Express Secure

An API-driven SPA written using ReactJS that provides users with the ability to perform static analysis scans of their public NodeJS Express GitHub repositories.
Explore the code »

View Demo · Report Bug · Explore Backend API code

Table of Contents

1. About The Project
   • Built With
2. Getting Started
   • Prerequisites
   • Installation
3. Usage
4. Roadmap
5. Contributing
6. License
7. Contact
8. Acknowledgments

About The Project

Express Secure is a single-page application that interacts with an RESTful API to perform identify software vulnerabilities in NodeJS Express repositories. The application allows the user to specify a GitHub account and import the repositories and branches related to that account. A branch can be selected to perform a scan and return the identified vulnerabilities.

(back to top)

Built With

• https://reactjs.org/
• https://fontawesome.com/v5/docs/web/use-with/react
• https://react-bulma.dev/en
• https://www.djangoproject.com/
• https://github.com/ajinabraham/njsscan/
• https://docs.github.com/en/rest/

(back to top)

Getting Started

To get a local copy up and running follow these simple steps.

ER Diagram

Wireframe

Prerequisites

The client requires the backend API https://github.com/hcduffey/express-secure-api to work.

Installation

1. Clone the repo

   git clone https://github.com/hcduffey/express-secure-client.git

2. Install the dependencies

   npm i

3. Run it

   npm start

(back to top)

Usage

You must first import or select an existing GitHub account by clicking the person button on the right-hand side of the navigation bar.

Initiating a Scan

Select one of the imported repositories from the drop-down, and click the sync button to list the branches for that repository. Click the desired branch to scan, and the press the 'New Scan' button. The vulnerability results will be returned in the main table. You can download a CSV file with the details of the scan results and get an overview of the results.

Removing GitHub Accounts

Click the toolbox button on the right-hand side of the nav bar. You will be presented with a list of the currently imported GitHub accounts. Click the trashcan icon next to the account you want to remove to delete it. This will also remove any repositories, branches, scans, and vulnerabilities associated with that account.

(back to top)

Roadmap

• Provide users with some identifier for repositories that are NodeJS Express applications to show that they can be scanned with useful results
• The currently used scanning package will timeout or generate errors for larger repositories. Either address these limitations, or change to a different scanning package (currently using NodeJSScan).

(back to top)

Contributing

Contributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are greatly appreciated.

If you have a suggestion that would make this better, please fork the repo and create a pull request. You can also simply open an issue with the tag "enhancement". Don't forget to give the project a star! Thanks again!

1. Fork the Project
2. Create your Feature Branch (git checkout -b feature/AmazingFeature)
3. Commit your Changes (git commit -m 'Add some AmazingFeature')
4. Push to the Branch (git push origin feature/AmazingFeature)
5. Open a Pull Request

(back to top)

License

Distributed under the MIT License. See LICENSE.txt for more information.

(back to top)

Contact

Cliff Duffey - @cliffduffey2

Project Link: https://github.com/hcduffey/express-secure-client

API Project Link: https://github.com/hcduffey/express-secure-api

(back to top)

Acknowledgments

• Best-README-Template

(back to top)