demo
86003f2adc
14-stage Jenkins pipeline with real scanners (Semgrep, Gitleaks, Trivy, SonarQube, Checkov, ZAP, Cosign), Helm chart, DefectDojo integration. Includes CWE-89, CWE-79, CWE-798, CWE-22, CWE-330 for SAST/secrets demo.
20 lines
623 B
YAML
20 lines
623 B
YAML
rules:
|
|
- id: no-eval
|
|
patterns:
|
|
- pattern: eval(...)
|
|
message: "eval() is banned — remote code execution risk (CWE-95)"
|
|
severity: ERROR
|
|
languages: [javascript]
|
|
- id: no-child-process-exec
|
|
patterns:
|
|
- pattern: require('child_process').exec(...)
|
|
message: "child_process.exec() with dynamic input is banned — command injection risk (CWE-78)"
|
|
severity: ERROR
|
|
languages: [javascript]
|
|
- id: no-new-function
|
|
patterns:
|
|
- pattern: new Function(...)
|
|
message: "new Function() is banned — code injection risk (CWE-95)"
|
|
severity: ERROR
|
|
languages: [javascript]
|