globocom/huskyciCI 내에서 보안 테스트 수행
<p align="center"> <img src="https://assets.kitploit.com/production/public/readmes/3050/b6bd985a0630c5430b871dcc65458e6468a5a28667d6c97d499978a42cc8426f.png" align="center" height="" /> <!-- logo font: Anton --> </p> <p align="center"> <a href="https://github.com/globocom/huskyCI/releases"><img src="https://img.shields.io/github/v/release/globocom/huskyCI"/></a> <a href="https://github.com/rafaveira3/writing-and-presentations/blob/master/DEFCON-27-APP-SEC-VILLAGE-Rafael-Santos-huskyCI-Finding-security-flaws-in-CI-before-deploying-them.pdf"><img src="https://img.shields.io/badge/DEFCON%2027-AppSec%20Village-black"/></a> <a href="https://github.com/rafaveira3/contributions/blob/master/huskyCI-BlackHat-Europe-2019.pdf"><img src="https://img.shields.io/badge/Black%20Hat%20Europe%202019-Arsenal-black"/></a> <a href="https://defectdojo.readthedocs.io/en/latest/integrations.html#huskyci-report"><img src="https://img.shields.io/badge/DefectDojo-Compatible-brightgreen"/></a> </p> 이 글은 [브라질 포르투갈어](https://github.com/globocom/huskyci/blob/main/README-ptBR.md)로도 읽을 수 있습니다. ## 소개 huskyCI는 보안 테스트를 조정하고 모든 결과를 데이터베이스에 중앙 집중화하여 추가 분석 및 메트릭을 제공하는 오픈 소스 도구입니다. Python ([Bandit][Bandit] 및 [Safety][Safety]), Ruby ([Brakeman][Brakeman]), JavaScript ([Npm Audit][NpmAudit] 및 [Yarn Audit][YarnAudit]), Golang ([Gosec][Gosec]), Java ([SpotBugs][SpotBugs] 및 [Find Sec Bugs][FindSec]), HCL ([TFSec][TFSec])에서 정적 보안 분석을 수행할 수 있습니다. 또한 [GitLeaks][Gitleaks]를 사용하여 AWS Secret Keys, Private SSH Keys 등과 같은 비밀 정보가 저장소에 있는지 감사할 수 있습니다. ## 어떻게 작동하나요? 개발자는 CI 파이프라인에 새로운 단계를 설정하여 취약점을 확인할 수 있습니다: <p align="center"><img src="https://assets.kitploit.com/production/public/readmes/3050/9cb3c135ad03dbd605a89f6b8eb6feaed517f8334ca58c4694791e36764d75fa.png"/></p> 코드에서 보안 문제가 발견되면 심각도, 신뢰도, 파일, 라인 등 유용한 정보가 표시됩니다. 예시는 다음과 같습니다: ``` [HUSKYCI][*] poc-python-bandit -> https://github.com/globocom/huskyCI.git [HUSKYCI][*] huskyCI analysis started! yDS9tb9mdt4QnnyvOBp3eVAXE1nWpTRQ [HUSKYCI][!] Title: Use of exec detected. [HUSKYCI][!] Language: Python [HUSKYCI][!] Tool: Bandit [HUSKYCI][!] Severity: MEDIUM [HUSKYCI][!] Confidence: HIGH [HUSKYCI][!] Details: Use of exec detected. [HUSKYCI][!] File: ./main.py [HUSKYCI][!] Line: 7 [HUSKYCI][!] Code: 6 7 exec(command) 8 [HUSKYCI][!] Title: Possible hardcoded password: 'password123!' [HUSKYCI][!] Language: Python [HUSKYCI][!] Tool: Bandit [HUSKYCI][!] Severity: LOW [HUSKYCI][!] Confidence: MEDIUM [HUSKYCI][!] Details: Possible hardcoded password: 'password123!' [HUSKYCI][!] File: ./main.py [HUSKYCI][!] Line: 1 [HUSKYCI][!] Code: 1 secret = 'password123!' 2 3 password = 'thisisnotapassword' #nohusky 4 [HUSKYCI][SUMMARY] Python -> huskyci/bandit:1.6.2 [HUSKYCI][SUMMARY] High: 0 [HUSKYCI][SUMMARY] Medium: 1 [HUSKYCI][SUMMARY] Low: 1 [HUSKYCI][SUMMARY] NoSecHusky: 1 [HUSKYCI][SUMMARY] Total [HUSKYCI][SUMMARY] High: 0 [HUSKYCI][SUMMARY] Medium: 1 [HUSKYCI][SUMMARY] Low: 1 [HUSKYCI][SUMMARY] NoSecHusky: 1 [HUSKYCI][*] The following securityTests were executed and no blocking vulnerabilities were found: [HUSKYCI][*] [huskyci/gitleaks:2.1.0] [HUSKYCI][*] Some HIGH/MEDIUM issues were found in these securityTests: [HUSKYCI][*] [huskyci/bandit:1.6.2] ERROR: Job failed: exit code 190 ``` ## 시작하기 Docker Compose를 사용하여 로컬 환경을 설정하여 huskyCI를 사용해 볼 수 있습니다. 자세한 내용은 [이 가이드](https://huskyci.opensource.globo.com/docs/quickstart/local-installation/)를 참조하세요. ## 문서 모든 가이드와 전체 문서는 [공식 문서 페이지](https://huskyci.opensource.globo.com/docs/quickstart/overview)에서 확인할 수 있습니다. ## 기여하기 [기여 가이드](https://github.com/globocom/huskyCI/blob/master/CONTRIBUTING.md)를 읽어 개발 프로세스, 버그 수정 및 개선 제안 방법, huskyCI 변경 사항 빌드 및 테스트 방법을 알아보세요. ## 소통 연락할 수 있는 몇 가지 채널이 있습니다. 언제든지 아래로 연락주세요: - [GitHub Issues](https://github.com/globocom/huskyCI/issues) - [Gitter](https://gitter.im/globocom/huskyCI) - [Twitter](https://twitter.com/huskyCI) ## 기여자 <!-- CONTRIBUTORS_START --> <table><tr><td align="center"><a href="https://github.com/rafaveira3"><img src="https://assets.kitploit.com/production/public/readmes/3050/5146d0b8159a316638a45768e767b09d426dcfbeb29386b4b03bae2cfabb9215.png" width="100" style="border-radius: 50%;"><br>rafaveira3</a></td><td align="center"><a href="https://github.com/Krlier"><img src="https://assets.kitploit.com/production/public/readmes/3050/dab2922be3ee0095c283e15a39806b851eb11dbc2987c72f2456fd51395007f2.png" width="100" style="border-radius: 50%;"><br>Krlier</a></td><td align="center"><a href="https://github.com/spimpaov"><img src="https://assets.kitploit.com/production/public/readmes/3050/9bfe5f81377e5b495cbfc93c6b50e6306fc3f803437514ea857491f0e7c4b7eb.jpg" width="100" style="border-radius: 50%;"><br>spimpaov</a></td><td align="center"><a href="https://github.com/joserenatosilva"><img src="https://assets.kitploit.com/production/public/readmes/3050/3c9942d2e936533e105bb0d996ca69519cce50946630f5213574a1fde88012d0.jpg" width="100" style="border-radius: 50%;"><br>joserenatosilva</a></td><td align="center"><a href="https://github.com/gabriel-cantergiani"><img src="https://assets.kitploit.com/production/public/readmes/3050/4324fd94c2d417dab64dcff55149f6831992c2471e91551c8aac53f81d303427.jpg" width="100" style="border-radius: 50%;"><br>gabriel-cantergiani</a></td></tr><tr><td align="center"><a href="https://github.com/marcelomagina"><img src="https://assets.kitploit.com/production/public/readmes/3050/375b26b8a7a5e13e4e5f0e663fa355f24a86b9588f95c021eb7136f26993ead8.jpg" width="100" style="border-radius: 50%;"><br>marcelomagina</a></td><td align="center"><a href="https://github.com/nettoclaudio"><img src="https://assets.kitploit.com/production/public/readmes/3050/33224b11e3b8d007eb5acd07f49bd9e9e951464b8cea835210d51fe403e260a2.jpg" width="100" style="border-radius: 50%;"><br>nettoclaudio</a></td><td align="center"><a href="https://github.com/edersonbrilhante"><img src="https://assets.kitploit.com/production/public/readmes/3050/5e0832ea97eba9fde0ec65d90368272f66048f5d82c484dfa36a2b6c93ef5d60.jpg" width="100" style="border-radius: 50%;"><br>edersonbrilhante</a></td><td align="center"><a href="https://github.com/GabhenDM"><img src="https://assets.kitploit.com/production/public/readmes/3050/2ef48cbb7d9bd26f1b76d3fcb44a71a8df04f0d5692897893ce9875fd57b9621.png" width="100" style="border-radius: 50%;"><br>GabhenDM</a></td><td align="center"><a href="https://github.com/mdjunior"><img src="https://assets.kitploit.com/production/public/readmes/3050/2306bd854fa1f798234d065f6b148f91b073543061d5a9799d09001d510e5e8d.jpg" width="100" style="border-radius: 50%;"><br>mdjunior</a></td></tr><tr><td align="center"><a href="https://github.com/fguisso"><img src="https://assets.kitploit.com/production/public/readmes/3050/619b47ee1dd5968369b512e22bfc8fdb97a914bc133c76bbb897b0d9a7b87f5b.jpg" width="100" style="border-radius: 50%;"><br>fguisso</a></td><td align="center"><a href="https://github.com/vitoriario"><img src="https://assets.kitploit.com/production/public/readmes/3050/528ddb3acbf882781447f260d60b23a5dcbcb9b417b2379eaf07496e95128a39.png" width="100" style="border-radius: 50%;"><br>vitoriario</a></td><td align="center"><a href="https://github.com/rodrigo-brito"><img src="https://assets.kitploit.com/production/public/readmes/3050/6ce31928ea32f0a905bfa5056926a3af5589ae1caa14ed9adf68021f0b390463.jpg" width="100" style="border-radius: 50%;"><br>rodrigo-brito</a></td><td align="center"><a href="https://github.com/gustavocovas"><img src="https://assets.kitploit.com/production/public/readmes/3050/f35cdeff2691cf0497af948242031fb26c4c111bb6440398483473b159981ffa.jpg" width="100" style="border-radius: 50%;"><br>gustavocovas</a></td><td align="center"><a href="https://github.com/abzcoding"><img src="https://assets.kitploit.com/production/public/readmes/3050/e4c587df03eae9c6901eaa4d493e26276811f1810255166e52e8e50252c60b05.jpg" width="100" style="border-radius: 50%;"><br>abzcoding</a></td></tr><tr><td align="center"><a href="https://github.com/lzakharov"><img src="https://assets.kitploit.com/production/public/readmes/3050/cf12ac437bd09c612ebe720df5d4930bb029ee2023e8f69ab34ee4ceba41938f.png" width="100" style="border-radius: 50%;"><br>lzakharov</a></td><td align="center"><a href="https://github.com/itepifanio"><img src="https://assets.kitploit.com/production/public/readmes/3050/f86bcfcb47ee4a9adc05232d646b5d0addb3716c23950adf9ee6fdad418d9c81.jpg" width="100" style="border-radius: 50%;"><br>itepifanio</a></td><td align="center"><a href="https://github.com/victorpalmeira"><img src="https://assets.kitploit.com/production/public/readmes/3050/a13c00b4ab82552880a3e165cbbb7d540dfab0ff6d1400293bcdaf177d85b011.jpg" width="100" style="border-radius: 50%;"><br>victorpalmeira</a></td><td align="center"><a href="https://github.com/meltedblocks"><img src="https://assets.kitploit.com/production/public/readmes/3050/003832410ba913633aad0d13609f082fb9db8e3924b65868b9fae8691fdba26b.jpg" width="100" style="border-radius: 50%;"><br>meltedblocks</a></td><td align="center"><a href="https://github.com/localleon"><img src="https://assets.kitploit.com/production/public/readmes/3050/91c1fa37aa7f6fb50b200f3065aeb8c47bb02c5020fc5f9f52ea2343dd3ce860.jpg" width="100" style="border-radius: 50%;"><br>localleon</a></td></tr><tr><td align="center"><a href="https://github.com/jimmy1134"><img src="https://assets.kitploit.com/production/public/readmes/3050/c37f7218d4d341f37fc7a0b2acee839ab1b253558b769eaf135dd6e2f889b75f.png" width="100" style="border-radius: 50%;"><br>jimmy1134</a></td><td align="center"><a href="https://github.com/henriquebonadio-zz"><img src="https://assets.kitploit.com/production/public/readmes/3050/2b99d052a99b61cbce6c1f08a6e7ec0c40f2875e818610974d4fcc4d1556a6aa.jpg" width="100" style="border-radius: 50%;"><br>henriquebonadio-zz</a></td><td align="center"><a href="https://github.com/vfiebig"><img src="https://assets.kitploit.com/production/public/readmes/3050/03abbb4960ae42e665bd571700fd8a4624fcecf1ec4061784b3fb872cc214e40.png" width="100" style="border-radius: 50%;"><br>vfiebig</a></td><td align="center"><a href="https://github.com/gitter-badger"><img src="https://assets.kitploit.com/production/public/readmes/3050/0dfe48ed3c5f135cf30a8b3adbb5733a5de734b9bb6bb48b8396568b27906f09.png" width="100" style="border-radius: 50%;"><br>gitter-badger</a></td><td align="center"><a href="https://github.com/renatoaquino"><img src="https://assets.kitploit.com/production/public/readmes/3050/4d9af7ba749ce50a405d48d3e4a8835f18ea6bf9a9871dc33ebb89bd6ebca5ae.png" width="100" style="border-radius: 50%;"><br>renatoaquino</a></td></tr><tr><td align="center"><a href="https://github.com/RayTdC"><img src="https://assets.kitploit.com/production/public/readmes/3050/1712b71e2075958893c9b2c21ecf4dc1f1ad1ca79b34a25f9c4c1d719b9b044d.png" width="100" style="border-radius: 50%;"><br>RayTdC</a></td><td align="center"><a href="https://github.com/rafaelrubbioli"><img src="https://assets.kitploit.com/production/public/readmes/3050/19e1d6f6eddbd0ebace5973b1f070c8fb1e4aae529deb0a04eaa1d8579da7716.jpg" width="100" style="border-radius: 50%;"><br>rafaelrubbioli</a></td><td align="center"><a href="https://github.com/rafaelsq"><img src="https://assets.kitploit.com/production/public/readmes/3050/8f33e3e17931ce5a565f36f51135c30435ac5ec4a9c7380ebb417e30658e5eaa.jpg" width="100" style="border-radius: 50%;"><br>rafaelsq</a></td><td align="center"><a href="https://github.com/ragoso"><img src="https://assets.kitploit.com/production/public/readmes/3050/6688971bce4039062752891e323cfa0bdac4a6ffac84dc172c91e635535f879f.png" width="100" style="border-radius: 50%;"><br>ragoso</a></td><td align="center"><a href="https://github.com/aranhams"><img src="https://assets.kitploit.com/production/public/readmes/3050/630555c80a1a50ba481e1ded0413cc818d37bf480910cc489cc856f0479360dd.png" width="100" style="border-radius: 50%;"><br>aranhams</a></td></tr></table> <!-- CONTRIBUTORS_END --> 이 프로젝트는 모든 [기여자](https://github.com/globocom/huskyCI/graphs/contributors) 덕분에 존재합니다. 여러분은 최고예요! ❤️🚀 ## 라이선스 huskyCI는 [BSD 3-Clause "New" 또는 "Revised" 라이선스](https://github.com/globocom/huskyCI/blob/master/LICENSE.md)에 따라 라이선스가 부여됩니다. [Bandit]: https://github.com/PyCQA/bandit [Safety]: https://github.com/pyupio/safety [Brakeman]: https://github.com/presidentbeef/brakeman [Gosec]: https://github.com/securego/gosec [NpmAudit]: https://docs.npmjs.com/cli/audit [YarnAudit]: https://yarnpkg.com/lang/en/docs/cli/audit/ [Gitleaks]: https://github.com/zricethezav/gitleaks [SpotBugs]: https://spotbugs.github.io [FindSec]: https://find-sec-bugs.github.io [TFSec]: https://github.com/liamg/tfsec
