Fa'aaogāina ole su'e fa'aletonu mo faletusi fa'aoga Fa'alagolago-Siaki ile GitlabCI

O se vaega taua o le pulega fa'aletonu o le malamalama lelei lea ma fa'amautu le sapalai o vaega fa'akomepiuta e fausia ai faiga fa'aonaponei. O 'au a Agile ma DevOps latou te fa'aogaina tele faletusi ma fa'avae e fa'aitiitia ai le taimi ma le tau. Ae o lenei pine foi e i ai se itu i lalo: o le avanoa e faʻatosina ai mea sese ma faʻafitauli a isi tagata.

E manino lava, e tatau i le 'au ona mautinoa e iloa poʻo fea vaega o punaoa tatala o loʻo aofia ai i ana talosaga, faʻamautinoa o loʻo laʻuina mai faʻamatalaga faʻatuatuaina mai punaoa faʻatuatuaina, ma laʻu mai faʻafouga fou o vaega pe a maeʻa ona faʻapipiʻi faʻafitauli fou.

I lenei pou, o le a matou vaʻavaʻai i le faʻaogaina o le OWASP Dependency Check e faʻateʻa ai se fale pe afai e iloa ai faʻafitauli matuia i lau code.

I le tusi "Development Security in Agile Projects" o loʻo faʻamatalaina faʻapea. OWASP Dependency Check o se si'i fua e fa'avasega uma vaega fa'apogai o lo'o fa'aogaina i totonu o se talosaga ma fa'aalia ai le fa'aletonu o lo'o iai. O loʻo i ai faʻamatalaga mo Java, .NET, Ruby (gemspec), PHP (fatu pese), Node.js ma Python, faʻapea foʻi ma nisi o galuega C/C++. Fa'alagolago Fa'alagolago e tu'ufa'atasia ma meafaigaluega fau masani, e aofia ai Ant, Maven ma Gradle, ma fa'aauau fa'aumau fa'atasi e pei o Jenkins.

O le Su'esu'ega Fa'alagolago e lipoti atu vaega uma o lo'o i ai fa'afitauli fa'aletonu mai le NIST's National Vulnerability Database (NVD) ma fa'afou i fa'amaumauga mai tala fou a le NVD.

O le mea e laki ai, o nei mea uma e mafai ona otometi ona faʻaogaina meafaigaluega e pei ole OWASP Dependency Check project poʻo polokalame faʻapisinisi pei o Pato Uliuli, JFrog Xray, Snyk, Nexus Lifecycle Sonatype po o SourceClear.

O nei meafaigaluega e mafai ona aofia ai i le fausiaina o paipa e otometi ai le suʻesuʻeina o punaoa tatala faʻalagolago, faʻamaonia lomiga tuai o faletusi ma faletusi o loʻo i ai faʻafitauli faʻapitoa, ma faʻagata le fausiaina pe a maua ni faʻafitauli matuia.

OWASP Fa'alagolago Siaki

Ina ia faʻataʻitaʻi ma faʻaalia pe faʻafefea ona galue le Dependency Check, matou te faʻaogaina lenei fale teu oloa fa'ata'ita'iga-siaki-fa'alagolago.

Ina ia matamata i le lipoti HTML, e te manaʻomia le faʻatulagaina o le nginx web server i lau gitlab-runner.

Fa'ata'ita'iga o se la'ititi nginx config:

server {
    listen       9999;
    listen       [::]:9999;
    server_name  _;
    root         /home/gitlab-runner/builds;

    location / {
        autoindex on;
    }

    error_page 404 /404.html;
        location = /40x.html {
    }

    error_page 500 502 503 504 /50x.html;
        location = /50x.html {
    }
}

I le faaiuga o le faʻapotopotoga e mafai ona e vaʻai i le ata lenei:

Mulimuli i le so'oga ma va'ai le lipoti o le Siaki Fa'alagolago.

O le ata muamua o le pito i luga o le lipoti ma se aotelega.

Fa'amatalaga fa'amalama lona lua CVE-2017-5638. O iinei tatou te vaʻaia ai le maualuga o le CVE ma fesoʻotaʻiga i faʻaoga.

O le faʻamalama lona tolu o faʻamatalaga o le log4j-api-2.7.jar. Matou te vaʻaia o tulaga CVE e 7.5 ma 9.8.

O le faʻamalama lona fa o faʻamatalaga o commons-fileupload-1.3.2.jar. Matou te vaʻaia o tulaga CVE e 7.5 ma 9.8.

Afai e te manaʻo e faʻaaoga itulau gitlab, o le a le aoga - o se galuega pa'ū o le a le faia ai se mea.

Faataitaiga iinei https://gitlab.com/anton_patsev/dependency-check-example-gitlab-pages.

Fausia galuega: leai ni mea faʻapitoa, ou te le vaʻai i le lipoti html. E tatau ona e taumafai Artifact: i taimi uma

https://gitlab.com/anton_patsev/dependency-check-example-gitlab-pages/-/jobs/400004246

Faʻatonutonuina le maualuga o faʻafitauli o le CVE

Ole laina pito sili ona taua ile faila gitlab-ci.yaml:

mvn $MAVEN_CLI_OPTS test org.owasp:dependency-check-maven:check -DfailBuildOnCVSS=7

Faatasi ai ma le failBuildOnCVSS parameter e mafai ona e fetuutuunai le maualuga o le CVE vulnerabilities e te manaʻomia e tali atu ai.

Si'itia le NIST Vulnerability Database (NVD) mai le Initaneti

Ua e maitauina o le NIST o loʻo faʻapipiʻiina i taimi uma le NIST faʻamatalaga faʻaletonu (NVD) mai le Initaneti:

Ina ia download, e mafai ona e faʻaogaina le aoga nist_data_mirror_golang

Tatou fa'apipi'i ma fa'alauiloa.

yum -y install yum-plugin-copr
yum copr enable antonpatsev/nist_data_mirror_golang
yum -y install nist-data-mirror
systemctl start nist-data-mirror

Nist-data-mirror e tuʻuina atu le NIST JSON CVE i /var/www/repos/nist-data-mirror/ i luga o le amataga ma faʻafouina faʻamaumauga i 24 itula uma.

Ina ia sii mai CVE JSON NIST, e tatau ona e faʻapipiʻi le nginx web server (mo se faʻataʻitaʻiga, i luga o lau gitlab-runner).

Fa'ata'ita'iga o se la'ititi nginx config:

server {
    listen       12345;
    listen       [::]:12345;
    server_name  _;
    root         /var/www/repos/nist-data-mirror/;

    location / {
        autoindex on;
    }

    error_page 404 /404.html;
        location = /40x.html {
    }

    error_page 500 502 503 504 /50x.html;
        location = /50x.html {
    }

}

Ina ia aua le faia se laina umi lea e faʻalauiloa ai le mvn, o le a matou faʻanofoina faʻamau i se isi fesuiaiga DEPENDENCY_OPTS.

Ole la'ititi la'ititi config .gitlab-ci.yml ole a fa'apea:

variables:
  MAVEN_OPTS: "-Dhttps.protocols=TLSv1.2 -Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=WARN -Dorg.slf4j.simpleLogger.showDateTime=true -Djava.awt.headless=true"
  MAVEN_CLI_OPTS: "--batch-mode --errors --fail-at-end --show-version -DinstallAtEnd=true -DdeployAtEnd=true"
  DEPENDENCY_OPTS: "-DfailBuildOnCVSS=7 -DcveUrlModified=http://localhost:12345/nvdcve-1.1-modified.json.gz -DcveUrlBase=http://localhost:12345/nvdcve-1.1-%d.json.gz"

cache:
  paths:
    - .m2/repository

verify:
  stage: test
  script:
    - set +e
    - mvn $MAVEN_CLI_OPTS install org.owasp:dependency-check-maven:check $DEPENDENCY_OPTS || EXIT_CODE=$?
    - export PATH_WITHOUT_HOME=$(pwd | sed -e "s//home/gitlab-runner/builds//g")
    - echo "************************* URL Dependency-check-report.html *************************"
    - echo "http://$HOSTNAME:9999$PATH_WITHOUT_HOME/target/dependency-check-report.html"
    - set -e
    - exit ${EXIT_CODE}
  tags:
    - shell

Telegram talatalanoaga e uiga i DevOps ma Puipuiga
Telegram channel DevSecOps / SSDLC - Faʻaleleia le saogalemu

puna: www.habr.com