From ea2640f335b2a3d255bf90b032d0ee4a9882f9a3 Mon Sep 17 00:00:00 2001 From: Ron Izraeli Date: Sun, 1 Dec 2024 21:44:59 +0200 Subject: [PATCH 1/8] scan --- .github/FUNDING.yml | 1 - .github/dependabot.yml | 14 --- .github/lock.yml | 10 --- .github/stale.yml | 10 --- .github/workflows/branchbuild.txt | 54 ----------- .github/workflows/build.yml | 51 ----------- .github/workflows/release.yml | 143 ------------------------------ .github/workflows/scan.yml | 37 ++++++++ .github/workflows/test.yml | 61 ------------- .github/workflows/welcome.yml | 17 ---- 10 files changed, 37 insertions(+), 361 deletions(-) delete mode 100644 .github/FUNDING.yml delete mode 100644 .github/dependabot.yml delete mode 100644 .github/lock.yml delete mode 100644 .github/stale.yml delete mode 100644 .github/workflows/branchbuild.txt delete mode 100644 .github/workflows/build.yml delete mode 100644 .github/workflows/release.yml create mode 100644 .github/workflows/scan.yml delete mode 100644 .github/workflows/test.yml delete mode 100644 .github/workflows/welcome.yml diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml deleted file mode 100644 index 3b2f9aae32a..00000000000 --- a/.github/FUNDING.yml +++ /dev/null @@ -1 +0,0 @@ -custom: https://owasp.org/donate/?reponame=www-project-webgoat&title=OWASP+WebGoat diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index f2ea9477f66..00000000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,14 +0,0 @@ -version: 2 -updates: - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - - package-ecosystem: "maven" - directory: "/" - schedule: - interval: "weekly" - - package-ecosystem: "docker" - directory: "/" - schedule: - interval: "weekly" diff --git a/.github/lock.yml b/.github/lock.yml deleted file mode 100644 index 436e0b9a78c..00000000000 --- a/.github/lock.yml +++ /dev/null @@ -1,10 +0,0 @@ ---- -daysUntilLock: 365 -skipCreatedBefore: false -exemptLabels: [] -lockLabel: false -lockComment: > - This thread has been automatically locked because it has not had - recent activity after it was closed. :lock: Please open a new issue - for regressions or related bugs. -setLockReason: false diff --git a/.github/stale.yml b/.github/stale.yml deleted file mode 100644 index 1df9ad312f2..00000000000 --- a/.github/stale.yml +++ /dev/null @@ -1,10 +0,0 @@ ---- -daysUntilStale: 90 -daysUntilClose: 14 -onlyLabels: - - waiting for input - - wontfix -staleLabel: stale -markComment: > - This issue has been automatically marked as `stale` because it has not had recent activity. :calendar: It will be _closed automatically_ in one week if no further activity occurs. -closeComment: false diff --git a/.github/workflows/branchbuild.txt b/.github/workflows/branchbuild.txt deleted file mode 100644 index 95a45a1f04f..00000000000 --- a/.github/workflows/branchbuild.txt +++ /dev/null @@ -1,54 +0,0 @@ -name: "Branch build" -on: - push: - branches: - - "*" - - "!main" - -jobs: - branch-build: - runs-on: ${{ matrix.os }} - strategy: - matrix: - os: [ ubuntu-latest, windows-latest, macos-latest ] - java-version: [ 21 ] - steps: - - uses: actions/checkout@v4 - - name: Set up JDK ${{ matrix.java-version }} - uses: actions/setup-java@v4 - with: - distribution: 'temurin' - java-version: ${{ matrix.java-version }} - architecture: x64 - - name: Cache Maven packages - uses: actions/cache@v3.3.1 - with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2- - - name: Build with Maven - run: mvn --no-transfer-progress verify - - name: "Set up QEMU" - if: runner.os == 'Linux' - uses: docker/setup-qemu-action@v2.2.0 - - name: "Set up Docker Buildx" - if: runner.os == 'Linux' - uses: docker/setup-buildx-action@v2 - - name: "Verify Docker WebGoat build" - if: runner.os == 'Linux' - uses: docker/build-push-action@v5.1.0 - with: - context: ./ - file: ./Dockerfile - push: false - build-args: | - webgoat_version=${{ env.WEBGOAT_MAVEN_VERSION }} - - name: "Verify Docker WebGoat desktop build" - uses: docker/build-push-action@v5.1.0 - if: runner.os == 'Linux' - with: - context: ./ - file: ./Dockerfile_desktop - push: false - build-args: | - webgoat_version=${{ env.WEBGOAT_MAVEN_VERSION }} diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml deleted file mode 100644 index 346f83f96d0..00000000000 --- a/.github/workflows/build.yml +++ /dev/null @@ -1,51 +0,0 @@ -name: "Main / Pull requests build" -on: - pull_request: - paths-ignore: - - '.txt' - - 'LICENSE' - - 'docs/**' - branches: [ main ] - push: - branches: - - main - -jobs: - pre-commit: - name: Pre-commit check - runs-on: ubuntu-latest - steps: - - name: Checkout git repository - uses: actions/checkout@v4.1.6 - - name: Setup python - uses: actions/setup-python@v5 - with: - python-version: "3.9" - - uses: actions/setup-java@v4 - with: - distribution: 'temurin' - java-version: '21' - - name: Pre-commit checks - uses: pre-commit/action@v3.0.1 - - name: pre-commit-ci-lite - uses: pre-commit-ci/lite-action@v1.1.0 - if: always() - build: - runs-on: ${{ matrix.os }} - needs: [ pre-commit ] - strategy: - fail-fast: true - matrix: - os: [ windows-latest, ubuntu-latest, macos-13 ] - max-parallel: 1 - steps: - - uses: actions/checkout@v4.1.6 - - name: Set up JDK 21 - uses: actions/setup-java@v4.2.1 - with: - distribution: 'temurin' - java-version: 21 - architecture: x64 - cache: 'maven' - - name: Build with Maven - run: mvn --no-transfer-progress verify diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml deleted file mode 100644 index 81dd6ebfd17..00000000000 --- a/.github/workflows/release.yml +++ /dev/null @@ -1,143 +0,0 @@ -name: "Release Pipeline" -on: - push: - tags: - - v* -jobs: - release: - if: github.repository == 'WebGoat/WebGoat' - name: Release WebGoat - runs-on: ubuntu-latest - permissions: - contents: write - environment: - name: release - steps: - - uses: actions/checkout@v4 - - - name: Set up JDK 21 - uses: actions/setup-java@v4 - with: - distribution: 'temurin' - java-version: 21 - architecture: x64 - cache: 'maven' - - - name: "Set labels for ${{ github.ref }}" - run: | - echo "WEBGOAT_TAG_VERSION=${{ github.ref_name }}" >> $GITHUB_ENV - WEBGOAT_MAVEN_VERSION=${{ github.ref_name }} - echo "WEBGOAT_MAVEN_VERSION=${WEBGOAT_MAVEN_VERSION:1}" >> $GITHUB_ENV - - name: Build with Maven - run: | - mvn --no-transfer-progress versions:set -DnewVersion=${{ env.WEBGOAT_MAVEN_VERSION }} - mvn --no-transfer-progress install -DskipTests - - - name: "Create release" - uses: softprops/action-gh-release@v1 - with: - draft: false - files: | - target/webgoat-${{ env.WEBGOAT_MAVEN_VERSION }}.jar - body: | - ## Version ${{ github.ref_name }} - - ### New functionality - - - test - - ### Bug fixes - - - [#743 - Character encoding errors](https://github.com/WebGoat/WebGoat/issues/743) - - Full change log: https://github.com/WebGoat/WebGoat/compare/${{ github.ref_name }}...${{ github.ref_name }} - - - ## Contributors - - Special thanks to the following contributors providing us with a pull request: - - - Person 1 - - Person 2 - - And everyone who provided feedback through Github. - - - Team WebGoat - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - - name: "Set up QEMU" - uses: docker/setup-qemu-action@v3.1.0 - with: - platforms: all - - - name: "Set up Docker Buildx" - uses: docker/setup-buildx-action@v3 - - - name: "Login to dockerhub" - uses: docker/login-action@v3.3.0 - with: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - - name: "Build and push WebGoat" - uses: docker/build-push-action@v6.9.0 - with: - context: ./ - file: ./Dockerfile - push: true - platforms: linux/amd64, linux/arm64 - tags: | - webgoat/webgoat:${{ env.WEBGOAT_TAG_VERSION }} - webgoat/webgoat:latest - build-args: | - webgoat_version=${{ env.WEBGOAT_MAVEN_VERSION }} - - - name: "Build and push WebGoat desktop" - uses: docker/build-push-action@v6.9.0 - with: - context: ./ - file: ./Dockerfile_desktop - push: true - platforms: linux/amd64, linux/arm64 - tags: | - webgoat/webgoat-desktop:${{ env.WEBGOAT_TAG_VERSION }} - webgoat/webgoat-desktop:latest - build-args: | - webgoat_version=${{ env.WEBGOAT_MAVEN_VERSION }} - new_version: - if: github.repository == 'WebGoat/WebGoat' - name: Update to next SNAPSHOT version - needs: [ release ] - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - name: Set up JDK 21 - uses: actions/setup-java@v4 - with: - distribution: 'temurin' - java-version: 21 - architecture: x64 - - - name: Set version to next snapshot - run: | - mvn build-helper:parse-version versions:set -DnewVersion=\${parsedVersion.majorVersion}.\${parsedVersion.minorVersion}-SNAPSHOT versions:commit - - - name: Push the changes to new branch - uses: devops-infra/action-commit-push@v0.9.2 - with: - github_token: "${{ secrets.GITHUB_TOKEN }}" - add_timestamp: true - commit_message: "Updating to the new development version" - force: false - - - name: Create PR - uses: devops-infra/action-pull-request@v0.5.5 - with: - github_token: "${{ secrets.GITHUB_TOKEN }}" - title: ${{ github.event.commits[0].message }} - target_branch: main diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml new file mode 100644 index 00000000000..62b3d5458e5 --- /dev/null +++ b/.github/workflows/scan.yml @@ -0,0 +1,37 @@ +name: CloudGuard Code Security + +on: push + +env: + SPECTRAL_DSN: ${{ secrets.SPECTRAL_DSN }} + + # JFrog platform url (for example: https://acme.jfrog.io) + JF_URL: ${{ vars.JF_URL }} + + # JFrog Platform access token + JF_ACCESS_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }} + +jobs: + spectral: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: CloudGuard Code Security Scan + uses: checkpointsw/spectral-github-action@v4 + with: + spectral-dsn: ${{ env.SPECTRAL_DSN }} + spectral-args: scan --fail-on-error --engines secrets,iac,oss --asset-mapping github.${{ github.repository_owner }} + jas: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: jfrog/setup-jfrog-cli@v4 + - run: | + jf audit --sca --iac --secrets --sast + xray: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: jfrog/setup-jfrog-cli@v4 + - run: | + jf s "*" \ No newline at end of file diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml deleted file mode 100644 index 54ea4f46153..00000000000 --- a/.github/workflows/test.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: "UI-Test" -on: - pull_request: - paths-ignore: - - 'LICENSE' - - 'docs/**' - push: - tags-ignore: - - 'v*' - paths-ignore: - - '.txt' - - '*.MD' - - '*.md' - - 'LICENSE' - - 'docs/**' - -jobs: - build: - runs-on: ubuntu-latest - # display name of the job - name: "Robot framework test" - steps: - # Uses an default action to checkout the code - - uses: actions/checkout@v4.1.6 - # Uses an action to add Python to the VM - - name: Setup Python - uses: actions/setup-python@v5 - with: - python-version: '3.7' - architecture: x64 - # Uses an action to add JDK 21 to the VM (and mvn?) - - name: set up JDK 21 - uses: actions/setup-java@v4.2.1 - with: - distribution: 'temurin' - java-version: 21 - architecture: x64 - cache: 'maven' - - uses: BSFishy/pip-action@v1 - with: - packages: | - robotframework - robotframework-SeleniumLibrary - webdriver-manager - selenium==4.9.1 - # TODO https://github.com/robotframework/SeleniumLibrary/issues/1835 - - name: Run with Maven - run: mvn --no-transfer-progress spring-boot:run & - - name: Wait to start - uses: ifaxity/wait-on-action@v1 - with: - resource: http://127.0.0.1:8080/WebGoat - - name: Test with Robotframework - run: python3 -m robot --variable HEADLESS:"1" --outputdir robotreport robot/goat.robot - # send report to forks only due to limits on permission tokens - - name: Send report to commit - if: github.repository != 'WebGoat/WebGoat' && github.event_name == 'push' - uses: joonvena/robotframework-reporter-action@v2.2 - with: - gh_access_token: ${{ secrets.GITHUB_TOKEN }} - report_path: 'robotreport' diff --git a/.github/workflows/welcome.yml b/.github/workflows/welcome.yml deleted file mode 100644 index e9dddd66c1b..00000000000 --- a/.github/workflows/welcome.yml +++ /dev/null @@ -1,17 +0,0 @@ -name: Welcome - -on: - issues: - types: - - opened - -jobs: - greeting: - if: github.repository == 'WebGoat/WebGoat' - runs-on: ubuntu-latest - steps: - - uses: actions/first-interaction@v1.3.0 - with: - repo-token: ${{ secrets.GITHUB_TOKEN }} - issue-message: 'Thanks for submitting your first issue, we will have a look as quickly as possible.' - pr-message: 'Thanks so much for your contribution, really appreciated! We will have a look and merge it if everything checks out!' From 48f646f436004552677daa973ba3c5b34cc25367 Mon Sep 17 00:00:00 2001 From: Ron Izraeli Date: Sun, 8 Dec 2024 10:46:46 +0200 Subject: [PATCH 2/8] add snyk --- .github/workflows/scan.yml | 51 +++++++++++++++++++++++++++++++++++--- 1 file changed, 47 insertions(+), 4 deletions(-) diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml index 62b3d5458e5..528040f680c 100644 --- a/.github/workflows/scan.yml +++ b/.github/workflows/scan.yml @@ -10,6 +10,8 @@ env: # JFrog Platform access token JF_ACCESS_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }} + + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} jobs: spectral: @@ -21,17 +23,58 @@ jobs: with: spectral-dsn: ${{ env.SPECTRAL_DSN }} spectral-args: scan --fail-on-error --engines secrets,iac,oss --asset-mapping github.${{ github.repository_owner }} - jas: + audit: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: jfrog/setup-jfrog-cli@v4 - run: | jf audit --sca --iac --secrets --sast - xray: + snyk-code: runs-on: ubuntu-latest + permissions: + security-events: write steps: - uses: actions/checkout@v4 - - uses: jfrog/setup-jfrog-cli@v4 + with: + fetch-depth: 0 + + - name: Run Snyk to check for code vulnerabilities + id: snyk_code + uses: snyk/actions/node@master + with: + command: code test + args: --sarif-file-output=snyk/code.sarif + - run: | - jf s "*" \ No newline at end of file + cat snyk/code.sarif + + - name: Upload sarif files + uses: github/codeql-action/upload-sarif@v3 + if: always() + with: + sarif_file: 'snyk/' + + snyk-dependency: + runs-on: ubuntu-latest + permissions: + security-events: write + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: + + - name: Run Snyk to check for dependency vulnerabilities + uses: snyk/actions/node@master + with: + command: test + args: --sarif-file-output=snyk/dependencies.sarif --all-projects + + - run: | + cat snyk/dependencies.sarif + + - name: Upload sarif files + uses: github/codeql-action/upload-sarif@v3 + if: always() + with: + sarif_file: 'snyk/' \ No newline at end of file From deb4b0586f10b4d591b902d6e596b338a811095f Mon Sep 17 00:00:00 2001 From: Ron Izraeli Date: Sun, 8 Dec 2024 10:51:43 +0200 Subject: [PATCH 3/8] print saruf --- .github/workflows/scan.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml index 528040f680c..c91c2487afa 100644 --- a/.github/workflows/scan.yml +++ b/.github/workflows/scan.yml @@ -46,7 +46,8 @@ jobs: command: code test args: --sarif-file-output=snyk/code.sarif - - run: | + - if: always() + run: | cat snyk/code.sarif - name: Upload sarif files @@ -70,7 +71,8 @@ jobs: command: test args: --sarif-file-output=snyk/dependencies.sarif --all-projects - - run: | + - if: always() + run: | cat snyk/dependencies.sarif - name: Upload sarif files From 1bd5297f9c0ab9c4beef8c02f686da3e4b2d152b Mon Sep 17 00:00:00 2001 From: Ron Izraeli Date: Sun, 8 Dec 2024 10:59:19 +0200 Subject: [PATCH 4/8] add iac --- .github/workflows/scan.yml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml index c91c2487afa..0bd2f13a73e 100644 --- a/.github/workflows/scan.yml +++ b/.github/workflows/scan.yml @@ -30,6 +30,33 @@ jobs: - uses: jfrog/setup-jfrog-cli@v4 - run: | jf audit --sca --iac --secrets --sast + + snyk-iac: + runs-on: ubuntu-latest + permissions: + security-events: write + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Run Snyk to check for code vulnerabilities + id: snyk_code + uses: snyk/actions/node@master + with: + command: code iac test + args: --sarif-file-output=snyk/iac.sarif + + - if: always() + run: | + cat snyk/iac.sarif + + - name: Upload sarif files + uses: github/codeql-action/upload-sarif@v3 + if: always() + with: + sarif_file: 'snyk/' + snyk-code: runs-on: ubuntu-latest permissions: From 71236ca845990f55c783bb279655ee1337494268 Mon Sep 17 00:00:00 2001 From: Ron Izraeli Date: Wed, 11 Dec 2024 11:21:42 +0200 Subject: [PATCH 5/8] add semgrep --- .github/workflows/scan.yml | 29 +++++++++++++++++++++++++++-- 1 file changed, 27 insertions(+), 2 deletions(-) diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml index 0bd2f13a73e..b675f8bbe8d 100644 --- a/.github/workflows/scan.yml +++ b/.github/workflows/scan.yml @@ -13,7 +13,20 @@ env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_TOKEN }} + jobs: + + semgrep: + runs-on: ubuntu-latest + container: + image: semgrep/semgrep + + steps: + - uses: actions/checkout@v4 + - run: | + semgrep ci --code --secrets --supply-chain + spectral: runs-on: ubuntu-latest steps: @@ -23,13 +36,25 @@ jobs: with: spectral-dsn: ${{ env.SPECTRAL_DSN }} spectral-args: scan --fail-on-error --engines secrets,iac,oss --asset-mapping github.${{ github.repository_owner }} - audit: + + audit-code: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: jfrog/setup-jfrog-cli@v4 + - run: | + jf audit --iac --secrets --sast --format json | tee code + - uses: Teebra/JSON-to-HTML-table@v2.0.0 + with: + json-file: path/to/your/jsonfile.json + + audit-dependency: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: jfrog/setup-jfrog-cli@v4 - run: | - jf audit --sca --iac --secrets --sast + jf audit --sca snyk-iac: runs-on: ubuntu-latest From 391cdfa059677afbc4dde52c61bd85817566f9d2 Mon Sep 17 00:00:00 2001 From: Ron Izraeli Date: Wed, 11 Dec 2024 11:22:23 +0200 Subject: [PATCH 6/8] semgrep --- .github/workflows/scan.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml index b675f8bbe8d..b5869c574f6 100644 --- a/.github/workflows/scan.yml +++ b/.github/workflows/scan.yml @@ -19,13 +19,13 @@ jobs: semgrep: runs-on: ubuntu-latest - container: - image: semgrep/semgrep + container: + image: semgrep/semgrep - steps: - - uses: actions/checkout@v4 - - run: | - semgrep ci --code --secrets --supply-chain + steps: + - uses: actions/checkout@v4 + - run: | + semgrep ci --code --secrets --supply-chain spectral: runs-on: ubuntu-latest From a28274755911e7c87c36eaa64d801c7edca290aa Mon Sep 17 00:00:00 2001 From: Ron Izraeli Date: Wed, 11 Dec 2024 11:51:11 +0200 Subject: [PATCH 7/8] block semgrep --- .github/workflows/scan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml index b5869c574f6..d2f99516950 100644 --- a/.github/workflows/scan.yml +++ b/.github/workflows/scan.yml @@ -25,7 +25,7 @@ jobs: steps: - uses: actions/checkout@v4 - run: | - semgrep ci --code --secrets --supply-chain + semgrep ci --code --secrets --supply-chain --no-suppress-errors spectral: runs-on: ubuntu-latest From 7f3a74440aac73c43d3e43c7dee1b407518c3f66 Mon Sep 17 00:00:00 2001 From: Ron Izraeli Date: Wed, 11 Dec 2024 11:55:39 +0200 Subject: [PATCH 8/8] rename jobs --- .github/workflows/scan.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml index d2f99516950..95b093b51af 100644 --- a/.github/workflows/scan.yml +++ b/.github/workflows/scan.yml @@ -37,7 +37,7 @@ jobs: spectral-dsn: ${{ env.SPECTRAL_DSN }} spectral-args: scan --fail-on-error --engines secrets,iac,oss --asset-mapping github.${{ github.repository_owner }} - audit-code: + jfrog-code: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 @@ -48,7 +48,7 @@ jobs: with: json-file: path/to/your/jsonfile.json - audit-dependency: + jfrog-dependency: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4