied role from user registration requests CI/CD Pipeline #645: Commit 552df4b pushed by devin-ai-integration Bot
12m 8s devin/1789456153-fix-role-mass-assignment
devin/1789456153-fix-role-mass-assignment
12m 8s
Fix: Zip Slip path traversal in POST /file-upload: ZIP entry paths are only checked with a substring match, allowing arbitrary file write anywhere under the application root CI/CD Pipeline #644: Pull request #368 opened by WesternConcrete
12m 37s devin/1789456057-fix-zip-slip-file-upload
devin/1789456057-fix-zip-slip-file-upload
12m 37s
Fix: confine ZIP upload extraction to uploads/complaints directory CI/CD Pipeline #643: Commit 57d991d pushed by devin-ai-integration Bot
9m 33s devin/1789456057-fix-zip-slip-file-upload
devin/1789456057-fix-zip-slip-file-upload
9m 33s
Fix: XML external entity (XXE) injection in POST /file-upload: libxmljs2 parses uploaded XML with noent: true, allowing local file disclosure CI/CD Pipeline #642: Pull request #367 opened by WesternConcrete
12m 14s devin/1789455882-fix-xxe-file-upload
devin/1789455882-fix-xxe-file-upload
12m 14s
Fix: disable external entity substitution in B2B XML upload parser CI/CD Pipeline #641: Commit 5a67aa2 pushed by devin-ai-integration Bot
9m 6s devin/1789455882-fix-xxe-file-upload
devin/1789455882-fix-xxe-file-upload
9m 6s
Fix: Unauthenticated access to customer order confirmation PDFs via /ftp CI/CD Pipeline #640: Pull request #365 synchronize by devin-ai-integration Bot
11m 47s devin/1789370006-order-pdf-owner-check-develop
devin/1789370006-order-pdf-owner-check-develop
11m 47s
Harden order PDF token selection and ownership check CI/CD Pipeline #639: Commit 1ebcb7d pushed by devin-ai-integration Bot
9m 35s devin/1789370006-order-pdf-owner-check-develop
devin/1789370006-order-pdf-owner-check-develop
9m 35s
Fix: Unauthenticated access to customer order confirmation PDFs via /ftp CI/CD Pipeline #638: Pull request #365 synchronize by devin-ai-integration Bot
8m 33s devin/1789370006-order-pdf-owner-check-develop
devin/1789370006-order-pdf-owner-check-develop
8m 33s
Add FTP order ownership integration coverage CI/CD Pipeline #637: Commit 85ec9e1 pushed by devin-ai-integration Bot
9m 18s devin/1789370006-order-pdf-owner-check-develop
devin/1789370006-order-pdf-owner-check-develop
9m 18s
Fix: Missing ownership check on PUT /api/Addresss/:id allows modifying other users' saved addresses CI/CD Pipeline #636: Pull request #366 synchronize by devin-ai-integration Bot
12m 31s devin/1789370009-address-update-owner-check-develop
devin/1789370009-address-update-owner-check-develop
12m 31s
Return validation errors under error and sync codefix variants CI/CD Pipeline #635: Commit 5f37879 pushed by devin-ai-integration Bot
9m 22s devin/1789370009-address-update-owner-check-develop
devin/1789370009-address-update-owner-check-develop
9m 22s
Fix: Unauthenticated access to customer order confirmation PDFs via /ftp CI/CD Pipeline #634: Pull request #365 synchronize by devin-ai-integration Bot
12m 5s devin/1789370006-order-pdf-owner-check-develop
devin/1789370006-order-pdf-owner-check-develop
12m 5s
Verify order PDF ownership against the JWT and stored order CI/CD Pipeline #633: Commit beff0d0 pushed by devin-ai-integration Bot
9m 37s devin/1789370006-order-pdf-owner-check-develop
devin/1789370006-order-pdf-owner-check-develop
9m 37s
Fix: Missing ownership check on PUT /api/Addresss/:id allows modifying other users' saved addresses CI/CD Pipeline #632: Pull request #366 opened by WesternConcrete
9m 26s devin/1789370009-address-update-owner-check-develop
devin/1789370009-address-update-owner-check-develop
9m 26s
Fix: Unauthenticated access to customer order confirmation PDFs via /ftp CI/CD Pipeline #631: Pull request #365 opened by WesternConcrete
10m 29s devin/1789370006-order-pdf-owner-check-develop
devin/1789370006-order-pdf-owner-check-develop
10m 29s
Fix: Unauthenticated access to customer order confirmation PDFs via /ftp CI/CD Pipeline #630: Pull request #364 opened by WesternConcrete
11m 55s devin/1789369761-order-pdf-owner-check
devin/1789369761-order-pdf-owner-check
11m 55s
Enforce address ownership on PUT /api/Addresss/:id CI/CD Pipeline #629: Commit 18a0edd pushed by devin-ai-integration Bot
9m 38s devin/1789369815-address-update-owner-check
devin/1789369815-address-update-owner-check
9m 38s
Require order ownership to download order confirmation PDFs CI/CD Pipeline #628: Commit 5a7f7f6 pushed by devin-ai-integration Bot
9m 18s devin/1789369761-order-pdf-owner-check
devin/1789369761-order-pdf-owner-check
9m 18s
Fix: Server-side template injection: GET /profile passes the user-controlled username to eval(), enabling remote code execution CI/CD Pipeline #627: Pull request #363 opened by WesternConcrete
12m 24s devin/1789283345-profile-ssti-eval-develop
devin/1789283345-profile-ssti-eval-develop
12m 24s
Fix: remove eval() of user-controlled username in GET /profile (SSTI/… CI/CD Pipeline #626: Commit 3c3cd40 pushed by devin-ai-integration Bot
11m 36s devin/1789283345-profile-ssti-eval-develop
devin/1789283345-profile-ssti-eval-develop
11m 36s
Fix: Server-side template injection: GET /profile passes the user-controlled username to eval(), enabling remote code execution CI/CD Pipeline #625: Pull request #362 opened by WesternConcrete
13m 10s devin/1789283286-profile-ssti-eval
devin/1789283286-profile-ssti-eval
13m 10s
Fix: remove eval() of user-controlled username in GET /profile (SSTI/… CI/CD Pipeline #624: Commit da93327 pushed by devin-ai-integration Bot
8m 51s devin/1789283286-profile-ssti-eval
devin/1789283286-profile-ssti-eval
8m 51s