Security Scanning Security Sast

1---
2name: security-scanning-security-sast
3description: Static Application Security Testing (SAST) for code vulnerability
4  analysis across multiple languages and frameworks
5metadata:
6  globs: "**/*.py, **/*.js, **/*.ts, **/*.java, **/*.rb, **/*.go, **/*.rs, **/*.php"
7  keywords: sast, static analysis, code security, vulnerability scanning, bandit,
8    semgrep, eslint, sonarqube, codeql, security patterns, code review, ast
9    analysis
10---
11# SAST Security Plugin
12 
13Static Application Security Testing (SAST) for comprehensive code vulnerability detection across multiple languages, frameworks, and security patterns.
14 
15## Capabilities
16 
17- **Multi-language SAST**: Python, JavaScript/TypeScript, Java, Ruby, PHP, Go, Rust
18- **Tool integration**: Bandit, Semgrep, ESLint Security, SonarQube, CodeQL, PMD, SpotBugs, Brakeman, gosec, cargo-clippy
19- **Vulnerability patterns**: SQL injection, XSS, hardcoded secrets, path traversal, IDOR, CSRF, insecure deserialization
20- **Framework analysis**: Django, Flask, React, Express, Spring Boot, Rails, Laravel
21- **Custom rule authoring**: Semgrep pattern development for organization-specific security policies
22 
23## Use this skill when
24 
25Use for code review security analysis, injection vulnerabilities, hardcoded secrets, framework-specific patterns, custom security policy enforcement, pre-deployment validation, legacy code assessment, and compliance (OWASP, PCI-DSS, SOC2).
26 
27**Specialized tools**: Use `security-secrets.md` for advanced credential scanning, `security-owasp.md` for Top 10 mapping, `security-api.md` for REST/GraphQL endpoints.
28 
29## Do not use this skill when
30 
31- You only need runtime testing or penetration testing
32- You cannot access the source code or build outputs
33- The environment forbids third-party scanning tools
34 
35## Instructions
36 
371. Identify the languages, frameworks, and scope to scan.
382. Select SAST tools and configure rules for the codebase.
393. Run scans in CI or locally with reproducible settings.
404. Triage findings, prioritize by severity, and propose fixes.
41 
42## Safety
43 
44- Avoid uploading proprietary code to external services without approval.
45- Require review before enabling auto-fix or blocking releases.
46 
47## SAST Tool Selection
48 
49### Python: Bandit
50 
51```bash
52# Installation & scan
53pip install bandit
54bandit -r . -f json -o bandit-report.json
55bandit -r . -ll -ii -f json  # High/Critical only
56```
57 
58**Configuration**: `.bandit`
59```yaml
60exclude_dirs: ['/tests/', '/venv/', '/.tox/', '/build/']
61tests: [B201, B301, B302, B303, B304, B305, B307, B308, B312, B323, B324, B501, B502, B506, B602, B608]
62skips: [B101]
63```
64 
65### JavaScript/TypeScript: ESLint Security
66 
67```bash
68npm install --save-dev eslint @eslint/plugin-security eslint-plugin-no-secrets
69eslint . --ext .js,.jsx,.ts,.tsx --format json > eslint-security.json
70```
71 
72**Configuration**: `.eslintrc-security.json`
73```json
74{
75  "plugins": ["@eslint/plugin-security", "eslint-plugin-no-secrets"],
76  "extends": ["plugin:security/recommended"],
77  "rules": {
78    "security/detect-object-injection": "error",
79    "security/detect-non-literal-fs-filename": "error",
80    "security/detect-eval-with-expression": "error",
81    "security/detect-pseudo-random-prng": "error",
82    "no-secrets/no-secrets": "error"
83  }
84}
85```
86 
87### Multi-Language: Semgrep
88 
89```bash
90pip install semgrep
91semgrep --config=auto --json --output=semgrep-report.json
92semgrep --config=p/security-audit --json
93semgrep --config=p/owasp-top-ten --json
94semgrep ci --config=auto  # CI mode
95```
96 
97**Custom Rules**: `.semgrep.yml`
98```yaml
99rules:
100  - id: sql-injection-format-string
101    pattern: cursor.execute("... %s ..." % $VAR)
102    message: SQL injection via string formatting
103    severity: ERROR
104    languages: [python]
105    metadata:
106      cwe: "CWE-89"
107      owasp: "A03:2021-Injection"
108 
109  - id: dangerous-innerHTML
110    pattern: $ELEM.innerHTML = $VAR
111    message: XSS via innerHTML assignment
112    severity: ERROR
113    languages: [javascript, typescript]
114    metadata:
115      cwe: "CWE-79"
116 
117  - id: hardcoded-aws-credentials
118    patterns:
119      - pattern: $KEY = "AKIA..."
120      - metavariable-regex:
121          metavariable: $KEY
122          regex: "(aws_access_key_id|AWS_ACCESS_KEY_ID)"
123    message: Hardcoded AWS credentials detected
124    severity: ERROR
125    languages: [python, javascript, java]
126 
127  - id: path-traversal-open
128    patterns:
129      - pattern: open($PATH, ...)
130      - pattern-not: open(os.path.join(SAFE_DIR, ...), ...)
131      - metavariable-pattern:
132          metavariable: $PATH
133          patterns:
134            - pattern: $REQ.get(...)
135    message: Path traversal via user input
136    severity: ERROR
137    languages: [python]
138 
139  - id: command-injection
140    patterns:
141      - pattern-either:
142          - pattern: os.system($CMD)
143          - pattern: subprocess.call($CMD, shell=True)
144      - metavariable-pattern:
145          metavariable: $CMD
146          patterns:
147            - pattern-either:
148                - pattern: $X + $Y
149                - pattern: f"...{$VAR}..."
150    message: Command injection via shell=True
151    severity: ERROR
152    languages: [python]
153```
154 
155### Other Language Tools
156 
157**Java**: `mvn spotbugs:check`
158**Ruby**: `brakeman -o report.json -f json`
159**Go**: `gosec -fmt=json -out=gosec.json ./...`
160**Rust**: `cargo clippy -- -W clippy::unwrap_used`
161 
162## Vulnerability Patterns
163 
164### SQL Injection
165 
166**VULNERABLE**: String formatting/concatenation with user input in SQL queries
167 
168**SECURE**:
169```python
170# Parameterized queries
171cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))
172User.objects.filter(id=user_id)  # ORM
173```
174 
175### Cross-Site Scripting (XSS)
176 
177**VULNERABLE**: Direct HTML manipulation with unsanitized user input (innerHTML, outerHTML, document.write)
178 
179**SECURE**:
180```javascript
181// Use textContent for plain text
182element.textContent = userInput;
183 
184// React auto-escapes
185<div>{userInput}</div>
186 
187// Sanitize when HTML required
188import DOMPurify from 'dompurify';
189element.innerHTML = DOMPurify.sanitize(userInput);
190```
191 
192### Hardcoded Secrets
193 
194**VULNERABLE**: Hardcoded API keys, passwords, tokens in source code
195 
196**SECURE**:
197```python
198import os
199API_KEY = os.environ.get('API_KEY')
200PASSWORD = os.getenv('DB_PASSWORD')
201```
202 
203### Path Traversal
204 
205**VULNERABLE**: Opening files using unsanitized user input
206 
207**SECURE**:
208```python
209import os
210ALLOWED_DIR = '/var/www/uploads'
211file_name = request.args.get('file')
212file_path = os.path.join(ALLOWED_DIR, file_name)
213file_path = os.path.realpath(file_path)
214if not file_path.startswith(os.path.realpath(ALLOWED_DIR)):
215    raise ValueError("Invalid file path")
216with open(file_path, 'r') as f:
217    content = f.read()
218```
219 
220### Insecure Deserialization
221 
222**VULNERABLE**: pickle.loads(), yaml.load() with untrusted data
223 
224**SECURE**:
225```python
226import json
227data = json.loads(user_input)  # SECURE
228import yaml
229config = yaml.safe_load(user_input)  # SECURE
230```
231 
232### Command Injection
233 
234**VULNERABLE**: os.system() or subprocess with shell=True and user input
235 
236**SECURE**:
237```python
238subprocess.run(['ping', '-c', '4', user_input])  # Array args
239import shlex
240safe_input = shlex.quote(user_input)  # Input validation
241```
242 
243### Insecure Random
244 
245**VULNERABLE**: random module for security-critical operations
246 
247**SECURE**:
248```python
249import secrets
250token = secrets.token_hex(16)
251session_id = secrets.token_urlsafe(32)
252```
253 
254## Framework Security
255 
256### Django
257 
258**VULNERABLE**: @csrf_exempt, DEBUG=True, weak SECRET_KEY, missing security middleware
259 
260**SECURE**:
261```python
262# settings.py
263DEBUG = False
264SECRET_KEY = os.environ.get('DJANGO_SECRET_KEY')
265 
266MIDDLEWARE = [
267    'django.middleware.security.SecurityMiddleware',
268    'django.middleware.csrf.CsrfViewMiddleware',
269    'django.middleware.clickjacking.XFrameOptionsMiddleware',
270]
271 
272SECURE_SSL_REDIRECT = True
273SESSION_COOKIE_SECURE = True
274CSRF_COOKIE_SECURE = True
275X_FRAME_OPTIONS = 'DENY'
276```
277 
278### Flask
279 
280**VULNERABLE**: debug=True, weak secret_key, CORS wildcard
281 
282**SECURE**:
283```python
284import os
285from flask_talisman import Talisman
286 
287app.secret_key = os.environ.get('FLASK_SECRET_KEY')
288Talisman(app, force_https=True)
289CORS(app, origins=['https://example.com'])
290```
291 
292### Express.js
293 
294**VULNERABLE**: Missing helmet, CORS wildcard, no rate limiting
295 
296**SECURE**:
297```javascript
298const helmet = require('helmet');
299const rateLimit = require('express-rate-limit');
300 
301app.use(helmet());
302app.use(cors({ origin: 'https://example.com' }));
303app.use(rateLimit({ windowMs: 15 * 60 * 1000, max: 100 }));
304```
305 
306## Multi-Language Scanner Implementation
307 
308```python
309import json
310import subprocess
311from pathlib import Path
312from typing import Dict, List, Any
313from dataclasses import dataclass
314from datetime import datetime
315 
316@dataclass
317class SASTFinding:
318    tool: str
319    severity: str
320    category: str
321    title: str
322    description: str
323    file_path: str
324    line_number: int
325    cwe: str
326    owasp: str
327    confidence: str
328 
329class MultiLanguageSASTScanner:
330    def __init__(self, project_path: str):
331        self.project_path = Path(project_path)
332        self.findings: List[SASTFinding] = []
333 
334    def detect_languages(self) -> List[str]:
335        """Auto-detect languages"""
336        languages = []
337        indicators = {
338            'python': ['*.py', 'requirements.txt'],
339            'javascript': ['*.js', 'package.json'],
340            'typescript': ['*.ts', 'tsconfig.json'],
341            'java': ['*.java', 'pom.xml'],
342            'ruby': ['*.rb', 'Gemfile'],
343            'go': ['*.go', 'go.mod'],
344            'rust': ['*.rs', 'Cargo.toml'],
345        }
346        for lang, patterns in indicators.items():
347            for pattern in patterns:
348                if list(self.project_path.glob(f'**/{pattern}')):
349                    languages.append(lang)
350                    break
351        return languages
352 
353    def run_comprehensive_sast(self) -> Dict[str, Any]:
354        """Execute all applicable SAST tools"""
355        languages = self.detect_languages()
356 
357        scan_results = {
358            'timestamp': datetime.now().isoformat(),
359            'languages': languages,
360            'tools_executed': [],
361            'findings': []
362        }
363 
364        self.run_semgrep_scan()
365        scan_results['tools_executed'].append('semgrep')
366 
367        if 'python' in languages:
368            self.run_bandit_scan()
369            scan_results['tools_executed'].append('bandit')
370        if 'javascript' in languages or 'typescript' in languages:
371            self.run_eslint_security_scan()
372            scan_results['tools_executed'].append('eslint-security')
373 
374        scan_results['findings'] = [vars(f) for f in self.findings]
375        scan_results['summary'] = self.generate_summary()
376        return scan_results
377 
378    def run_semgrep_scan(self):
379        """Run Semgrep"""
380        for ruleset in ['auto', 'p/security-audit', 'p/owasp-top-ten']:
381            try:
382                result = subprocess.run([
383                    'semgrep', '--config', ruleset, '--json', '--quiet',
384                    str(self.project_path)
385                ], capture_output=True, text=True, timeout=300)
386 
387                if result.stdout:
388                    data = json.loads(result.stdout)
389                    for f in data.get('results', []):
390                        self.findings.append(SASTFinding(
391                            tool='semgrep',
392                            severity=f.get('extra', {}).get('severity', 'MEDIUM').upper(),
393                            category='sast',
394                            title=f.get('check_id', ''),
395                            description=f.get('extra', {}).get('message', ''),
396                            file_path=f.get('path', ''),
397                            line_number=f.get('start', {}).get('line', 0),
398                            cwe=f.get('extra', {}).get('metadata', {}).get('cwe', ''),
399                            owasp=f.get('extra', {}).get('metadata', {}).get('owasp', ''),
400                            confidence=f.get('extra', {}).get('metadata', {}).get('confidence', 'MEDIUM')
401                        ))
402            except Exception as e:
403                print(f"Semgrep {ruleset} failed: {e}")
404 
405    def generate_summary(self) -> Dict[str, Any]:
406        """Generate statistics"""
407        severity_counts = {'CRITICAL': 0, 'HIGH': 0, 'MEDIUM': 0, 'LOW': 0}
408        for f in self.findings:
409            severity_counts[f.severity] = severity_counts.get(f.severity, 0) + 1
410 
411        return {
412            'total_findings': len(self.findings),
413            'severity_breakdown': severity_counts,
414            'risk_score': self.calculate_risk_score(severity_counts)
415        }
416 
417    def calculate_risk_score(self, severity_counts: Dict[str, int]) -> int:
418        """Risk score 0-100"""
419        weights = {'CRITICAL': 10, 'HIGH': 7, 'MEDIUM': 4, 'LOW': 1}
420        total = sum(weights[s] * c for s, c in severity_counts.items())
421        return min(100, int((total / 50) * 100))
422```
423 
424## CI/CD Integration
425 
426### GitHub Actions
427 
428```yaml
429name: SAST Scan
430on:
431  pull_request:
432    branches: [main]
433 
434jobs:
435  sast:
436    runs-on: ubuntu-latest
437    steps:
438      - uses: actions/checkout@v3
439      - uses: actions/setup-python@v4
440        with:
441          python-version: '3.11'
442 
443      - name: Install tools
444        run: |
445          pip install bandit semgrep
446          npm install -g eslint @eslint/plugin-security
447 
448      - name: Run scans
449        run: |
450          bandit -r . -f json -o bandit.json || true
451          semgrep --config=auto --json --output=semgrep.json || true
452 
453      - name: Upload reports
454        uses: actions/upload-artifact@v3
455        with:
456          name: sast-reports
457          path: |
458            bandit.json
459            semgrep.json
460```
461 
462### GitLab CI
463 
464```yaml
465sast:
466  stage: test
467  image: python:3.11
468  script:
469    - pip install bandit semgrep
470    - bandit -r . -f json -o bandit.json || true
471    - semgrep --config=auto --json --output=semgrep.json || true
472  artifacts:
473    reports:
474      sast: bandit.json
475```
476 
477## Best Practices
478 
4791. **Run early and often** - Pre-commit hooks and CI/CD
4802. **Combine multiple tools** - Different tools catch different vulnerabilities
4813. **Tune false positives** - Configure exclusions and thresholds
4824. **Prioritize findings** - Focus on CRITICAL/HIGH first
4835. **Framework-aware scanning** - Use specific rulesets
4846. **Custom rules** - Organization-specific patterns
4857. **Developer training** - Secure coding practices
4868. **Incremental remediation** - Fix gradually
4879. **Baseline management** - Track known issues
48810. **Regular updates** - Keep tools current
489 
490## Related Tools
491 
492- **security-secrets.md** - Advanced credential detection
493- **security-owasp.md** - OWASP Top 10 assessment
494- **security-api.md** - API security testing
495- **security-scan.md** - Comprehensive security scanning
496