Initial commit: payment API with vulnerable legacy billing module
Python/Flask, intentionally outdated dependencies (flask 2.0.1, requests 2.25.1, urllib3 1.26.4) for SCA demo. CWE-89, CWE-327, CWE-798, CWE-22 in legacy_billing.py.
This commit is contained in:
@@ -0,0 +1,19 @@
|
||||
rules:
|
||||
- id: no-eval
|
||||
patterns:
|
||||
- pattern: eval(...)
|
||||
message: "eval() is banned — code injection risk (CWE-95)"
|
||||
severity: ERROR
|
||||
languages: [python, javascript]
|
||||
- id: no-os-system
|
||||
patterns:
|
||||
- pattern: os.system(...)
|
||||
message: "os.system() is banned — command injection risk (CWE-78)"
|
||||
severity: ERROR
|
||||
languages: [python]
|
||||
- id: no-subprocess-shell
|
||||
patterns:
|
||||
- pattern: subprocess.run(..., shell=True, ...)
|
||||
message: "subprocess with shell=True is banned — command injection risk (CWE-78)"
|
||||
severity: ERROR
|
||||
languages: [python]
|
||||
@@ -0,0 +1,8 @@
|
||||
FROM public.ecr.aws/docker/library/python:3.11-slim
|
||||
WORKDIR /app
|
||||
COPY requirements.txt .
|
||||
RUN pip install --no-cache-dir -r requirements.txt
|
||||
COPY app.py legacy_billing.py ./
|
||||
EXPOSE 5000
|
||||
USER 65534
|
||||
CMD ["python", "app.py"]
|
||||
Vendored
+233
@@ -0,0 +1,233 @@
|
||||
pipeline {
|
||||
agent {
|
||||
kubernetes {
|
||||
yaml '''
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
spec:
|
||||
containers:
|
||||
- name: build
|
||||
image: public.ecr.aws/docker/library/python:3.11-slim
|
||||
command: ["sleep", "999999"]
|
||||
resources: { limits: { memory: 1Gi } }
|
||||
- name: semgrep
|
||||
image: semgrep/semgrep:latest
|
||||
command: ["sleep", "999999"]
|
||||
resources: { limits: { memory: 1Gi } }
|
||||
- name: gitleaks
|
||||
image: ghcr.io/gitleaks/gitleaks:latest
|
||||
command: ["sleep", "999999"]
|
||||
resources: { limits: { memory: 256Mi } }
|
||||
- name: trivy
|
||||
image: ghcr.io/aquasecurity/trivy:latest
|
||||
command: ["sleep", "999999"]
|
||||
resources: { limits: { memory: 1Gi } }
|
||||
- name: sonar
|
||||
image: sonarsource/sonar-scanner-cli:latest
|
||||
command: ["sleep", "999999"]
|
||||
resources: { limits: { memory: 2Gi } }
|
||||
env:
|
||||
- name: SONAR_TOKEN
|
||||
valueFrom: { secretKeyRef: { name: sonar-token, key: SONAR_TOKEN } }
|
||||
- name: kaniko
|
||||
image: gcr.io/kaniko-project/executor:debug
|
||||
command: ["/busybox/sh", "-c", "sleep 999999"]
|
||||
resources: { limits: { memory: 1Gi } }
|
||||
- name: checkov
|
||||
image: bridgecrew/checkov:latest
|
||||
command: ["sleep", "999999"]
|
||||
resources: { limits: { memory: 512Mi } }
|
||||
- name: cosign
|
||||
image: public.ecr.aws/docker/library/alpine:3.20
|
||||
command: ["sleep", "999999"]
|
||||
resources: { limits: { memory: 256Mi } }
|
||||
env:
|
||||
- name: COSIGN_PASSWORD
|
||||
valueFrom: { secretKeyRef: { name: cosign-keys, key: password } }
|
||||
volumeMounts:
|
||||
- { name: cosign-keys, mountPath: /keys, readOnly: true }
|
||||
- name: zap
|
||||
image: ghcr.io/zaproxy/zaproxy:stable
|
||||
command: ["sleep", "999999"]
|
||||
resources: { limits: { memory: 1Gi } }
|
||||
- name: git
|
||||
image: alpine/git:latest
|
||||
command: ["sleep", "999999"]
|
||||
resources: { limits: { memory: 128Mi } }
|
||||
- name: uploader
|
||||
image: curlimages/curl:latest
|
||||
command: ["sleep", "999999"]
|
||||
resources: { limits: { memory: 128Mi } }
|
||||
env:
|
||||
- name: DD_TOKEN
|
||||
valueFrom: { secretKeyRef: { name: defectdojo-token, key: DD_TOKEN } }
|
||||
volumes:
|
||||
- name: cosign-keys
|
||||
secret: { secretName: cosign-keys }
|
||||
'''
|
||||
}
|
||||
}
|
||||
environment {
|
||||
REGISTRY = "10.0.1.215:30500"
|
||||
IMAGE = "payment-api"
|
||||
SONAR_HOST = "http://sonarqube-sonarqube.platform.svc:9000"
|
||||
DD_URL = "http://defectdojo-django.security.svc"
|
||||
APP_URL = "http://payment-api.demo-app.svc:5000"
|
||||
}
|
||||
stages {
|
||||
stage('Install & Test') {
|
||||
steps { container('build') { sh 'pip install --quiet -r requirements.txt pytest && python -m pytest -q' } }
|
||||
}
|
||||
stage('SAST — Semgrep audit') {
|
||||
steps {
|
||||
container('semgrep') {
|
||||
sh 'semgrep scan --config auto --json --output semgrep.json --metrics=off || true'
|
||||
}
|
||||
}
|
||||
}
|
||||
stage('SAST Gate') {
|
||||
steps {
|
||||
container('semgrep') {
|
||||
sh 'semgrep scan --config .semgrep-gate.yml --error --exclude=legacy_billing.py --metrics=off .'
|
||||
}
|
||||
}
|
||||
}
|
||||
stage('Secrets — Gitleaks') {
|
||||
steps {
|
||||
container('gitleaks') {
|
||||
sh 'gitleaks detect --source . --no-git --report-format json --report-path gitleaks.json || true'
|
||||
}
|
||||
}
|
||||
}
|
||||
stage('SCA — Trivy deps') {
|
||||
steps {
|
||||
container('trivy') {
|
||||
sh 'trivy fs --scanners vuln --format json --output trivy-fs.json .'
|
||||
sh 'trivy fs --scanners vuln --severity HIGH,CRITICAL .'
|
||||
}
|
||||
}
|
||||
}
|
||||
stage('SonarQube') {
|
||||
steps {
|
||||
container('sonar') {
|
||||
sh 'sonar-scanner -Dsonar.host.url=$SONAR_HOST -Dsonar.token=$SONAR_TOKEN -Dsonar.qualitygate.wait=false'
|
||||
}
|
||||
}
|
||||
}
|
||||
stage('Build — Kaniko') {
|
||||
steps {
|
||||
container('kaniko') {
|
||||
sh '''/kaniko/executor \
|
||||
--context "dir://$(pwd)" \
|
||||
--dockerfile Dockerfile \
|
||||
--destination "$REGISTRY/$IMAGE:$BUILD_NUMBER" \
|
||||
--tar-path image.tar \
|
||||
--insecure --insecure-pull'''
|
||||
}
|
||||
}
|
||||
}
|
||||
stage('Image Scan — Trivy') {
|
||||
steps {
|
||||
container('trivy') {
|
||||
sh 'trivy image --input image.tar --format json --output trivy-image.json'
|
||||
}
|
||||
}
|
||||
}
|
||||
stage('SBOM — CycloneDX') {
|
||||
steps {
|
||||
container('trivy') {
|
||||
sh 'trivy image --input image.tar --format cyclonedx --output sbom.cdx.json'
|
||||
}
|
||||
}
|
||||
}
|
||||
stage('IaC — Checkov') {
|
||||
steps {
|
||||
container('checkov') {
|
||||
sh 'checkov -d . --quiet -o json > checkov.json || true'
|
||||
}
|
||||
}
|
||||
}
|
||||
stage('Sign — Cosign') {
|
||||
steps {
|
||||
container('cosign') {
|
||||
sh '''
|
||||
wget -qO /tmp/cosign https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64
|
||||
chmod +x /tmp/cosign
|
||||
/tmp/cosign sign --key /keys/cosign.key --allow-insecure-registry --tlog-upload=false --yes "$REGISTRY/$IMAGE:$BUILD_NUMBER"
|
||||
'''
|
||||
}
|
||||
}
|
||||
}
|
||||
stage('Deploy — GitOps bump') {
|
||||
steps {
|
||||
container('git') {
|
||||
sh '''
|
||||
git config --global --add safe.directory "$(pwd)"
|
||||
git config user.name "Jenkins CI"
|
||||
git config user.email "jenkins@demo.local"
|
||||
sed -i "s/^ tag: .*/ tag: \\"$BUILD_NUMBER\\"/" helm/values.yaml
|
||||
if git diff --quiet helm/values.yaml; then
|
||||
echo "values.yaml already points at build $BUILD_NUMBER — nothing to push"
|
||||
else
|
||||
git add helm/values.yaml
|
||||
git commit -m "ci: deploy build $BUILD_NUMBER [ci skip]"
|
||||
git push http://demo:devsecops@gitea-http.platform.svc:3000/demo/$IMAGE.git HEAD:main
|
||||
fi
|
||||
'''
|
||||
}
|
||||
}
|
||||
}
|
||||
stage('DAST — OWASP ZAP') {
|
||||
steps {
|
||||
container('uploader') {
|
||||
sh '''
|
||||
echo "Waiting for deployment to become healthy..."
|
||||
for i in $(seq 1 60); do
|
||||
if curl -sf "$APP_URL/health" > /dev/null; then echo "App is up"; break; fi
|
||||
sleep 10
|
||||
done
|
||||
'''
|
||||
}
|
||||
container('zap') {
|
||||
sh '''
|
||||
rm -rf /zap/wrk && ln -s "$(pwd)" /zap/wrk
|
||||
zap-baseline.py -t "$APP_URL" -J zap.json -I || true
|
||||
'''
|
||||
}
|
||||
}
|
||||
}
|
||||
stage('Publish — DefectDojo') {
|
||||
steps {
|
||||
container('uploader') {
|
||||
sh '''
|
||||
upload() {
|
||||
[ -f "$2" ] || { echo "skip $1 ($2 missing)"; return 0; }
|
||||
curl -sf -X POST "$DD_URL/api/v2/import-scan/" \
|
||||
-H "Authorization: Token $DD_TOKEN" \
|
||||
-F scan_type="$1" \
|
||||
-F file=@"$2" \
|
||||
-F product_name=$IMAGE \
|
||||
-F engagement_name="CI Build $BUILD_NUMBER" \
|
||||
-F auto_create_context=true \
|
||||
-F active=true -F verified=true \
|
||||
> /dev/null && echo "uploaded: $1" || echo "FAILED: $1"
|
||||
}
|
||||
upload "Semgrep JSON Report" semgrep.json
|
||||
upload "Gitleaks Scan" gitleaks.json
|
||||
upload "Trivy Scan" trivy-fs.json
|
||||
upload "Trivy Scan" trivy-image.json
|
||||
upload "Checkov Scan" checkov.json
|
||||
upload "ZAP Scan" zap.json
|
||||
'''
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
post {
|
||||
always {
|
||||
archiveArtifacts artifacts: '*.json', allowEmptyArchive: true
|
||||
}
|
||||
success { echo 'Pipeline PASSED — findings aggregated in DefectDojo.' }
|
||||
failure { echo 'Pipeline FAILED — a security gate blocked the release.' }
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,26 @@
|
||||
from flask import Flask, jsonify, request
|
||||
import legacy_billing
|
||||
|
||||
app = Flask(__name__)
|
||||
|
||||
|
||||
@app.route("/health")
|
||||
def health():
|
||||
return jsonify(status="healthy")
|
||||
|
||||
|
||||
@app.route("/api/payments/<int:payment_id>")
|
||||
def get_payment(payment_id):
|
||||
return jsonify(id=payment_id, amount=1250, currency="CZK", status="settled")
|
||||
|
||||
|
||||
@app.route("/api/payments", methods=["POST"])
|
||||
def create_payment():
|
||||
data = request.get_json(silent=True) or {}
|
||||
if "amount" not in data:
|
||||
return jsonify(error="Missing amount"), 400
|
||||
return jsonify(id=1001, amount=data["amount"], status="pending"), 201
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
app.run(host="0.0.0.0", port=5000)
|
||||
@@ -0,0 +1,4 @@
|
||||
apiVersion: v2
|
||||
name: payment-api
|
||||
version: 1.0.0
|
||||
description: DevSecOps demo application (payment-api)
|
||||
@@ -0,0 +1,44 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ .Chart.Name }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Chart.Name }}
|
||||
team: platform-demo
|
||||
environment: demo
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: {{ .Chart.Name }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ .Chart.Name }}
|
||||
team: platform-demo
|
||||
environment: demo
|
||||
spec:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
ports:
|
||||
- containerPort: 5000
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop: [ALL]
|
||||
resources: {{ toYaml .Values.resources | nindent 12 }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 5000
|
||||
initialDelaySeconds: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 5000
|
||||
initialDelaySeconds: 10
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ .Chart.Name }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.service.port }}
|
||||
targetPort: {{ .Values.service.port }}
|
||||
selector:
|
||||
app.kubernetes.io/name: {{ .Chart.Name }}
|
||||
@@ -0,0 +1,15 @@
|
||||
replicaCount: 1
|
||||
image:
|
||||
repository: 10.0.1.215:30500/payment-api
|
||||
tag: "1"
|
||||
pullPolicy: IfNotPresent
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 5000
|
||||
resources:
|
||||
requests:
|
||||
memory: 64Mi
|
||||
cpu: 50m
|
||||
limits:
|
||||
memory: 192Mi
|
||||
cpu: 200m
|
||||
@@ -0,0 +1,27 @@
|
||||
# LEGACY MODULE — INTENTIONAL VULNERABILITIES FOR DEMO
|
||||
# Included in full security scans, excluded from the blocking SAST gate.
|
||||
import hashlib
|
||||
import sqlite3
|
||||
|
||||
# CWE-798: Hardcoded credentials
|
||||
STRIPE_SECRET_KEY = "sk_live_demo51HGXvKLkjJKtxo0LNZFakeDemo"
|
||||
DB_PASSWORD = "billing-master-2019"
|
||||
AWS_ACCESS_KEY_ID = "AKIAY0DEMO4BILLINGKY"
|
||||
|
||||
|
||||
# CWE-89: SQL Injection via f-string
|
||||
def get_invoice(conn: sqlite3.Connection, invoice_id: str):
|
||||
cur = conn.cursor()
|
||||
cur.execute(f"SELECT * FROM invoices WHERE id = '{invoice_id}'")
|
||||
return cur.fetchone()
|
||||
|
||||
|
||||
# CWE-327: Weak cryptographic hash for passwords
|
||||
def hash_password(password: str) -> str:
|
||||
return hashlib.md5(password.encode()).hexdigest()
|
||||
|
||||
|
||||
# CWE-22: Path traversal
|
||||
def read_receipt(base_dir: str, filename: str) -> str:
|
||||
with open(base_dir + "/" + filename) as fh:
|
||||
return fh.read()
|
||||
@@ -0,0 +1,9 @@
|
||||
flask==2.0.1
|
||||
werkzeug==2.0.3
|
||||
jinja2==3.0.3
|
||||
markupsafe==2.0.1
|
||||
itsdangerous==2.0.1
|
||||
click==8.0.4
|
||||
requests==2.25.1
|
||||
urllib3==1.26.4
|
||||
certifi==2020.12.5
|
||||
@@ -0,0 +1,4 @@
|
||||
sonar.projectKey=payment-api
|
||||
sonar.projectName=Payment API
|
||||
sonar.sources=.
|
||||
sonar.exclusions=test_app.py,helm/**
|
||||
+21
@@ -0,0 +1,21 @@
|
||||
from app import app
|
||||
|
||||
|
||||
def test_health():
|
||||
client = app.test_client()
|
||||
res = client.get("/health")
|
||||
assert res.status_code == 200
|
||||
assert res.get_json()["status"] == "healthy"
|
||||
|
||||
|
||||
def test_get_payment():
|
||||
client = app.test_client()
|
||||
res = client.get("/api/payments/7")
|
||||
assert res.status_code == 200
|
||||
assert res.get_json()["id"] == 7
|
||||
|
||||
|
||||
def test_create_payment_requires_amount():
|
||||
client = app.test_client()
|
||||
res = client.post("/api/payments", json={})
|
||||
assert res.status_code == 400
|
||||
Reference in New Issue
Block a user