oursky / devsecops-ci Goto Github PK

make sure following are ignored

• .git
• .svn
• *.gpg
• *.pfx
• *.pem
• *.cer
• *.cert
• *.p12
• *.key
• .env
• docker-compose.override.yml

PS. error only if offensive file found.

currently after running checker, screen is flooded with issues. To make it easier to use (especially for QA), the report should be more organized and can be easily transfer to create git issue.

The report should also provide hint on the problem found and way to resolve it.

show what have been checked, e.g. which requirements.txt, which code directory scanned, etc.

https://github.com/securego/gosec

ensure no secrets committed to codebase.

• check with filename pattern
• content aware, check with entropy

As we see sometime npm audit report a vulnerability but there is no fix yet, without a fix this will fail a CI check thus block the PR. We shall allow suppress of individual alarm, but let the author aware that:

1. should create an issue on github and remove the suppressed alarm when a fix is ready.
2. list out what is suppressed when running the checker.

• cocoapod
• gradle
• npm
• pip

• --target-dir defaults to /target
• alias /usr/local/bin/check to check.sh

expected command:

docker run -it --rm -v "`pwd`:/target:ro" devsecops-ci check
docker run -it --rm -v "`pwd`:/target:ro" devsecops-ci check --commit-range=rev1..rev2

https://github.com/PyCQA/bandit

https://www.owasp.org/index.php/OWASP_Dependency_Check

Find all docker-compose.yml and check password environment is configured for

• redis
• mongodb
• mysql
• pgsql

If detected typescript, run tslint with microsoft sdl rules

I don't want to suppress alerts, let's generate problematic requirement.txt on the fly?

Please add the following to .dockerignore:

.git/
*.pfx
docker-compose.override.yml

Please add the following to .gitignore:

*.pfx
docker-compose.override.yml

https://www.owasp.org/index.php/OWASP_Dependency_Check

• individual accept config filename from arg
• top level check.sh default $TARGET_DIR/.devsecops-ci as config file

• find all package.json
• invoke npm audit

• readme
• project skeleton (dummy docker and pass checker)
• travis

Use https://pypi.org/project/langdetect/ to detect language, and apply different entropy threshold, furthermore, implement a flag, disabled by default, to suppress all entropy check to non-english / non-ascii text.

• basic structure for expansible checker architecture
• https://github.com/pyupio/safety
• test case

sometime its better to whitelist a false positive text than ignoring whole file.

As alpine does not keep old packages.

reference: https://medium.com/@stschindler/the-problem-with-docker-and-alpines-package-pinning-18346593e891