-
Notifications
You must be signed in to change notification settings - Fork 9
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #109 from Mixeway/feature/codeproject-branches
Feature/codeproject branches
- Loading branch information
Showing
63 changed files
with
1,509 additions
and
237 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
117 changes: 117 additions & 0 deletions
117
src/main/java/io/mixeway/api/cicd/controller/CICDController.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,117 @@ | ||
| package io.mixeway.api.cicd.controller; | ||
|
|
||
| import io.mixeway.api.cicd.model.LoadSCA; | ||
| import io.mixeway.api.cicd.service.CICDService; | ||
| import io.mixeway.api.cioperations.model.LoadVulnModel; | ||
| import io.mixeway.api.cioperations.model.ZapReportModel; | ||
| import io.mixeway.api.protocol.cioperations.GetInfoRequest; | ||
| import io.mixeway.api.protocol.cioperations.PrepareCIOperation; | ||
| import io.mixeway.api.protocol.securitygateway.SecurityGatewayResponse; | ||
| import io.mixeway.utils.Status; | ||
| import lombok.RequiredArgsConstructor; | ||
| import org.springframework.http.ResponseEntity; | ||
| import org.springframework.security.access.prepost.PreAuthorize; | ||
| import org.springframework.stereotype.Controller; | ||
| import org.springframework.web.bind.annotation.*; | ||
|
|
||
| import javax.validation.Valid; | ||
| import java.io.IOException; | ||
| import java.net.UnknownHostException; | ||
| import java.security.*; | ||
| import java.security.cert.CertificateException; | ||
|
|
||
| @RequiredArgsConstructor | ||
| @Controller | ||
| @RequestMapping("/v3/api/cicd") | ||
| @PreAuthorize("hasAuthority('ROLE_API')") | ||
| public class CICDController { | ||
| private final CICDService cicdService; | ||
|
|
||
|
|
||
| /** | ||
| * | ||
| * Request that meant to create CodeProject or return CodeProject by repoUrl contained in getInfoRequest | ||
| * | ||
| * @param getInfoRequest - info with repoURL and branch | ||
| */ | ||
| @PostMapping(value = "/codeproject/info") | ||
| public ResponseEntity<PrepareCIOperation> getCPInfo(@Valid @RequestBody GetInfoRequest getInfoRequest, Principal principal) throws CertificateException, UnrecoverableKeyException, NoSuchAlgorithmException, KeyManagementException, KeyStoreException, IOException { | ||
| return cicdService.getCPInfo(getInfoRequest, principal); | ||
| } | ||
|
|
||
| /** | ||
| * | ||
| * Request that meant to | ||
| * 1. Create or get proper branch for CodeProject with given ID | ||
| * 2. Call SCA scanner to load vulnerabilities and link those with pair codeproject - codeprojectbranch | ||
| * | ||
| * @param loadSCA | ||
| */ | ||
| @PostMapping(value = "/codeproject/load/sca") | ||
| public ResponseEntity<Status> loadSca(@Valid @RequestBody LoadSCA loadSCA, Principal principal) throws CertificateException, UnrecoverableKeyException, NoSuchAlgorithmException, KeyManagementException, KeyStoreException, IOException { | ||
| return cicdService.loadSca(loadSCA, principal); | ||
| } | ||
|
|
||
|
|
||
| /** | ||
| * | ||
| * Request that load vulnerabilities from arbitrary sources such as GitLeaks and KICS: | ||
| * 1. Create or get proper branch for CodeProject with given ID | ||
| * 2. Load vulnerabilities to DB and link those with pair CodeProject - CodeProjectBranch | ||
| * | ||
| */ | ||
| @PreAuthorize("hasAuthority('ROLE_API')") | ||
| @PostMapping(value="/codeproject/loadvulns/{codeProjectId}") | ||
| public ResponseEntity<Status> loadVulns (@RequestBody LoadVulnModel loadVulnModel, | ||
| @PathVariable(value = "codeProjectId") Long id, | ||
| Principal principal) throws Exception { | ||
| return cicdService.loadVulnerabilitiesFromCICDToProject( | ||
| loadVulnModel.getVulns(), | ||
| id, | ||
| loadVulnModel.getBranch(), | ||
| loadVulnModel.getCommitId(), | ||
| principal); | ||
| } | ||
|
|
||
| /** | ||
| * | ||
| * Request that start SAST Scan for given scope: | ||
| * 1. Create or get proper branch for CodeProject with given ID | ||
| * 2. Load vulnerabilities to DB and link those with pair CodeProject - CodeProjectBranch | ||
| * | ||
| */ | ||
| @PreAuthorize("hasAuthority('ROLE_API')") | ||
| @PostMapping(value = "/codeproject/run/sast") | ||
| public ResponseEntity<Status> performSastScanForCodeProject( @RequestBody LoadSCA loadSCA, Principal principal) throws UnrecoverableKeyException, CertificateException, NoSuchAlgorithmException, KeyStoreException, IOException, KeyManagementException { | ||
| return cicdService.performSastScanForCodeProject(loadSCA, principal); | ||
| } | ||
|
|
||
|
|
||
| /** | ||
| * | ||
| * Request that load vulnerabilities from arbitrary sources such as ZAP: | ||
| * 1. Create or get proper branch for CodeProject with given ID | ||
| * 2. Load vulnerabilities to DB and link those with pair CodeProject - CodeProjectBranch | ||
| * TODO Upload report ZAP with info regarding repoUrl to link repo with webapp | ||
| * | ||
| */ | ||
|
|
||
| @PreAuthorize("hasAuthority('ROLE_API')") | ||
| @PostMapping(value="/loadvulns/zap/{ciid}") | ||
| public ResponseEntity<Status> loadVulnsZap (@RequestBody ZapReportModel loadVulnModel, | ||
| @PathVariable(value = "ciid") String ciid, | ||
| Principal principal) throws Exception { | ||
| return cicdService.loadVulnZap(loadVulnModel,ciid,principal); | ||
| } | ||
|
|
||
| /** | ||
| * Validate State of security for given CodeProject and Branch | ||
| */ | ||
| @CrossOrigin(origins="*") | ||
| @PreAuthorize("hasAuthority('ROLE_API')") | ||
| @PostMapping(value = "/codeproject/validate",produces = "application/json") | ||
| public ResponseEntity<SecurityGatewayResponse> cicdValidate(@RequestBody LoadSCA loadSCA, | ||
| Principal principal) throws UnknownHostException { | ||
| return cicdService.validate(loadSCA, principal); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| package io.mixeway.api.cicd.model; | ||
|
|
||
| public class CodeProjectInfo { | ||
|
|
||
|
|
||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| package io.mixeway.api.cicd.model; | ||
|
|
||
| import lombok.AllArgsConstructor; | ||
| import lombok.Getter; | ||
| import lombok.NoArgsConstructor; | ||
| import lombok.Setter; | ||
|
|
||
| @Getter | ||
| @Setter | ||
| @NoArgsConstructor | ||
| @AllArgsConstructor | ||
| public class LoadSCA { | ||
| private Long codeProjectId; | ||
| private String branch; | ||
| private String commitId; | ||
| } |
Oops, something went wrong.