diff --git a/.github/ISSUE_TEMPLATE/new_security_scanner.md b/.github/ISSUE_TEMPLATE/new_security_scanner.md new file mode 100644 index 0000000000..4209c8d8eb --- /dev/null +++ b/.github/ISSUE_TEMPLATE/new_security_scanner.md @@ -0,0 +1,35 @@ +--- +name: 'New Security Scanner request' +about: 'Suggest an idea for a new security scanner to integrate in this project.' +labels: 'security scanner' +--- +## New Scanner implementation request + +**Is your feature request related to a problem? Please describe.** +- _A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]_ + +**Describe the solution you'd like** +- _A clear and concise description of what you want to happen._ + +**Describe alternatives you've considered** +- _A clear and concise description of any alternative solutions or features you've considered._ + +**Additional context** +- _Add any other context or screenshots about the feature request here._ + +## Steps to implement a new scanner +> Hint: A general guide how to implement a new scanner is documented [here]( https://github.com/secureCodeBox/secureCodeBox/blob/master/docs/developer-guide/README.md#developing-own-processes) + +### Must have +- [ ] Create a [new public secureCodeBox repository](https://github.com/organizations/secureCodeBox/repositories/new) for the scanner implementation +- [ ] Implement a new scanner microservice an reuse some of the existing stuff, if possible +- [ ] Check if there is a [healthcheck](https://github.com/secureCodeBox/secureCodeBox/blob/master/docs/developer-guide/README.md#healthchecks-for-scanner-microservices) for the microservice implemented +- [ ] Implement a [new basic security process](https://github.com/secureCodeBox/secureCodeBox/blob/master/docs/developer-guide/README.md#developing-a-process-model) for the scanner +- [ ] Update the [docker-compose](https://github.com/secureCodeBox/secureCodeBox/blob/master/docker-compose.yml) files and integrate your new scanner there +- [ ] Update the [user guide](https://github.com/secureCodeBox/secureCodeBox/tree/master/docs/user-guide) and [developer guide](https://github.com/secureCodeBox/secureCodeBox/tree/master/docs/developer-guide) +- [ ] Implement a integration test for the scanner [here](https://github.com/secureCodeBox/secureCodeBox/tree/master/test) + +### Should have +- [ ] Update the [CLI examples](https://github.com/secureCodeBox/secureCodeBox/tree/master/cli) +- [ ] Update the [Jenkins Pipeline](https://github.com/secureCodeBox/integration-pipeline-jenkins-examples) examples +- [ ] Update the [OpenShift Container Setup](https://github.com/secureCodeBox/ansible-role-securecodebox-openshift) diff --git a/docs/developer-guide/README.md b/docs/developer-guide/README.md index 3aed8ba661..20804693ee 100644 --- a/docs/developer-guide/README.md +++ b/docs/developer-guide/README.md @@ -78,8 +78,8 @@ curl -X POST 'http://:8080/box/jobs//result' -H 'Conte -To edit these models, Camunda provides a free modelling tool for the BPMN models which you can [download here](camunda_modeler). -Feel free to get inspiration from the [prepackaged processes here](prepackaged_processes). +To edit these models, Camunda provides a free modelling tool for the BPMN models which you can [download here](https://camunda.com/products/modeler/). +Feel free to get inspiration from the [prepackaged processes here](https://github.com/secureCodeBox/engine/tree/master/scb-scanprocesses).
Just copy a process model from the prepackaged? @@ -239,6 +239,3 @@ Note: }, } ``` - -[prepackaged_processes]: https://github.com/secureCodeBox/engine/tree/master/scb-scanprocesses -[camunda_modeler]: https://camunda.com/download/modeler/ diff --git a/docs/user-guide/persistence/README.md b/docs/user-guide/persistence/README.md index e02c27ff9f..e91dd4c572 100644 --- a/docs/user-guide/persistence/README.md +++ b/docs/user-guide/persistence/README.md @@ -62,27 +62,30 @@ Alternatively the corresponding environment variables, e.g. `SECURECODEBOX_PERSI #### Runetime Security Test Config The DefectDjojo Persistence Provider requries some additional configuration for every securityTest. -This configuration is to set additional information e.g. for which product should engagment and findings be created? - -| Meta Field |  Description | Example Value | Mandatory | -| --------------------- | ---------------------------------------------------------------------------------------------------- | ------------- | --------- | -| `DEFECT_DOJO_USER` | Username of the DefectDojo user responsible for the scan. Defaults to username of the technical user | john_doe | no | -| `SCB_BRANCH` | Tag or branch of the product the engagement tested | develop | no | -| `SCB_BUILD_ID` | Build ID of the product the engagement tested | 1.0 | no | -| `SCB_COMMIT_HASH` | Commit hash from repo | 9a03412 | no | -| `SCB_TRACKER` | Link to epic or ticket system with changes to version | http://your-ticket-system.com | no | -| `SCB_REPO` | Repository | http://your-remote-repository.com | no | -| `SCB_BUILD_SERVER` | Build server responsible for CI/CD test | http://your-build-server.com | no | -| `SCB_SCM_SERVER` | Source code server for CI/CD test | http://your-scm-server.com | no | -| `SCB_ENGAGEMENT_TITLE`| Title for the engagement. Defaults to name of the supported scanner or "Generic Findings Import" | Engagement No.1337 | no | - -An example security test with these values set would look like this. +This configuration has only one **mandatory** parameter, which is the **context** of the security scan. This has to be the same as the product name inside DefectDojo related to the scan. Once the scan is finished a new engagment for the product and all findings are getting imported. + +Other than the context, there are also a number of optional params, which are used to populate other fields of the DefectDojo engagment. +These can be set by passing them in the `metaData` param of the securityTest. + +| Meta Field |  Description | Example Value | Mandatory | +| ---------------------- | ---------------------------------------------------------------------------------------------------- | --------------------------------- | --------- | +| `DEFECT_DOJO_USER` | Username of the DefectDojo user responsible for the scan. Defaults to username of the technical user | john_doe | no | +| `SCB_BRANCH` | Tag or branch of the product the engagement tested | develop | no | +| `SCB_BUILD_ID` | Build ID of the product the engagement tested | 1.0 | no | +| `SCB_COMMIT_HASH` | Commit hash from repo | 9a03412 | no | +| `SCB_TRACKER` | Link to epic or ticket system with changes to version | http://your-ticket-system.com | no | +| `SCB_REPO` | Repository | http://your-remote-repository.com | no | +| `SCB_BUILD_SERVER` | Build server responsible for CI/CD test | http://your-build-server.com | no | +| `SCB_SCM_SERVER` | Source code server for CI/CD test | http://your-scm-server.com | no | +| `SCB_ENGAGEMENT_TITLE` | Title for the engagement. Defaults to name of the supported scanner or "Generic Findings Import" | Engagement No.1337 | no | + +An example security test with these values set would look like this: ```json [ { "name": "nmap", - "context": "feature-team-1/product-1", + "context": "product-1", "target": { "name": "Test Server", "location": "10.11.11.11", @@ -91,15 +94,15 @@ An example security test with these values set would look like this. } }, "metaData": { - "DEFECT_DOJO_USER": "john_doe", - "SCB_BRANCH": "develop", - "SCB_BUILD_ID": "1.0", - "SCB_COMMIT_HASH": "9a03412", - "SCB_TRACKER": "http://your-ticket-system.com", - "SCB_REPO": "http://your-remote-repository.com", - "SCB_BUILD_SERVER": "http://your-build-server.com", - "SCB_SCM_SERVER": "http://your-scm-server.com", - "SCB_ENGAGEMENT_TITLE": "Engagement No.1337" + "DEFECT_DOJO_USER": "john_doe", + "SCB_BRANCH": "develop", + "SCB_BUILD_ID": "1.0", + "SCB_COMMIT_HASH": "9a03412", + "SCB_TRACKER": "http://your-ticket-system.com", + "SCB_REPO": "http://your-remote-repository.com", + "SCB_BUILD_SERVER": "http://your-build-server.com", + "SCB_SCM_SERVER": "http://your-scm-server.com", + "SCB_ENGAGEMENT_TITLE": "Engagement No.1337" } } ] diff --git a/test/package-lock.json b/test/package-lock.json index 0226a2bde1..10714f34e6 100644 --- a/test/package-lock.json +++ b/test/package-lock.json @@ -393,13 +393,21 @@ "dev": true }, "axios": { - "version": "0.18.0", - "resolved": "https://registry.npmjs.org/axios/-/axios-0.18.0.tgz", - "integrity": "sha1-MtU+SFHv3AoRmTts0AB4nXDAUQI=", + "version": "0.18.1", + "resolved": "https://registry.npmjs.org/axios/-/axios-0.18.1.tgz", + "integrity": "sha512-0BfJq4NSfQXd+SkFdrvFbG7addhYSBA2mQwISr46pD6E5iqkWg02RAs8vyTT/j0RTnoYmeXauBuSv1qKwR179g==", "dev": true, "requires": { - "follow-redirects": "^1.3.0", - "is-buffer": "^1.1.5" + "follow-redirects": "1.5.10", + "is-buffer": "^2.0.2" + }, + "dependencies": { + "is-buffer": { + "version": "2.0.3", + "resolved": "https://registry.npmjs.org/is-buffer/-/is-buffer-2.0.3.tgz", + "integrity": "sha512-U15Q7MXTuZlrbymiz95PJpZxu8IlipAp4dtS3wOdgPXx3mqBnslrWU14kxfHB+Py/+2PVKSr37dMAgM2A4uArw==", + "dev": true + } } }, "babel-jest": { @@ -1330,9 +1338,9 @@ } }, "follow-redirects": { - "version": "1.6.1", - "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.6.1.tgz", - "integrity": "sha512-t2JCjbzxQpWvbhts3l6SH1DKzSrx8a+SsaVf4h6bG4kOXUuPYS/kg2Lr4gQSb7eemaHqJkOThF1BGyjlUkO1GQ==", + "version": "1.5.10", + "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz", + "integrity": "sha512-0V5l4Cizzvqt5D44aTXbFZz+FtyXV1vrDN6qrelxtfYQKW0KO0W2T/hkE8xvGa/540LkZlkaUjO4ailYTFtHVQ==", "dev": true, "requires": { "debug": "=3.1.0" @@ -1396,7 +1404,8 @@ "ansi-regex": { "version": "2.1.1", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "aproba": { "version": "1.2.0", @@ -1417,12 +1426,14 @@ "balanced-match": { "version": "1.0.0", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "brace-expansion": { "version": "1.1.11", "bundled": true, "dev": true, + "optional": true, "requires": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" @@ -1437,17 +1448,20 @@ "code-point-at": { "version": "1.1.0", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "concat-map": { "version": "0.0.1", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "console-control-strings": { "version": "1.1.0", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "core-util-is": { "version": "1.0.2", @@ -1564,7 +1578,8 @@ "inherits": { "version": "2.0.3", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "ini": { "version": "1.3.5", @@ -1576,6 +1591,7 @@ "version": "1.0.0", "bundled": true, "dev": true, + "optional": true, "requires": { "number-is-nan": "^1.0.0" } @@ -1590,6 +1606,7 @@ "version": "3.0.4", "bundled": true, "dev": true, + "optional": true, "requires": { "brace-expansion": "^1.1.7" } @@ -1597,12 +1614,14 @@ "minimist": { "version": "0.0.8", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "minipass": { "version": "2.3.5", "bundled": true, "dev": true, + "optional": true, "requires": { "safe-buffer": "^5.1.2", "yallist": "^3.0.0" @@ -1621,6 +1640,7 @@ "version": "0.5.1", "bundled": true, "dev": true, + "optional": true, "requires": { "minimist": "0.0.8" } @@ -1701,7 +1721,8 @@ "number-is-nan": { "version": "1.0.1", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "object-assign": { "version": "4.1.1", @@ -1713,6 +1734,7 @@ "version": "1.4.0", "bundled": true, "dev": true, + "optional": true, "requires": { "wrappy": "1" } @@ -1798,7 +1820,8 @@ "safe-buffer": { "version": "5.1.2", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "safer-buffer": { "version": "2.1.2", @@ -1834,6 +1857,7 @@ "version": "1.0.2", "bundled": true, "dev": true, + "optional": true, "requires": { "code-point-at": "^1.0.0", "is-fullwidth-code-point": "^1.0.0", @@ -1853,6 +1877,7 @@ "version": "3.0.1", "bundled": true, "dev": true, + "optional": true, "requires": { "ansi-regex": "^2.0.0" } @@ -1896,12 +1921,14 @@ "wrappy": { "version": "1.0.2", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "yallist": { "version": "3.0.3", "bundled": true, - "dev": true + "dev": true, + "optional": true } } }, diff --git a/test/package.json b/test/package.json index 6b1c093c6e..8d22be0309 100644 --- a/test/package.json +++ b/test/package.json @@ -9,7 +9,7 @@ }, "license": "Apache2", "devDependencies": { - "axios": "^0.18.0", + "axios": "^0.18.1", "jest": "^24.0.0" }, "jest": {