Initial commit: inventory API with vulnerable legacy reports module

ASP.NET Core (.NET 8), intentionally outdated NuGet packages (Newtonsoft.Json 12.0.2, Microsoft.Data.SqlClient 2.0.0) for SCA demo. CWE-89, CWE-327, CWE-798, CWE-22, CWE-330 in LegacyReports.cs.
2026-09-02 12:57:34 +00:00
parent 518c510a54
commit 734f73afb5
11 changed files with 416 additions and 0 deletions
@@ -0,0 +1,13 @@
+rules:
+  - id: no-eval
+    patterns:
+      - pattern: eval(...)
+    message: "eval() is banned — code injection risk (CWE-95)"
+    severity: ERROR
+    languages: [javascript, python]
+  - id: no-process-start
+    patterns:
+      - pattern: System.Diagnostics.Process.Start(...)
+    message: "Process.Start() with dynamic input is banned — command injection risk (CWE-78)"
+    severity: ERROR
+    languages: [csharp]
@@ -0,0 +1,11 @@
+FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
+WORKDIR /src
+COPY . .
+RUN dotnet publish InventoryApi.csproj -c Release -o /app/publish
+
+FROM mcr.microsoft.com/dotnet/aspnet:8.0
+WORKDIR /app
+COPY --from=build /app/publish .
+EXPOSE 8080
+USER 1654
+ENTRYPOINT ["dotnet", "InventoryApi.dll"]
@@ -0,0 +1,16 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <InvariantGlobalization>true</InvariantGlobalization>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <!-- Intentionally outdated packages for the SCA demo -->
+    <PackageReference Include="Newtonsoft.Json" Version="12.0.2" />
+    <PackageReference Include="Microsoft.Data.SqlClient" Version="2.0.0" />
+  </ItemGroup>
+
+</Project>
@@ -0,0 +1,234 @@
+pipeline {
+  agent {
+    kubernetes {
+      yaml '''
+apiVersion: v1
+kind: Pod
+spec:
+  containers:
+    - name: build
+      image: mcr.microsoft.com/dotnet/sdk:8.0
+      command: ["sleep", "999999"]
+      resources: { limits: { memory: 2Gi } }
+    - name: semgrep
+      image: semgrep/semgrep:latest
+      command: ["sleep", "999999"]
+      resources: { limits: { memory: 1Gi } }
+    - name: gitleaks
+      image: ghcr.io/gitleaks/gitleaks:latest
+      command: ["sleep", "999999"]
+      resources: { limits: { memory: 256Mi } }
+    - name: trivy
+      image: ghcr.io/aquasecurity/trivy:latest
+      command: ["sleep", "999999"]
+      resources: { limits: { memory: 1Gi } }
+    - name: sonar
+      image: sonarsource/sonar-scanner-cli:latest
+      command: ["sleep", "999999"]
+      resources: { limits: { memory: 2Gi } }
+      env:
+        - name: SONAR_TOKEN
+          valueFrom: { secretKeyRef: { name: sonar-token, key: SONAR_TOKEN } }
+    - name: kaniko
+      image: gcr.io/kaniko-project/executor:debug
+      command: ["/busybox/sh", "-c", "sleep 999999"]
+      resources: { limits: { memory: 2Gi } }
+    - name: checkov
+      image: bridgecrew/checkov:latest
+      command: ["sleep", "999999"]
+      resources: { limits: { memory: 512Mi } }
+    - name: cosign
+      image: public.ecr.aws/docker/library/alpine:3.20
+      command: ["sleep", "999999"]
+      resources: { limits: { memory: 256Mi } }
+      env:
+        - name: COSIGN_PASSWORD
+          valueFrom: { secretKeyRef: { name: cosign-keys, key: password } }
+      volumeMounts:
+        - { name: cosign-keys, mountPath: /keys, readOnly: true }
+    - name: zap
+      image: ghcr.io/zaproxy/zaproxy:stable
+      command: ["sleep", "999999"]
+      resources: { limits: { memory: 1Gi } }
+    - name: git
+      image: alpine/git:latest
+      command: ["sleep", "999999"]
+      resources: { limits: { memory: 128Mi } }
+    - name: uploader
+      image: curlimages/curl:latest
+      command: ["sleep", "999999"]
+      securityContext: { runAsUser: 1000 }
+      resources: { limits: { memory: 128Mi } }
+      env:
+        - name: DD_TOKEN
+          valueFrom: { secretKeyRef: { name: defectdojo-token, key: DD_TOKEN } }
+  volumes:
+    - name: cosign-keys
+      secret: { secretName: cosign-keys }
+'''
+    }
+  }
+  environment {
+    REGISTRY   = "10.0.1.215:30500"
+    IMAGE      = "inventory-api"
+    SONAR_HOST = "http://sonarqube-sonarqube.platform.svc:9000"
+    DD_URL     = "http://defectdojo-django.security.svc"
+    APP_URL    = "http://inventory-api.demo-app.svc:8080"
+  }
+  stages {
+    stage('Install & Test') {
+      steps { container('build') { sh 'dotnet restore && dotnet build -c Release --no-restore' } }
+    }
+    stage('SAST — Semgrep audit') {
+      steps {
+        container('semgrep') {
+          sh 'semgrep scan --config auto --json --output semgrep.json --metrics=off || true'
+        }
+      }
+    }
+    stage('SAST Gate') {
+      steps {
+        container('semgrep') {
+          sh 'semgrep scan --config .semgrep-gate.yml --error --exclude=LegacyReports.cs --metrics=off .'
+        }
+      }
+    }
+    stage('Secrets — Gitleaks') {
+      steps {
+        container('gitleaks') {
+          sh 'gitleaks detect --source . --no-git --report-format json --report-path gitleaks.json || true'
+        }
+      }
+    }
+    stage('SCA — Trivy deps') {
+      steps {
+        container('trivy') {
+          sh 'trivy fs --scanners vuln --format json --output trivy-fs.json .'
+          sh 'trivy fs --scanners vuln --severity HIGH,CRITICAL .'
+        }
+      }
+    }
+    stage('SonarQube') {
+      steps {
+        container('sonar') {
+          sh 'sonar-scanner -Dsonar.host.url=$SONAR_HOST -Dsonar.token=$SONAR_TOKEN -Dsonar.qualitygate.wait=false'
+        }
+      }
+    }
+    stage('Build — Kaniko') {
+      steps {
+        container('kaniko') {
+          sh '''/kaniko/executor \
+            --context "dir://$(pwd)" \
+            --dockerfile Dockerfile \
+            --destination "$REGISTRY/$IMAGE:$BUILD_NUMBER" \
+            --tar-path image.tar \
+            --insecure --insecure-pull'''
+        }
+      }
+    }
+    stage('Image Scan — Trivy') {
+      steps {
+        container('trivy') {
+          sh 'trivy image --input image.tar --format json --output trivy-image.json'
+        }
+      }
+    }
+    stage('SBOM — CycloneDX') {
+      steps {
+        container('trivy') {
+          sh 'trivy image --input image.tar --format cyclonedx --output sbom.cdx.json'
+        }
+      }
+    }
+    stage('IaC — Checkov') {
+      steps {
+        container('checkov') {
+          sh 'checkov -d . --quiet -o json > checkov.json || true'
+        }
+      }
+    }
+    stage('Sign — Cosign') {
+      steps {
+        container('cosign') {
+          sh '''
+            wget -qO /tmp/cosign https://github.com/sigstore/cosign/releases/download/v2.4.1/cosign-linux-amd64
+            chmod +x /tmp/cosign
+            /tmp/cosign sign --key /keys/cosign.key --allow-insecure-registry --tlog-upload=false --yes "$REGISTRY/$IMAGE:$BUILD_NUMBER"
+          '''
+        }
+      }
+    }
+    stage('Deploy — GitOps bump') {
+      steps {
+        container('git') {
+          sh '''
+            git config --global --add safe.directory "$(pwd)"
+            git config user.name "Jenkins CI"
+            git config user.email "jenkins@demo.local"
+            sed -i "s/^  tag: .*/  tag: \\"$BUILD_NUMBER\\"/" helm/values.yaml
+            if git diff --quiet helm/values.yaml; then
+              echo "values.yaml already points at build $BUILD_NUMBER — nothing to push"
+            else
+              git add helm/values.yaml
+              git commit -m "ci: deploy build $BUILD_NUMBER [ci skip]"
+              git push http://demo:devsecops@gitea-http.platform.svc:3000/demo/$IMAGE.git HEAD:main
+            fi
+          '''
+        }
+      }
+    }
+    stage('DAST — OWASP ZAP') {
+      steps {
+        container('uploader') {
+          sh '''
+            echo "Waiting for deployment to become healthy..."
+            for i in $(seq 1 60); do
+              if curl -sf "$APP_URL/health" > /dev/null; then echo "App is up"; break; fi
+              sleep 10
+            done
+          '''
+        }
+        container('zap') {
+          sh '''
+            rm -rf /zap/wrk && ln -s "$(pwd)" /zap/wrk
+            zap-baseline.py -t "$APP_URL" -J zap.json -I || true
+          '''
+        }
+      }
+    }
+    stage('Publish — DefectDojo') {
+      steps {
+        container('uploader') {
+          sh '''
+            upload() {
+              [ -f "$2" ] || { echo "skip $1 ($2 missing)"; return 0; }
+              curl -sf -X POST "$DD_URL/api/v2/import-scan/" \
+                -H "Authorization: Token $DD_TOKEN" \
+                -F scan_type="$1" \
+                -F file=@"$2" \
+                -F product_name=$IMAGE \
+                -F engagement_name="CI Build $BUILD_NUMBER" \
+                -F auto_create_context=true \
+                -F active=true -F verified=true \
+                > /dev/null && echo "uploaded: $1" || echo "FAILED: $1"
+            }
+            upload "Semgrep JSON Report" semgrep.json
+            upload "Gitleaks Scan"       gitleaks.json
+            upload "Trivy Scan"          trivy-fs.json
+            upload "Trivy Scan"          trivy-image.json
+            upload "Checkov Scan"        checkov.json
+            upload "ZAP Scan"            zap.json
+          '''
+        }
+      }
+    }
+  }
+  post {
+    always {
+      archiveArtifacts artifacts: '*.json', allowEmptyArchive: true
+    }
+    success { echo 'Pipeline PASSED — findings aggregated in DefectDojo.' }
+    failure { echo 'Pipeline FAILED — a security gate blocked the release.' }
+  }
+}
@@ -0,0 +1,43 @@
+// LEGACY MODULE — INTENTIONAL VULNERABILITIES FOR DEMO
+// Included in full security scans, excluded from the blocking SAST gate.
+using System.Security.Cryptography;
+using System.Text;
+using Microsoft.Data.SqlClient;
+
+namespace InventoryApi.Legacy;
+
+public static class LegacyReports
+{
+    // CWE-798: Hardcoded credentials
+    public const string ConnectionString =
+        "Server=inventory-db;Database=inventory;User Id=sa;Password=Inv3ntory2019!;";
+    public const string AwsAccessKeyId = "AKIA5NETDEMO7INVENTY";
+    public const string ReportSigningKey = "legacy-report-signing-key-2019";
+
+    // CWE-89: SQL Injection via string concatenation
+    public static SqlCommand GetStockReport(SqlConnection conn, string warehouse)
+    {
+        return new SqlCommand(
+            "SELECT * FROM stock WHERE warehouse = '" + warehouse + "'", conn);
+    }
+
+    // CWE-327: Weak cryptographic hash
+    public static string HashApiKey(string apiKey)
+    {
+        using var md5 = MD5.Create();
+        return Convert.ToHexString(md5.ComputeHash(Encoding.UTF8.GetBytes(apiKey)));
+    }
+
+    // CWE-22: Path traversal
+    public static string ReadReport(string baseDir, string fileName)
+    {
+        return File.ReadAllText(baseDir + "/" + fileName);
+    }
+
+    // CWE-330: Insecure randomness for tokens
+    public static string ExportToken()
+    {
+        var rnd = new Random();
+        return rnd.Next().ToString("x") + rnd.Next().ToString("x");
+    }
+}
@@ -0,0 +1,21 @@
+var builder = WebApplication.CreateBuilder(args);
+var app = builder.Build();
+
+var items = new[]
+{
+    new { Id = 1, Name = "Rack server R740", Stock = 12 },
+    new { Id = 2, Name = "Switch 48p PoE", Stock = 31 },
+    new { Id = 3, Name = "UPS 3000VA", Stock = 7 },
+};
+
+app.MapGet("/health", () => Results.Json(new { status = "healthy" }));
+
+app.MapGet("/api/items", () => Results.Json(items));
+
+app.MapGet("/api/items/{id:int}", (int id) =>
+{
+    var item = items.FirstOrDefault(i => i.Id == id);
+    return item is null ? Results.NotFound() : Results.Json(item);
+});
+
+app.Run();
@@ -0,0 +1,4 @@
+apiVersion: v2
+name: inventory-api
+version: 1.0.0
+description: DevSecOps demo application (inventory-api)
@@ -0,0 +1,44 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Chart.Name }}
+  labels:
+    app.kubernetes.io/name: {{ .Chart.Name }}
+    team: platform-demo
+    environment: demo
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ .Chart.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ .Chart.Name }}
+        team: platform-demo
+        environment: demo
+    spec:
+      securityContext:
+        runAsNonRoot: true
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - containerPort: 8080
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: [ALL]
+          resources: {{ toYaml .Values.resources | nindent 12 }}
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8080
+            initialDelaySeconds: 5
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8080
+            initialDelaySeconds: 10
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Chart.Name }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: {{ .Values.service.port }}
+  selector:
+    app.kubernetes.io/name: {{ .Chart.Name }}
@@ -0,0 +1,15 @@
+replicaCount: 1
+image:
+  repository: 10.0.1.215:30500/inventory-api
+  tag: "1"
+  pullPolicy: IfNotPresent
+service:
+  type: ClusterIP
+  port: 8080
+resources:
+  requests:
+    memory: 64Mi
+    cpu: 50m
+  limits:
+    memory: 192Mi
+    cpu: 200m
@@ -0,0 +1,4 @@
+sonar.projectKey=inventory-api
+sonar.projectName=Inventory API
+sonar.sources=.
+sonar.exclusions=helm/**,bin/**,obj/**