# Taint Analysis の例
def handler(request):
    user_input = request.GET.get('query')   # Source: ユーザー入力
    #                    |
    #              データが流れる
    #                    |
    #                    v
    result = db.execute(                     # Sink: SQL 実行
        f"SELECT * FROM users WHERE name = '{user_input}'"  # 脆弱性検出!
    )
    return result
 
# サニタイズされている場合は安全と判定
def safe_handler(request):
    user_input = request.GET.get('query')   # Source: ユーザー入力
    #                    |
    #            サニタイズ処理
    #                    |
    #                    v
    sanitized = escape(user_input)           # Sanitizer
    result = db.execute(                     # Sink: SQL 実行
        "SELECT * FROM users WHERE name = %s", [sanitized]   # 安全と判定
    )
    return result

# sonar-project.properties
sonar.projectKey=myapp
sonar.projectName=My Application
sonar.projectVersion=1.0
sonar.sources=src
sonar.tests=tests
sonar.language=js
sonar.javascript.lcov.reportPaths=coverage/lcov.info
 
# セキュリティルールの重点設定
sonar.issue.ignore.multicriteria=e1
sonar.issue.ignore.multicriteria.e1.ruleKey=javascript:S1234
sonar.issue.ignore.multicriteria.e1.resourceKey=**/test/**
 
# エンコーディング設定
sonar.sourceEncoding=UTF-8
 
# 除外パターン
sonar.exclusions=**/node_modules/**,**/vendor/**,**/dist/**
sonar.test.exclusions=**/test/**,**/*.test.js

// SonarQube Quality Gate 設定例 (API 経由)
// POST /api/qualitygates/create
{
  "name": "Security-Focused Gate",
  "conditions": [
    {
      "metric": "new_security_hotspots_reviewed",
      "op": "LT",
      "error": "100"
    },
    {
      "metric": "new_vulnerabilities",
      "op": "GT",
      "error": "0"
    },
    {
      "metric": "new_security_rating",
      "op": "GT",
      "error": "1"
    },
    {
      "metric": "new_coverage",
      "op": "LT",
      "error": "80"
    }
  ]
}

# GitHub Actions での SonarQube 統合
name: Code Quality
on: [push, pull_request]
 
jobs:
  sonarqube:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # 差分解析に必要
 
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
 
      - name: Install dependencies
        run: npm ci
 
      - name: Run tests with coverage
        run: npm test -- --coverage
 
      - name: SonarQube Scan
        uses: sonarsource/sonarqube-scan-action@master
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
 
      - name: Quality Gate Check
        uses: sonarsource/sonarqube-quality-gate-action@master
        timeout-minutes: 5
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
 
      - name: Post results to PR
        if: github.event_name == 'pull_request' && failure()
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: 'SonarQube Quality Gate failed. Please check the SonarQube dashboard for details.'
            })

# .semgrep.yml - カスタムルール
rules:
  - id: hardcoded-secret
    patterns:
      - pattern: |
          $KEY = "..."
      - metavariable-regex:
          metavariable: $KEY
          regex: '(?i)(password|secret|api_key|token)'
    message: "ハードコードされたシークレットが検出されました"
    severity: ERROR
    languages: [python, javascript, go]
    metadata:
      cwe: "CWE-798: Use of Hard-coded Credentials"
      owasp: "A07:2021 - Identification and Authentication Failures"
 
  - id: sql-injection
    patterns:
      - pattern: |
          cursor.execute(f"... {$VAR} ...")
    message: "SQL インジェクションの可能性: パラメータ化クエリを使用してください"
    severity: ERROR
    languages: [python]
    metadata:
      cwe: "CWE-89: SQL Injection"
      owasp: "A03:2021 - Injection"
    fix: |
      cursor.execute("... %s ...", ($VAR,))
 
  - id: unsafe-deserialization
    pattern: pickle.loads(...)
    message: "安全でないデシリアライゼーション: 信頼できないデータに pickle を使用しないでください"
    severity: WARNING
    languages: [python]
    metadata:
      cwe: "CWE-502: Deserialization of Untrusted Data"
 
  - id: open-redirect
    patterns:
      - pattern: redirect($URL)
      - pattern-not: redirect("/...")
    message: "オープンリダイレクトの可能性: 外部 URL へのリダイレクトを検証してください"
    severity: WARNING
    languages: [python]
 
  - id: missing-csrf-protection
    patterns:
      - pattern: |
          @app.route("...", methods=["POST"])
          def $FUNC(...):
              ...
      - pattern-not-inside: |
          @csrf_protect
          ...
    message: "POST エンドポイントに CSRF 保護がありません"
    severity: WARNING
    languages: [python]
 
  - id: insecure-random
    patterns:
      - pattern-either:
          - pattern: random.random()
          - pattern: random.randint(...)
          - pattern: Math.random()
    message: "セキュリティ目的には暗号学的に安全な乱数生成器を使用してください"
    severity: WARNING
    languages: [python, javascript]
    fix-regex:
      regex: "random\\.random\\(\\)"
      replacement: "secrets.token_hex(32)"

# 高度なパターンマッチングの例
rules:
  # taint モード: source から sink への汚染追跡
  - id: tainted-sql-query
    mode: taint
    pattern-sources:
      - pattern: request.args.get(...)
      - pattern: request.form.get(...)
      - pattern: request.json[...]
    pattern-sinks:
      - pattern: db.execute($QUERY, ...)
      - pattern: cursor.execute($QUERY, ...)
    pattern-sanitizers:
      - pattern: sanitize(...)
      - pattern: escape(...)
    message: "ユーザー入力が SQL クエリに直接使用されています"
    severity: ERROR
    languages: [python]
 
  # join モード: 複数条件の組み合わせ
  - id: jwt-without-verification
    patterns:
      - pattern: jwt.decode($TOKEN, ...)
      - pattern-not: jwt.decode($TOKEN, ..., verify=True, ...)
      - pattern-not: jwt.decode($TOKEN, ..., algorithms=[...], ...)
    message: "JWT の署名検証が無効になっている可能性があります"
    severity: ERROR
    languages: [python]

# Semgrep の基本実行
semgrep --config auto .                    # 自動ルール選択
semgrep --config .semgrep.yml .            # カスタムルール
semgrep --config p/owasp-top-ten .         # OWASP Top 10 ルール
semgrep --config p/javascript .            # JavaScript 専用ルール
semgrep --config p/python .               # Python 専用ルール
semgrep --config p/golang .               # Go 専用ルール
 
# 出力形式の指定
semgrep --config auto --json -o results.json .     # JSON 形式
semgrep --config auto --sarif -o results.sarif .   # SARIF 形式 (GitHub連携用)
semgrep --config auto --emacs .                    # Emacs 形式
 
# CI/CD ゲート (エラーがあればビルド失敗)
semgrep --config auto --error .
 
# 特定ファイルのみスキャン
semgrep --config auto --include="*.py" .
semgrep --config auto --exclude="tests/*" .
 
# 差分のみスキャン (高速化)
semgrep --config auto --baseline-commit HEAD~1 .
 
# Semgrep CI (Semgrep App 連携)
SEMGREP_APP_TOKEN=xxx semgrep ci

// CodeQL クエリ例: SQL インジェクションの検出
import javascript
import DataFlow::PathGraph
 
class SqlInjectionConfig extends TaintTracking::Configuration {
  SqlInjectionConfig() { this = "SqlInjectionConfig" }
 
  override predicate isSource(DataFlow::Node source) {
    exists(Express::RequestExpr req |
      source.asExpr() = req.getAPropertyRead("query").getAPropertyRead(_)
    )
  }
 
  override predicate isSink(DataFlow::Node sink) {
    exists(DatabaseAccess db |
      sink.asExpr() = db.getAQueryArgument()
    )
  }
}
 
from SqlInjectionConfig cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasFlowPath(source, sink)
select sink, source, sink,
  "この SQL クエリは $@ から来たユーザー入力を含んでいます。",
  source.getNode(), "ユーザー入力"

# GitHub Actions での CodeQL 統合
name: CodeQL Analysis
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1'  # 毎週月曜 6:00 UTC
 
jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    strategy:
      matrix:
        language: [javascript, python]
    steps:
      - uses: actions/checkout@v4
 
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          queries: +security-extended,security-and-quality
 
      - name: Autobuild
        uses: github/codeql-action/autobuild@v3
 
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:${{ matrix.language }}"

# Bandit のインストールと実行
pip install bandit
 
# 基本実行
bandit -r ./src/
 
# 重大度でフィルタ
bandit -r ./src/ -ll  # Medium 以上のみ
 
# 特定テストのみ実行
bandit -r ./src/ -t B601,B602,B603  # シェルインジェクション系
 
# JSON 出力
bandit -r ./src/ -f json -o bandit-results.json
 
# 除外設定
bandit -r ./src/ --exclude tests/,docs/

# .bandit - Bandit 設定ファイル
[bandit]
exclude = tests,docs,venv
tests = B101,B102,B103,B104,B105,B106,B107,B108,B110
# B301-B303: pickle 関連
# B601-B603: シェルインジェクション
# B608: SQL インジェクション
 
skips = B101  # assert の使用 (テストでは必要)
 
[bandit.plugins.hardcoded_password_string]
word_list = password,pass,passwd,pwd,secret,token,api_key,apikey

# Bandit が検出する典型的な脆弱性
 
# B602: subprocess with shell=True (高リスク)
import subprocess
user_input = input("Command: ")
subprocess.call(user_input, shell=True)  # 検出!
 
# B608: SQL injection
query = "SELECT * FROM users WHERE id = '%s'" % user_id  # 検出!
 
# B105: Hardcoded password
password = "super_secret_123"  # 検出!
 
# B301: Pickle usage
import pickle
data = pickle.loads(untrusted_data)  # 検出!
 
# B104: Binding to all interfaces
from flask import Flask
app = Flask(__name__)
app.run(host='0.0.0.0')  # 検出!

<!-- ZAP スキャンポリシー設定例 -->
<configuration>
  <scanner>
    <!-- SQL Injection テスト -->
    <plugin id="40018" enabled="true" strength="HIGH" threshold="MEDIUM"/>
    <!-- XSS テスト -->
    <plugin id="40012" enabled="true" strength="HIGH" threshold="LOW"/>
    <!-- Path Traversal テスト -->
    <plugin id="6" enabled="true" strength="MEDIUM" threshold="MEDIUM"/>
    <!-- Remote Code Execution -->
    <plugin id="40014" enabled="true" strength="HIGH" threshold="HIGH"/>
    <!-- CSRF テスト -->
    <plugin id="40003" enabled="true" strength="MEDIUM" threshold="LOW"/>
  </scanner>
  <spider>
    <maxDuration>10</maxDuration>
    <maxDepth>5</maxDepth>
    <threadCount>5</threadCount>
  </spider>
</configuration>

from zapv2 import ZAPv2
import time
 
zap = ZAPv2(apikey='your-api-key', proxies={
    'http': 'http://localhost:8080',
    'https': 'http://localhost:8080',
})
 
target = 'https://staging.example.com'
 
# 認証設定
context_id = zap.context.new_context('authenticated-context')
 
# ログインページの URL パターンを含める
zap.context.include_in_context(context_id, f'{target}.*')
 
# フォームベース認証の設定
auth_method_config = (
    f'loginUrl={target}/login&'
    f'loginRequestData=username={{%username%}}&password={{%password%}}'
)
zap.authentication.set_authentication_method(
    context_id, 'formBasedAuthentication', auth_method_config
)
 
# ログイン状態の検証パターン
zap.authentication.set_logged_in_indicator(context_id, '\\QWelcome\\E')
zap.authentication.set_logged_out_indicator(context_id, '\\QLogin\\E')
 
# ユーザーの追加
user_id = zap.users.new_user(context_id, 'test-user')
zap.users.set_authentication_credentials(
    context_id, user_id,
    f'username=testuser&password=TestPass123!'
)
zap.users.set_user_enabled(context_id, user_id, True)
 
# 認証済みスキャンの実行
zap.forcedUser.set_forced_user(context_id, user_id)
zap.forcedUser.set_forced_user_mode_enabled(True)

from zapv2 import ZAPv2
import time
import json
import sys
 
# ZAP に接続
zap = ZAPv2(apikey='your-api-key', proxies={
    'http': 'http://localhost:8080',
    'https': 'http://localhost:8080',
})
 
target = 'https://staging.example.com'
 
def run_zap_scan(target_url, scan_type='full'):
    """ZAP による自動セキュリティスキャン
 
    Args:
        target_url: スキャン対象の URL
        scan_type: 'baseline' (パッシブのみ) または 'full' (アクティブ含む)
 
    Returns:
        tuple: (high_alerts, medium_alerts, low_alerts)
    """
 
    print(f"[*] Target: {target_url}")
    print(f"[*] Scan type: {scan_type}")
 
    # Step 1: Spider (クロール)
    print("[*] Phase 1: Spidering target...")
    scan_id = zap.spider.scan(target_url)
    while int(zap.spider.status(scan_id)) < 100:
        progress = zap.spider.status(scan_id)
        print(f"    Spider progress: {progress}%")
        time.sleep(2)
 
    urls_found = len(zap.spider.results(scan_id))
    print(f"[+] Spider found {urls_found} URLs")
 
    # Ajax Spider (SPA 対応)
    print("[*] Phase 1.5: Ajax Spidering...")
    zap.ajaxSpider.scan(target_url)
    timeout = 120  # 2分のタイムアウト
    while zap.ajaxSpider.status == 'running' and timeout > 0:
        time.sleep(5)
        timeout -= 5
    zap.ajaxSpider.stop()
    print(f"[+] Ajax Spider found additional URLs")
 
    # Step 2: Passive Scan の完了を待つ
    print("[*] Phase 2: Waiting for passive scan...")
    while int(zap.pscan.records_to_scan) > 0:
        remaining = zap.pscan.records_to_scan
        print(f"    Records remaining: {remaining}")
        time.sleep(1)
    print("[+] Passive scan completed")
 
    # Step 3: Active Scan (baseline でなければ)
    if scan_type == 'full':
        print("[*] Phase 3: Active scanning...")
        scan_id = zap.ascan.scan(target_url)
        while int(zap.ascan.status(scan_id)) < 100:
            progress = zap.ascan.status(scan_id)
            print(f"    Active scan progress: {progress}%")
            time.sleep(5)
        print("[+] Active scan completed")
    else:
        print("[*] Phase 3: Skipped (baseline scan)")
 
    # Step 4: 結果を取得・分類
    alerts = zap.core.alerts(baseurl=target_url)
    high_alerts = [a for a in alerts if a['risk'] == 'High']
    medium_alerts = [a for a in alerts if a['risk'] == 'Medium']
    low_alerts = [a for a in alerts if a['risk'] == 'Low']
    info_alerts = [a for a in alerts if a['risk'] == 'Informational']
 
    print(f"\n[=] Results Summary:")
    print(f"    High:          {len(high_alerts)}")
    print(f"    Medium:        {len(medium_alerts)}")
    print(f"    Low:           {len(low_alerts)}")
    print(f"    Informational: {len(info_alerts)}")
 
    # 重複除去した脆弱性タイプの一覧
    unique_alerts = set()
    for alert in high_alerts + medium_alerts:
        unique_alerts.add(f"[{alert['risk']}] {alert['alert']}")
    if unique_alerts:
        print(f"\n[!] Unique vulnerability types found:")
        for ua in sorted(unique_alerts):
            print(f"    - {ua}")
 
    # HTML レポート出力
    with open('zap-report.html', 'w') as f:
        f.write(zap.core.htmlreport())
    print(f"\n[+] HTML report saved to zap-report.html")
 
    # JSON レポート出力
    with open('zap-report.json', 'w') as f:
        json.dump(alerts, f, indent=2)
    print(f"[+] JSON report saved to zap-report.json")
 
    return high_alerts, medium_alerts, low_alerts
 
# 実行
high, medium, low = run_zap_scan(target, scan_type='full')
 
# CI/CD ゲート判定
if high:
    print("\n[FAIL] CRITICAL: High-risk vulnerabilities found!")
    for alert in high:
        print(f"  - {alert['alert']}: {alert['url']}")
    sys.exit(1)
elif medium:
    print("\n[WARN] Medium-risk vulnerabilities found (not blocking)")
    sys.exit(0)
else:
    print("\n[PASS] No high/medium-risk vulnerabilities found")
    sys.exit(0)

# GitHub Actions での ZAP スキャン
name: DAST Scan
on:
  deployment_status:
 
jobs:
  zap-baseline:
    if: github.event.deployment_status.state == 'success'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: ZAP Baseline Scan
        uses: zaproxy/action-baseline@v0.12.0
        with:
          target: ${{ github.event.deployment.payload.url }}
          rules_file_name: '.zap/rules.tsv'
          cmd_options: '-a'
          issue_title: 'ZAP Baseline Scan Report'
          fail_action: true
 
      - name: Upload ZAP Report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: zap-baseline-report
          path: report_html.html
 
  zap-full:
    needs: zap-baseline
    if: contains(github.event.deployment.environment, 'staging')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: ZAP Full Scan
        uses: zaproxy/action-full-scan@v0.10.0
        with:
          target: ${{ github.event.deployment.payload.url }}
          rules_file_name: '.zap/rules.tsv'
          cmd_options: '-a -j'
 
      - name: Upload Full Scan Report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: zap-full-report
          path: report_html.html

# .zap/rules.tsv
# ルールID	動作	説明
10010	IGNORE	Cookie No HttpOnly Flag (低リスク、他で対応)
10011	IGNORE	Cookie Without Secure Flag (開発環境のため)
10015	WARN	Incomplete or No Cache-control Header Set
10017	FAIL	Cross-Domain JavaScript Source File Inclusion
10020	FAIL	X-Frame-Options Header Not Set
10021	FAIL	X-Content-Type-Options Header Missing
10038	FAIL	Content Security Policy (CSP) Header Not Set
40012	FAIL	Cross Site Scripting (Reflected)
40014	FAIL	Cross Site Scripting (Persistent)
40018	FAIL	SQL Injection
90022	FAIL	Application Error Disclosure

# nuclei テンプレート例: カスタム脆弱性チェック
id: custom-admin-panel-check
info:
  name: Admin Panel Detection
  author: security-team
  severity: medium
  description: 公開されている管理画面の検出
  tags: admin,panel,exposure
 
requests:
  - method: GET
    path:
      - "{{BaseURL}}/admin"
      - "{{BaseURL}}/admin/login"
      - "{{BaseURL}}/wp-admin"
      - "{{BaseURL}}/administrator"
      - "{{BaseURL}}/manage"
    matchers-condition: or
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "admin"
          - "login"
          - "dashboard"
        condition: or

# Nuclei の実行
nuclei -u https://staging.example.com -t nuclei-templates/    # テンプレート指定
nuclei -u https://staging.example.com -tags cve               # CVE テンプレート
nuclei -u https://staging.example.com -severity critical,high  # 重大度フィルタ
nuclei -l urls.txt -t nuclei-templates/ -o results.json -json  # バッチ実行

// Java アプリケーションへの IAST エージェント導入
// JVM 起動オプションに追加
// java -javaagent:/path/to/contrast.jar -jar myapp.jar
 
// もしくは Dockerfile で設定
// FROM eclipse-temurin:21-jre
// COPY contrast.jar /opt/contrast/
// ENV JAVA_TOOL_OPTIONS="-javaagent:/opt/contrast/contrast.jar"
// COPY myapp.jar /app/
// CMD ["java", "-jar", "/app/myapp.jar"]

# contrast_security.yaml - IAST エージェント設定
api:
  url: https://app.contrastsecurity.com/Contrast
  api_key: ${CONTRAST_API_KEY}
  service_key: ${CONTRAST_SERVICE_KEY}
 
agent:
  java:
    enable_assess: true        # IAST 機能有効化
    enable_protect: false      # RASP 機能 (本番用)
    assess:
      enable_sampling: true
      sampling_window: 180
      sampling_request_frequency: 5
    rules:
      disabled_rules:
        - cookie-flags-missing  # テスト環境では無視

# .github/workflows/security-pipeline.yml
name: Security Pipeline
on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
 
env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
 
jobs:
  # ====================================
  # Stage 1: 静的解析 (並列実行)
  # ====================================
  sast-semgrep:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Semgrep Scan
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/owasp-top-ten
            p/r2c-security-audit
            .semgrep.yml
          generateSarif: true
 
      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep.sarif
 
  sast-sonarqube:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
 
      - name: SonarQube Scan
        uses: sonarsource/sonarqube-scan-action@master
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
 
      - name: Quality Gate
        uses: sonarsource/sonarqube-quality-gate-action@master
        timeout-minutes: 5
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
 
  # ====================================
  # Stage 1b: SCA + シークレットスキャン (並列)
  # ====================================
  sca:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Trivy filesystem scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          severity: 'HIGH,CRITICAL'
          exit-code: '1'
          format: 'sarif'
          output: 'trivy-fs-results.sarif'
 
      - name: Upload Trivy SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-fs-results.sarif
 
  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # 全履歴をスキャン
 
      - name: Gitleaks scan
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
  # ====================================
  # Stage 2: コンテナスキャン
  # ====================================
  container-scan:
    needs: [sast-semgrep, sast-sonarqube, sca, secret-scan]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Build container image
        run: docker build -t ${{ env.IMAGE_NAME }}:${{ github.sha }} .
 
      - name: Trivy image scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: '${{ env.IMAGE_NAME }}:${{ github.sha }}'
          severity: 'CRITICAL'
          exit-code: '1'
          format: 'sarif'
          output: 'trivy-image-results.sarif'
 
      - name: Upload Trivy Image SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-image-results.sarif
 
  # ====================================
  # Stage 3: DAST (ステージング環境)
  # ====================================
  dast:
    needs: container-scan
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Deploy to staging
        id: deploy
        run: |
          # ステージング環境へデプロイ
          echo "staging_url=https://staging.example.com" >> $GITHUB_OUTPUT
 
      - name: Wait for deployment
        run: |
          for i in $(seq 1 30); do
            if curl -sf "${{ steps.deploy.outputs.staging_url }}/health"; then
              echo "Deployment is healthy"
              exit 0
            fi
            sleep 10
          done
          echo "Deployment health check failed"
          exit 1
 
      - name: ZAP Baseline Scan
        uses: zaproxy/action-baseline@v0.12.0
        with:
          target: ${{ steps.deploy.outputs.staging_url }}
          rules_file_name: '.zap/rules.tsv'
          cmd_options: '-a'
          fail_action: true
 
      - name: ZAP Full Scan (週次)
        if: github.event.schedule != ''
        uses: zaproxy/action-full-scan@v0.10.0
        with:
          target: ${{ steps.deploy.outputs.staging_url }}
 
  # ====================================
  # Stage 4: セキュリティレポート集約
  # ====================================
  security-summary:
    needs: [sast-semgrep, sast-sonarqube, sca, secret-scan, container-scan]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Security Summary
        run: |
          echo "## Security Scan Summary" >> $GITHUB_STEP_SUMMARY
          echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| SAST (Semgrep) | ${{ needs.sast-semgrep.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| SAST (SonarQube) | ${{ needs.sast-sonarqube.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| SCA (Trivy) | ${{ needs.sca.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Secrets (Gitleaks) | ${{ needs.secret-scan.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Container Scan | ${{ needs.container-scan.result }} |" >> $GITHUB_STEP_SUMMARY

# .pre-commit-config.yaml
repos:
  # Semgrep (SAST)
  - repo: https://github.com/returntocorp/semgrep
    rev: v1.50.0
    hooks:
      - id: semgrep
        args: ['--config', 'auto', '--error']
 
  # Gitleaks (シークレットスキャン)
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks
 
  # Bandit (Python SAST)
  - repo: https://github.com/PyCQA/bandit
    rev: 1.7.7
    hooks:
      - id: bandit
        args: ['-ll', '-ii']
 
  # ESLint Security (JavaScript SAST)
  - repo: https://github.com/pre-commit/mirrors-eslint
    rev: v8.56.0
    hooks:
      - id: eslint
        additional_dependencies:
          - eslint-plugin-security@2.1.0
 
  # Hadolint (Dockerfile lint)
  - repo: https://github.com/hadolint/hadolint
    rev: v2.12.0
    hooks:
      - id: hadolint

# pre-commit のセットアップ
pip install pre-commit
pre-commit install
pre-commit install --hook-type commit-msg
 
# 全ファイルに対して実行 (初回)
pre-commit run --all-files
 
# 特定のフックのみ実行
pre-commit run semgrep --all-files
pre-commit run gitleaks --all-files

# gitleaks のインストールと実行
# macOS
brew install gitleaks
 
# 現在のリポジトリをスキャン
gitleaks detect --source . --report-format json --report-path gitleaks-report.json
 
# Git 履歴全体をスキャン
gitleaks detect --source . --report-format json --report-path gitleaks-report.json --log-opts="--all"
 
# 特定のコミット範囲のみスキャン
gitleaks detect --source . --log-opts="HEAD~10..HEAD"
 
# 差分のみスキャン (CI/CD 用、高速)
gitleaks protect --staged  # ステージングされたファイルのみ

# .gitleaks.toml - カスタムルール設定
title = "Custom Gitleaks Configuration"
 
[allowlist]
description = "Global allowlist"
paths = [
    '''test/.*''',
    '''.*_test\.go''',
    '''.*\.test\.js''',
    '''fixtures/.*''',
    '''__mocks__/.*''',
]
regexTarget = "match"
 
# AWS Access Key
id = "aws-access-key"
description = "AWS Access Key ID"
regex = '''AKIA[0-9A-Z]{16}'''
tags = ["aws", "credentials"]
entropy = 3.5
 
# AWS Secret Key
id = "aws-secret-key"
description = "AWS Secret Access Key"
regex = '''(?i)aws_secret_access_key\s*[:=]\s*['"]?([A-Za-z0-9/+=]{40})['"]?'''
tags = ["aws", "credentials"]
 
# Generic API Key
id = "generic-api-key"
description = "Generic API Key"
regex = '''(?i)(api[_-]?key|apikey)\s*[:=]\s*['"][a-zA-Z0-9]{20,}['"]'''
tags = ["api", "generic"]
 
# GitHub Token
id = "github-token"
description = "GitHub Personal Access Token"
regex = '''ghp_[a-zA-Z0-9]{36}'''
tags = ["github", "token"]
 
# Slack Webhook
id = "slack-webhook"
description = "Slack Webhook URL"
regex = '''https://hooks\.slack\.com/services/T[a-zA-Z0-9]{8}/B[a-zA-Z0-9]{8}/[a-zA-Z0-9]{24}'''
tags = ["slack", "webhook"]
 
# Private Key
id = "private-key"
description = "Private Key"
regex = '''-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----'''
tags = ["key", "private"]
 
# JWT
id = "jwt-token"
description = "JSON Web Token"
regex = '''eyJ[A-Za-z0-9-_]+\.eyJ[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+'''
tags = ["jwt", "token"]
 
# ルール固有の allowlist
id = "generic-password"
description = "Generic Password"
regex = '''(?i)(password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]'''
tags = ["password"]
[rules.allowlist]
regexes = [
    '''(?i)password\s*[:=]\s*'"['"]''',
]

# BFG Repo-Cleaner によるシークレット削除
# ※ 最終手段として使用。チーム全員に影響する
 
# 1. ベアクローンを作成
git clone --mirror https://github.com/user/repo.git
 
# 2. BFG でシークレットを含むファイルを削除
java -jar bfg.jar --replace-text passwords.txt repo.git
 
# 3. クリーンアップ
cd repo.git
git reflog expire --expire=now --all
git gc --prune=now --aggressive
 
# 4. プッシュ (force push が必要)
git push

# Semgrep の偽陽性抑制
 
# インラインでの抑制 (理由を必ず記載)
def get_system_info():
    # nosemgrep: hardcoded-secret  # システム定数、シークレットではない
    DEFAULT_REGION = "us-east-1"
    return DEFAULT_REGION
 
# ファイルレベルでの抑制 (.semgrepignore)
# .semgrepignore
tests/
fixtures/
**/testdata/**
vendor/

# SonarQube の偽陽性抑制
 
# インラインで抑制
String query = buildQuery(param); // NOSONAR - パラメータはバリデーション済み
 
# SonarQube UI でも抑制可能:
# Issues → Won't Fix / False Positive をマーク
# 理由をコメントとして記録

# vulnerable_app.py
from flask import Flask, request, render_template_string
import subprocess
import os
 
app = Flask(__name__)
 
@app.route('/search')
def search():
    query = request.args.get('q', '')
    # 脆弱性 1: テンプレートインジェクション
    return render_template_string(f'<h1>Results for: {query}</h1>')
 
@app.route('/ping')
def ping():
    host = request.args.get('host', '')
    # 脆弱性 2: コマンドインジェクション
    result = subprocess.run(f'ping -c 1 {host}', shell=True, capture_output=True)
    return result.stdout.decode()
 
@app.route('/file')
def read_file():
    filename = request.args.get('name', '')
    # 脆弱性 3: パストラバーサル
    filepath = os.path.join('/var/data', filename)
    with open(filepath) as f:
        return f.read()