|
| 1 | +build_rules: |
| 2 | + - id: "No critical or high SAST findings" |
| 3 | + finding_types: |
| 4 | + - vuln |
| 5 | + cvss_31_severity_ratings: |
| 6 | + - critical |
| 7 | + - high |
| 8 | + threshold: 0 |
| 9 | + - id: "Allow 0 secrets" |
| 10 | + finding_types: |
| 11 | + - secret |
| 12 | + threshold: 0 |
| 13 | + options: |
| 14 | + num_findings: 10 # Return 10 sast findings |
| 15 | + - id: "No reachable SCA findings" |
| 16 | + finding_types: |
| 17 | + - oss_vuln |
| 18 | + cvss_31_severity_ratings: |
| 19 | + - critical |
| 20 | + - high |
| 21 | + threshold: 0 |
| 22 | + options: |
| 23 | + reachable: true |
| 24 | + num_findings: 10 # Return 10 reachable sca findings |
| 25 | + - id: "No critical or high container findings" |
| 26 | + finding_types: |
| 27 | + - container |
| 28 | + cvss_31_severity_ratings: |
| 29 | + - critical |
| 30 | + - high |
| 31 | + threshold: 0 |
| 32 | + options: |
| 33 | + num_findings: 10 # Return 10 container findings |
| 34 | +# The above rule is perhaps the most common in that it |
| 35 | +# is designed to be used with Pull Request and to block |
| 36 | +# new vulns from being introduced that aren't already on |
| 37 | +# the 'main' branch |
| 38 | +# |
| 39 | +# Below is enchalada with all the options shown |
| 40 | +# |
| 41 | +# ID is the name that will be reflected in the PR comments |
| 42 | +# - id: build-rule-enchalada |
| 43 | +# - vuln |
| 44 | +#. - oss_vuln |
| 45 | +# - secret |
| 46 | +# - insight |
| 47 | +# - container |
| 48 | +# Do you want to block ALL types by severity? |
| 49 | +# cvss_31_severity_ratings: |
| 50 | +# - critical |
| 51 | +# - high |
| 52 | +# - medium |
| 53 | +#. - low |
| 54 | +# Do you want to focus on just one or more types? |
| 55 | +# type: |
| 56 | +# - Weak Random |
| 57 | +# - Sensitive Data Leak |
| 58 | +# - Deserialization |
| 59 | +# - Directory Traversal |
| 60 | +# - Sensitive Data Exposure |
| 61 | +# - Remote Code Execution |
| 62 | +# - Command Injection |
| 63 | +# - Security Best Practices |
| 64 | +# - Unsafe Reflection |
| 65 | +# - Regex Injection |
| 66 | +# - SQL Injection |
| 67 | +# - XML External Entities |
| 68 | +# - Template Injection |
| 69 | +# - Cross-Site Scripting |
| 70 | +# - JSON Injection |
| 71 | +# - Potential SQL Injection |
| 72 | +# - Potential Regex Injection |
| 73 | +# - Header Injection |
| 74 | +# - Security Misconfiguration |
| 75 | +# - Deprecated Function Use |
| 76 | +# - Mail Injection |
| 77 | +# - Race Condition |
| 78 | +# - Sensitive Data Usage |
| 79 | +# - Open Redirect |
| 80 | +# - Error Handling |
| 81 | +# - HTTP to Database |
| 82 | +# - HTTP to Model |
| 83 | +# - LDAP Injection |
| 84 | +# - Denial of Service |
| 85 | +# - CRLF Injection |
| 86 | +# - NoSQL Injection |
| 87 | +# - Weak Hash |
| 88 | +# - Session Injection |
| 89 | +# - Server-Side Request Forgery |
| 90 | +# - Prototype Pollution |
| 91 | +# - Log Forging |
| 92 | +# - XPath Injection |
| 93 | +# - Insecure Authentication |
| 94 | +# - Intent Redirection |
| 95 | +# - Authentication Bypass |
| 96 | +# - Weak Cipher |
| 97 | +# - Crypto |
| 98 | +# Focus by OWASP Category? |
| 99 | +# owasp_category: |
| 100 | +# - a01-2021-broken-access-control |
| 101 | +# - a02-2021-cryptographic-failures |
| 102 | +# - a03-2021-injection |
| 103 | +# - a04-2021-insecure-design |
| 104 | +# - a05-2021-security-misconfiguration |
| 105 | +# - a06-2021-vulnerable-and-outdated-components |
| 106 | +# - a07-2021-identification-and-authentication-failures |
| 107 | +# - a08-2021-software-and-data-integrity-failures |
| 108 | +# - a09-2021-security-logging-and-monitoring-failures |
| 109 | +# - a10-2021-server-side-request-forgery-(ssrf) |
| 110 | + |
0 commit comments