# ========================================
# 依存関係混乱攻撃のシナリオ
# ========================================
 
# 1. 社内で "mycompany-utils" というパッケージを内部レジストリで使用
# requirements.txt:
#   mycompany-utils==1.0.0
 
# 2. 攻撃者が PyPI に "mycompany-utils" を version 99.0.0 で公開
#    → setup.py に悪意あるインストールスクリプトを仕込む
 
# 3. pip が公開 PyPI の高バージョン (99.0.0) を優先インストール
# pip install mycompany-utils
# → PyPI の 99.0.0 がインストールされる（内部レジストリの 1.0.0 ではなく）
 
# ========================================
# 防御策
# ========================================
 
# 方法1: pip.conf で内部レジストリのみを参照
# [global]
# index-url = https://internal.pypi.mycompany.com/simple/
# extra-index-url = (設定しない → 公開 PyPI を参照しない)
 
# 方法2: .npmrc でスコープごとにレジストリを指定 (npm)
# @mycompany:registry=https://npm.mycompany.com/
# registry=https://registry.npmjs.org/
 
# 方法3: PyPI にプレースホルダパッケージを公開
#   → 内部パッケージと同名の空パッケージを公開し、攻撃者の先手を打つ
 
# 方法4: ハッシュ検証で予期しないパッケージの変更を検出
# pip install --require-hashes -r requirements.txt
# requirements.txt:
#   mycompany-utils==1.0.0 \
#     --hash=sha256:abc123def456...

# .github/dependabot.yml
version: 2
updates:
  # ========================================
  # npm 依存関係
  # ========================================
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "09:00"
      timezone: "Asia/Tokyo"
    open-pull-requests-limit: 10
    reviewers:
      - "security-team"
    labels:
      - "dependencies"
      - "security"
    # セキュリティアップデートは即座に、バージョンアップデートはグループ化
    groups:
      production-dependencies:
        dependency-type: "production"
        update-types:
          - "minor"
          - "patch"
      dev-dependencies:
        dependency-type: "development"
    ignore:
      # メジャーバージョンアップは手動で対応
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]
    # セキュリティアドバイザリ対応は例外（メジャーでも自動PR）
    # → GitHub Security Advisories が自動的に処理
 
  # ========================================
  # Python 依存関係
  # ========================================
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "weekly"
    groups:
      python-deps:
        patterns: ["*"]
        update-types: ["minor", "patch"]
 
  # ========================================
  # Docker イメージ
  # ========================================
  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"
    # ベースイメージの更新は必ず追従
    ignore: []
 
  # ========================================
  # GitHub Actions のバージョン管理
  # ========================================
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    # Actions のバージョン固定は特に重要（サプライチェーン攻撃対策）

# .github/workflows/security-scan.yml
name: Security Scan
on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: '0 0 * * *'  # 毎日 0:00 UTC
 
permissions:
  contents: read
  security-events: write
 
jobs:
  # ========================================
  # npm audit
  # ========================================
  npm-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
 
      - name: Install dependencies
        run: npm ci
 
      - name: npm audit (high/critical only)
        run: npm audit --audit-level=high
 
  # ========================================
  # Trivy filesystem scan
  # ========================================
  trivy-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Trivy vulnerability scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          severity: 'HIGH,CRITICAL'
          exit-code: '1'  # 脆弱性発見時にビルド失敗
          format: 'sarif'
          output: 'trivy-results.sarif'
 
      - name: Upload Trivy scan results to Security tab
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'
 
  # ========================================
  # pip-audit (Python)
  # ========================================
  pip-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'
 
      - name: Install pip-audit
        run: pip install pip-audit
 
      - name: Run pip-audit
        run: pip-audit -r requirements.txt --desc --fix --dry-run

# ========================================
# 基本的なスキャンコマンド
# ========================================
 
# ファイルシステムスキャン (プロジェクト全体)
trivy fs --severity HIGH,CRITICAL .
 
# コンテナイメージスキャン
trivy image --severity HIGH,CRITICAL myapp:latest
 
# 特定の脆弱性を無視（正当な理由がある場合）
trivy fs --severity HIGH,CRITICAL --ignore-unfixed .
 
# JSON 形式で出力（CI/CD パイプライン向け）
trivy fs --format json --output results.json .
 
# SBOM 出力付きスキャン
trivy fs --format cyclonedx --output sbom.json .
 
# ========================================
# 出力例
# ========================================
# myapp (npm)
# ============
# Total: 5 (HIGH: 3, CRITICAL: 2)
#
# ┌──────────────┬───────────────────┬──────────┬────────────┬────────────┐
# │   Library    │   Vulnerability   │ Severity │ Installed  │   Fixed    │
# ├──────────────┼───────────────────┼──────────┼────────────┼────────────┤
# │ lodash       │ CVE-2021-23337    │ HIGH     │ 4.17.20    │ 4.17.21    │
# │ express      │ CVE-2024-XXXX     │ CRITICAL │ 4.17.1     │ 4.18.2     │
# │ jsonwebtoken │ CVE-2022-23529    │ HIGH     │ 8.5.1      │ 9.0.0      │
# │ axios        │ CVE-2023-45857    │ HIGH     │ 1.5.0      │ 1.6.0      │
# │ node-forge   │ CVE-2022-24771    │ CRITICAL │ 1.2.1      │ 1.3.0      │
# └──────────────┴───────────────────┴──────────┴────────────┴────────────┘
 
# ========================================
# .trivyignore — 正当な理由で無視する脆弱性
# ========================================
# CVE-2021-23337  # lodash: 本アプリでは該当コードパスを使用していない
# CVE-2023-XXXXX  # テスト用依存関係のため本番影響なし

# Snyk CLIのインストールと使用
npm install -g snyk
 
# プロジェクトのスキャン
snyk test
 
# 監視モード（新規脆弱性の継続的検出）
snyk monitor
 
# 修正可能な脆弱性の自動修正
snyk fix
 
# コンテナイメージのスキャン
snyk container test myapp:latest
 
# IaC のスキャン
snyk iac test terraform/

# Snyk API を使った自動脆弱性レポート生成
import requests
import json
from datetime import datetime
 
def generate_vulnerability_report(org_id: str, api_token: str) -> dict:
    """Snyk API から組織全体の脆弱性レポートを生成"""
    headers = {
        'Authorization': f'token {api_token}',
        'Content-Type': 'application/json',
    }
 
    # 全プロジェクトの脆弱性を取得
    response = requests.get(
        f'https://api.snyk.io/rest/orgs/{org_id}/issues',
        headers=headers,
        params={'version': '2024-01-01', 'limit': 100},
    )
    response.raise_for_status()
    issues = response.json()
 
    # 重大度別に集計
    severity_counts = {'critical': 0, 'high': 0, 'medium': 0, 'low': 0}
    for issue in issues.get('data', []):
        severity = issue['attributes']['effective_severity_level']
        severity_counts[severity] = severity_counts.get(severity, 0) + 1
 
    return {
        'timestamp': datetime.utcnow().isoformat(),
        'total_issues': len(issues.get('data', [])),
        'severity_breakdown': severity_counts,
        'org_id': org_id,
    }

# ========================================
# SBOM 生成ツール
# ========================================
 
# syft で CycloneDX 形式の SBOM を生成
syft dir:. -o cyclonedx-json > sbom.cyclonedx.json
 
# syft で SPDX 形式の SBOM を生成
syft dir:. -o spdx-json > sbom.spdx.json
 
# Trivy で SBOM 生成
trivy fs --format cyclonedx --output sbom.json .
 
# コンテナイメージから SBOM 生成
syft myapp:latest -o cyclonedx-json > image-sbom.json
 
# npm で SBOM を生成 (npm 10+)
npm sbom --sbom-format cyclonedx
 
# cdxgen で SBOM 生成（複数言語対応）
npx @cyclonedx/cdxgen -o sbom.json
 
# ========================================
# SBOM からの脆弱性スキャン
# ========================================
 
# grype で SBOM から脆弱性をスキャン
grype sbom:sbom.cyclonedx.json
 
# Trivy で SBOM スキャン
trivy sbom sbom.cyclonedx.json
 
# ========================================
# SBOM の検証
# ========================================
 
# CycloneDX の形式検証
cyclonedx validate --input-file sbom.json --input-format json

# SBOM を CI/CD で管理するスクリプト
import json
import subprocess
from datetime import datetime
from pathlib import Path
from typing import Optional
 
def generate_and_analyze_sbom(
    project_dir: str,
    output_dir: str,
    severity_threshold: str = "HIGH",
) -> dict:
    """SBOM を生成して脆弱性分析を実行"""
 
    output_path = Path(output_dir)
    output_path.mkdir(parents=True, exist_ok=True)
 
    timestamp = datetime.utcnow().strftime('%Y%m%dT%H%M%S')
 
    # Step 1: CycloneDX SBOM を生成
    sbom_file = output_path / f"sbom-{timestamp}.json"
    result = subprocess.run(
        ["syft", f"dir:{project_dir}", "-o", "cyclonedx-json"],
        capture_output=True, text=True, check=True,
    )
    sbom = json.loads(result.stdout)
    sbom_file.write_text(json.dumps(sbom, indent=2))
 
    # Step 2: 脆弱性スキャン
    vuln_file = output_path / f"vulnerabilities-{timestamp}.json"
    vuln_result = subprocess.run(
        ["grype", f"sbom:{sbom_file}", "-o", "json"],
        capture_output=True, text=True,
    )
    vulnerabilities = json.loads(vuln_result.stdout)
    vuln_file.write_text(json.dumps(vulnerabilities, indent=2))
 
    # Step 3: 分析結果の集計
    matches = vulnerabilities.get("matches", [])
    severity_counts = {}
    for match in matches:
        sev = match.get("vulnerability", {}).get("severity", "unknown")
        severity_counts[sev] = severity_counts.get(sev, 0) + 1
 
    # Step 4: ライセンス分析
    components = sbom.get("components", [])
    license_counts = {}
    for comp in components:
        for lic in comp.get("licenses", []):
            lic_id = lic.get("license", {}).get("id", "unknown")
            license_counts[lic_id] = license_counts.get(lic_id, 0) + 1
 
    return {
        "sbom_path": str(sbom_file),
        "vulnerability_path": str(vuln_file),
        "component_count": len(components),
        "vulnerability_count": len(matches),
        "severity_breakdown": severity_counts,
        "license_breakdown": license_counts,
        "timestamp": timestamp,
    }

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "vulnerabilities": [
    {
      "id": "CVE-2021-23337",
      "source": { "name": "NVD" },
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "detail": "lodash.template() は本アプリケーションで使用していないため影響なし。コードパス分析により確認済み。",
        "response": ["will_not_fix"]
      },
      "affects": [
        {
          "ref": "pkg:npm/lodash@4.17.20"
        }
      ]
    }
  ]
}

# ========================================
# JavaScript / Node.js
# ========================================
# CI では npm ci を使用 (lock ファイルに厳密に従う)
npm ci  # npm install ではなく ci を使用
 
# lock ファイルは必ず Git 管理
git add package-lock.json
git commit -m "Update lock file"
 
# ========================================
# Python
# ========================================
# pip-compile で requirements.txt をハッシュ付きで生成
pip-compile --generate-hashes requirements.in > requirements.txt
 
# ハッシュ検証付きインストール
pip install --require-hashes -r requirements.txt
 
# ========================================
# Go
# ========================================
# go.sum が自動生成される (チェックサム検証)
go mod verify
 
# 依存関係の整理
go mod tidy
 
# ========================================
# Rust
# ========================================
# Cargo.lock は必ずコミット
cargo build  # Cargo.lock 自動生成
 
# 依存関係の監査
cargo audit

// package.json — npm overrides
{
  "overrides": {
    "lodash": "4.17.21",
    "minimist": ">=1.2.6",
    "json5": ">=2.2.2"
  }
}

// package.json — yarn resolutions
{
  "resolutions": {
    "lodash": "4.17.21",
    "**/minimist": ">=1.2.6"
  }
}

# ========================================
# ライセンスチェックの自動化
# ========================================
 
# JavaScript: license-checker
npx license-checker --summary
npx license-checker --failOn "GPL-3.0;AGPL-3.0;SSPL-1.0"
npx license-checker --production --json > licenses.json
 
# Python: pip-licenses
pip install pip-licenses
pip-licenses --format=table
pip-licenses --fail-on="GNU General Public License v3 (GPLv3)"
pip-licenses --format=json > licenses.json
 
# Go: go-licenses
go install github.com/google/go-licenses@latest
go-licenses check ./...
go-licenses csv ./... > licenses.csv
 
# マルチ言語: FOSSA
# fossa analyze
# fossa test  # ポリシー違反でビルド失敗

# NG: .gitignore にロックファイルを追加
echo "package-lock.json" >> .gitignore
echo "yarn.lock" >> .gitignore
 
# OK: ロックファイルを必ずコミット
git add package-lock.json
git commit -m "Update lock file"
 
# CI では npm ci を使用 (lock ファイルに基づく厳密インストール)
# npm install は lock ファイルを更新してしまうため CI では使用しない

# NG: postinstall スクリプトの問題を避けるために常時無視
npm install --ignore-scripts
 
# → ネイティブモジュールのビルドが行われず本番で障害
# → セキュリティ対策にもなっていない（インストール後に手動で実行する可能性）
 
# OK: 信頼できるパッケージのみ使用 + npm audit で検証
npm ci
npm audit --audit-level=high

{
  "dependencies": {
    "express": "4.17.1",
    "lodash": "4.17.19",
    "jsonwebtoken": "8.5.1"
  }
}

# デバッグ用ユーティリティ
import logging
import traceback
from functools import wraps
 
# ロガーの設定
logging.basicConfig(
    level=logging.DEBUG,
    format='%(asctime)s [%(levelname)s] %(name)s: %(message)s'
)
logger = logging.getLogger(__name__)
 
def debug_decorator(func):
    """関数の入出力をログ出力するデコレータ"""
    @wraps(func)
    def wrapper(*args, **kwargs):
        logger.debug(f"呼び出し: {func.__name__}(args={args}, kwargs={kwargs})")
        try:
            result = func(*args, **kwargs)
            logger.debug(f"戻り値: {func.__name__} -> {result}")
            return result
        except Exception as e:
            logger.error(f"例外発生: {func.__name__}: {e}")
            logger.error(traceback.format_exc())
            raise
    return wrapper
 
@debug_decorator
def process_data(items):
    """データ処理（デバッグ対象）"""
    if not items:
        raise ValueError("空のデータ")
    return [item * 2 for item in items]

# 設計判断の記録テンプレート
class ArchitectureDecisionRecord:
    """ADR (Architecture Decision Record) の作成"""
 
    def __init__(self, title: str):
        self.title = title
        self.context = ""
        self.decision = ""
        self.consequences = []
        self.alternatives = []
 
    def set_context(self, context: str):
        """背景と課題の記述"""
        self.context = context
        return self
 
    def set_decision(self, decision: str):
        """決定内容の記述"""
        self.decision = decision
        return self
 
    def add_consequence(self, consequence: str, positive: bool = True):
        """結果の追加"""
        self.consequences.append({
            'description': consequence,
            'type': 'positive' if positive else 'negative'
        })
        return self
 
    def add_alternative(self, name: str, reason_rejected: str):
        """却下した代替案の追加"""
        self.alternatives.append({
            'name': name,
            'reason_rejected': reason_rejected
        })
        return self
 
    def to_markdown(self) -> str:
        """Markdown形式で出力"""
        md = f"# ADR: {self.title}\n\n"
        md += f"## 背景\n{self.context}\n\n"
        md += f"## 決定\n{self.decision}\n\n"
        md += "## 結果\n"
        for c in self.consequences:
            icon = "✅" if c['type'] == 'positive' else "⚠️"
            md += f"- {icon} {c['description']}\n"
        md += "\n## 却下した代替案\n"
        for a in self.alternatives:
            md += f"- **{a['name']}**: {a['reason_rejected']}\n"
        return md

# チーム間のAPI契約定義
from dataclasses import dataclass
from typing import List, Optional
from enum import Enum
 
class Priority(Enum):
    LOW = "low"
    MEDIUM = "medium"
    HIGH = "high"
    CRITICAL = "critical"
 
@dataclass
class APIContract:
    """チーム間のAPI契約"""
    endpoint: str
    method: str
    owner_team: str
    consumers: List[str]
    sla_ms: int  # レスポンスタイムSLA
    priority: Priority
 
    def validate_sla(self, actual_ms: int) -> bool:
        """SLA準拠の確認"""
        return actual_ms <= self.sla_ms
 
    def to_openapi(self) -> dict:
        """OpenAPI形式で出力"""
        return {
            'path': self.endpoint,
            'method': self.method,
            'x-owner': self.owner_team,
            'x-consumers': self.consumers,
            'x-sla-ms': self.sla_ms
        }
 
# 使用例
contracts = [
    APIContract(
        endpoint="/api/v1/users",
        method="GET",
        owner_team="user-team",
        consumers=["order-team", "notification-team"],
        sla_ms=200,
        priority=Priority.HIGH
    ),
    APIContract(
        endpoint="/api/v1/orders",
        method="POST",
        owner_team="order-team",
        consumers=["payment-team", "inventory-team"],
        sla_ms=500,
        priority=Priority.CRITICAL
    )
]

# セキュアコーディング例
import hashlib
import secrets
import hmac
from typing import Optional
 
class SecurityUtils:
    """セキュリティユーティリティ"""
 
    @staticmethod
    def generate_token(length: int = 32) -> str:
        """暗号学的に安全なトークン生成"""
        return secrets.token_urlsafe(length)
 
    @staticmethod
    def hash_password(password: str, salt: Optional[str] = None) -> tuple:
        """パスワードのハッシュ化"""
        if salt is None:
            salt = secrets.token_hex(16)
        hashed = hashlib.pbkdf2_hmac(
            'sha256',
            password.encode('utf-8'),
            salt.encode('utf-8'),
            iterations=100000
        )
        return hashed.hex(), salt
 
    @staticmethod
    def verify_password(password: str, hashed: str, salt: str) -> bool:
        """パスワードの検証"""
        new_hash, _ = SecurityUtils.hash_password(password, salt)
        return hmac.compare_digest(new_hash, hashed)
 
    @staticmethod
    def sanitize_input(value: str) -> str:
        """入力値のサニタイズ"""
        dangerous_chars = ['<', '>', '"', "'", '&', '\\']
        result = value
        for char in dangerous_chars:
            result = result.replace(char, '')
        return result.strip()
 
# 使用例
token = SecurityUtils.generate_token()
hashed, salt = SecurityUtils.hash_password("my_password")
is_valid = SecurityUtils.verify_password("my_password", hashed, salt)

# マイグレーションスクリプトのテンプレート
import json
import logging
from pathlib import Path
from datetime import datetime
from typing import List, Dict, Callable
 
logger = logging.getLogger(__name__)
 
class MigrationRunner:
    """段階的マイグレーション実行エンジン"""
 
    def __init__(self, migration_dir: str):
        self.migration_dir = Path(migration_dir)
        self.migrations: List[Dict] = []
        self.completed: List[str] = []
 
    def register(self, version: str, description: str,
                 up: Callable, down: Callable):
        """マイグレーションの登録"""
        self.migrations.append({
            'version': version,
            'description': description,
            'up': up,
            'down': down,
            'registered_at': datetime.now().isoformat()
        })
 
    def run_up(self, target_version: str = None):
        """マイグレーションの実行（アップグレード）"""
        for migration in self.migrations:
            if migration['version'] in self.completed:
                continue
            logger.info(f"実行中: {migration['version']} - "
                       f"{migration['description']}")
            try:
                migration['up']()
                self.completed.append(migration['version'])
                logger.info(f"完了: {migration['version']}")
            except Exception as e:
                logger.error(f"失敗: {migration['version']}: {e}")
                raise
            if target_version and migration['version'] == target_version:
                break
 
    def run_down(self, target_version: str):
        """マイグレーションのロールバック"""
        for migration in reversed(self.migrations):
            if migration['version'] not in self.completed:
                continue
            if migration['version'] == target_version:
                break
            logger.info(f"ロールバック: {migration['version']}")
            migration['down']()
            self.completed.remove(migration['version'])
 
    def status(self) -> Dict:
        """マイグレーション状態の確認"""
        return {
            'total': len(self.migrations),
            'completed': len(self.completed),
            'pending': len(self.migrations) - len(self.completed),
            'versions': {
                m['version']: 'completed'
                if m['version'] in self.completed else 'pending'
                for m in self.migrations
            }
        }