Bảo mật phát triển phần mềm

# STEP 1: Create vulnerable sample codebase for SAST testing
$vulnDir = "C:\sast-lab\vuln-app"
New-Item -ItemType Directory -Path $vulnDir -Force | Out-Null

# Write Python file containing common security anti-patterns
@'
import sqlite3, os, subprocess

# CWE-798: Hardcoded credential
DB_PASSWORD = "SuperSecret123!"
API_KEY = "sk-prod-abcdef1234567890"

def get_user(user_id):
    # CWE-89: SQL Injection via string concatenation
    conn = sqlite3.connect("users.db")
    query = "SELECT * FROM users WHERE id = " + user_id
    return conn.execute(query).fetchall()

def process_file(filename):
    # CWE-78: OS Command injection via shell=True
    subprocess.run("cat " + filename, shell=True)

def check_cert(hostname):
    # CWE-295: Disabled TLS certificate verification
    import ssl
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    return ctx
'@ | Set-Content "$vulnDir\app.py" -Encoding UTF8

Write-Host "[+] Vulnerable sample app created at $vulnDir" -ForegroundColor Green

# STEP 2: Pattern-based SAST scan (PowerShell-native)
Write-Host "`n[*] Running pattern-based SAST scan..." -ForegroundColor Cyan

$patterns = @{
    "Hardcoded Credential" = @{ Regex = '(?i)(password|passwd|secret|api_key)\s*=\s*["\x27][^"\x27]{6,}["\x27]'; Severity = "CRITICAL"; CWE = "CWE-798" }
    "SQL String Concat"    = @{ Regex = 'execute\s*\(\s*["\x27].*\+|query\s*=.*\+\s*\w+'; Severity = "HIGH"; CWE = "CWE-89" }
    "Shell Injection"      = @{ Regex = 'shell\s*=\s*True'; Severity = "HIGH"; CWE = "CWE-78" }
    "TLS Disabled"         = @{ Regex = 'verify\s*=\s*False|CERT_NONE|check_hostname\s*=\s*False'; Severity = "HIGH"; CWE = "CWE-295" }
    "Debug Mode On"        = @{ Regex = 'DEBUG\s*=\s*True|debug\s*=\s*true'; Severity = "MEDIUM"; CWE = "CWE-215" }
}

$findings = @()
$files = Get-ChildItem -Path $vulnDir -Include "*.py","*.js","*.cs" -Recurse

foreach ($file in $files) {
    $lines = Get-Content $file.FullName
    $lineNum = 0
    foreach ($line in $lines) {
        $lineNum++
        foreach ($checkName in $patterns.Keys) {
            $check = $patterns[$checkName]
            if ($line -match $check.Regex) {
                $findings += [PSCustomObject]@{
                    File     = $file.Name
                    Line     = $lineNum
                    Severity = $check.Severity
                    CWE      = $check.CWE
                    Pattern  = $checkName
                    Code     = $line.Trim()
                }
            }
        }
    }
}

# STEP 3: Display findings grouped by severity
$critical = $findings | Where-Object Severity -eq "CRITICAL"
$high     = $findings | Where-Object Severity -eq "HIGH"
$medium   = $findings | Where-Object Severity -eq "MEDIUM"

Write-Host "`n=== SAST SCAN RESULTS ===" -ForegroundColor White
Write-Host "CRITICAL: $($critical.Count)  HIGH: $($high.Count)  MEDIUM: $($medium.Count)" -ForegroundColor Yellow

foreach ($f in $findings | Sort-Object Severity) {
    $color = switch ($f.Severity) {
        "CRITICAL" { "Red" }
        "HIGH"     { "Yellow" }
        "MEDIUM"   { "Cyan" }
    }
    Write-Host "[$($f.Severity)] $($f.Pattern) — $($f.File):L$($f.Line) [$($f.CWE)]" -ForegroundColor $color
    Write-Host "  Code: $($f.Code)" -ForegroundColor DarkGray
}

# STEP 4: Semgrep SAST scan (install: pip install semgrep)
if (Get-Command semgrep -ErrorAction SilentlyContinue) {
    Write-Host "`n[*] Running Semgrep with OWASP ruleset..." -ForegroundColor Cyan
    semgrep --config "p/owasp-top-ten" --config "p/python" `
            --json --output "$vulnDir\semgrep-results.json" $vulnDir
    $results = Get-Content "$vulnDir\semgrep-results.json" | ConvertFrom-Json
    Write-Host "[+] Semgrep found $($results.results.Count) findings" -ForegroundColor Green
} else {
    Write-Host "[!] Semgrep not installed. Install: pip install semgrep" -ForegroundColor Yellow
}

Write-Host "`n[+] SAST audit complete. Pipeline blocks on CRITICAL/HIGH findings." -ForegroundColor Green

#!/bin/bash
# DevSecOps Security Pipeline — CISSP Lab
# Usage: chmod +x devsecops-scan.sh && ./devsecops-scan.sh /path/to/project

PROJECT_DIR="${1:-$(pwd)}"
FAIL=0

echo "=========================================="
echo " DevSecOps Security Pipeline Scanner"
echo " Project: $PROJECT_DIR"
echo "=========================================="

# STAGE 1: Secrets detection
echo -e "\n[STAGE 1] Secret Detection..."
if command -v trufflehog >/dev/null 2>&1; then
    SECRETS_COUNT=$(trufflehog filesystem --directory="$PROJECT_DIR" \
        --only-verified --json 2>/dev/null | wc -l)
    if [ "$SECRETS_COUNT" -gt 0 ]; then
        echo "[CRITICAL] $SECRETS_COUNT verified secret(s) found! Pipeline BLOCKED."
        FAIL=1
    else
        echo "[PASS] No verified secrets detected."
    fi
else
    SECRETS=$(grep -rEn \
        '(password|passwd|secret|api.key|token)\s*=\s*["\x27][^"\x27]{8,}' \
        "$PROJECT_DIR" --include="*.py" --include="*.js" --include="*.env" \
        2>/dev/null | grep -v ".git" | head -20)
    if [ -n "$SECRETS" ]; then
        echo "[HIGH] Potential hardcoded secrets found — review before merge"
        FAIL=1
    else
        echo "[PASS] No obvious hardcoded secrets found."
    fi
fi

# STAGE 2: SAST — Semgrep
echo -e "\n[STAGE 2] SAST — Semgrep..."
if command -v semgrep >/dev/null 2>&1; then
    semgrep --config "p/owasp-top-ten" \
            --config "p/python"        \
            --severity ERROR           \
            --quiet                    \
            --json "$PROJECT_DIR" 2>/dev/null \
        | python3 -c "
import json, sys
data = json.load(sys.stdin)
results = data.get('results', [])
print(f'Semgrep findings: {len(results)}')
for r in results[:10]:
    sev = r['extra']['severity']
    path = r['path']
    line = r['start']['line']
    rule = r['check_id']
    print(f'  [{sev}] {rule} — {path}:{line}')
critical = [r for r in results if r['extra']['severity'] == 'ERROR']
print(f'ERROR severity: {len(critical)}')
sys.exit(1 if critical else 0)
"
    [ $? -ne 0 ] && FAIL=1
else
    echo "[WARN] Semgrep not installed. Install: pip install semgrep"
fi

# STAGE 3: Python SAST — Bandit
echo -e "\n[STAGE 3] Python SAST — Bandit..."
if command -v bandit >/dev/null 2>&1; then
    bandit -r "$PROJECT_DIR" -ll --format json --quiet 2>/dev/null \
        | python3 -c "
import json, sys
data = json.load(sys.stdin)
metrics = data.get('metrics', {}).get('_totals', {})
high = int(metrics.get('SEVERITY.HIGH', 0))
med  = int(metrics.get('SEVERITY.MEDIUM', 0))
print(f'Bandit — HIGH: {high}, MEDIUM: {med}')
for issue in data.get('results', [])[:5]:
    sev  = issue['issue_severity']
    test = issue['test_name']
    fname = issue['filename']
    lnum = issue['line_number']
    print(f'  [{sev}] {test} — {fname}:{lnum}')
sys.exit(1 if high > 0 else 0)
"
    [ $? -ne 0 ] && FAIL=1
else
    echo "[WARN] Bandit not installed. Install: pip install bandit"
fi

# STAGE 4: SCA — pip-audit
echo -e "\n[STAGE 4] SCA — Dependency Vulnerability Check..."
REQUIREMENTS=$(find "$PROJECT_DIR" -name "requirements*.txt" 2>/dev/null | head -1)
if [ -n "$REQUIREMENTS" ] && command -v pip-audit >/dev/null 2>&1; then
    pip-audit -r "$REQUIREMENTS" --format=columns 2>/dev/null
    VULN_COUNT=$(pip-audit -r "$REQUIREMENTS" --format=json 2>/dev/null \
        | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(sum(len(v['vulns']) for v in d['dependencies']))
")
    if [ "$VULN_COUNT" -gt 0 ]; then
        echo "[HIGH] $VULN_COUNT vulnerable dependencies found!"
        FAIL=1
    else
        echo "[PASS] No known vulnerabilities in dependencies."
    fi
else
    echo "[WARN] pip-audit not found or no requirements.txt. Install: pip install pip-audit"
fi

# STAGE 5: Container scan — Trivy
echo -e "\n[STAGE 5] Container Security — Trivy..."
if command -v trivy >/dev/null 2>&1; then
    trivy fs --severity HIGH,CRITICAL "$PROJECT_DIR" 2>/dev/null | tail -20
    [ ${PIPESTATUS[0]} -ne 0 ] && { echo "[CRITICAL] HIGH/CRITICAL CVEs detected!"; FAIL=1; }
else
    echo "[WARN] Trivy not installed. See: https://trivy.dev"
fi

# STAGE 6: SBOM Generation
echo -e "\n[STAGE 6] SBOM Generation..."
if command -v syft >/dev/null 2>&1; then
    syft dir:"$PROJECT_DIR" -o spdx-json > /tmp/sbom.spdx.json 2>/dev/null
    PKG_COUNT=$(python3 -c \
        "import json,sys; d=json.load(open('/tmp/sbom.spdx.json')); print(len(d.get('packages',[])))")
    echo "[PASS] SBOM generated: $PKG_COUNT packages (SPDX format → /tmp/sbom.spdx.json)"
else
    echo "[WARN] syft not installed. Install: curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh"
fi

# FINAL GATE
echo -e "\n=========================================="
if [ $FAIL -eq 1 ]; then
    echo "[BLOCKED] Pipeline FAILED — fix all CRITICAL/HIGH findings before merge"
    echo "          Reference: https://owasp.org/Top10/"
    exit 1
else
    echo "[PASS] All security gates passed — safe to merge"
    exit 0
fi