How tolugit/aws-app-security-testing-pipeline works
This is a Spring Boot dashboard microservice with a widget-count endpoint and two widget lookup variants: one intentionally SQL-injection-vulnerable raw query and one parameterized-equivalent lookup. The request handler owns calls to the repository and JDBC layer; both reach the database through separate paths. The tree includes PostgreSQL and ZAP deployment manifests, and source comments describe ZAP/OpenRASP testing intent, but their runtime wiring is not shown in the sampled source, so those flows are omitted.
Main entry points: WidgetController.java Widget endpoints · WidgetRepository.java Widget repository · DashboardServiceApplication.java Spring Boot app · Widget.java Widget entity
Components 7
HTTP API
- Widget endpoints
app/dashboard-service/src/main/java/com/ast/dashboard/WidgetController.java
Persistence
- Widget repository
app/dashboard-service/src/main/java/com/ast/dashboard/WidgetRepository.java - Raw SQL access
app/dashboard-service/src/main/java/com/ast/dashboard/WidgetController.java - Widget entity
app/dashboard-service/src/main/java/com/ast/dashboard/Widget.java
Service Runtime
- Spring Boot app
app/dashboard-service/src/main/java/com/ast/dashboard/DashboardServiceApplication.java
Other components
- API client
- PostgreSQL
Connections 7
- Spring Boot app → Widget endpoints: starts service
- API client → Widget endpoints: calls routes
- Widget endpoints → Widget repository: counts / filters
- Widget endpoints → Raw SQL access: runs raw query
- Widget repository → Widget entity: maps entity
- Widget repository → PostgreSQL: reads / counts
- Raw SQL access → PostgreSQL: queries