SAST/DAST/SCA 代码安全分析

# docker-compose.yml
services:
  sonarqube:
    image: sonarqube:community
    ports:
      - "9000:9000"
    environment:
      - SONAR_ES_BOOTSTRAP_CHECKS_DISABLE=true
    volumes:
      - sonarqube_data:/opt/sonarqube/data
      - sonarqube_extensions:/opt/sonarqube/extensions

# Maven 项目扫描
mvn sonar:sonar \
  -Dsonar.host.url=http://localhost:9000 \
  -Dsonar.login=sqp_xxx

# .semgrep.yml
rules:
  - id: no-raw-sql
    pattern: |
      String $SQL = $X + $Y;
      $STMT.executeQuery($SQL);
    message: "禁止字符串拼接 SQL，请使用参数化查询"
    languages: [java]
    severity: ERROR
    
  - id: no-weak-hash
    pattern-either:
      - pattern: MessageDigest.getInstance("MD5")
      - pattern: MessageDigest.getInstance("SHA1")
    message: "使用 MD5/SHA1 不安全，请使用 SHA-256+"
    languages: [java]
    severity: WARNING

# 运行扫描
semgrep --config=auto --json --output=semgrep-report.json .

# 或使用 registry 规则
semgrep --config=p/owasp-top-ten .
semgrep --config=p/javascript .
semgrep --config=p/ci .

# .github/workflows/codeql.yml
name: "CodeQL"

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  analyze:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: github/codeql-action/init@v3
        with:
          languages: java
          queries: security-extended,security-and-quality
      - uses: github/codeql-action/analyze@v3

# Docker 运行
docker run -t owasp/zap2docker-stable zap-baseline.py \
  -t https://target-app.com \
  -r zap-report.html

# 全量扫描（ longer ，更彻底 ）
docker run -t owasp/zap2docker-stable zap-full-scan.py \
  -t https://target-app.com \
  -r zap-report.html

# 带认证的扫描
docker run -t owasp/zap2docker-stable zap-full-scan.py \
  -t https://target-app.com \
  --hook=/zap/auth_hook.py \
  -z "auth.loginurl=https://target-app.com/login"

# CLI 扫描
npm install -g snyk
snyk test                    # 测试依赖漏洞
snyk monitor                 # 持续监控
snyk test --json > report.json

# 修复建议
snyk fix                     # 自动尝试升级修复

# Docker 镜像扫描
snyk container test myapp:latest

<!-- Maven -->
<plugin>
    <groupId>org.owasp</groupId>
    <artifactId>dependency-check-maven</artifactId>
    <configuration>
        <failBuildOnCVSS>7</failBuildOnCVSS>
    </configuration>
</plugin>

<!-- 运行 -->
<!-- mvn org.owasp:dependency-check-maven:check -->

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "maven"
    directory: "/"
    schedule:
      interval: "daily"
    open-pull-requests-limit: 10
    
  - package-ecosystem: "npm"
    directory: "/frontend"
    schedule:
      interval: "weekly"

# .gitlab-ci.yml
stages:
  - build
  - test
  - security
  - deploy

sast:
  stage: security
  image: returntocorp/semgrep
  script:
    - semgrep --config=auto --json --output=semgrep.json .
  artifacts:
    reports:
      sast: semgrep.json
  allow_failure: false   # 安全门禁：失败即阻断

sca:
  stage: security
  image: maven:3.9
  script:
    - mvn org.owasp:dependency-check-maven:check
  artifacts:
    reports:
      dependency_scanning: target/dependency-check-report.json
  allow_failure: false

dast:
  stage: security
  image: owasp/zap2docker-stable
  script:
    - zap-baseline.py -t $CI_ENVIRONMENT_URL -r dast-report.html
  artifacts:
    reports:
      dast: dast-report.html
  allow_failure: true     # DAST 可能不稳定，允许失败但告警

# SonarQube Quality Gate
conditions:
  - metric: vulnerabilities
    operator: GT
    threshold: 0        # 不允许任何安全漏洞
  
  - metric: security_hotspots_reviewed
    operator: LT
    threshold: 100      # 安全热点必须全部审核
  
  - metric: coverage
    operator: LT
    threshold: 80       # 测试覆盖率 > 80%