test

pedrompflopes · Jan 29, 2024 · 33f7d61 · 33f7d61
1 parent da52659
commit 33f7d61
Show file tree

Hide file tree

Showing 7 changed files with 147 additions and 175 deletions.
diff --git a/.github/workflows/issue.yml b/.github/workflows/issue.yml
@@ -1,57 +1,57 @@
-name: Notify Jira
-on:
-  issues:
-    types: [opened]
-
-jobs:
-   issue:
-    name: notify_jira
-    uses: pedrompflopes/ast-github-tester/.github/workflows/notify_jira.yml@main
-    with:
-      title: ${{ github.event.issue.title }}
-      body: ${{ github.event.issue.body }}
-      html_url: ${{ github.event.issue.html_url }}
-      owner: ${{ github.event.repository.owner.id }}
-      issue_number: ${{ github.event.issue.number }}
-      repo: ${{ github.event.repository.full_name }}
-    secrets: inherit 
-
-# This workflow is triggered by github issue and creates a jira ticket in the respective configured account
-#
 # name: Notify Jira
 # on:
 #   issues:
 #     types: [opened]
 
+# jobs:
+#    issue:
+#     name: notify_jira
+#     uses: pedrompflopes/ast-github-tester/.github/workflows/notify_jira.yml@main
+#     with:
+#       title: ${{ github.event.issue.title }}
+#       body: ${{ github.event.issue.body }}
+#       html_url: ${{ github.event.issue.html_url }}
+#       owner: ${{ github.event.repository.owner.id }}
+#       issue_number: ${{ github.event.issue.number }}
+#       repo: ${{ github.event.repository.full_name }}
+#     secrets: inherit 
+
+# # This workflow is triggered by github issue and creates a jira ticket in the respective configured account
+# #
+# # name: Notify Jira
+# # on:
+# #   issues:
+# #     types: [opened]
 
 
-# jobs:
-#   jirajob:
-#     runs-on: ubuntu-latest
-#     steps:
-#       - name: Jira Login
-#         uses: atlassian/gajira-login@v3
-#         env:
-#           JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL}}
-#           JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL}}
-#           JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN}}
-#       - name: Jira Create issue
-#         id: create_jira_issue
-#         uses: atlassian/gajira-create@v3
-#         with:
-#           project: AST
-#           issuetype: Bug
-#           summary: '[GITHUB ISSUE] ${{github.event.issue.title}}'
-#           description: ${{github.event.issue.body}} see more at ${{github.event.issue.html_url}}
-#           fields: ${{ secrets.JIRA_FIELDS}}
 
-#       - name: Add comment to GitHub issue
-#         uses: actions/[email protected]
-#         with:
-#           script: |
-#             github.issues.createComment({
-#               issue_number: context.issue.number,
-#               owner: context.repo.owner,
-#               repo: context.repo.repo,
-#               body: 'Internal Jira issue: [${{ steps.create_jira_issue.outputs.issue }}](${{ inputs.JIRA_BASE_URL }}/browse/${{ steps.create_jira_issue.outputs.issue }})'
-#             })     
+# # jobs:
+# #   jirajob:
+# #     runs-on: ubuntu-latest
+# #     steps:
+# #       - name: Jira Login
+# #         uses: atlassian/gajira-login@v3
+# #         env:
+# #           JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL}}
+# #           JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL}}
+# #           JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN}}
+# #       - name: Jira Create issue
+# #         id: create_jira_issue
+# #         uses: atlassian/gajira-create@v3
+# #         with:
+# #           project: AST
+# #           issuetype: Bug
+# #           summary: '[GITHUB ISSUE] ${{github.event.issue.title}}'
+# #           description: ${{github.event.issue.body}} see more at ${{github.event.issue.html_url}}
+# #           fields: ${{ secrets.JIRA_FIELDS}}
+
+# #       - name: Add comment to GitHub issue
+# #         uses: actions/[email protected]
+# #         with:
+# #           script: |
+# #             github.issues.createComment({
+# #               issue_number: context.issue.number,
+# #               owner: context.repo.owner,
+# #               repo: context.repo.repo,
+# #               body: 'Internal Jira issue: [${{ steps.create_jira_issue.outputs.issue }}](${{ inputs.JIRA_BASE_URL }}/browse/${{ steps.create_jira_issue.outputs.issue }})'
+# #             })     
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -17,10 +17,9 @@ jobs:
         with:
           base_uri: https://deu.ast.checkmarx.net/
           cx_tenant: ${{ secrets.TENANT }}
-          additional_params: --debug --async
-      - name: Cx report
-        uses: actions/upload-artifact@v3
+          additional_params: --report-format sarif --output-path . 
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v2
         with:
-          name: cx_result.pdf
-          path: cx_result.pdf
+          sarif_file: cx_result.sarif
 
diff --git a/.github/workflows/notify_jira.yml b/.github/workflows/notify_jira.yml
@@ -1,54 +1,54 @@
-name: Notify Jira
+# name: Notify Jira
 
-on:
-  workflow_call:
-    inputs:
-      title:
-        description: 'Issue title'
-        required: true
-        type: string
-      body:
-        description: 'Body'
-        required: true
-        type: string
-      html_url:
-        description: 'URL'
-        required: true
-        type: string
-      repo:
-        description: 'Repository name'
-        required: true
-        type: string
+# on:
+#   workflow_call:
+#     inputs:
+#       title:
+#         description: 'Issue title'
+#         required: true
+#         type: string
+#       body:
+#         description: 'Body'
+#         required: true
+#         type: string
+#       html_url:
+#         description: 'URL'
+#         required: true
+#         type: string
+#       repo:
+#         description: 'Repository name'
+#         required: true
+#         type: string
 
-jobs:
-  notify_jira:
-    runs-on: ubuntu-latest
-    env:
-      JIRA_URL: "https://checkmarx.atlassian.net/"
-    steps:
-      - name: Jira Login
-        uses: atlassian/gajira-login@v3
-        env:
-          JIRA_BASE_URL: ${{ env.JIRA_URL }}
-          JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
-          JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
-      - name: Jira Create issue
-        id: create_jira_issue
-        uses: atlassian/gajira-create@v3
-        with:
-          project: AST
-          issuetype: Bug
-          summary: '${{inputs.repo}} ${{inputs.title}}'
-          description: ${{inputs.body}} see more at ${{inputs.html_url}}
-          fields: ${{ secrets.JIRA_FIELDS}}
+# jobs:
+#   notify_jira:
+#     runs-on: ubuntu-latest
+#     env:
+#       JIRA_URL: "https://checkmarx.atlassian.net/"
+#     steps:
+#       - name: Jira Login
+#         uses: atlassian/gajira-login@v3
+#         env:
+#           JIRA_BASE_URL: ${{ env.JIRA_URL }}
+#           JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
+#           JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+#       - name: Jira Create issue
+#         id: create_jira_issue
+#         uses: atlassian/gajira-create@v3
+#         with:
+#           project: AST
+#           issuetype: Bug
+#           summary: '${{inputs.repo}} ${{inputs.title}}'
+#           description: ${{inputs.body}} see more at ${{inputs.html_url}}
+#           fields: ${{ secrets.JIRA_FIELDS}}
 
-      - name: Add comment to GitHub issue
-        uses: actions/[email protected]
-        with:
-          script: |
-            github.issues.createComment({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              body: 'Internal Jira issue: [${{ steps.create_jira_issue.outputs.issue }}](${{ env.JIRA_URL }}/browse/${{ steps.create_jira_issue.outputs.issue }})'
-            })
+#       - name: Add comment to GitHub issue
+#         uses: actions/[email protected]
+#         with:
+#           script: |
+#             github.issues.createComment({
+#               issue_number: context.issue.number,
+#               owner: context.repo.owner,
+#               repo: context.repo.repo,
+#               body: 'Internal Jira issue: [${{ steps.create_jira_issue.outputs.issue }}](${{ env.JIRA_URL }}/browse/${{ steps.create_jira_issue.outputs.issue }})'
+#             })
diff --git a/.github/workflows/teams.yml b/.github/workflows/teams.yml
@@ -1,15 +1,15 @@
-name: Notify
+# name: Notify
 
-on:
-  workflow_dispatch:
+# on:
+#   workflow_dispatch:
 
-jobs:
-    notify:
-        runs-on: ubuntu-latest
-        steps:
-          - name: Send a Notification
-            id: notify
-            uses: thechetantalwar/teams-notify@v2
-            with:
-              teams_webhook_url: ${{ secrets.TEAM_HOOK }}
-              message: "Github Action Build Number logs  sdfsd ### TEST "
+# jobs:
+#     notify:
+#         runs-on: ubuntu-latest
+#         steps:
+#           - name: Send a Notification
+#             id: notify
+#             uses: thechetantalwar/teams-notify@v2
+#             with:
+#               teams_webhook_url: ${{ secrets.TEAM_HOOK }}
+#               message: "Github Action Build Number logs  sdfsd ### TEST "
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -1,14 +1,14 @@
-name: test Scan
+# name: test Scan
 
-on: [pull_request,workflow_dispatch]
+# on: [pull_request,workflow_dispatch]
 
 
-jobs:
-  build:
-    runs-on: ubuntu-latest
+# jobs:
+#   build:
+#     runs-on: ubuntu-latest
 
-    steps:
-      - uses: actions/checkout@v2      
-      - name: Adding markdown
-        run: | 
-          cat ./file.md >$GITHUB_STEP_SUMMARY
+#     steps:
+#       - uses: actions/checkout@v2      
+#       - name: Adding markdown
+#         run: | 
+#           cat ./file.md >$GITHUB_STEP_SUMMARY
diff --git a/bamboo-specs/bamboo.yml b/bamboo-specs/bamboo.yml
@@ -1,22 +1,22 @@
-version: 2
-plan:
-  project-key: TESTER
-  key: MPCX
-  name: Checkmarx Scan
+# version: 2
+# plan:
+#   project-key: TESTER
+#   key: MPCX
+#   name: Checkmarx Scan
 
-stages:
-  - Stage 1:
-      jobs:
-        - Job cli
+# stages:
+#   - Stage 1:
+#       jobs:
+#         - Job cli
 
-Job cli:
-  docker:
-    image: ubuntu:latest
-  tasks:
-    - script:
-        - apt update && apt install -y curl git
-        - /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
-        - /home/linuxbrew/.linuxbrew/bin/brew install checkmarx/ast-cli/ast-cli
-        - /home/linuxbrew/.linuxbrew/Cellar/ast-cli/*/bin/cx \
-        - brew install checkmarx/ast-cli/ast-cli
-        - cx scan create -s ${bamboo.build.working.directory} --project-name ${bamboo.planRepository.1.name} --base-uri ${bamboo.CX_BASE_URI} --tenant ${bamboo.CX_TENANT} --client-id ${bamboo.CX_CLIENT_ID} --client-secret ${bamboo.CX_CLIENT_ID_SECRET} --branch ${bamboo.planRepository.1.branchName}
+# Job cli:
+#   docker:
+#     image: ubuntu:latest
+#   tasks:
+#     - script:
+#         - apt update && apt install -y curl git
+#         - /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+#         - /home/linuxbrew/.linuxbrew/bin/brew install checkmarx/ast-cli/ast-cli
+#         - /home/linuxbrew/.linuxbrew/Cellar/ast-cli/*/bin/cx \
+#         - brew install checkmarx/ast-cli/ast-cli
+#         - cx scan create -s ${bamboo.build.working.directory} --project-name ${bamboo.planRepository.1.name} --base-uri ${bamboo.CX_BASE_URI} --tenant ${bamboo.CX_TENANT} --client-id ${bamboo.CX_CLIENT_ID} --client-secret ${bamboo.CX_CLIENT_ID_SECRET} --branch ${bamboo.planRepository.1.branchName}
diff --git a/insecure.php b/insecure.php
@@ -1,27 +0,0 @@
-<?php
-
-// First a SQL Injection attack V9
-//$var = $_POST['var'];
-//mysql_query("SELECT * FROM sometable WHERE id = $var");
-
-//
-/// XSS example
-//
-$var = $_POST['var'];
-//echo "<div>$var</div>\n";
-
-
-//
-/// 2nd XSS example
-//
-$var = $_POST['varB'];
-echo "<div>$varB</div>\n";
-
-//
-/// Forget to terminate user input after a redirect
-//
-if ($_SESSION['user_logged_in'] !== true) {
-  header('Location: /login.php');
-}
-
-// Important private logic that shouldn't happen because we've already redirected the user!