From 98f549ab289ebcd8def5e3eac6c38ea71251e8fe Mon Sep 17 00:00:00 2001 From: ShiftLeft Date: Thu, 6 May 2021 21:27:48 -0400 Subject: [PATCH 01/13] adding ShiftLeft action workflow config --- .github/workflows/shiftleft.yml | 59 +++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100644 .github/workflows/shiftleft.yml diff --git a/.github/workflows/shiftleft.yml b/.github/workflows/shiftleft.yml new file mode 100644 index 000000000..79695c970 --- /dev/null +++ b/.github/workflows/shiftleft.yml @@ -0,0 +1,59 @@ +--- +# This workflow integrates ShiftLeft NG SAST with GitHub +# Visit https://docs.shiftleft.io for help +name: ShiftLeft + +on: + pull_request: + workflow_dispatch: + +jobs: + NextGen-Static-Analysis: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v2 + # We are building this application with Java 11 + - name: Setup Java JDK + uses: actions/setup-java@v1.4.3 + with: + java-version: 11.0.x + - name: Package with maven + run: mvn compile package + - name: Download ShiftLeft CLI + run: | + curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl + # ShiftLeft requires Java 1.8. Post the package step override the version + - name: Setup Java JDK + uses: actions/setup-java@v1.4.3 + with: + java-version: 1.8 + - name: Extract branch name + shell: bash + run: echo "##[set-output name=branch;]$(echo ${GITHUB_REF#refs/heads/})" + id: extract_branch + - name: NextGen Static Analysis + run: ${GITHUB_WORKSPACE}/sl analyze --wait --app shiftleft-java-demo --tag branch=${{ github.head_ref || steps.extract_branch.outputs.branch }} --vcs-prefix-correction "io/shiftleft=src/main/java/" --java --cpg target/hello-shiftleft-0.0.1.jar + env: + SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} + + Build-Rules: + runs-on: ubuntu-latest + needs: NextGen-Static-Analysis + steps: + - uses: actions/checkout@v2 + - name: Download ShiftLeft CLI + run: | + curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl + - name: Validate Build Rules + run: | + ${GITHUB_WORKSPACE}/sl check-analysis --app shiftleft-java-demo \ + --branch "${{ github.head_ref || steps.extract_branch.outputs.branch }}" \ + --report \ + --github-pr-number=${{github.event.number}} \ + --github-pr-user=${{ github.repository_owner }} \ + --github-pr-repo=${{ github.event.repository.name }} \ + --github-token=${{ secrets.GITHUB_TOKEN }} + env: + SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} + + \ No newline at end of file From 97096a122a385a78c01a4f1fd62567105054e1b8 Mon Sep 17 00:00:00 2001 From: ShiftLeft Date: Thu, 6 May 2021 21:27:48 -0400 Subject: [PATCH 02/13] adding ShiftLeft action workflow config --- shiftleft.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 shiftleft.yml diff --git a/shiftleft.yml b/shiftleft.yml new file mode 100644 index 000000000..220d4baf4 --- /dev/null +++ b/shiftleft.yml @@ -0,0 +1,12 @@ +build_rules: + - id: allow-zero-findings + finding_types: + - vuln + - secret + - insight + - "*" + severity: + - SEVERITY_MEDIUM_IMPACT + - SEVERITY_HIGH_IMPACT + - SEVERITY_LOW_IMPACT + threshold: 0 \ No newline at end of file From 064dfed3c17bb31e3d91c7c716b3b5ca701a5929 Mon Sep 17 00:00:00 2001 From: robwlundy <83795676+robwlundy@users.noreply.github.com> Date: Thu, 13 May 2021 11:07:03 -0400 Subject: [PATCH 03/13] Update CustomerController.java comment out customer account debugger --- .../java/io/shiftleft/controller/CustomerController.java | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/main/java/io/shiftleft/controller/CustomerController.java b/src/main/java/io/shiftleft/controller/CustomerController.java index 40e1c4917..6f32dd6cb 100644 --- a/src/main/java/io/shiftleft/controller/CustomerController.java +++ b/src/main/java/io/shiftleft/controller/CustomerController.java @@ -123,8 +123,9 @@ public Customer getCustomer(@PathVariable("customerId") Long customerId) { } Account account = new Account(4242l,1234, "savings", 1, 0); - log.info("Account Data is {}", account); - log.info("Customer Data is {}", customer); + //FOR DEBUGGING ONLY + //log.info("Account Data is {}", account); + //log.info("Customer Data is {}", customer); try { dispatchEventToSalesForce(String.format(" Customer %s Logged into SalesForce", customer)); From 87cb0e6b98455faccca3a9fac768f3711057aba9 Mon Sep 17 00:00:00 2001 From: robwlundy <83795676+robwlundy@users.noreply.github.com> Date: Thu, 13 May 2021 14:18:17 -0400 Subject: [PATCH 04/13] Update CustomerController.java undid comment out --- src/main/java/io/shiftleft/controller/CustomerController.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/java/io/shiftleft/controller/CustomerController.java b/src/main/java/io/shiftleft/controller/CustomerController.java index 6f32dd6cb..4aa577de6 100644 --- a/src/main/java/io/shiftleft/controller/CustomerController.java +++ b/src/main/java/io/shiftleft/controller/CustomerController.java @@ -125,7 +125,7 @@ public Customer getCustomer(@PathVariable("customerId") Long customerId) { Account account = new Account(4242l,1234, "savings", 1, 0); //FOR DEBUGGING ONLY //log.info("Account Data is {}", account); - //log.info("Customer Data is {}", customer); + log.info("Customer Data is {}", customer); try { dispatchEventToSalesForce(String.format(" Customer %s Logged into SalesForce", customer)); From d4d1a73f9f20cc4c9ce0a9039be5f57072aebd0b Mon Sep 17 00:00:00 2001 From: robwlundy <83795676+robwlundy@users.noreply.github.com> Date: Thu, 13 May 2021 16:33:50 -0400 Subject: [PATCH 05/13] Update CustomerController.java comment out --- src/main/java/io/shiftleft/controller/CustomerController.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/java/io/shiftleft/controller/CustomerController.java b/src/main/java/io/shiftleft/controller/CustomerController.java index 4aa577de6..6f32dd6cb 100644 --- a/src/main/java/io/shiftleft/controller/CustomerController.java +++ b/src/main/java/io/shiftleft/controller/CustomerController.java @@ -125,7 +125,7 @@ public Customer getCustomer(@PathVariable("customerId") Long customerId) { Account account = new Account(4242l,1234, "savings", 1, 0); //FOR DEBUGGING ONLY //log.info("Account Data is {}", account); - log.info("Customer Data is {}", customer); + //log.info("Customer Data is {}", customer); try { dispatchEventToSalesForce(String.format(" Customer %s Logged into SalesForce", customer)); From b39d8339cec06ff2b5084fc31b8a778f6eb7ed44 Mon Sep 17 00:00:00 2001 From: robwlundy <83795676+robwlundy@users.noreply.github.com> Date: Fri, 14 May 2021 09:34:48 -0400 Subject: [PATCH 06/13] Set up CI with Azure Pipelines [skip ci] --- azure-pipelines-1.yml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 azure-pipelines-1.yml diff --git a/azure-pipelines-1.yml b/azure-pipelines-1.yml new file mode 100644 index 000000000..34edff52a --- /dev/null +++ b/azure-pipelines-1.yml @@ -0,0 +1,22 @@ +# Maven +# Build your Java project and run tests with Apache Maven. +# Add steps that analyze code, save build artifacts, deploy, and more: +# https://docs.microsoft.com/azure/devops/pipelines/languages/java + +trigger: +- master + +pool: + vmImage: ubuntu-latest + +steps: +- task: Maven@3 + inputs: + mavenPomFile: 'pom.xml' + mavenOptions: '-Xmx3072m' + javaHomeOption: 'JDKVersion' + jdkVersionOption: '1.8' + jdkArchitectureOption: 'x64' + publishJUnitResults: true + testResultsFiles: '**/surefire-reports/TEST-*.xml' + goals: 'package' From 3df1ba29d711061d29a8a2a4b1b9d3007a47fa63 Mon Sep 17 00:00:00 2001 From: robwlundy <83795676+robwlundy@users.noreply.github.com> Date: Mon, 17 May 2021 11:09:48 -0400 Subject: [PATCH 07/13] Update CustomerController.java make customer info available for debug --- src/main/java/io/shiftleft/controller/CustomerController.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/java/io/shiftleft/controller/CustomerController.java b/src/main/java/io/shiftleft/controller/CustomerController.java index 6f32dd6cb..4aa577de6 100644 --- a/src/main/java/io/shiftleft/controller/CustomerController.java +++ b/src/main/java/io/shiftleft/controller/CustomerController.java @@ -125,7 +125,7 @@ public Customer getCustomer(@PathVariable("customerId") Long customerId) { Account account = new Account(4242l,1234, "savings", 1, 0); //FOR DEBUGGING ONLY //log.info("Account Data is {}", account); - //log.info("Customer Data is {}", customer); + log.info("Customer Data is {}", customer); try { dispatchEventToSalesForce(String.format(" Customer %s Logged into SalesForce", customer)); From baffc0b942280b8cf5ee4cfd65cec098cc62553d Mon Sep 17 00:00:00 2001 From: robwlundy <83795676+robwlundy@users.noreply.github.com> Date: Mon, 17 May 2021 11:10:27 -0400 Subject: [PATCH 08/13] Update CustomerController.java --- src/main/java/io/shiftleft/controller/CustomerController.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/java/io/shiftleft/controller/CustomerController.java b/src/main/java/io/shiftleft/controller/CustomerController.java index 4aa577de6..6f32dd6cb 100644 --- a/src/main/java/io/shiftleft/controller/CustomerController.java +++ b/src/main/java/io/shiftleft/controller/CustomerController.java @@ -125,7 +125,7 @@ public Customer getCustomer(@PathVariable("customerId") Long customerId) { Account account = new Account(4242l,1234, "savings", 1, 0); //FOR DEBUGGING ONLY //log.info("Account Data is {}", account); - log.info("Customer Data is {}", customer); + //log.info("Customer Data is {}", customer); try { dispatchEventToSalesForce(String.format(" Customer %s Logged into SalesForce", customer)); From 75dc36d758505ba9a0e5f1baf83670ae3fd33cae Mon Sep 17 00:00:00 2001 From: robwlundy <83795676+robwlundy@users.noreply.github.com> Date: Mon, 17 May 2021 11:11:21 -0400 Subject: [PATCH 09/13] Update CustomerController.java make customer info available for debug --- src/main/java/io/shiftleft/controller/CustomerController.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/java/io/shiftleft/controller/CustomerController.java b/src/main/java/io/shiftleft/controller/CustomerController.java index 6f32dd6cb..4aa577de6 100644 --- a/src/main/java/io/shiftleft/controller/CustomerController.java +++ b/src/main/java/io/shiftleft/controller/CustomerController.java @@ -125,7 +125,7 @@ public Customer getCustomer(@PathVariable("customerId") Long customerId) { Account account = new Account(4242l,1234, "savings", 1, 0); //FOR DEBUGGING ONLY //log.info("Account Data is {}", account); - //log.info("Customer Data is {}", customer); + log.info("Customer Data is {}", customer); try { dispatchEventToSalesForce(String.format(" Customer %s Logged into SalesForce", customer)); From d36e1615f9bbcf98ba2a47d0172a8caa9e43bfef Mon Sep 17 00:00:00 2001 From: robwlundy <83795676+robwlundy@users.noreply.github.com> Date: Thu, 16 Dec 2021 18:51:13 -0500 Subject: [PATCH 10/13] Update pom.xml --- pom.xml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pom.xml b/pom.xml index eb17410c8..d42be2021 100644 --- a/pom.xml +++ b/pom.xml @@ -31,6 +31,11 @@ jasypt 1.9.2 + + org.apache.logging.log4j + log4j-api + 2.16.0 + com.github.ulisesbocchio jasypt-spring-boot-starter From ae93db4d0a61694a7f307a7a50b571f7d19e8c59 Mon Sep 17 00:00:00 2001 From: robwlundy <83795676+robwlundy@users.noreply.github.com> Date: Thu, 16 Dec 2021 18:52:22 -0500 Subject: [PATCH 11/13] Update shiftleft.yml --- .github/workflows/shiftleft.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/shiftleft.yml b/.github/workflows/shiftleft.yml index 79695c970..b48bc6213 100644 --- a/.github/workflows/shiftleft.yml +++ b/.github/workflows/shiftleft.yml @@ -32,7 +32,7 @@ jobs: run: echo "##[set-output name=branch;]$(echo ${GITHUB_REF#refs/heads/})" id: extract_branch - name: NextGen Static Analysis - run: ${GITHUB_WORKSPACE}/sl analyze --wait --app shiftleft-java-demo --tag branch=${{ github.head_ref || steps.extract_branch.outputs.branch }} --vcs-prefix-correction "io/shiftleft=src/main/java/" --java --cpg target/hello-shiftleft-0.0.1.jar + run: ${GITHUB_WORKSPACE}/sl analyze --wait --app shiftleft-java-l4 --tag branch=${{ github.head_ref || steps.extract_branch.outputs.branch }} --vcs-prefix-correction "io/shiftleft=src/main/java/" --java --cpg target/hello-shiftleft-0.0.1.jar env: SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} @@ -56,4 +56,4 @@ jobs: env: SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} - \ No newline at end of file + From 5db76b33059d85214505b46d98f91318cf8aab79 Mon Sep 17 00:00:00 2001 From: robwlundy <83795676+robwlundy@users.noreply.github.com> Date: Thu, 16 Dec 2021 19:00:52 -0500 Subject: [PATCH 12/13] Update pom.xml --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index d42be2021..1cce22ff0 100644 --- a/pom.xml +++ b/pom.xml @@ -34,7 +34,7 @@ org.apache.logging.log4j log4j-api - 2.16.0 + 2.14.0 com.github.ulisesbocchio From 65c79dd7a116906c5c66214450bae4b773e7d3bb Mon Sep 17 00:00:00 2001 From: robwlundy <83795676+robwlundy@users.noreply.github.com> Date: Tue, 25 Jan 2022 11:03:21 -0500 Subject: [PATCH 13/13] Update shiftleft.yml --- shiftleft.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/shiftleft.yml b/shiftleft.yml index 220d4baf4..941a13288 100644 --- a/shiftleft.yml +++ b/shiftleft.yml @@ -9,4 +9,9 @@ build_rules: - SEVERITY_MEDIUM_IMPACT - SEVERITY_HIGH_IMPACT - SEVERITY_LOW_IMPACT - threshold: 0 \ No newline at end of file + threshold: 0 + - id: reachable-oss-vuln + finding_types: [oss_vuln] + options: + reachable: true + num_findings: 10