Skip to content

Commit b2dbcbc

Browse files
TaofeeqibTaofeeqib
committed
DevSecOps test
1 parent 2afd644 commit b2dbcbc

11 files changed

Lines changed: 102 additions & 65 deletions

‎.github/workflows/devsecops-pipeline.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,8 @@ jobs:
187187
- name: Ensure docs/reports directory exists
188188
run: mkdir -p ./docs/reports
189189

190+
- run: npm install
191+
190192
- name: Generate SBOM with CycloneDX
191193
uses: CycloneDX/gh-node-module-generatebom@master
192194
with:
@@ -251,8 +253,8 @@ jobs:
251253
with:
252254
target: 'http://localhost:4200'
253255
allow_issue_writing: true
254-
# Generate reports and adjust options for better detection
255-
cmd_options: '-a -j -T 60 -z "-config globalexcludeurl.url_list.url\(0\)=.*/favicon.ico$" -x /tmp/zap-output/zap-baseline-report.xml -J /tmp/zap-output/zap-baseline-report.json'
256+
# Use default report formats (report_json.json, report_xml.xml, report_html.html, report_md.md)
257+
cmd_options: '-a -j -T 60 -z "-config globalexcludeurl.url_list.url\(0\)=.*/favicon.ico$"'
256258
rules_file_name: 'zap-rules.tsv'
257259
issue_title: 'ZAP Baseline Scan Report'
258260
artifact_name: 'zap-baseline-report'

‎.github/workflows/scripts/copy-zap-reports.sh‎

Lines changed: 46 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,38 @@
11
#!/bin/bash
22

3-
# Function to create ZAP XML placeholder
4-
function create_zap_xml_placeholder() {
5-
echo '<?xml version="1.0" encoding="UTF-8"?>' > ./docs/reports/zap-baseline-report.xml
6-
echo '<OWASPZAPReport version="2.11.0" generated="2025-09-07T12:00:00">' >> ./docs/reports/zap-baseline-report.xml
7-
echo ' <site name="http://localhost:4200">' >> ./docs/reports/zap-baseline-report.xml
8-
echo ' <alerts></alerts>' >> ./docs/reports/zap-baseline-report.xml
9-
echo ' </site>' >> ./docs/reports/zap-baseline-report.xml
10-
echo '</OWASPZAPReport>' >> ./docs/reports/zap-baseline-report.xml
3+
# Function to create ZAP default report placeholders
4+
function create_zap_default_placeholders() {
5+
# Create JSON placeholder
6+
echo '{' > ./docs/reports/report_json.json
7+
echo ' "site": "http://localhost:4200",' >> ./docs/reports/report_json.json
8+
echo ' "generated": "2025-09-07T12:00:00",' >> ./docs/reports/report_json.json
9+
echo ' "version": "2.11.0",' >> ./docs/reports/report_json.json
10+
echo ' "alerts": []' >> ./docs/reports/report_json.json
11+
echo '}' >> ./docs/reports/report_json.json
12+
13+
# Create XML placeholder
14+
echo '<?xml version="1.0" encoding="UTF-8"?>' > ./docs/reports/report_xml.xml
15+
echo '<OWASPZAPReport version="2.11.0" generated="2025-09-07T12:00:00">' >> ./docs/reports/report_xml.xml
16+
echo ' <site name="http://localhost:4200">' >> ./docs/reports/report_xml.xml
17+
echo ' <alerts></alerts>' >> ./docs/reports/report_xml.xml
18+
echo ' </site>' >> ./docs/reports/report_xml.xml
19+
echo '</OWASPZAPReport>' >> ./docs/reports/report_xml.xml
20+
21+
# Create HTML placeholder
22+
echo '<!DOCTYPE html>' > ./docs/reports/report_html.html
23+
echo '<html><head><title>ZAP Scanning Report</title></head>' >> ./docs/reports/report_html.html
24+
echo '<body><h1>ZAP Scanning Report</h1>' >> ./docs/reports/report_html.html
25+
echo '<p>This is a placeholder for ZAP HTML report.</p>' >> ./docs/reports/report_html.html
26+
echo '</body></html>' >> ./docs/reports/report_html.html
27+
28+
# Create Markdown placeholder
29+
echo '# ZAP Scanning Report' > ./docs/reports/report_md.md
30+
echo 'Generated: 2025-09-07T12:00:00' >> ./docs/reports/report_md.md
31+
echo '' >> ./docs/reports/report_md.md
32+
echo 'This is a placeholder for ZAP Markdown report.' >> ./docs/reports/report_md.md
1133
}
1234

13-
# Function to create ZAP JSON placeholder
14-
function create_zap_json_placeholder() {
15-
echo '{' > ./docs/reports/zap-baseline-report.json
16-
echo ' "site": "http://localhost:4200",' >> ./docs/reports/zap-baseline-report.json
17-
echo ' "generated": "2025-09-07T12:00:00",' >> ./docs/reports/zap-baseline-report.json
18-
echo ' "version": "2.11.0",' >> ./docs/reports/zap-baseline-report.json
19-
echo ' "alerts": []' >> ./docs/reports/zap-baseline-report.json
20-
echo '}' >> ./docs/reports/zap-baseline-report.json
21-
}
22-
23-
echo "Looking for ZAP Baseline Scan report files..."
35+
echo "Looking for ZAP report files..."
2436

2537
# Check in /tmp/zap-output where we directed ZAP to write reports
2638
echo "Checking in /tmp/zap-output:"
@@ -32,33 +44,33 @@ if [ -d "/tmp/zap-output" ]; then
3244
cp -v /tmp/zap-output/*.* ./docs/reports/ 2>/dev/null || echo "No files to copy from /tmp/zap-output"
3345
fi
3446

35-
# Look for baseline scan reports only
47+
# Look for default ZAP report formats
3648
for report in \
37-
./zap-baseline-report.xml \
38-
./zap-baseline-report.json \
3949
./report_json.json \
4050
./report_xml.xml \
4151
./report_html.html \
4252
./report_md.md \
43-
/tmp/zap-output/zap-baseline-report.xml \
44-
/tmp/zap-output/zap-baseline-report.json \
45-
/tmp/zap-baseline-report.xml \
46-
/tmp/zap-baseline-report.json \
47-
/zap/wrk/zap-baseline-report.xml \
48-
/zap/wrk/zap-baseline-report.json; do
53+
/tmp/zap-output/report_json.json \
54+
/tmp/zap-output/report_xml.xml \
55+
/tmp/zap-output/report_html.html \
56+
/tmp/zap-output/report_md.md \
57+
/zap/wrk/report_json.json \
58+
/zap/wrk/report_xml.xml \
59+
/zap/wrk/report_html.html \
60+
/zap/wrk/report_md.md; do
4961
if [ -f "$report" ]; then
5062
echo "Found report: $report"
5163
cp -v "$report" ./docs/reports/
5264
fi
5365
done
5466

55-
# If no reports were found, create placeholders
56-
if [ ! -f "./docs/reports/zap-baseline-report.xml" ] && [ ! -f "./docs/reports/zap-baseline-report.json" ]; then
57-
echo "Creating placeholder for ZAP baseline reports (XML and JSON)"
58-
create_zap_xml_placeholder
59-
create_zap_json_placeholder
67+
# Check if we found any of the default ZAP reports
68+
if [ ! -f "./docs/reports/report_json.json" ] && [ ! -f "./docs/reports/report_xml.xml" ] &&
69+
[ ! -f "./docs/reports/report_html.html" ] && [ ! -f "./docs/reports/report_md.md" ]; then
70+
echo "No default ZAP reports found. Creating placeholders."
71+
create_zap_default_placeholders
6072
fi
6173

6274
# Check if any reports were copied or created
6375
echo "Contents of docs/reports directory:"
64-
ls -la ./docs/reports/
76+
ls -la ./docs/reports/

‎.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,7 @@ testem.log
3838
.DS_Store
3939
Thumbs.db
4040
.vscode/extensions.json
41+
42+
# DefectDojo
43+
/django-DefectDojo
44+
django-DefectDojo/

‎README.md‎

Lines changed: 5 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ This project implements a comprehensive DevSecOps pipeline for a deliberately vu
77
The pipeline includes the following security stages:
88

99
1. **Secrets Scanning** - Using TruffleHog OSS to detect exposed credentials
10-
2. **Static Application Security Testing (SAST)** - Using Semgrep with JavaScript, Angular, and Node.js rulesets
10+
2. **Static Application Security Testing (SAST)** - Using CodeQL with JavaScript, Angular, and Node.js rulesets
1111
3. **Software Composition Analysis (SCA)** - Using OWASP Dependency-Check to identify vulnerable dependencies
1212
4. **Software Bill of Materials (SBOM)** - Using CycloneDX to generate a comprehensive inventory of components
1313
5. **Dynamic Application Security Testing (DAST)** - Using OWASP ZAP to perform runtime security testing
@@ -46,7 +46,6 @@ The pipeline is designed to detect:
4646
1. Secrets and credentials exposed in code
4747
2. XSS vulnerabilities in Angular code
4848
3. Vulnerable dependencies in both frontend and backend
49-
4. Other security issues defined in Semgrep rules
5049

5150
## Integration with DefectDojo
5251

@@ -57,7 +56,7 @@ Scan results from all security tools are aggregated in DefectDojo for:
5756
- Historical security trend analysis
5857

5958
### Note on ZAP Reports
60-
When importing ZAP scan results into DefectDojo, use the XML format (`zap-baseline-report.xml`) which is specifically formatted for DefectDojo compatibility. The XML report requires properly formatted URLs with fully qualified domain names to be parsed correctly by DefectDojo's ZAP parser.
59+
When importing ZAP scan results into DefectDojo, use the XML format (`report_xml.xml`) which is specifically formatted for DefectDojo compatibility. The XML report requires properly formatted URLs with fully qualified domain names to be parsed correctly by DefectDojo's ZAP parser.
6160

6261
## Screenshots
6362

@@ -75,21 +74,12 @@ All security scan results are stored in the `docs/reports` directory for easy ac
7574
- **OWASP Dependency-Check Results** - `dependency-check-*.sarif`
7675
- **CycloneDX SBOM** - `angular-xss-sbom.json`
7776
- **ZAP DAST Reports** - Multiple formats available:
78-
- XML format: `zap-baseline-report.xml` (DefectDojo compatible format)
79-
- JSON format: `zap-baseline-report.json` and `report_json.json`
80-
- Markdown format: `zap-baseline-report.md` and `report_md.md`
81-
- HTML format: `report_html.html` (contains detailed findings with risk levels)
77+
- JSON format: `report_json.json`
78+
- Markdown format: `report_md.md`
79+
- HTML format: `report_html.html`
8280

83-
A comprehensive report index is available at `docs/reports/README.md`.
8481

8582
To view SARIF files, you can use:
8683
- GitHub Security Code Scanning dashboard
8784
- [SARIF Viewer VSCode Extension](https://marketplace.visualstudio.com/items?itemName=MS-SarifVSCode.sarif-viewer)
8885
- [SARIF Web Viewer](https://microsoft.github.io/sarif-web-component/)
89-
90-
## Future Enhancements
91-
92-
- Implement container scanning
93-
- Add automated security regression testing
94-
- Enhance Semgrep rules for custom vulnerabilities
95-
- Add GitHub Pages to host scan reports

‎docs/screenshots/DefectDojo_SAST.png‎

479 KB
Loading

‎docs/screenshots/DefectDojo_SCA.png‎

643 KB
Loading

‎docs/screenshots/SAST_Screenshot 2025-09-07 at 6.51.35 PM.png‎

730 KB
Loading

‎docs/screenshots/SCA_Screenshot 2025-09-07 at 6.52.10 PM.png‎

619 KB
Loading

‎docs/screenshots/Secret_Screenshot 2025-09-07 at 6.50.50 PM.png‎

714 KB
Loading

‎import-to-defectdojo.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ else
114114
fi
115115

116116
# Import ZAP report
117-
for zap_file in "$REPORTS_DIR/zap-baseline-report.xml" "$REPORTS_DIR/report_html.html" "$REPORTS_DIR/zap-baseline-report.json"; do
117+
for zap_file in "$REPORTS_DIR/report_xml.xml" "$REPORTS_DIR/report_html.html" "$REPORTS_DIR/report_json.json"; do
118118
if [ -f "$zap_file" ] && [ -s "$zap_file" ]; then
119119
echo "Importing ZAP report: $zap_file"
120120
IMPORT_RESPONSE=$(curl -s -X POST \

0 commit comments

Comments
 (0)