Skip to content

Commit d66b61e

Browse files
kevinalee-duplicatekevinalee-duplicate
committed
Refactoring actions and structure
1 parent ba82041 commit d66b61e

38 files changed

Lines changed: 9243 additions & 1315 deletions

‎.github/workflows/fod.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -297,7 +297,7 @@ jobs:
297297
run: |
298298
fcli fod session login --url $FOD_API_URI --client-id $FOD_CLIENT_ID --client-secret $FOD_CLIENT_SECRET --fod-session github-actions
299299
fcli fod action run release-summary --release "${FOD_RELEASE}" --fod-session github-actions >> $GITHUB_STEP_SUMMARY
300-
fcli fod action run etc/custom-check-policy.action --on-unsigned=ignore --release "${FOD_RELEASE}" --fod-session github-actions
300+
fcli fod action run etc/actions/custom-check-policy.action --on-unsigned=ignore --release "${FOD_RELEASE}" --fod-session github-actions
301301
fcli fod session logout --fod-session github-actions
302302
continue-on-error: true # allow the workflow to continue even if this job fails
303303
env:

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,3 +140,6 @@ logs
140140
email-db.json
141141
iwa.db
142142
*.fpr
143+
junit.xml
144+
aviator_*
145+
.fortify

‎.gitlab-ci.yml‎

Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
#
2+
# An example GitLab CI/CD pipeline configuration file for a Python application yhat includes build, test, deploy and
3+
# - OpenText Application Security Core (FoD) SAST/DAST/SCA scans ... or
4+
# - OpenText Application Security (ScanCentral) SAST/DAST scans
5+
# - OpenText SCA Core (Debricked) ... or
6+
# - Sonatype Lifecycle (Nexus IQ Server)
7+
#
8+
# This pipeline uses the Fortify fcli tool and GitLab CI/CD Components (https://gitlab.com/Fortify/components)
9+
#
10+
# If using OpenText Application Security Core (FoD) set the following variables in your GitLab project/organisation:
11+
# - FOD_URL: Fortify on Demand URL (e.g., https://ams.fortify.com)
12+
# - FOD_API_URL: Fortify API URL (e.g., https://api.ams.fortify.com)
13+
# - FOD_CLIENT_ID: Fortify on Demand Client ID
14+
# - FOD_CLIENT_SECRET: Fortify on Demand Client Secret
15+
# - FOD_APP_NAME_POSTFIX: Optional postfix for the application name
16+
#
17+
# If using OpenText Application Security (ScanCentral) set the following variables in your GitLab project/organisation:
18+
# - SSC_URL: Software Security Center URL (e.g. https://ssc.customer.fortifyhosted.net/)
19+
# - SSC_TOKEN: Sofware Security Center CIToken
20+
# - SC_SAST_TOKEN: ScanCentral SAST Client Authentication Token
21+
# - SSC_APP_NAME_POSTFIX: Optional postfix for the application name
22+
# - SCDAST_SETTINGS_ID: Optional ScanCentral DAST Settings Id for DAST scan to run
23+
#
24+
# If using Sonatype Lifecycle (Nexus IQ Server) set the following variables in your GitLab project/organisation:
25+
# - NEXUS_IQ_URL: Nexus IQ Server URL
26+
# - NEXUS_IQ_USERNAME: Nexus IQ Username
27+
# - NEXUS_IQ_PASSWORD: Nexus IQ Password
28+
#
29+
# If using OpenText SCA Core (Debricked) set the following variables in your GitLab project/organisation:
30+
# - DEBRICKED_TOKEN: Debricked Access Token
31+
#
32+
# These variables are used to control which jobs to run
33+
#
34+
35+
36+
spec:
37+
inputs:
38+
debug:
39+
default: false
40+
type: boolean
41+
42+
---
43+
44+
image: node:20 # default image to use for the pipeline
45+
46+
stages:
47+
- build
48+
- dockerize
49+
- test
50+
- deploy
51+
- scan
52+
53+
workflow:
54+
rules:
55+
# Only run the pipeline for merge requests and pushes to branches (not both when a merge request is open)
56+
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
57+
- if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS
58+
when: never
59+
- if: $CI_COMMIT_BRANCH
60+
61+
variables:
62+
DEFAULT_APP_NAME: "InsecureRestAPI"
63+
DEFAULT_PARENT_RELEASE_NAME: "main"
64+
DEFAULT_PARENT_APPVERSION_NAME: "main"
65+
DEFAULT_RELEASE_NAME: "${CI_COMMIT_BRANCH}"
66+
DEFAULT_APPVERSION_NAME: "${CI_COMMIT_BRANCH}"
67+
DEFAULT_SONATYPE_IQ_APPLICATION_ID: "insecurerestapi"
68+
IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
69+
70+
# use a cache for Python .venv and deps
71+
cache:
72+
key: ${CI_COMMIT_REF_SLUG}
73+
paths:
74+
- node_modules
75+
76+
# include CI/CD components and jobs depending on what we want to run
77+
# there are lots of conditional includes based on CI/CD variables to ensure only jobs required are run
78+
include:
79+
# include fortify jobs
80+
- component: $CI_SERVER_FQDN/Fortify/components/fcli/linux@main
81+
inputs:
82+
stage: scan # Stage in which to run the fcli commands
83+
- component: $CI_SERVER_FQDN/Fortify/components/ast-scan/linux@main
84+
inputs:
85+
job-name: fortify-sast-scan # Optional job name used for running the AST scan, defaults to 'fortify-ast-scan'
86+
stage: scan # Stage in which to run the AST scan, defaults to 'test'
87+
rules:
88+
- if: ( $SSC_URL != null || $SSC_URL =~ /^./ )
89+
- if: ( $FOD_URL != null || $FOD_URL =~ /^./ )
90+
# include Sonatype Nexus IQ jobs if NEXUS_IQ_URL is defined
91+
- component: $CI_SERVER_FQDN/sonatype-integrations/components/evaluate-sbom@main
92+
inputs:
93+
application-id: $DEFAULT_SONATYPE_IQ_APPLICATION_ID
94+
scan-targets:
95+
- package-lock.json
96+
result-file: evaluation-result.json
97+
report-name: evaluation-report.html
98+
sbom-standard: cycloneDx
99+
sbom-version: "1.5"
100+
ignore-system-errors: true
101+
rules:
102+
- if: ( $NEXUS_IQ_URL != null || $NEXUS_IQ_URL =~ /^./ )
103+
# include Debricked jobs if $DEBRICKED_TOKEN is defined
104+
- local: etc/gitlab-debricked.yml
105+
rules:
106+
- if: ( $DEBRICKED_TOKEN != null || $DEBRICKED_TOKEN =~ /^./ )
107+
# include FoD jobs is $FOD_URL is defined
108+
- local: etc/gitlab-fod.yml
109+
rules:
110+
- if: ( $FOD_URL != null || $FOD_URL =~ /^./ )
111+
# include ScanCentral jobs if $SSC_URL is defined
112+
- local: etc/gitlab-scancentral.yml
113+
rules:
114+
- if: ( $SSC_URL != null || $SSC_URL =~ /^./ )
115+
116+
117+
# Set fcli job to "never run" as it will be extended by other jobs included
118+
fcli:
119+
stage: scan
120+
rules:
121+
- when: never
122+
123+
124+
# This is a sample job to build the application. You can replace it with your actual build job.
125+
npm-build:
126+
stage: build
127+
before_script:
128+
- npm i
129+
script:
130+
- echo "Building the application..."
131+
- npm run swagger
132+
- npm run build
133+
artifacts:
134+
paths:
135+
- dist
136+
137+
# This is a sample job to test a Node application using jest. You can replace it with your actual test job.
138+
npm-test:
139+
stage: test
140+
before_script:
141+
- npm i
142+
script:
143+
- echo "Testing the application..."
144+
- npm run test
145+
artifacts:
146+
when: always
147+
reports:
148+
junit:
149+
- junit.xml
150+
151+
# This is a sample job to build the application into a Docker image and push it to the GitLab Container Registry
152+
docker-build:
153+
stage: dockerize
154+
image: docker:latest
155+
dependencies:
156+
- npm-build
157+
services:
158+
- docker:dind
159+
before_script:
160+
- echo $CI_JOB_TOKEN | docker login -u gitlab-ci-token --password-stdin $CI_REGISTRY
161+
- echo $IMAGE_TAG
162+
script:
163+
- docker build -t $IMAGE_TAG .
164+
- docker push $IMAGE_TAG
165+
rules:
166+
- if: $CI_COMMIT_BRANCH == "main"
167+
168+
# This job runs Sonatype Nexus IQ evaluation on the Docker image built in the docker-build job.
169+
sonatype-docker-scan:
170+
stage: test
171+
image: docker:latest
172+
services:
173+
- docker:dind
174+
needs:
175+
- job: docker-build
176+
before_script:
177+
- echo $CI_JOB_TOKEN | docker login -u gitlab-ci-token --password-stdin $CI_REGISTRY
178+
- echo $IMAGE_TAG
179+
- docker pull $IMAGE_TAG
180+
- export NEXUS_CONTAINER_IMAGE_REGISTRY_USER=gitlab-ci-token
181+
- export NEXUS_CONTAINER_IMAGE_REGISTRY_PASSWORD=$CI_JOB_TOKEN
182+
- export NEXUS_CONTAINER_INCLUDE_ONLY_OS_COMPONENTS=true
183+
script:
184+
- |
185+
docker run -v /tmp:/tmp -v $CI_PROJECT_DIR:/sonatype/reports -v /var/run/docker.sock:/var/run/docker.sock \
186+
-e NEXUS_IQ_URL -e NEXUS_IQ_USERNAME -e NEXUS_IQ_PASSWORD -e NEXUS_CONTAINER_IMAGE_REGISTRY_USER -e NEXUS_CONTAINER_IMAGE_REGISTRY_PASSWORD \
187+
sonatype/gitlab-nexus-iq-pipeline:latest /sonatype/evaluate -i $DEFAULT_SONATYPE_IQ_APPLICATION_ID -t stage-release container:$IMAGE_TAG
188+
artifacts:
189+
paths:
190+
- $CI_PROJECT_DIR/$CI_PROJECT_NAME-policy-eval-report.html
191+
rules:
192+
- if: $CI_COMMIT_BRANCH == "main"
193+
194+
# This is a sample job to deploy the application. You can replace it with your actual deploy job.
195+
deploy:
196+
stage: deploy
197+
script:
198+
- echo "Deploying the application..."
199+
rules:
200+
- if: $CI_COMMIT_BRANCH == "main"

‎.sonatype-config‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
iq-for-vscode:
2+
applicationId: insecurerestapi
3+
includeDev: false
4+
type: ['npm']

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,5 +98,5 @@ sca-scan: ## run OpenText software composition analysis
9898

9999
.PHONY: nexus-iq-scan
100100
nexus-iq-scan: ## run Sonatype Nexus IQ software composition analysis
101-
@echo "Running Sonatype Nexusi IQ software composition analysis..."
101+
@echo "Running Sonatype Nexus IQ software composition analysis..."
102102
nexus-iq-cli -i $(PROJECT_LOWER) -s $(NEXUS_IQ_URL) -a "$(NEXUS_IQ_USERNAME):$(NEXUS_IQ_PASSWORD)" package-lock.json

‎README.md‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
[![Fortify Security Scan](https://github.com/fortify-presales/InsecureRestAPI/actions/workflows/fod.yml/badge.svg)](https://github.com/fortify-presales/InsecureRestAPI/actions/workflows/fod.yml) [![Debricked](https://github.com/kadraman/InsecureRestAPI/actions/workflows/debricked.yml/badge.svg)](https://github.com/kadraman/InsecureRestAPI/actions/workflows/debricked.yml)
2-
31
# InsecureRestAPI
42

53
_InsecureRestAPI_ is a simple NodeJS/Express/MongoFB REST API that can be used for the demonstration of Application Security testing tools - such as [OpenText Application Security](https://www.opentext.com/products/application-security).
@@ -8,8 +6,7 @@ Pre-requisities
86
---------------
97

108
- [Node.js 20 or later](https://nodejs.org/en/download)
11-
- [CygWin](https://www.cygwin.com/) - if running on Windows
12-
- [MongoDB](https://www.mongodb.com/) Community Edition (optional as a version is embedded for testing)
9+
- [MongoDB](https://www.mongodb.com/) Community Edition (optional as an embedded version will be downloaded for testing)
1310
- Docker installation (optional)
1411

1512
Run Application (locally)
@@ -19,8 +16,9 @@ You can the run the application locally using the following:
1916

2017

2118
```
19+
npm install
2220
npm install -g ts-node-dev
23-
make run
21+
npm run dev
2422
```
2523

2624
The API should then be available at the URL `http://localhost:5000`. If it fails to start,
@@ -32,7 +30,7 @@ Run Application (as Docker container)
3230
You also can build a Docker image for the application using the following:
3331

3432
```
35-
make build
33+
npm run build
3634
docker build -t demoapi:latest .
3735
```
3836

‎babel.config.js‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
module.exports = {
2+
presets: [
3+
['@babel/preset-env', {targets: {node: 'current'}}],
4+
'@babel/preset-typescript',
5+
],
6+
};

‎bin/cleanup.ps1‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
2+
# Import local environment specific settings
3+
$EnvSettings = $(ConvertFrom-StringData -StringData (Get-Content ".\.env" | Where-Object {-not ($_.StartsWith('#'))} | Out-String))
4+
$AppName = $EnvSettings['SSC_APP_NAME']
5+
6+
Write-Host "Removing files..."
7+
Remove-Item -Force -Recurse ".fortify" -ErrorAction SilentlyContinue
8+
Remove-Item "$($AppName)*.fpr" -ErrorAction SilentlyContinue
9+
Remove-Item "$($AppName)*.pdf" -ErrorAction SilentlyContinue
10+
Remove-Item "fod.zip" -ErrorAction SilentlyContinue
11+
Remove-Item "*Package.zip" -ErrorAction SilentlyContinue
12+
Remove-Item "fortifypackage.zip" -ErrorAction SilentlyContinue
13+
Remove-Item -Force -Recurse ".debricked" -ErrorAction SilentlyContinue
14+
Remove-Item -Force -Recurse "dist" -ErrorAction SilentlyContinue
15+
Remove-Item -Force -Recurse "logs" -ErrorAction SilentlyContinue
16+
Remove-Item "*.lock" -ErrorAction SilentlyContinue
17+
Remove-Item "*.log" -ErrorAction SilentlyContinue
18+
19+
Write-Host "Done."

‎bin/sast-scan.ps1‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
#
2+
# Example script to perform Fortify Static Code Analysis
3+
#
4+
5+
# Parameters
6+
param (
7+
[Parameter(Mandatory=$false)]
8+
[ValidateSet('classic','security','devops')]
9+
[string]$ScanPolicy = "classic",
10+
[Parameter(Mandatory=$false)]
11+
[switch]$CreatePDF,
12+
[Parameter(Mandatory=$false)]
13+
[switch]$UploadToSSC
14+
)
15+
16+
# Import local environment specific settings
17+
$EnvSettings = $(ConvertFrom-StringData -StringData (Get-Content ".\.env" | Where-Object {-not ($_.StartsWith('#'))} | Out-String))
18+
$AppName = $EnvSettings['SSC_APP_NAME']
19+
$AppVersion = $EnvSettings['SSC_APP_VER_NAME']
20+
$SSCUrl = $EnvSettings['SSC_URL']
21+
$SSCAuthToken = $EnvSettings['SSC_AUTH_TOKEN'] # AnalysisUploadToken or CIToken
22+
$JVMArgs = "-Xss256M"
23+
#$ScanSwitches = "-Dcom.fortify.sca.rules.enable_wi_correlation=true"
24+
$ScanSwitches = "-Dcom.fortify.sca.ProjectRoot=.fortify"
25+
26+
if ([string]::IsNullOrEmpty($AppName)) { throw "Application Name has not been set in '.env'" }
27+
if ([string]::IsNullOrEmpty($AppVersion)) { throw "Application Version has not been set in '.env'" }
28+
29+
# Run the translation and scan
30+
31+
Write-Host Running translation...
32+
& sourceanalyzer $JVMArgs $ScanSwitches -b "$AppName" .
33+
34+
Write-Host Running scan...
35+
& sourceanalyzer '-Dcom.fortify.sca.ProjectRoot=.fortify' $JVMArgs $ScanSwitches -b "$AppName" `
36+
-verbose -scan-policy $ScanPolicy `
37+
-rules etc/sast-custom-rules/example-custom-rules.xml -filter etc/sast-filters/example-filter.txt `
38+
-build-project "$AppName" -build-version "$AppVersion" -build-label "SNAPSHOT" `
39+
-scan -f "$($AppName).fpr"
40+
41+
# summarise issue count by analyzer
42+
& FPRUtility -information -analyzerIssueCounts -project "$($AppName).fpr"
43+
44+
if ($CreatePDF) {
45+
Write-Host Generating PDF report...
46+
& ReportGenerator '-Dcom.fortify.sca.ProjectRoot=.fortify' -user "Demo User" -format pdf -f "$($AppName).pdf" -source "$($AppName).fpr"
47+
}
48+
49+
if ($UploadToSSC) {
50+
Write-Host Uploading results to SSC...
51+
& fortifyclient uploadFPR -file "$($AppName).fpr" -url $SSCUrl -authtoken $SSCAuthToken -application $AppName -applicationVersion $AppVersion
52+
}
53+
54+
Write-Host Done.

‎bin/sast-scan.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ source .env
3636
AppName=$SSC_APP_NAME
3737
AppVersion=$SSC_APP_VER_NAME
3838
SSCUrl=$SSC_URL
39-
SSCAuthToken=$SSC_AUTH_TOKEN # AnalysisUploadToken
39+
SSCAuthToken=$SSC_AUTH_TOKEN # AnalysisUploadToken or CIToken
4040
JVMArgs="-Xss256M"
4141
ScanSwitches="-Dcom.fortify.sca.ProjectRoot=.fortify"
4242

@@ -53,7 +53,7 @@ echo Running translation...
5353
sourceanalyzer $ScanSwitches $JVMArgs -b "$AppName" .
5454

5555
echo Running scan...
56-
sourceanalyzer $ScanSwitches $JVMArgs -b "$AppName" -debug -verbose \
56+
sourceanalyzer $ScanSwitches $JVMArgs -b "$AppName" -verbose \
5757
-scan-policy $ScanPolicy -build-project "$AppName" -build-version "$AppVersion" -build-label "SNAPSHOT" \
5858
-scan -f "${AppName}.fpr"
5959

0 commit comments

Comments
 (0)