oursky / devsecops-ci Goto Github PK
View Code? Open in Web Editor NEWSecurity checkers callable from CI
License: Apache License 2.0
Security checkers callable from CI
License: Apache License 2.0
make sure following are ignored
PS. error only if offensive file found.
currently after running checker, screen is flooded with issues. To make it easier to use (especially for QA), the report should be more organized and can be easily transfer to create git issue.
The report should also provide hint on the problem found and way to resolve it.
show what have been checked, e.g. which requirements.txt
, which code directory scanned, etc.
ensure no secrets committed to codebase.
As we see sometime npm audit report a vulnerability but there is no fix yet, without a fix this will fail a CI check thus block the PR. We shall allow suppress of individual alarm, but let the author aware that:
--target-dir
defaults to /target
/usr/local/bin/check
to check.sh
expected command:
docker run -it --rm -v "`pwd`:/target:ro" devsecops-ci check
docker run -it --rm -v "`pwd`:/target:ro" devsecops-ci check --commit-range=rev1..rev2
Find all docker-compose.yml and check password environment is configured for
If detected typescript, run tslint with microsoft sdl rules
I don't want to suppress alerts, let's generate problematic requirement.txt on the fly?
Please add the following to .dockerignore:
.git/
*.pfx
docker-compose.override.yml
Please add the following to .gitignore:
*.pfx
docker-compose.override.yml
Traceback (most recent call last):
File "main.py", line 4, in <module>
from scanner import GitScanner
File "/usr/local/devsecops-ci/git-secret/scanner.py", line 2, in <module>
from git import Repo
File "/usr/local/lib/python3.7/site-packages/git/__init__.py", line 38, in <module>
from git.exc import * # @NoMove @IgnorePep8
File "/usr/local/lib/python3.7/site-packages/git/exc.py", line 9, in <module>
from git.compat import UnicodeMixin, safe_decode, string_types
File "/usr/local/lib/python3.7/site-packages/git/compat.py", line 16, in <module>
from gitdb.utils.compat import (
ModuleNotFoundError: No module named 'gitdb.utils.compat'
make[1]: *** [Makefile:11: check] Error 1
$TARGET_DIR/.devsecops-ci
as config filepackage.json
npm audit
Use https://pypi.org/project/langdetect/ to detect language, and apply different entropy threshold, furthermore, implement a flag, disabled by default, to suppress all entropy check to non-english / non-ascii text.
sometime its better to whitelist a false positive text than ignoring whole file.
As alpine does not keep old packages.
reference: https://medium.com/@stschindler/the-problem-with-docker-and-alpines-package-pinning-18346593e891
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.