TeamCityを使ったCI/CDパイプラインによるアプリケーションのセキュリティ強化

import os
import requests
 
buildConfName = os.getenv("TEAMCITY_BUILDCONF_NAME")
token = os.getenv("TEAMCITY_API_TOKEN")
url = f"http://'TeamCityサーバーのホスト名とポート番号'/app/rest/builds/multiple/buildType:name:{buildConfName},count:1"
headers = {"Authorization": f"Bearer {token}", "Accept": "application/json"}
response = requests.get(url, headers=headers)
lastBuild = response.json()
 
if lastBuild["count"] > 0:
    lastBuildId = lastBuild["build"][0]["id"]
    url = f"http://'TeamCityサーバーのホスト名とポート番号'/app/rest/builds/id:{lastBuildId}"
    response = requests.get(url, headers=headers)
    buildInfo = response.json()
    if buildInfo["lastChanges"]["count"] > 0:
        commitHash = buildInfo["lastChanges"]["change"][0]["version"]
        print(f"##teamcity[setParameter name='demo.lastCommit' value='{commitHash}']")

#!/bin/bash
if [ -n "%demo.lastCommit%" ]; then
	ggshield secret scan commit-range %demo.lastCommit%...HEAD --json > ggshield_results.json
else
	ggshield secret scan repo ./ --json > ggshield_results.json
fi
 
python3 /your/path/your-import-defect-dojo-script.py --host "DefectDojoのURL" --engagement "DefectDojoのエンゲージメントID" --scan_type "Ggshield Scan" --build_id $BUILD_NUMBER --report ggshield_results.json

import requests
import sys
import os
 
 
def uploadToDefectDojo(token, url, engagement_id, scan_type, build_id, filename):
    multipart_form_data = {
        'file': (filename, open(filename, 'rb')),
        'scan_type': (None, scan_type),
        'engagement': (None, engagement_id),
        'build_id': (None, build_id),
        'active': (None, 'true'),
        'verified': (None, 'true'),
    }
 
    endpoint = '/api/v2/import-scan/'
    r = requests.post(
        url + endpoint,
        files=multipart_form_data,
        headers={
            'Authorization': 'Token ' + token,
        }
    )
    if r.status_code >= 400:
        sys.exit(f'Post failed: {r.text}')
    print(r.text)
 
if __name__ == "__main__":
    try:
        token = os.getenv("DEFECT_DOJO_API_TOKEN")
    except KeyError: 
        print("Please set the environment variable DEFECT_DOJO_API_TOKEN") 
        sys.exit(1)
    if len(sys.argv) == 11:
        url = sys.argv[2]
        engagement_id = sys.argv[4]
        scan_type = sys.argv[6]
        build_id = sys.argv[8]
        report = sys.argv[10]
        uploadToDefectDojo(token, url, engagement_id, scan_type, build_id, report)
    else:
        print(
            'Usage: --host DOJO_URL --engagement ENGAGEMENT_ID --scan_type SCAN_TYPE --build_id BUILD_ID --report REPORT_FILE')
        sys.exit(1)
 

#!/bin/bash
if [ -n "%demo.lastCommit%" ]; then
  export SEMGREP_BASELINE_REF=%demo.lastCommit%
fi
semgrep scan --json -o semgrep_report.json
 
python3 /your/path/your-import-defect-dojo-script.py --host "DefectDojoのURL" --engagement "DefectDojoのエンゲージメントID" --scan_type "Semgrep JSON Report" --build_id $BUILD_NUMBER --report semgrep_report.json

#!/bin/bash
checkov -f /your/path/Dockerfile -o json --output-file-path checkov
 
python3 /your/path/your-import-defect-dojo-script.py --host "DefectDojoのURL" --engagement "DefectDojoのエンゲージメントID" --scan_type "Checkov Scan" --build_id $BUILD_NUMBER --report checkov/results_json.json

#!/bin/bash
cdxgen -t php ./ --server-url "Dependency-Track APIサーバーのURL" --api-key "Dependency-TrackのAPIキー" --project-id "Dependency-TrackのプロジェクトID"

#!/bin/bash
cdxgen -t javascript ./ --server-url "Dependency-Track APIサーバーのURL" --api-key "Dependency-TrackのAPIキー" --project-id "Dependency-TrackのプロジェクトID"

#!/bin/bash
syft "コンテナイメージ" -o [email protected] > container_sbom.json
python3 /your/path/your-import-dependency-track-script.py --host "Dependency-Track APIサーバーのURL" --project "Dependency-TrackのプロジェクトID" --sbom container_sbom.json

import requests
import json
import base64
import sys
import os
 
 
def uploadToDTrack(api_key, url, project_id, sbom):
    with open(sbom, 'r') as file:
        sbom_data = file.read()
 
    print(sbom_data)
 
    data = {
        'bom': base64.b64encode(bytes(sbom_data, 'utf-8')).decode('utf-8'),
        'project': project_id,
    }
 
    json_data = json.dumps(data)
 
    endpoint = '/api/v1/bom/'
    r = requests.put(
        url + endpoint,
        data=json_data,
        headers={
            'X-Api-Key': api_key,
            'Content-Type': 'application/json',
            'Accept': 'application/json',
        }
    )
    if r.status_code >= 400:
        sys.exit(f'Put failed: {r.text}')
    print(r.text)
 
if __name__ == "__main__":
    try:
        api_key = os.getenv("DTRACK_API_KEY")
    except KeyError: 
        print("Please set the environment variable DTRACK_API_KEY") 
        sys.exit(1)
    if len(sys.argv) == 7:
        url = sys.argv[2]
        project_id = sys.argv[4]
        sbom = sys.argv[6]
        uploadToDTrack(api_key, url, project_id, sbom)
    else:
        print('Usage: --host DTRACK_URL --project PROJECT_ID --sbom SBOM_FILE')

package _Self.buildTypes
 
import jetbrains.buildServer.configs.kotlin.*
import jetbrains.buildServer.configs.kotlin.buildFeatures.perfmon
import jetbrains.buildServer.configs.kotlin.buildSteps.python
import jetbrains.buildServer.configs.kotlin.buildSteps.script
import jetbrains.buildServer.configs.kotlin.triggers.vcs
 
object PipelineDemo : BuildType({
    name = "Pipeline Demo"
 
    params {
        param("demo.lastCommit", "")
    }
 
    vcs {
        root(HttpsGithubCom86worldNocodeDemoRefsHeadsMain)
    }
    steps {
        python {
            name = "Get Last Commit of Previous Build"
            id = "get_last_commit"
            command = script {
                content = """
                    import os
                    import requests
                    
                    buildConfName = os.getenv("TEAMCITY_BUILDCONF_NAME")
                    token = os.getenv("TEAMCITY_API_TOKEN")
                    url = f"http://your-teamcity-server:port/app/rest/builds/multiple/buildType:name:{buildConfName},count:1"
                    headers = {"Authorization": f"Bearer {token}", "Accept": "application/json"}
                    response = requests.get(url, headers=headers)
                    lastBuild = response.json()
                    
                    if lastBuild["count"] > 0:
                        lastBuildId = lastBuild["build"][0]["id"]
                        url = f"http://your-teamcity-server:port/app/rest/builds/id:{lastBuildId}"
                        response = requests.get(url, headers=headers)
                        buildInfo = response.json()
                        if buildInfo["lastChanges"]["count"] > 0:
                            commitHash = buildInfo["lastChanges"]["change"][0]["version"]
                            print(f"##teamcity[setParameter name='demo.lastCommit' value='{commitHash}']")
                """.trimIndent()
            }
        }
        script {
            name = "Detect Secrets in Code"
            id = "detect_secret"
            scriptContent = """
                #!/bin/bash
                if [ -n "%demo.lastCommit%" ]; then
                	ggshield secret scan commit-range %demo.lastCommit%...HEAD --json > ggshield_results.json
                else
                	ggshield secret scan repo ./ --json > ggshield_results.json
                fi
                
                python3 /your/path/your-import-defect-dojo-script.py --host http://your-defectdojo-server:port --engagement your-engagemant-id --scan_type "Ggshield Scan" --build_id ${'$'}BUILD_NUMBER --report ggshield_results.json
            """.trimIndent()
        }
        script {
            name = "Find Vulnerabilities in Code"
            id = "find_vulnerabilities"
            scriptContent = """
                #!/bin/bash
                if [ -n "%demo.lastCommit%" ]; then
                  export SEMGREP_BASELINE_REF=%demo.lastCommit%
                fi
                semgrep scan --json -o semgrep_report.json
                python3 /your/path/your-import-defect-dojo-script.py --host http://your-defectdojo-server:port --engagement your-engagemant-id --scan_type "Semgrep JSON Report" --build_id ${'$'}BUILD_NUMBER --report semgrep_report.json
            """.trimIndent()
        }
        script {
            name = "Scan Dockerfile"
            id = "scan_dockerfile"
            scriptContent = """
                #!/bin/bash
                checkov -f /your/path/Dockerfile -o json --output-file-path checkov
                python3 /your/path/your-import-defect-dojo-script.py --host http://your-defectdojo-server:port --engagement your-engagemant-id --scan_type "Checkov Scan" --build_id ${'$'}BUILD_NUMBER --report checkov/results_json.json
            """.trimIndent()
        }
        script {
            name = "Upload Backend SBOM"
            id = "upload_backend_sbom"
            scriptContent = """
                #!/bin/bash
                cdxgen -t php ./ --server-url http://your-dtrack-apiserver:port --api-key ${'$'}DTRACK_API_KEY --project-id your-project-id
            """.trimIndent()
        }
        script {
            name = "Upload Frontend SBOM"
            id = "upload_frontend_sbom"
            scriptContent = """
                #!/bin/bash
                NODE_OPTIONS=--max-old-space-size=4096 cdxgen -t javascript ./ --server-url http://your-dtrack-apiserver:port --api-key ${'$'}DTRACK_API_KEY --project-id your-project-id
            """.trimIndent()
        }
        script {
            name = "Upload Container SBOM"
            id = "upload_container_sbom"
            scriptContent = """
                #!/bin/bash
                syft your-docker-image -o [email protected] > container_sbom.json
                python3 /your/path/your-import-dependency-track-script.py --host http://your-dtrack-apiserver:port --project your-project-id --sbom container_sbom.json
            """.trimIndent()
        }
    }
    triggers {
        vcs {
        }
    }
 
    features {
        perfmon {
        }
    }
})

[
  {
    "report_name": "Product Report: demo-app",
    [...]
    "findings": [
        {
            "id": 1,
            "title": "perl:5.36.0-7+deb12u1 Affected By: CVE-2023-47100 (NVD)",
            "cwe": 755,
            "cvssv3_score": 9.8,
            "severity": "Critical",
            "description": "You are using a component with a known vulnerability. Version 5.36.0-7+deb12u1 of the perl component is affected by the vulnerability with an id of CVE-2023-47100...."
            [...]
        },
        {
            "id": 2,
            [...]
        }
    ],
    [...]
  }
]

for (const item of $input.all()) {
  item.json.severity_count = { critical: 0, high: 0, medium: 0, low: 0, info: 0 }
  const findings = item.json.findings
  for (const finding of findings) {
    switch (finding.severity) {
      case 'Critical':
        item.json.severity_count.critical++
        break
      case 'High':
        item.json.severity_count.high++
        break
      case 'Medium':
        item.json.severity_count.medium++
        break
      case 'Low':
        item.json.severity_count.low++
        break
      case 'Info':
        item.json.severity_count.info++
        break
      default:
    }
    
    finding.description = finding.description.length > 1000 ? 
        finding.description.slice(0, 1000) + '...' : 
        finding.description
  }
}
 
return $input.all()

{
  "channel_id": "投稿したいチャネルのID",
  "message": "### Daily Security Report\n\n|findings|count|\n|:---|---:|\n|critical|{{ $('severity集計ノードの名前').first().json.severity_count.critical }}|\n|high|{{ $('severity集計ノードの名前').first().json.severity_count.high }}|\n|medium|{{ $('severity集計ノードの名前').first().json.severity_count.medium }}|\n|low|{{ $('severity集計ノードの名前').first().json.severity_count.low }}|\n|info|{{ $('severity集計ノードの名前').first().json.severity_count.info }}|\n\nPlease check the attachment for more details.",
  "file_ids": [
    "{{ $json.file_infos[0].id }}"
  ]
}