From c24db3b8e1d523c48c739b7d1f35e7452363d764 Mon Sep 17 00:00:00 2001 From: William Zujkowski Date: Mon, 14 Jul 2025 12:43:55 -0400 Subject: [PATCH 1/3] fixed more filepaths --- ci/tasks/zap-scan.yml | 2 +- repomix-output.xml | 957 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 958 insertions(+), 1 deletion(-) create mode 100644 repomix-output.xml diff --git a/ci/tasks/zap-scan.yml b/ci/tasks/zap-scan.yml index 2c21e75..014350e 100644 --- a/ci/tasks/zap-scan.yml +++ b/ci/tasks/zap-scan.yml @@ -17,7 +17,7 @@ outputs: params: TARGET_CONTEXT: # one of internal, external, pages, unauthenticated - CREDHB_CRED: # JSON with all context credentials + CREDHB_CRED: ((repo_name))/ci/config.yml run: path: bash diff --git a/repomix-output.xml b/repomix-output.xml new file mode 100644 index 0000000..3ca7408 --- /dev/null +++ b/repomix-output.xml @@ -0,0 +1,957 @@ +This file is a merged representation of the entire codebase, combined into a single document by Repomix. +The content has been processed where content has been compressed (code blocks are separated by ⋮---- delimiter). + + +This section contains a summary of this file. + + +This file contains a packed representation of the entire repository's contents. +It is designed to be easily consumable by AI systems for analysis, code review, +or other automated processes. + + + +The content is organized as follows: +1. This summary section +2. Repository information +3. Directory structure +4. Repository files (if enabled) +5. Multiple file entries, each consisting of: + - File path as an attribute + - Full contents of the file + + + +- This file should be treated as read-only. Any changes should be made to the + original repository files, not this packed version. +- When processing this file, use the file path to distinguish + between different files in the repository. +- Be aware that this file may contain sensitive information. Handle it with + the same level of security as you would the original repository. + + + +- Some files may have been excluded based on .gitignore rules and Repomix's configuration +- Binary files are not included in this packed representation. Please refer to the Repository Structure section for a complete list of file paths, including binary files +- Files matching patterns in .gitignore are excluded +- Files matching default ignore patterns are excluded +- Content has been compressed - code blocks are separated by ⋮---- delimiter +- Files are sorted by Git change count (files with more changes are at the bottom) + + + + + +.github/ + ISSUE_TEMPLATE/ + change_request.md + issue.md + story.md + workflows/ + cg-logo.svg + security-considerations.properties.json + security-considerations.yml + pull_request_template.md + stale.yml +ci/ + tasks/ + zap-scan.yml + zap-config/ + urls.csv + zap.yaml + config.yml + pipeline.yml +.gitignore +CODEOWNERS +CONTRIBUTING.md +Dockerfile +LICENSE.md +README.md +SECURITY.md + + + +This section contains the contents of the repository's files. + + +--- +name: Change Request +about: Submit a change request for review and deployment. +title: "[Change Request] " +labels: change-request +assignees: "" +--- + +## Change Request Summary +Provide a concise summary of the change you are proposing. Include a brief title and description. + +**Example:** "Upgrade authentication library to v2.5.1 to address CVE-2023-XXXX." + +## Change Details +- **What is being changed?** + Describe the components or services affected. + +- **Why is this change needed?** + Explain the motivation (bug fix, security patch, new feature, etc.). + +- **Change Type:** + - [ ] Planned Change + - [ ] Emergency Change + +- **Priority:** + Indicate the appropriate priority level (P1, P2, P3, P4). + +## Impact Analysis +- **Affected Systems/Components:** + List all systems or components impacted by this change. + +- **Security Impact Analysis (SIA):** + - Describe potential security risks, vulnerabilities, or changes to controls. + - Has a SIA been performed? **Yes / No** + - Attach or link any supporting documentation. + +- **Privacy Impact Assessment (PIA):** + - Describe any potential privacy risks or impacts on data handling. + - Has a PIA been performed? **Yes / No** + - Attach or link any supporting documentation. + +## Rollback Plan +Outline your rollback plan if this change causes issues. Detail the steps to revert the change and restore service. + +## Approvals +This change requires review and sign-off by the following stakeholders: +- [ ] **Security Team** +- [ ] **Platform Operations** +- [ ] **Pages Operations** +- [ ] **System Owner** + +*(If auto-assignment did not occur, please manually tag the appropriate reviewers.)* + +## Additional Information +Provide any further details, related issue references, or links to documentation that may assist in the review process. + +--- + +*Please ensure all sections are completed before submitting this change request.* + + + +--- +name: Issue +about: Suggest a new issue for this project +title: "[short phrase distinguishing this from other Issues]" +labels: '' +assignees: '' + +--- +Short description explaining the high-level reason for the new issue. + +## Notes + +- Additional details, technical information, resource links, and implementation notes +- Excerpt and link to any relevant slack discussions + +## Acceptance Criteria + +- [ ] Determine next steps and acceptance criteria + + + +--- +name: Story +about: Suggest a new story for this project +title: "[short phrase distinguishing this from other Stories]" +labels: '' +assignees: '' + +--- + +In order to [reason/outcome/goal], [someone or "we"] want [a specific change in product implementation/behavior] + +## Acceptance Criteria +* [ ] GIVEN [a precondition] \ + AND [another precondition] + WHEN [test step] \ + AND [test step] \ + THEN [verification step] \ + AND [verification step] + +--- + +## Security considerations +[note any potential changes to security boundaries, practices, documentation, risk that arise directly from this story] + +## Implementation sketch +[links to background notes, sketches, and/or relevant documentation +* [ ] [first thing to do] +* [ ] [another thing to do] + + + + + + + + + + +{ + "name": "Security Considerations Workflow", + "description": "Checks for security considerations within a pull request description.", + "iconName": "cg-logo", + "categories": [ + "Compliance" + ] +} + + + +name: Security Considerations Workflow + +on: + pull_request: + types: [opened, edited, reopened] + +jobs: + security-considerations: + runs-on: ubuntu-latest + steps: + - uses: cloud-gov/security-considerations-action@main + + + +## Changes proposed in this pull request: + +- +- +- + +## Things to check + +- For any logging statements, is there any chance that they could be logging sensitive data? +- Are log statements using a logging library with a logging level set? Setting a logging level means that log statements "below" that level will not be written to the output. For example, if the logging level is set to `INFO` and debugging statements are written with `log.debug` or similar, then they won't be written to the otput, which can prevent unintentional leaks of sensitive data. + +## Security considerations + +[Note the any security considerations here, or make note of why there are none] + + + +## Org-wide stale.yml file +# NOTE: This can be overridden by putting a different .github/stale.yml at the repo level + +# Number of days of inactivity before an issue becomes stale +daysUntilStale: 60 +# Number of days of inactivity before a stale issue is closed +daysUntilClose: 60 +# Issues with these labels will never be considered stale +# exemptLabels: +# - compliance +# Label to use when marking an issue as stale +staleLabel: stale +# Comment to post when marking an issue as stale. Set to `false` to disable +markComment: > + This issue has been automatically marked as stale because it has not had + recent activity. It will be closed if no further activity occurs in the next 60 days. +# Comment to post when closing a stale issue. Set to `false` to disable +closeComment: > + This issue has been automatically closed because it has not had activity + in the last 120 days. + + + +context,url +internal,https://internal1.cloud.gov +internal,https://internal2.cloud.gov +external,https://public-api.cloud.gov +pages,https://pages-staging.cloud.gov +pages,https://pages.cloud.gov +unauthenticated,https://login.fr.cloud.gov +unauthenticated,https://idp.fr.cloud.gov + + + +name: "Juice Shop Full DAST" +description: "Traditional & AJAX Spider, Passive & Active scanning with multi-format reports" + +progressToStdout: true # Stream progress to console + +name: "Context-Aware DAST" +description: "Spider + Active/Passive scan per URL with multi-format reports" +progressToStdout: true + +jobs: + - type: spider + parameters: + maxDepth: 5 + threadCount: 2 + + - type: passiveScan-config + parameters: + maxAlertsPerRule: 10 + scanOnlyInScope: true + + - type: passiveScan-wait + parameters: + maxDuration: 60 + + - type: activeScan + parameters: + policy: "Default Policy" + maxScanDurationInMins: 0 + + - type: report + parameters: + template: "traditional-html" + reportDir: "/zap/wrk" + reportFile: "{{yyyy-MM-dd}}-[[site]]-html.html" + displayReport: false + risks: + - high + - medium + - low + # - info + confidences: + - high + - medium +# - low +# - falsepositive + + - type: report + parameters: + template: "traditional-json" + reportDir: "/zap/wrk" + reportFile: "{{yyyy-MM-dd}}-[[site]]-json.json" + displayReport: false + risks: + - high + - medium + - low + # - info + confidences: + - high + - medium + # - low + # - falsepositive + + - type: report + parameters: + template: "traditional-xml" + reportDir: "/zap/wrk" + reportFile: "{{yyyy-MM-dd}}-[[site]]-xml.xml" + displayReport: false + risks: + - high + - medium + - low + # - info + confidences: + - high + - medium + # - low + # - falsepositive + + - type: report + parameters: + template: "sarif-json" + reportDir: "/zap/wrk" + reportFile: "{{yyyy-MM-dd}}-[[site]]-sarif.sarif.json" + displayReport: false + risks: + - high + - medium + - low + # - info + confidences: + - high + - medium + # - low + # - falsepositive + + - type: exitStatus + parameters: + warnLevel: MEDIUM + errorLevel: HIGH + + + +# General Files +*.log +*.tmp +*.bak +*.swp +*.swo +.DS_Store +Thumbs.db +Desktop.ini +._* +.Trashes +.Spotlight-V100 +.TemporaryItems +.Trash-* +*.pid +*.pid.lock +*.seed +*.db +*.dbmdl +*.tlog +*.tmproj +*.tmp_proj +*.un~ +*.user +*.userosscache +*.userprefs +*.vbproj.user +*.vssscc +*.vspscc +*.suo +*.cache +*.csproj.user +*.sln.docstates +*.iws + +# Byte-compiled / Optimized / DLL files +__pycache__/ +*.py[cod] +*$py.class +*.so + +# Distribution / Packaging +.Python +build/ +develop-eggs/ +dist/ +downloads/ +eggs/ +.eggs/ +lib/ +lib64/ +parts/ +sdist/ +var/ +wheels/ +*.egg-info/ +.installed.cfg +*.egg + +# Virtual Environments +.env +.venv +env/ +venv/ +ENV/ +env.bak/ +venv.bak/ + +# IDE / Editor Configurations +/.idea/ +*.iml +/.vscode/ +*.code-workspace +*.sublime-project +*.sublime-workspace +/.vs/ +/.atom/ +/.eclipse/ +/.netbeans/ +/.intellij/ +/.jbuilder/ +/.rubymine/ +/.mine/ +/.textmate/ +/.vim/ +/.emacs.d/ +*.sw* + +# Security - Sensitive files +*.pem +*.key +*.crt +*.csr +*.gpg +*.asc +.secret +*.vault +*.token +*.apikey +*.credentials +secrets.yml +credentials.yml +config/dev.yml +config/private.yml + +# Dependency Directories +/node_modules/ +/bower_components/ +/.jekyll-cache/ +/vendor/ + +# Go specific +/bin/ +*.o +*.a +*.out +Gopkg.lock +Gopkg.toml + +# Binaries for programs and plugins +*.exe +*.exe~ +*.dll +*.so +*.dylib + +# Test binary, built with `go test -c` +*.test + +# Output of the go coverage tool, specifically when used with LiteIDE +*.out + +# Ruby specific +/.bundle/ +/.yardoc +/_yardoc/ +/coverage/ +/doc/ +/pkg/ +/spec/reports/ +/tmp/ +*.gem +*.rbc +.capistrano/ +.rspec +.ruby-version +.ruby-gemset +# Ignore Byebug command history file. +.byebug_history + +# Cloud Foundry specific +manifest.yml +manifest-*.yml +*.env +*.vars.yml +*.vars-*.yml +/deployments/ + +# BOSH specific +*.release +/releases/ +/dev_releases/ +/.dev_builds/ +/blobs/ +/config/ +/private.yml +*.tgz + +# Concourse specific +/fly-* +/concourse-* +/pipelines/ +/tasks/ +/groups/ +/resources/ + +# Logs, Databases, and Configuration Files +*.log +*.sql +*.sqlite +*.sqlite3 +/log/ +*.env* +**/log/*.log +**/log/*.log* + +# OS Generated Files +.DS_Store +.DS_Store? +.Spotlight-V100 +.Trashes +ehthumbs.db +Thumbs.db + +# Build Artifacts and Directories +/dist/ +/tmp/ +/out/ +/build/ +/target/ +/coverage/ +/Release/ +/Debug/ +/x64/ +/x86/ +*.lock +*.DS_Store +*.tgz +/.terraform/ + +# Certificates and Keys +*.csr +*.crt +*.key +*.pem +*.pfx + +# System and Miscellaneous +$RECYCLE.BIN/ +$tf/ + + + +# Contribution Policy + +Cloud.gov is an open source project operated by the U.S. General Services Administration (GSA) to support federal agency missions. While we value transparency and collaboration, we must balance openness with the responsibilities of operating a secure, compliant, and trusted federal platform. + +## Who can contribute + +We welcome contributions from: + +- Employees of U.S. federal agencies +- Contractors working under a current agreement with a U.S. government entity +- GSA-approved contributors as part of official interagency collaboration + +## Who we cannot accept contributions from + +To avoid the appearance of government endorsement, manage supply chain risk, and maintain the integrity of our compliance posture, we do **not** accept unsolicited contributions from: + +- Individuals unaffiliated with the U.S. government +- International contributors or organizations +- Unvetted accounts or first-time contributors submitting minor changes + +If you're unsure whether your contribution fits, feel free to open an issue first so we can discuss it. + + + +# License + +As a work of the [United States government](https://www.usa.gov/), this project is in the public domain within the United States of America. + +Additionally, we waive copyright and related rights in the work worldwide through the CC0 1.0 Universal public domain dedication. + +## CC0 1.0 Universal Summary + +This is a human-readable summary of the [Legal Code (read the full text)](https://creativecommons.org/publicdomain/zero/1.0/legalcode). + +### No Copyright + +The person who associated a work with this deed has dedicated the work to the public domain by waiving all of their rights to the work worldwide under copyright law, including all related and neighboring rights, to the extent allowed by law. + +You can copy, modify, distribute, and perform the work, even for commercial purposes, all without asking permission. + +### Other Information + +In no way are the patent or trademark rights of any person affected by CC0, nor are the rights that other persons may have in the work or in how the work is used, such as publicity or privacy rights. + +Unless expressly stated otherwise, the person who associated a work with this deed makes no warranties about the work, and disclaims liability for all uses of the work, to the fullest extent permitted by applicable law. When using or citing the work, you should not imply endorsement by the author or the affirmer. + + + +# Github templates + +This repo contains Github templates (pull request, issue, etc) for the cloud-gov organization. + + + +# Reporting Security Issues + +Please refrain from reporting security vulnerabilities through public GitHub issues. + +Instead, kindly report them via the information provided in [cloud.gov's security.txt](https://cloud.gov/.well-known/security.txt). + +When reporting, include the following details (as much as possible) to help us understand the nature and extent of the potential issue: + +- Type of issue (e.g., buffer overflow, SQL injection, cross-site scripting, etc.) +- Full paths of related source file(s) +- Location of affected source code (tag/branch/commit or direct URL) +- Any special configuration required to reproduce the issue +- Step-by-step instructions to reproduce the issue +- Proof-of-concept or exploit code (if available) +- Impact of the issue, including potential exploitation by attackers + +Providing this information will facilitate a quicker triage of your report. + + + +# Per https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners#codeowners-syntax + +# If you want to match two or more code owners with the same pattern, + +# all the code owners must be on the same line. If the code owners + +# are not on the same line, the pattern matches only the last mentioned + +# code owner. + +- @cloud-gov/platform-ops @cloud-gov/office-of-cybersecurity + + + +# syntax=docker/dockerfile:1.4 +ARG base_image + +################################################################################ +# STAGE 1 — ZAP BUILDER: pull official ZAP bits (JDK & scripts bundled upstream) +################################################################################ +FROM zaproxy/zap-stable:latest AS zap-builder + +USER root +ARG ENABLE_ADDON_UPDATE="false" +WORKDIR /zap + +# Sanity-check baseline script +RUN test -x /zap/zap-baseline.py + +# Optional add-on update +RUN if [ "${ENABLE_ADDON_UPDATE}" = "true" ]; then \ + /zap/zap.sh -cmd -silent -addonupdate; \ + else \ + echo "Skipping ZAP add-on update"; \ + fi + +################################################################################ +# STAGE 2 — FINAL IMAGE: your hardened Ubuntu base with Java 21 LTS +################################################################################ +FROM ${base_image} + +# Use root for installation +USER root +ARG DEBIAN_FRONTEND=noninteractive +WORKDIR /zap + +# Copy ZAP installation from builder stage +COPY --from=zap-builder /zap /zap + +# Install Java 21 LTS and necessary tooling, then harden under /zap +RUN apt-get update && \ + apt-get install -y --no-install-recommends \ + openjdk-21-jre-headless \ + curl \ + jq \ + python3-pip && \ + pip3 install --no-cache-dir zaproxy && \ + find /zap -xdev -perm /6000 -type f -exec chmod a-s {} + && \ + apt-get purge -y python3-pip && \ + apt-get autoremove -y && \ + apt-get clean && \ + rm -rf /var/lib/apt/lists/* /usr/share/doc /usr/share/man + +# Create non-root zap user and set permissions +RUN useradd -u 1000 -m -s /bin/bash zap && \ + chown -R zap:zap /zap + +# Switch to non-root for runtime +USER zap + +# Configure environment for ZAP +ENV JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64 \ + PATH=${JAVA_HOME}/bin:/zap:${PATH} \ + ZAP_PORT=8080 \ + IS_CONTAINERIZED=true + +# Embed metadata via OCI labels +LABEL org.opencontainers.image.title="zap-runner" \ + org.opencontainers.image.description="Containerized OWASP ZAP baseline scanner" \ + org.opencontainers.image.version="2.16.0" \ + org.opencontainers.image.created="2025-07-11T00:00:00Z" \ + org.opencontainers.image.source="https://github.com/cloud-gov/zap-runner" \ + org.opencontainers.image.licenses="CC0-1.0" \ + org.opencontainers.image.authors="Cloud.gov Office of Cybersecurity" + +# Healthcheck for ZAP daemon +HEALTHCHECK --interval=30s --timeout=5s \ + CMD curl -fs http://localhost:${ZAP_PORT}/ || exit 1 + +# Default entrypoint and command +ENTRYPOINT ["zap-baseline.py"] +CMD ["-daemon", "-r", "/zap/wrk/report.html", "-J", "/zap/wrk/report.json"] + + + +# ci/config.yml +--- +repo_name: zap-runner +runner_tag: "latest" + +credentials: + internal: + client_id: ((credentials.internal.client_id?)) + client_secret: ((credentials.internal.client_secret?)) + token_uri: ((credentials.internal.token_uri?)) + external: + client_id: ((credentials.external.client_id?)) + client_secret: ((credentials.external.client_secret?)) + token_uri: ((credentials.external.token_uri?)) + pages: + client_id: ((credentials.pages.client_id?)) + client_secret: ((credentials.pages.client_secret?)) + token_uri: ((credentials.pages.token_uri?)) + unauthenticated: + client_id: "" + client_secret: "" + token_uri: "" + + + +platform: linux + +image_resource: + type: registry-image + source: + aws_access_key_id: ((ecr_aws_key)) + aws_secret_access_key: ((ecr_aws_secret)) + repository: ((repo_name)) + aws_region: us-gov-west-1 + tag: ((runner_tag)) + +inputs: + - name: ((repo_name)) + +outputs: + - name: zap-report + +params: + TARGET_CONTEXT: # one of internal, external, pages, unauthenticated + CREDHB_CRED: # JSON with all context credentials + +run: + path: bash + args: + - -ceux + - | + #!/usr/bin/env bash + + echo "Starting DAST for context '${TARGET_CONTEXT}'" + + CREDS_JSON="$CREDHB_CRED" + + # Filter URLs for this context + mapfile -t URLS < <( + tail -n +2 ((repo_name))/ci/zap-config/urls.csv | \ + awk -F',' -v ctx="$TARGET_CONTEXT" '$1==ctx { print $2 }' + ) + + if [ ${#URLS[@]} -eq 0 ]; then + echo "No URLs for context '$TARGET_CONTEXT', skipping." + exit 0 + fi + + # Extract credentials for this context (may be empty) + CLIENT_ID=$(jq -r --arg ctx "$TARGET_CONTEXT" '.[$ctx].client_id // empty' <<<"$CREDS_JSON") + CLIENT_SECRET=$(jq -r --arg ctx "$TARGET_CONTEXT" '.[$ctx].client_secret // empty' <<<"$CREDS_JSON") + TOKEN_URI=$(jq -r --arg ctx "$TARGET_CONTEXT" '.[$ctx].token_uri // empty' <<<"$CREDS_JSON") + + mkdir -p zap-report + + for url in "${URLS[@]}"; do + host=$(echo "$url" | sed -E 's#https?://##;s#/.*##') + HTML_OUT="zap-report/${TARGET_CONTEXT}-${host}.html" + JSON_OUT="zap-report/${TARGET_CONTEXT}-${host}.json" + XML_OUT="zap-report/${TARGET_CONTEXT}-${host}.xml" + + echo "→ Scanning $url" + + # Build auth args only if all credentials present + AUTH_ARGS=() + if [[ -n "$CLIENT_ID" && -n "$CLIENT_SECRET" && -n "$TOKEN_URI" ]]; then + AUTH_ARGS+=( -t "${CLIENT_ID}:${CLIENT_SECRET}:${TOKEN_URI}" ) + else + echo "Warning: missing credentials for context '$TARGET_CONTEXT'; proceeding without auth." + fi + + zap-baseline.py \ + -t "$url" \ + -c ((repo_name))/ci/zap-config/zap.yaml \ + -r "$HTML_OUT" \ + -J "$JSON_OUT" \ + -x "$XML_OUT" \ + "${AUTH_ARGS[@]}" + + echo " Reports: $HTML_OUT, $JSON_OUT, $XML_OUT" + done + + echo "Context '$TARGET_CONTEXT' scans complete." + + + +--- +jobs: + - name: set-self + plan: + - get: zap-runner + trigger: true + + - set_pipeline: zap-scanner + file: zap-runner/ci/pipeline.yml + var_files: + - zap-runner/ci/config.yml + + - name: scan-all-contexts + plan: + + - get: zap-runner + trigger: true + passed: + - set-self + + - across: + - var: context + values: + - "internal" + - "external" + - "pages" + - "unauthenticated" + max_in_flight: all + fail_fast: false + do: + - task: zap-scan + file: zap-runner/ci/tasks/zap-scan.yml + vars: + repo_name: ((repo_name)) + runner_tag: ((runner_tag)) + params: + TARGET_CONTEXT: ((.:context)) + CREDHB_CRED: ((credentials)) + +groups: + - name: default + jobs: + - set-self + - scan-all-contexts + + - name: zap-runner + type: git + source: + uri: https://github.com/cloud-gov/((repo_name)) + branch: main + commit_verification_keys: ((cloud-gov-pgp-keys)) + +resource_types: + - name: registry-image + type: registry-image + source: + aws_access_key_id: ((ecr_aws_key)) + aws_secret_access_key: ((ecr_aws_secret)) + repository: registry-image-resource + aws_region: us-gov-west-1 + tag: latest + + - name: git + type: registry-image + source: + aws_access_key_id: ((ecr_aws_key)) + aws_secret_access_key: ((ecr_aws_secret)) + repository: git-resource + aws_region: us-gov-west-1 + tag: latest + + - name: time + type: registry-image + source: + aws_access_key_id: ((ecr_aws_key)) + aws_secret_access_key: ((ecr_aws_secret)) + repository: time-resource + aws_region: us-gov-west-1 + tag: latest + + + From 311f69982c7959b12cf7e725756a443911b81695 Mon Sep 17 00:00:00 2001 From: William Zujkowski Date: Mon, 14 Jul 2025 12:50:00 -0400 Subject: [PATCH 2/3] fixed more filepaths --- ci/pipeline.yml | 2 +- repomix-output.xml | 957 --------------------------------------------- 2 files changed, 1 insertion(+), 958 deletions(-) delete mode 100644 repomix-output.xml diff --git a/ci/pipeline.yml b/ci/pipeline.yml index a85f145..30c4175 100644 --- a/ci/pipeline.yml +++ b/ci/pipeline.yml @@ -44,7 +44,7 @@ groups: jobs: - set-self - scan-all-contexts - +resources: - name: zap-runner type: git source: diff --git a/repomix-output.xml b/repomix-output.xml deleted file mode 100644 index 3ca7408..0000000 --- a/repomix-output.xml +++ /dev/null @@ -1,957 +0,0 @@ -This file is a merged representation of the entire codebase, combined into a single document by Repomix. -The content has been processed where content has been compressed (code blocks are separated by ⋮---- delimiter). - - -This section contains a summary of this file. - - -This file contains a packed representation of the entire repository's contents. -It is designed to be easily consumable by AI systems for analysis, code review, -or other automated processes. - - - -The content is organized as follows: -1. This summary section -2. Repository information -3. Directory structure -4. Repository files (if enabled) -5. Multiple file entries, each consisting of: - - File path as an attribute - - Full contents of the file - - - -- This file should be treated as read-only. Any changes should be made to the - original repository files, not this packed version. -- When processing this file, use the file path to distinguish - between different files in the repository. -- Be aware that this file may contain sensitive information. Handle it with - the same level of security as you would the original repository. - - - -- Some files may have been excluded based on .gitignore rules and Repomix's configuration -- Binary files are not included in this packed representation. Please refer to the Repository Structure section for a complete list of file paths, including binary files -- Files matching patterns in .gitignore are excluded -- Files matching default ignore patterns are excluded -- Content has been compressed - code blocks are separated by ⋮---- delimiter -- Files are sorted by Git change count (files with more changes are at the bottom) - - - - - -.github/ - ISSUE_TEMPLATE/ - change_request.md - issue.md - story.md - workflows/ - cg-logo.svg - security-considerations.properties.json - security-considerations.yml - pull_request_template.md - stale.yml -ci/ - tasks/ - zap-scan.yml - zap-config/ - urls.csv - zap.yaml - config.yml - pipeline.yml -.gitignore -CODEOWNERS -CONTRIBUTING.md -Dockerfile -LICENSE.md -README.md -SECURITY.md - - - -This section contains the contents of the repository's files. - - ---- -name: Change Request -about: Submit a change request for review and deployment. -title: "[Change Request] " -labels: change-request -assignees: "" ---- - -## Change Request Summary -Provide a concise summary of the change you are proposing. Include a brief title and description. - -**Example:** "Upgrade authentication library to v2.5.1 to address CVE-2023-XXXX." - -## Change Details -- **What is being changed?** - Describe the components or services affected. - -- **Why is this change needed?** - Explain the motivation (bug fix, security patch, new feature, etc.). - -- **Change Type:** - - [ ] Planned Change - - [ ] Emergency Change - -- **Priority:** - Indicate the appropriate priority level (P1, P2, P3, P4). - -## Impact Analysis -- **Affected Systems/Components:** - List all systems or components impacted by this change. - -- **Security Impact Analysis (SIA):** - - Describe potential security risks, vulnerabilities, or changes to controls. - - Has a SIA been performed? **Yes / No** - - Attach or link any supporting documentation. - -- **Privacy Impact Assessment (PIA):** - - Describe any potential privacy risks or impacts on data handling. - - Has a PIA been performed? **Yes / No** - - Attach or link any supporting documentation. - -## Rollback Plan -Outline your rollback plan if this change causes issues. Detail the steps to revert the change and restore service. - -## Approvals -This change requires review and sign-off by the following stakeholders: -- [ ] **Security Team** -- [ ] **Platform Operations** -- [ ] **Pages Operations** -- [ ] **System Owner** - -*(If auto-assignment did not occur, please manually tag the appropriate reviewers.)* - -## Additional Information -Provide any further details, related issue references, or links to documentation that may assist in the review process. - ---- - -*Please ensure all sections are completed before submitting this change request.* - - - ---- -name: Issue -about: Suggest a new issue for this project -title: "[short phrase distinguishing this from other Issues]" -labels: '' -assignees: '' - ---- -Short description explaining the high-level reason for the new issue. - -## Notes - -- Additional details, technical information, resource links, and implementation notes -- Excerpt and link to any relevant slack discussions - -## Acceptance Criteria - -- [ ] Determine next steps and acceptance criteria - - - ---- -name: Story -about: Suggest a new story for this project -title: "[short phrase distinguishing this from other Stories]" -labels: '' -assignees: '' - ---- - -In order to [reason/outcome/goal], [someone or "we"] want [a specific change in product implementation/behavior] - -## Acceptance Criteria -* [ ] GIVEN [a precondition] \ - AND [another precondition] - WHEN [test step] \ - AND [test step] \ - THEN [verification step] \ - AND [verification step] - ---- - -## Security considerations -[note any potential changes to security boundaries, practices, documentation, risk that arise directly from this story] - -## Implementation sketch -[links to background notes, sketches, and/or relevant documentation -* [ ] [first thing to do] -* [ ] [another thing to do] - - - - - - - - - - -{ - "name": "Security Considerations Workflow", - "description": "Checks for security considerations within a pull request description.", - "iconName": "cg-logo", - "categories": [ - "Compliance" - ] -} - - - -name: Security Considerations Workflow - -on: - pull_request: - types: [opened, edited, reopened] - -jobs: - security-considerations: - runs-on: ubuntu-latest - steps: - - uses: cloud-gov/security-considerations-action@main - - - -## Changes proposed in this pull request: - -- -- -- - -## Things to check - -- For any logging statements, is there any chance that they could be logging sensitive data? -- Are log statements using a logging library with a logging level set? Setting a logging level means that log statements "below" that level will not be written to the output. For example, if the logging level is set to `INFO` and debugging statements are written with `log.debug` or similar, then they won't be written to the otput, which can prevent unintentional leaks of sensitive data. - -## Security considerations - -[Note the any security considerations here, or make note of why there are none] - - - -## Org-wide stale.yml file -# NOTE: This can be overridden by putting a different .github/stale.yml at the repo level - -# Number of days of inactivity before an issue becomes stale -daysUntilStale: 60 -# Number of days of inactivity before a stale issue is closed -daysUntilClose: 60 -# Issues with these labels will never be considered stale -# exemptLabels: -# - compliance -# Label to use when marking an issue as stale -staleLabel: stale -# Comment to post when marking an issue as stale. Set to `false` to disable -markComment: > - This issue has been automatically marked as stale because it has not had - recent activity. It will be closed if no further activity occurs in the next 60 days. -# Comment to post when closing a stale issue. Set to `false` to disable -closeComment: > - This issue has been automatically closed because it has not had activity - in the last 120 days. - - - -context,url -internal,https://internal1.cloud.gov -internal,https://internal2.cloud.gov -external,https://public-api.cloud.gov -pages,https://pages-staging.cloud.gov -pages,https://pages.cloud.gov -unauthenticated,https://login.fr.cloud.gov -unauthenticated,https://idp.fr.cloud.gov - - - -name: "Juice Shop Full DAST" -description: "Traditional & AJAX Spider, Passive & Active scanning with multi-format reports" - -progressToStdout: true # Stream progress to console - -name: "Context-Aware DAST" -description: "Spider + Active/Passive scan per URL with multi-format reports" -progressToStdout: true - -jobs: - - type: spider - parameters: - maxDepth: 5 - threadCount: 2 - - - type: passiveScan-config - parameters: - maxAlertsPerRule: 10 - scanOnlyInScope: true - - - type: passiveScan-wait - parameters: - maxDuration: 60 - - - type: activeScan - parameters: - policy: "Default Policy" - maxScanDurationInMins: 0 - - - type: report - parameters: - template: "traditional-html" - reportDir: "/zap/wrk" - reportFile: "{{yyyy-MM-dd}}-[[site]]-html.html" - displayReport: false - risks: - - high - - medium - - low - # - info - confidences: - - high - - medium -# - low -# - falsepositive - - - type: report - parameters: - template: "traditional-json" - reportDir: "/zap/wrk" - reportFile: "{{yyyy-MM-dd}}-[[site]]-json.json" - displayReport: false - risks: - - high - - medium - - low - # - info - confidences: - - high - - medium - # - low - # - falsepositive - - - type: report - parameters: - template: "traditional-xml" - reportDir: "/zap/wrk" - reportFile: "{{yyyy-MM-dd}}-[[site]]-xml.xml" - displayReport: false - risks: - - high - - medium - - low - # - info - confidences: - - high - - medium - # - low - # - falsepositive - - - type: report - parameters: - template: "sarif-json" - reportDir: "/zap/wrk" - reportFile: "{{yyyy-MM-dd}}-[[site]]-sarif.sarif.json" - displayReport: false - risks: - - high - - medium - - low - # - info - confidences: - - high - - medium - # - low - # - falsepositive - - - type: exitStatus - parameters: - warnLevel: MEDIUM - errorLevel: HIGH - - - -# General Files -*.log -*.tmp -*.bak -*.swp -*.swo -.DS_Store -Thumbs.db -Desktop.ini -._* -.Trashes -.Spotlight-V100 -.TemporaryItems -.Trash-* -*.pid -*.pid.lock -*.seed -*.db -*.dbmdl -*.tlog -*.tmproj -*.tmp_proj -*.un~ -*.user -*.userosscache -*.userprefs -*.vbproj.user -*.vssscc -*.vspscc -*.suo -*.cache -*.csproj.user -*.sln.docstates -*.iws - -# Byte-compiled / Optimized / DLL files -__pycache__/ -*.py[cod] -*$py.class -*.so - -# Distribution / Packaging -.Python -build/ -develop-eggs/ -dist/ -downloads/ -eggs/ -.eggs/ -lib/ -lib64/ -parts/ -sdist/ -var/ -wheels/ -*.egg-info/ -.installed.cfg -*.egg - -# Virtual Environments -.env -.venv -env/ -venv/ -ENV/ -env.bak/ -venv.bak/ - -# IDE / Editor Configurations -/.idea/ -*.iml -/.vscode/ -*.code-workspace -*.sublime-project -*.sublime-workspace -/.vs/ -/.atom/ -/.eclipse/ -/.netbeans/ -/.intellij/ -/.jbuilder/ -/.rubymine/ -/.mine/ -/.textmate/ -/.vim/ -/.emacs.d/ -*.sw* - -# Security - Sensitive files -*.pem -*.key -*.crt -*.csr -*.gpg -*.asc -.secret -*.vault -*.token -*.apikey -*.credentials -secrets.yml -credentials.yml -config/dev.yml -config/private.yml - -# Dependency Directories -/node_modules/ -/bower_components/ -/.jekyll-cache/ -/vendor/ - -# Go specific -/bin/ -*.o -*.a -*.out -Gopkg.lock -Gopkg.toml - -# Binaries for programs and plugins -*.exe -*.exe~ -*.dll -*.so -*.dylib - -# Test binary, built with `go test -c` -*.test - -# Output of the go coverage tool, specifically when used with LiteIDE -*.out - -# Ruby specific -/.bundle/ -/.yardoc -/_yardoc/ -/coverage/ -/doc/ -/pkg/ -/spec/reports/ -/tmp/ -*.gem -*.rbc -.capistrano/ -.rspec -.ruby-version -.ruby-gemset -# Ignore Byebug command history file. -.byebug_history - -# Cloud Foundry specific -manifest.yml -manifest-*.yml -*.env -*.vars.yml -*.vars-*.yml -/deployments/ - -# BOSH specific -*.release -/releases/ -/dev_releases/ -/.dev_builds/ -/blobs/ -/config/ -/private.yml -*.tgz - -# Concourse specific -/fly-* -/concourse-* -/pipelines/ -/tasks/ -/groups/ -/resources/ - -# Logs, Databases, and Configuration Files -*.log -*.sql -*.sqlite -*.sqlite3 -/log/ -*.env* -**/log/*.log -**/log/*.log* - -# OS Generated Files -.DS_Store -.DS_Store? -.Spotlight-V100 -.Trashes -ehthumbs.db -Thumbs.db - -# Build Artifacts and Directories -/dist/ -/tmp/ -/out/ -/build/ -/target/ -/coverage/ -/Release/ -/Debug/ -/x64/ -/x86/ -*.lock -*.DS_Store -*.tgz -/.terraform/ - -# Certificates and Keys -*.csr -*.crt -*.key -*.pem -*.pfx - -# System and Miscellaneous -$RECYCLE.BIN/ -$tf/ - - - -# Contribution Policy - -Cloud.gov is an open source project operated by the U.S. General Services Administration (GSA) to support federal agency missions. While we value transparency and collaboration, we must balance openness with the responsibilities of operating a secure, compliant, and trusted federal platform. - -## Who can contribute - -We welcome contributions from: - -- Employees of U.S. federal agencies -- Contractors working under a current agreement with a U.S. government entity -- GSA-approved contributors as part of official interagency collaboration - -## Who we cannot accept contributions from - -To avoid the appearance of government endorsement, manage supply chain risk, and maintain the integrity of our compliance posture, we do **not** accept unsolicited contributions from: - -- Individuals unaffiliated with the U.S. government -- International contributors or organizations -- Unvetted accounts or first-time contributors submitting minor changes - -If you're unsure whether your contribution fits, feel free to open an issue first so we can discuss it. - - - -# License - -As a work of the [United States government](https://www.usa.gov/), this project is in the public domain within the United States of America. - -Additionally, we waive copyright and related rights in the work worldwide through the CC0 1.0 Universal public domain dedication. - -## CC0 1.0 Universal Summary - -This is a human-readable summary of the [Legal Code (read the full text)](https://creativecommons.org/publicdomain/zero/1.0/legalcode). - -### No Copyright - -The person who associated a work with this deed has dedicated the work to the public domain by waiving all of their rights to the work worldwide under copyright law, including all related and neighboring rights, to the extent allowed by law. - -You can copy, modify, distribute, and perform the work, even for commercial purposes, all without asking permission. - -### Other Information - -In no way are the patent or trademark rights of any person affected by CC0, nor are the rights that other persons may have in the work or in how the work is used, such as publicity or privacy rights. - -Unless expressly stated otherwise, the person who associated a work with this deed makes no warranties about the work, and disclaims liability for all uses of the work, to the fullest extent permitted by applicable law. When using or citing the work, you should not imply endorsement by the author or the affirmer. - - - -# Github templates - -This repo contains Github templates (pull request, issue, etc) for the cloud-gov organization. - - - -# Reporting Security Issues - -Please refrain from reporting security vulnerabilities through public GitHub issues. - -Instead, kindly report them via the information provided in [cloud.gov's security.txt](https://cloud.gov/.well-known/security.txt). - -When reporting, include the following details (as much as possible) to help us understand the nature and extent of the potential issue: - -- Type of issue (e.g., buffer overflow, SQL injection, cross-site scripting, etc.) -- Full paths of related source file(s) -- Location of affected source code (tag/branch/commit or direct URL) -- Any special configuration required to reproduce the issue -- Step-by-step instructions to reproduce the issue -- Proof-of-concept or exploit code (if available) -- Impact of the issue, including potential exploitation by attackers - -Providing this information will facilitate a quicker triage of your report. - - - -# Per https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners#codeowners-syntax - -# If you want to match two or more code owners with the same pattern, - -# all the code owners must be on the same line. If the code owners - -# are not on the same line, the pattern matches only the last mentioned - -# code owner. - -- @cloud-gov/platform-ops @cloud-gov/office-of-cybersecurity - - - -# syntax=docker/dockerfile:1.4 -ARG base_image - -################################################################################ -# STAGE 1 — ZAP BUILDER: pull official ZAP bits (JDK & scripts bundled upstream) -################################################################################ -FROM zaproxy/zap-stable:latest AS zap-builder - -USER root -ARG ENABLE_ADDON_UPDATE="false" -WORKDIR /zap - -# Sanity-check baseline script -RUN test -x /zap/zap-baseline.py - -# Optional add-on update -RUN if [ "${ENABLE_ADDON_UPDATE}" = "true" ]; then \ - /zap/zap.sh -cmd -silent -addonupdate; \ - else \ - echo "Skipping ZAP add-on update"; \ - fi - -################################################################################ -# STAGE 2 — FINAL IMAGE: your hardened Ubuntu base with Java 21 LTS -################################################################################ -FROM ${base_image} - -# Use root for installation -USER root -ARG DEBIAN_FRONTEND=noninteractive -WORKDIR /zap - -# Copy ZAP installation from builder stage -COPY --from=zap-builder /zap /zap - -# Install Java 21 LTS and necessary tooling, then harden under /zap -RUN apt-get update && \ - apt-get install -y --no-install-recommends \ - openjdk-21-jre-headless \ - curl \ - jq \ - python3-pip && \ - pip3 install --no-cache-dir zaproxy && \ - find /zap -xdev -perm /6000 -type f -exec chmod a-s {} + && \ - apt-get purge -y python3-pip && \ - apt-get autoremove -y && \ - apt-get clean && \ - rm -rf /var/lib/apt/lists/* /usr/share/doc /usr/share/man - -# Create non-root zap user and set permissions -RUN useradd -u 1000 -m -s /bin/bash zap && \ - chown -R zap:zap /zap - -# Switch to non-root for runtime -USER zap - -# Configure environment for ZAP -ENV JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64 \ - PATH=${JAVA_HOME}/bin:/zap:${PATH} \ - ZAP_PORT=8080 \ - IS_CONTAINERIZED=true - -# Embed metadata via OCI labels -LABEL org.opencontainers.image.title="zap-runner" \ - org.opencontainers.image.description="Containerized OWASP ZAP baseline scanner" \ - org.opencontainers.image.version="2.16.0" \ - org.opencontainers.image.created="2025-07-11T00:00:00Z" \ - org.opencontainers.image.source="https://github.com/cloud-gov/zap-runner" \ - org.opencontainers.image.licenses="CC0-1.0" \ - org.opencontainers.image.authors="Cloud.gov Office of Cybersecurity" - -# Healthcheck for ZAP daemon -HEALTHCHECK --interval=30s --timeout=5s \ - CMD curl -fs http://localhost:${ZAP_PORT}/ || exit 1 - -# Default entrypoint and command -ENTRYPOINT ["zap-baseline.py"] -CMD ["-daemon", "-r", "/zap/wrk/report.html", "-J", "/zap/wrk/report.json"] - - - -# ci/config.yml ---- -repo_name: zap-runner -runner_tag: "latest" - -credentials: - internal: - client_id: ((credentials.internal.client_id?)) - client_secret: ((credentials.internal.client_secret?)) - token_uri: ((credentials.internal.token_uri?)) - external: - client_id: ((credentials.external.client_id?)) - client_secret: ((credentials.external.client_secret?)) - token_uri: ((credentials.external.token_uri?)) - pages: - client_id: ((credentials.pages.client_id?)) - client_secret: ((credentials.pages.client_secret?)) - token_uri: ((credentials.pages.token_uri?)) - unauthenticated: - client_id: "" - client_secret: "" - token_uri: "" - - - -platform: linux - -image_resource: - type: registry-image - source: - aws_access_key_id: ((ecr_aws_key)) - aws_secret_access_key: ((ecr_aws_secret)) - repository: ((repo_name)) - aws_region: us-gov-west-1 - tag: ((runner_tag)) - -inputs: - - name: ((repo_name)) - -outputs: - - name: zap-report - -params: - TARGET_CONTEXT: # one of internal, external, pages, unauthenticated - CREDHB_CRED: # JSON with all context credentials - -run: - path: bash - args: - - -ceux - - | - #!/usr/bin/env bash - - echo "Starting DAST for context '${TARGET_CONTEXT}'" - - CREDS_JSON="$CREDHB_CRED" - - # Filter URLs for this context - mapfile -t URLS < <( - tail -n +2 ((repo_name))/ci/zap-config/urls.csv | \ - awk -F',' -v ctx="$TARGET_CONTEXT" '$1==ctx { print $2 }' - ) - - if [ ${#URLS[@]} -eq 0 ]; then - echo "No URLs for context '$TARGET_CONTEXT', skipping." - exit 0 - fi - - # Extract credentials for this context (may be empty) - CLIENT_ID=$(jq -r --arg ctx "$TARGET_CONTEXT" '.[$ctx].client_id // empty' <<<"$CREDS_JSON") - CLIENT_SECRET=$(jq -r --arg ctx "$TARGET_CONTEXT" '.[$ctx].client_secret // empty' <<<"$CREDS_JSON") - TOKEN_URI=$(jq -r --arg ctx "$TARGET_CONTEXT" '.[$ctx].token_uri // empty' <<<"$CREDS_JSON") - - mkdir -p zap-report - - for url in "${URLS[@]}"; do - host=$(echo "$url" | sed -E 's#https?://##;s#/.*##') - HTML_OUT="zap-report/${TARGET_CONTEXT}-${host}.html" - JSON_OUT="zap-report/${TARGET_CONTEXT}-${host}.json" - XML_OUT="zap-report/${TARGET_CONTEXT}-${host}.xml" - - echo "→ Scanning $url" - - # Build auth args only if all credentials present - AUTH_ARGS=() - if [[ -n "$CLIENT_ID" && -n "$CLIENT_SECRET" && -n "$TOKEN_URI" ]]; then - AUTH_ARGS+=( -t "${CLIENT_ID}:${CLIENT_SECRET}:${TOKEN_URI}" ) - else - echo "Warning: missing credentials for context '$TARGET_CONTEXT'; proceeding without auth." - fi - - zap-baseline.py \ - -t "$url" \ - -c ((repo_name))/ci/zap-config/zap.yaml \ - -r "$HTML_OUT" \ - -J "$JSON_OUT" \ - -x "$XML_OUT" \ - "${AUTH_ARGS[@]}" - - echo " Reports: $HTML_OUT, $JSON_OUT, $XML_OUT" - done - - echo "Context '$TARGET_CONTEXT' scans complete." - - - ---- -jobs: - - name: set-self - plan: - - get: zap-runner - trigger: true - - - set_pipeline: zap-scanner - file: zap-runner/ci/pipeline.yml - var_files: - - zap-runner/ci/config.yml - - - name: scan-all-contexts - plan: - - - get: zap-runner - trigger: true - passed: - - set-self - - - across: - - var: context - values: - - "internal" - - "external" - - "pages" - - "unauthenticated" - max_in_flight: all - fail_fast: false - do: - - task: zap-scan - file: zap-runner/ci/tasks/zap-scan.yml - vars: - repo_name: ((repo_name)) - runner_tag: ((runner_tag)) - params: - TARGET_CONTEXT: ((.:context)) - CREDHB_CRED: ((credentials)) - -groups: - - name: default - jobs: - - set-self - - scan-all-contexts - - - name: zap-runner - type: git - source: - uri: https://github.com/cloud-gov/((repo_name)) - branch: main - commit_verification_keys: ((cloud-gov-pgp-keys)) - -resource_types: - - name: registry-image - type: registry-image - source: - aws_access_key_id: ((ecr_aws_key)) - aws_secret_access_key: ((ecr_aws_secret)) - repository: registry-image-resource - aws_region: us-gov-west-1 - tag: latest - - - name: git - type: registry-image - source: - aws_access_key_id: ((ecr_aws_key)) - aws_secret_access_key: ((ecr_aws_secret)) - repository: git-resource - aws_region: us-gov-west-1 - tag: latest - - - name: time - type: registry-image - source: - aws_access_key_id: ((ecr_aws_key)) - aws_secret_access_key: ((ecr_aws_secret)) - repository: time-resource - aws_region: us-gov-west-1 - tag: latest - - - From 5ab366c8f132130cb27e3507c6698ef15a064484 Mon Sep 17 00:00:00 2001 From: William Zujkowski Date: Mon, 14 Jul 2025 12:52:45 -0400 Subject: [PATCH 3/3] fixed more filepaths --- ci/pipeline.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/ci/pipeline.yml b/ci/pipeline.yml index 30c4175..c6f2f79 100644 --- a/ci/pipeline.yml +++ b/ci/pipeline.yml @@ -12,9 +12,6 @@ jobs: - name: scan-all-contexts plan: - - get: zap-config - trigger: true - - get: zap-runner trigger: true passed: @@ -44,6 +41,7 @@ groups: jobs: - set-self - scan-all-contexts + resources: - name: zap-runner type: git