feat: Implement DevSecOps demo page

[CalinL]

No description provided.

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 72f21a5.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Vulnerabilities

src/webapp01/webapp01.csproj

Name	Version	Vulnerability	Severity
Newtonsoft.Json	12.0.2	Improper Handling of Exceptional Conditions in Newtonsoft.Json	high

Only included vulnerabilities with severity moderate or higher.

OpenSSF Scorecard

Package	Version	Score	Details
nuget/Newtonsoft.Json	12.0.2	🟢 5	Details Check Score Reason Code-Review 🟢 3 Found 10/30 approved changesets -- score normalized to 3 Maintained 🟢 5 4 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 5 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Vulnerabilities 🟢 10 0 existing vulnerabilities detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 7 SAST tool detected but not run on all commits

Scanned Files

• src/webapp01/webapp01.csproj

To fix the issue, replace the generic catch (Exception ex) block with specific exception types that are relevant to the Regex.IsMatch operation. For example:

• ArgumentException can be caught to handle invalid regex patterns.
• Any other exceptions that are critical or unexpected should not be caught here and should propagate to higher levels.

This ensures that only anticipated errors are handled, while critical exceptions are not suppressed.

---

[Copilot]

Pull Request Overview

This PR introduces a DevSecOps demo page to showcase insecure code patterns for educational purposes while adding a new dependency.

• Adds Newtonsoft.Json to the project file.
• Updates the homepage to link to the new DevSecOps demo page.
• Implements a new demo page with backend logic demonstrating insecure logging and a vulnerable regex pattern.

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/webapp01/webapp01.csproj	Added a reference to Newtonsoft.Json to support JSON operations.
src/webapp01/Pages/Index.cshtml	Updated the homepage to include a link to the new DevSecOps demo page.
src/webapp01/Pages/DevSecOps.cshtml.cs	New backend implementation demonstrating insecure logging and regex vulnerability patterns.
src/webapp01/Pages/DevSecOps.cshtml	New frontend view for the DevSecOps demo page.

Comments suppressed due to low confidence (1)

src/webapp01/webapp01.csproj:16

• [nitpick] Both Newtonsoft.Json and System.Text.Json are referenced; consider verifying if both libraries are necessary or if consolidating to one could simplify JSON handling.

    <PackageReference Include="Newtonsoft.Json" Version="12.0.2" />

[Copilot]

This direct concatenation of user input is intentionally insecure for demonstration of log forging; consider adding a clearer comment or a TODO indicating that this should never be used in production.

Suggested change

	_logger.LogInformation("User input from query: " + UserInput);
	_logger.LogInformation("User input from query: {UserInput}", UserInput);

[Copilot]

Since the regex pattern is known to be vulnerable to ReDoS, add a comment or a TODO note clarifying that this insecure regex is for demonstration purposes only.

Suggested change

	// GHAS Code Scanning can often detect such vulnerable regex patterns.
	// GHAS Code Scanning can often detect such vulnerable regex patterns.
	// TODO: This regex pattern is insecure and vulnerable to ReDoS attacks.
	// It is used here for demonstration purposes only and should not be used in production.