---
# System prepended metadata

title: Lab 2 - Static Application Security Testing (SAST) I

---

# Lab 2 - Static Application Security Testing (SAST) I

Group 0:
Valentin Chernyshov, Iskander Bakhtiyarov, Dmitrii Chermnykh

## Task 1 - SAST Theory

#### What is Static Code Analysis?
In computer science, static program analysis (or static analysis) is the analysis of computer programs performed without executing them, in contrast with dynamic program analysis, which is performed on programs during their execution.
#### Give and explain the limitation(s) of Static Analyzers.
1. Automated tools do not support all programming languages.
2. Automated tools produce false positives and false negatives.
3. Automated tools can provide a false sense of security that everything is being addressed.
4. Automated tools only as good as the rules they are using to scan with.
5. It does not find vulnerabilities introduced in the runtime environment.


#### Give an explain the benefit(s) of Static Analysis Tool.
1. It can find weaknesses in the code at the exact location.
2. It allows a quicker turn around for fixes.
3. It is relatively fast.
4. It can scan the entire code base.
5. It can provide mitigation recommendations, reducing the research time.
6. It permits weaknesses to be found earlier in the development life cycle, reducing the cost to fix.

#### Give and explain the best criterias when choosing a Static Analysis Tool.

1. Main programming language of the codebase - for better performance
2. How difficult is to integrate such tool in development lifecycle - for smooth integration
3. Analyzer should provide the baselining analysis results - to supress false positives
4. Analysis speed
5. Understandable reports
6. Licence cost
7. Reputation and reviews


## Task 3 - Analysis
#### SQ `docker-compose.yml`
```yaml
version: '3.7'

services:
  sonarqube:
    image: sonarqube:9.6.1-community
    container_name: sonarqube
    restart: always

    ports:
      - 9000:9000
    volumes:
      - sonarqube_data:/opt/sonarqube/data
      - sonarqube_extensions:/opt/sonarqube/extensions
      - sonarqube_logs:/opt/sonarqube/logs

volumes:
  sonarqube_data:
    name: sonarqube_data
  sonarqube_extensions:
    name: sonarqube_extensions
  sonarqube_logs:
    name: sonarqube_logs
```

#### SQ job
```yaml
sonarqube-check:
  interruptible: false
  needs: []
  stage: test
  image:
    name: sonarsource/sonar-scanner-cli:latest
    entrypoint: [""]
  variables:
    SONAR_USER_HOME: "${CI_PROJECT_DIR}/.sonar"  # Defines the location of the analysis task cache
    GIT_DEPTH: "0"  # Tells git to fetch all the branches of the project, required by the analysis task
  cache:
    key: "${CI_JOB_NAME}"
    paths:
      - .sonar/cache
  script:
    - sonar-scanner
  allow_failure: false
```

#### What is a Quality Gate? What is a quality profile?

The Quality Gate lets you set your own code quality and security conditions by selecting a metric and then setting the pass/fail threshold. If any of the conditions in the QG fail, the overall QG fails and you know not to merge your code until you remedy the situation.

Quality Profiles are collections of rules to apply during an analysis for a particular rule.

#### Our Quality Gate:
![](https://i.imgur.com/sboPXnP.png)


## Task 4 - Remediation.

#### Solve 5 different Major issues

In first scan 68 issues were found

![](https://i.imgur.com/ZMVi1H2.jpg)


The major part of found issues was commented code and in appropriate function using so some commented code was removed and some functions were rewritten  
Here you can see what was changed

![](https://i.imgur.com/8Q513G0.jpg)

![](https://i.imgur.com/J582jmT.jpg)

![](https://i.imgur.com/Xmz9Ha6.jpg)

![](https://i.imgur.com/Pwut543.jpg)

![](https://i.imgur.com/Q0mkVAx.jpg)

![](https://i.imgur.com/0OWccG3.jpg)

Here you can see all changes

![](https://i.imgur.com/5xAQgYj.png)

#### Scan your project again, analyze the results and share your understandings

After second scan 63 major issues were found

![](https://i.imgur.com/MNxz8qa.jpg)

![](https://i.imgur.com/F7pnZfy.jpg)

#### Pipeline

Pipeline is failed because of Quality Gate

![](https://i.imgur.com/r5NWo2p.png)

Build and push:
![](https://i.imgur.com/fDPCw3Q.png)

SQ check:
![](https://i.imgur.com/XmBzkkp.png)


#### Slack

Slack is not avalable in Russia nowadays. Thus, unfortunately this task cannot be done

## Bonus

#### Build container job
```yaml
build:
  interruptible: true

  # We also run tests during the build of the container. The separate test job is only present to satisfy the lab requirements.
  needs: []
  stage: build
  image: quay.io/buildah/stable
  variables:
    IMAGE_NAME: "$CI_REGISTRY/devsexops/lab2"
    BUILDAH_LAYERS: 'true'
  before_script:
    # Note: unlike in normal environment, we do not have a domain here.
    # We have chosen to use the registry as an insecure one because we don't think that
    # considering encryption and MITM attacks is important for this lab and we don't
    # want to work with increased complexity when using self-signed certificates.
    - |
      echo "
      [registries.insecure]
      registries = [\"$CI_REGISTRY\"]
      " > /etc/containers/registries.conf
    - export REGISTRY_AUTH_FILE=${HOME}/auth.json
    - buildah login -u "$CI_REGISTRY_USER" -p "$CI_JOB_TOKEN" "$CI_REGISTRY"
  script:
    - >
      buildah build
      -t "$IMAGE_NAME:$CI_COMMIT_SHA"
      -t "$IMAGE_NAME:latest"
    - buildah push "$IMAGE_NAME:$CI_COMMIT_SHA"
    - buildah push "$IMAGE_NAME:latest"
```

#### Job status:

![](https://i.imgur.com/fDPCw3Q.png)

