Skip to content

Commit f7ae7b8

Browse files
BulletdevBulletdev
committed
feat: implement aditional sec tests suites
1 parent dc02662 commit f7ae7b8

4 files changed

Lines changed: 754 additions & 0 deletions

File tree

‎security_tests/scripts/run-app-security-tests.sh‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
#!/bin/bash
2+
# ProStaff API - Application-Specific Security Tests
3+
# Runs tests for multi-tenancy, SSRF, secrets, and other app-specific vulnerabilities
4+
5+
set -e
6+
7+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
8+
REPORT_DIR="security_tests/reports"
9+
10+
echo "╔════════════════════════════════════════════════════════════════╗"
11+
echo "║ ProStaff API - Application Security Test Suite ║"
12+
echo "╚════════════════════════════════════════════════════════════════╝"
13+
echo ""
14+
15+
GREEN='\033[0;32m'
16+
RED='\033[0;31m'
17+
YELLOW='\033[1;33m'
18+
BLUE='\033[0;34m'
19+
NC='\033[0m'
20+
21+
TOTAL_PASSED=0
22+
TOTAL_FAILED=0
23+
24+
run_test() {
25+
TEST_NAME=$1
26+
SCRIPT=$2
27+
28+
echo ""
29+
echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
30+
echo -e "${BLUE}Running: $TEST_NAME${NC}"
31+
echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
32+
echo ""
33+
34+
if [ ! -f "$SCRIPT" ]; then
35+
echo -e "${RED}[SKIP]${NC} Script not found: $SCRIPT"
36+
return
37+
fi
38+
39+
if bash "$SCRIPT"; then
40+
echo ""
41+
echo -e "${GREEN}[SUCCESS]${NC} $TEST_NAME passed"
42+
TOTAL_PASSED=$((TOTAL_PASSED + 1))
43+
else
44+
echo ""
45+
echo -e "${RED}[FAILED]${NC} $TEST_NAME failed"
46+
TOTAL_FAILED=$((TOTAL_FAILED + 1))
47+
fi
48+
}
49+
50+
# Check if API is running
51+
echo "Checking if API is running..."
52+
if ! curl -s http://localhost:3333/up > /dev/null 2>&1; then
53+
echo -e "${YELLOW}WARNING: API is not running at http://localhost:3333${NC}"
54+
echo ""
55+
echo "Start the API first:"
56+
echo " docker compose up -d"
57+
echo ""
58+
echo "Some tests will be skipped..."
59+
echo ""
60+
fi
61+
62+
# Run tests
63+
run_test "Multi-Tenancy Isolation" "$SCRIPT_DIR/test-multi-tenancy-isolation.sh"
64+
run_test "SSRF Protection" "$SCRIPT_DIR/test-ssrf-protection.sh"
65+
run_test "Secrets Scanning" "$SCRIPT_DIR/scan-secrets.sh"
66+
67+
# Summary
68+
echo ""
69+
echo "╔════════════════════════════════════════════════════════════════╗"
70+
echo "║ FINAL SUMMARY ║"
71+
echo "╚════════════════════════════════════════════════════════════════╝"
72+
echo ""
73+
echo -e "Total suites run: $((TOTAL_PASSED + TOTAL_FAILED))"
74+
echo -e "${GREEN}Passed: $TOTAL_PASSED${NC}"
75+
echo -e "${RED}Failed: $TOTAL_FAILED${NC}"
76+
echo ""
77+
78+
if [ $TOTAL_FAILED -eq 0 ]; then
79+
echo -e "${GREEN}✓ All application security tests passed!${NC}"
80+
echo ""
81+
echo "Reports available at:"
82+
echo " - $REPORT_DIR/multi-tenancy/multi-tenancy-report.json"
83+
echo " - $REPORT_DIR/ssrf/ssrf-report.json"
84+
echo " - $REPORT_DIR/secrets/secrets-summary.json"
85+
echo ""
86+
exit 0
87+
else
88+
echo -e "${RED}✗ Some tests failed. Review reports in $REPORT_DIR/${NC}"
89+
echo ""
90+
echo "Critical issues found. Please fix before deploying to production."
91+
echo ""
92+
exit 1
93+
fi

‎security_tests/scripts/scan-secrets.sh‎

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
#!/bin/bash
2+
# Secrets Scanning
3+
# Detects exposed secrets, API keys, tokens in code and git history
4+
5+
set -e
6+
7+
REPORT_DIR="security_tests/reports/secrets"
8+
mkdir -p "$REPORT_DIR"
9+
10+
echo "Secrets Scanning"
11+
echo "======================================"
12+
echo ""
13+
14+
GREEN='\033[0;32m'
15+
RED='\033[0;31m'
16+
YELLOW='\033[1;33m'
17+
NC='\033[0m'
18+
19+
# Check if running in CI
20+
IS_CI=${CI:-false}
21+
22+
# 1. TruffleHog - Git history secrets
23+
echo "[1/3] Scanning git history with TruffleHog..."
24+
if command -v trufflehog &> /dev/null; then
25+
trufflehog git file://. --json --only-verified > "$REPORT_DIR/trufflehog-report.json" 2>&1 || true
26+
27+
VERIFIED_SECRETS=$(jq 'select(.Verified == true)' "$REPORT_DIR/trufflehog-report.json" 2>/dev/null | jq -s 'length')
28+
29+
if [ "$VERIFIED_SECRETS" -gt 0 ]; then
30+
echo -e "${RED}CRITICAL: Found $VERIFIED_SECRETS verified secrets in git history!${NC}"
31+
jq -r 'select(.Verified == true) | " - \(.DetectorName): \(.SourceMetadata.Data.Git.file):\(.SourceMetadata.Data.Git.line)"' \
32+
"$REPORT_DIR/trufflehog-report.json" 2>/dev/null || true
33+
else
34+
echo -e "${GREEN}No verified secrets found in git history${NC}"
35+
fi
36+
else
37+
echo -e "${YELLOW}TruffleHog not installed - skipping${NC}"
38+
echo "Install: brew install trufflehog (macOS) or docker pull trufflesecurity/trufflehog"
39+
fi
40+
41+
echo ""
42+
43+
# 2. Gitleaks - Alternative secrets scanner
44+
echo "[2/3] Scanning with Gitleaks..."
45+
if command -v gitleaks &> /dev/null; then
46+
gitleaks detect --source . --report-path "$REPORT_DIR/gitleaks-report.json" --no-git || true
47+
48+
if [ -f "$REPORT_DIR/gitleaks-report.json" ]; then
49+
LEAKS_COUNT=$(jq 'length' "$REPORT_DIR/gitleaks-report.json" 2>/dev/null || echo "0")
50+
51+
if [ "$LEAKS_COUNT" -gt 0 ]; then
52+
echo -e "${RED}CRITICAL: Found $LEAKS_COUNT potential secrets!${NC}"
53+
jq -r '.[] | " - \(.RuleID): \(.File):\(.StartLine)"' "$REPORT_DIR/gitleaks-report.json" 2>/dev/null || true
54+
else
55+
echo -e "${GREEN}No secrets found${NC}"
56+
fi
57+
else
58+
echo -e "${GREEN}No secrets found${NC}"
59+
fi
60+
else
61+
echo -e "${YELLOW}Gitleaks not installed - skipping${NC}"
62+
echo "Install: brew install gitleaks (macOS) or docker pull zricethezav/gitleaks"
63+
fi
64+
65+
echo ""
66+
67+
# 3. Pattern-based search (fallback)
68+
echo "[3/3] Pattern-based secret search..."
69+
70+
PATTERNS=(
71+
"password\s*=\s*['\"](?!.*Test123)([^'\"]+)['\"]"
72+
"api[_-]?key\s*=\s*['\"]([^'\"]+)['\"]"
73+
"secret[_-]?key\s*=\s*['\"]([^'\"]+)['\"]"
74+
"access[_-]?token\s*=\s*['\"]([^'\"]+)['\"]"
75+
"private[_-]?key\s*=\s*['\"]([^'\"]+)['\"]"
76+
"aws[_-]?access[_-]?key[_-]?id\s*=\s*['\"]([^'\"]+)['\"]"
77+
"AKIA[0-9A-Z]{16}"
78+
"sk_live_[0-9a-zA-Z]{24}"
79+
"gh[ps]_[0-9a-zA-Z]{36}"
80+
)
81+
82+
SUSPICIOUS_FILES=()
83+
84+
for pattern in "${PATTERNS[@]}"; do
85+
MATCHES=$(grep -rEn "$pattern" app/ config/ lib/ 2>/dev/null | grep -v "brakeman:ignore" | grep -v "# nosemgrep" || true)
86+
87+
if [ -n "$MATCHES" ]; then
88+
echo -e "${YELLOW}Found potential secrets matching: $pattern${NC}"
89+
echo "$MATCHES" | while read -r line; do
90+
echo " $line"
91+
FILE=$(echo "$line" | cut -d: -f1)
92+
SUSPICIOUS_FILES+=("$FILE")
93+
done
94+
fi
95+
done
96+
97+
if [ ${#SUSPICIOUS_FILES[@]} -eq 0 ]; then
98+
echo -e "${GREEN}No suspicious patterns found${NC}"
99+
fi
100+
101+
echo ""
102+
103+
# 4. Check for common secrets files
104+
echo "Checking for exposed secrets files..."
105+
EXPOSED_FILES=()
106+
107+
SECRET_FILES=(
108+
".env"
109+
".env.local"
110+
".env.production"
111+
"config/master.key"
112+
"config/credentials.yml.enc"
113+
"config/database.yml"
114+
"id_rsa"
115+
"id_dsa"
116+
"*.pem"
117+
"*.p12"
118+
"*.key"
119+
)
120+
121+
for file in "${SECRET_FILES[@]}"; do
122+
if git ls-files --error-unmatch "$file" 2>/dev/null; then
123+
EXPOSED_FILES+=("$file")
124+
echo -e "${RED}CRITICAL: $file is tracked in git!${NC}"
125+
fi
126+
done
127+
128+
if [ ${#EXPOSED_FILES[@]} -eq 0 ]; then
129+
echo -e "${GREEN}No sensitive files in git${NC}"
130+
fi
131+
132+
echo ""
133+
134+
# Generate summary report
135+
cat > "$REPORT_DIR/secrets-summary.json" <<EOF
136+
{
137+
"timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
138+
"scans": {
139+
"trufflehog": {
140+
"ran": $([ -f "$REPORT_DIR/trufflehog-report.json" ] && echo "true" || echo "false"),
141+
"verified_secrets": ${VERIFIED_SECRETS:-0}
142+
},
143+
"gitleaks": {
144+
"ran": $([ -f "$REPORT_DIR/gitleaks-report.json" ] && echo "true" || echo "false"),
145+
"potential_leaks": ${LEAKS_COUNT:-0}
146+
},
147+
"pattern_search": {
148+
"ran": true,
149+
"suspicious_files_count": ${#SUSPICIOUS_FILES[@]}
150+
},
151+
"exposed_files": {
152+
"count": ${#EXPOSED_FILES[@]},
153+
"files": $(printf '%s\n' "${EXPOSED_FILES[@]}" | jq -R . | jq -s .)
154+
}
155+
},
156+
"status": "$([ ${VERIFIED_SECRETS:-0} -gt 0 ] || [ ${LEAKS_COUNT:-0} -gt 0 ] || [ ${#EXPOSED_FILES[@]} -gt 0 ] && echo "FAILED" || echo "PASSED")"
157+
}
158+
EOF
159+
160+
echo "======================================"
161+
echo "SUMMARY"
162+
echo "======================================"
163+
cat "$REPORT_DIR/secrets-summary.json" | jq .
164+
echo ""
165+
echo "Reports saved to: $REPORT_DIR/"
166+
167+
# Exit with error if secrets found
168+
if [ "${VERIFIED_SECRETS:-0}" -gt 0 ] || [ "${LEAKS_COUNT:-0}" -gt 0 ] || [ ${#EXPOSED_FILES[@]} -gt 0 ]; then
169+
echo ""
170+
echo -e "${RED}SECURITY RISK: Secrets detected!${NC}"
171+
exit 1
172+
else
173+
echo ""
174+
echo -e "${GREEN}SUCCESS: No secrets detected${NC}"
175+
exit 0
176+
fi

0 commit comments

Comments
 (0)