Skip to content

Commit a672bb4

Browse files
misonijnikmisonijnik
committed
Add OpenTaint + ZAP action and more controllers
1 parent beda2ba commit a672bb4

8 files changed

Lines changed: 1029 additions & 0 deletions

File tree

‎.github/workflows/security-scan-full.yml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
name: OpenTaint + ZAP Security Scan (Full Mode)
2+
3+
on:
4+
push
5+
6+
permissions:
7+
contents: read
8+
security-events: write
9+
10+
jobs:
11+
security-scan:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Checkout repository
15+
uses: actions/checkout@v6
16+
17+
- name: Set up JDK 21
18+
uses: actions/setup-java@v5
19+
with:
20+
java-version: '21'
21+
distribution: 'temurin'
22+
23+
- name: Setup Gradle
24+
uses: gradle/actions/setup-gradle@v5
25+
26+
- name: Build application
27+
run: ./gradlew build -x test
28+
29+
- name: Start Spring Boot application
30+
run: |
31+
./gradlew bootRun > app.log 2>&1 &
32+
echo $! > app.pid
33+
34+
# Wait for application to be ready
35+
echo "Waiting for application to start..."
36+
for i in {1..30}; do
37+
if curl -s http://localhost:8081/v3/api-docs > /dev/null; then
38+
echo "Application is ready!"
39+
break
40+
fi
41+
echo "Waiting... ($i/30)"
42+
sleep 2
43+
done
44+
45+
if ! curl -s http://localhost:8081/v3/api-docs > /dev/null; then
46+
echo "Application failed to start"
47+
cat app.log
48+
exit 1
49+
fi
50+
51+
- name: Run OpenTaint + ZAP security scan
52+
uses: seqra/opentaint/github/zap@github/v0
53+
with:
54+
mode: 'full'
55+
template: 'template.yaml'
56+
target: 'http://localhost:8081'
57+
artifact-name: 'seqra-zap-scan-results'
58+
upload-sarif: 'false'
59+
zap-cmd-options: '-addonupdate -addoninstall ascanrulesBeta -addoninstall pscanrulesBeta'
60+
61+
- name: Stop application
62+
if: always()
63+
run: |
64+
if [ -f app.pid ]; then
65+
kill $(cat app.pid) || true
66+
rm app.pid
67+
fi

‎.github/workflows/security-scan-pr.yml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
name: OpenTaint + ZAP Security Scan
2+
3+
on:
4+
pull_request
5+
6+
permissions:
7+
contents: read
8+
pull-requests: write
9+
security-events: write
10+
11+
jobs:
12+
security-scan:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout repository
16+
uses: actions/checkout@v6
17+
18+
- name: Set up JDK 21
19+
uses: actions/setup-java@v5
20+
with:
21+
java-version: '21'
22+
distribution: 'temurin'
23+
24+
- name: Setup Gradle
25+
uses: gradle/actions/setup-gradle@v5
26+
27+
- name: Build application
28+
run: ./gradlew build -x test
29+
30+
- name: Start Spring Boot application
31+
run: |
32+
./gradlew bootRun > app.log 2>&1 &
33+
echo $! > app.pid
34+
35+
# Wait for application to be ready
36+
echo "Waiting for application to start..."
37+
for i in {1..30}; do
38+
if curl -s http://localhost:8081/v3/api-docs > /dev/null; then
39+
echo "Application is ready!"
40+
break
41+
fi
42+
echo "Waiting... ($i/30)"
43+
sleep 2
44+
done
45+
46+
if ! curl -s http://localhost:8081/v3/api-docs > /dev/null; then
47+
echo "Application failed to start"
48+
cat app.log
49+
exit 1
50+
fi
51+
52+
- name: Run OpenTaint + ZAP security scan
53+
uses: seqra/opentaint/github/zap@github/v0
54+
with:
55+
mode: 'differential'
56+
template: 'template.yaml'
57+
target: 'http://localhost:8081'
58+
artifact-name: 'seqra-zap-scan-results'
59+
upload-sarif: 'true'
60+
zap-cmd-options: '-addonupdate -addoninstall ascanrulesBeta -addoninstall pscanrulesBeta'
61+
62+
- name: Stop application
63+
if: always()
64+
run: |
65+
if [ -f app.pid ]; then
66+
kill $(cat app.pid) || true
67+
rm app.pid
68+
fi

‎.github/workflows/zap-scan.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: ZAP Full Scan
2+
3+
on:
4+
pull_request
5+
6+
permissions:
7+
contents: read
8+
pull-requests: write
9+
10+
jobs:
11+
zap-scan:
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- name: Checkout repository
16+
uses: actions/checkout@v6
17+
18+
- name: Set up JDK 21
19+
uses: actions/setup-java@v5
20+
with:
21+
java-version: '21'
22+
distribution: 'temurin'
23+
24+
- name: Setup Gradle
25+
uses: gradle/actions/setup-gradle@v5
26+
27+
- name: Build application
28+
run: ./gradlew build -x test
29+
30+
- name: Start Spring Boot application
31+
run: |
32+
./gradlew bootRun > app.log 2>&1 &
33+
echo $! > app.pid
34+
35+
echo "Waiting for application to start..."
36+
for i in {1..30}; do
37+
if curl -s http://localhost:8081/v3/api-docs > /dev/null; then
38+
echo "Application is ready!"
39+
break
40+
fi
41+
echo "Waiting... ($i/30)"
42+
sleep 2
43+
done
44+
45+
if ! curl -s http://localhost:8081/v3/api-docs > /dev/null; then
46+
echo "Application failed to start"
47+
cat app.log
48+
exit 1
49+
fi
50+
51+
- name: Create output directory
52+
run: |
53+
mkdir -p zap-output
54+
chmod 777 zap-output
55+
56+
- name: Run ZAP Automation Framework scan
57+
uses: zaproxy/action-af@v0.2.0
58+
continue-on-error: true
59+
with:
60+
plan: 'full-scan.yaml'
61+
docker_name: 'ghcr.io/zaproxy/zaproxy:stable'
62+
cmd_options: '-addonupdate -addoninstall ascanrulesBeta -addoninstall pscanrulesBeta'
63+
64+
- name: Stop application
65+
if: always()
66+
run: |
67+
if [ -f app.pid ]; then
68+
kill $(cat app.pid) || true
69+
rm app.pid
70+
fi
71+
72+
- name: Upload ZAP scan results
73+
uses: actions/upload-artifact@v4
74+
if: always()
75+
with:
76+
name: zap-full-scan-results
77+
path: zap-output/
78+
retention-days: 30

‎.zap/rules.tsv‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
# ZAP API Scan Rules Configuration
2+
3+
# CWE-22: Path Traversal
4+
6 WARN (Path Traversal - Active/release)
5+
6+
# CWE-78: OS Command Injection
7+
10048 WARN (Remote Code Execution - Shell Shock - Active/beta)
8+
40045 IGNORE (Spring4Shell - Active/beta)
9+
40048 IGNORE (Remote Code Execution - CVE-2021-44228 - Active/beta)
10+
90020 WARN (Remote OS Command Injection - Active/release)
11+
90037 IGNORE (Server Side Template Injection - Active/beta)
12+
13+
# CWE-79: Cross-Site Scripting (XSS)
14+
40012 WARN (Cross Site Scripting (Reflected) - Active/release)
15+
40026 IGNORE (Cross Site Scripting (DOM Based) - Active/release)
16+
40031 IGNORE (Cross Site Scripting (Persistent) - Active/release)
17+
18+
# CWE-89: SQL Injection
19+
40018 WARN (SQL Injection - Active/release)
20+
40019 WARN (SQL Injection - MySQL - Active/beta)
21+
40020 WARN (SQL Injection - Hypersonic SQL - Active/beta)
22+
40021 WARN (SQL Injection - Oracle - Active/beta)
23+
40022 WARN (SQL Injection - PostgreSQL - Active/beta)
24+
40027 IGNORE (SQL Injection - SQLite - Active/beta)
25+
26+
# CWE-94: Code Injection
27+
40028 WARN (ELMAH Information Leak - Active/beta)
28+
40032 IGNORE (.htaccess Information Leak - Active/beta)
29+
90019 WARN (Server Side Code Injection - Active/release)
30+
31+
# CWE-113: CRLF Injection
32+
40003 WARN (CRLF Injection - Active/release)
33+
34+
# CWE-117: Log Injection
35+
40043 IGNORE (Log4Shell - Active/beta)
36+
40047 IGNORE (CORS Header - Active/beta)
37+
38+
# CWE-352: CSRF
39+
20012 WARN (Anti CSRF Tokens Scanner - Active/beta)
40+
41+
# CWE-601: Open Redirect
42+
20019 WARN (External Redirect - Active/release)
43+
44+
# CWE-611: XXE
45+
90023 WARN (XML External Entity Attack - Active/beta)
46+
47+
# CWE-643: XPath Injection
48+
90021 WARN (XPath Injection - Active/beta)
49+
50+
# CWE-917: Expression Language Injection
51+
90025 WARN (Expression Language Injection - Active/beta)
52+
53+
# CWE-918: SSRF
54+
40046 IGNORE (SSRF - Active/beta)
55+
56+
# CWE-943: NoSQL Injection
57+
40033 IGNORE (NoSQL Injection - MongoDB - Active/beta)
58+
90039 IGNORE (NoSQL Injection - Active/beta)
59+
60+
# CWE-1336: Prototype Pollution
61+
90035 IGNORE (Prototype Pollution - Active/beta)
62+
90036 IGNORE (Prototype Pollution (Client Side) - Active/beta)
63+
64+
# Additional passive scan rules to ignore
65+
90003 IGNORE (Sub Resource Integrity Attribute Missing - Passive/release)
66+
90004 IGNORE (Insufficient Site Isolation Against Spectre Vulnerability - Passive/release)
67+
68+
# Disable all other active scan rules not listed above
69+
0 IGNORE (Directory Browsing - Active/release)
70+
2 IGNORE (Private IP Disclosure - Passive/release)
71+
3 IGNORE (Session ID in URL Rewrite - Passive/release)
72+
7 IGNORE (Remote File Inclusion - Active/release)
73+
10010 IGNORE (Cookie No HttpOnly Flag - Passive/release)
74+
10011 IGNORE (Cookie Without Secure Flag - Passive/release)
75+
10012 IGNORE (Password Autocomplete in Browser - Passive/release)
76+
10015 IGNORE (Incomplete or No Cache-control and Pragma HTTP Header Set - Passive/release)
77+
10016 IGNORE (Web Browser XSS Protection Not Enabled - Passive/release)
78+
10017 IGNORE (Cross-Domain JavaScript Source File Inclusion - Passive/release)
79+
10019 IGNORE (Content-Type Header Missing - Passive/release)
80+
10020 IGNORE (X-Frame-Options Header Scanner - Passive/release)
81+
10021 IGNORE (X-Content-Type-Options Header Missing - Passive/release)
82+
10023 IGNORE (Information Disclosure - Debug Error Messages - Passive/beta)
83+
10024 IGNORE (Information Disclosure - Sensitive Informations in URL - Passive/beta)
84+
10025 IGNORE (Information Disclosure - Sensitive Information in HTTP Referrer Header - Passive/beta)
85+
10026 IGNORE (HTTP Parameter Override - Passive/beta)
86+
10027 IGNORE (Information Disclosure - Suspicious Comments - Passive/beta)
87+
10032 IGNORE (Viewstate Scanner - Passive/beta)
88+
10040 IGNORE (Secure Pages Include Mixed Content - Passive/release)
89+
10045 IGNORE (Source Code Disclosure - /WEB-INF folder - Active/beta)
90+
10095 IGNORE (Backup File Disclosure - Active/beta)
91+
10105 IGNORE (Weak Authentication Method - Passive/beta)
92+
10202 IGNORE (Absence of Anti-CSRF Tokens - Passive/beta)
93+
20014 IGNORE (HTTP Parameter Pollution scanner - Active/beta)
94+
20015 IGNORE (Heartbleed OpenSSL Vulnerability - Active/beta)
95+
20016 IGNORE (Cross-Domain Misconfiguration - Active/beta)
96+
20017 IGNORE (Source Code Disclosure - CVE-2012-1823 - Active/beta)
97+
20018 IGNORE (Remote Code Execution - CVE-2012-1823 - Active/beta)
98+
30001 IGNORE (Buffer Overflow - Active/release)
99+
30002 IGNORE (Format String Error - Active/release)
100+
30003 IGNORE (Integer Overflow Error - Active/beta)
101+
40008 IGNORE (Parameter Tampering - Active/release)
102+
40009 IGNORE (Server Side Include - Active/release)
103+
40013 IGNORE (Session Fixation - Active/beta)
104+
40014 IGNORE (Cross Site Scripting (Persistent) - Active/release)
105+
40016 IGNORE (Cross Site Scripting (Persistent) - Prime - Active/release)
106+
40017 IGNORE (Cross Site Scripting (Persistent) - Spider - Active/release)
107+
40023 IGNORE (Possible Username Enumeration - Active/beta)
108+
42 IGNORE (Source Code Disclosure - SVN - Active/beta)
109+
50000 IGNORE (Script Active Scan Rules - Active/release)
110+
50001 IGNORE (Script Passive Scan Rules - Passive/release)
111+
90001 IGNORE (Insecure JSF ViewState - Passive/beta)
112+
90011 IGNORE (Charset Mismatch - Passive/beta)
113+
90022 IGNORE (Application Error Disclosure - Passive/release)
114+
90024 IGNORE (Generic Padding Oracle - Active/beta)
115+
90026 IGNORE (SOAP Action Spoofing - Active/alpha)
116+
90028 IGNORE (Insecure HTTP Method - Active/beta)
117+
90029 IGNORE (SOAP XML Injection - Active/alpha)
118+
90030 IGNORE (WSDL File Passive Scanner - Passive/alpha)
119+
90033 IGNORE (Loosely Scoped Cookie - Passive/beta)

0 commit comments

Comments
 (0)