From 83eedeeeaaea7dfcffc3732557be5c2b0511a42b Mon Sep 17 00:00:00 2001 From: JosueUPT Date: Wed, 11 Dec 2024 22:29:25 -0500 Subject: [PATCH] fix-semgrep --- .github/workflows/php-tests.yml | 134 +++++++++++++------------------- 1 file changed, 52 insertions(+), 82 deletions(-) diff --git a/.github/workflows/php-tests.yml b/.github/workflows/php-tests.yml index b454d5e1..88460bf3 100644 --- a/.github/workflows/php-tests.yml +++ b/.github/workflows/php-tests.yml @@ -397,10 +397,13 @@ jobs: - name: Semgrep Scan run: | + # Crear directorio para resultados temporales + mkdir -p temp_results + echo "🔍 ANÁLISIS DETALLADO DE SEGURIDAD EN CONTROLLERS" echo "==============================================" - # Ejecutar scan detallado + # Ejecutar scan y guardar resultados semgrep scan \ --config "p/php" \ --config "p/security-audit" \ @@ -414,77 +417,40 @@ jobs: --severity WARNING \ --json > semgrep_results.json - echo -e "\n📊 ANÁLISIS DETALLADO POR CONTROLADOR" - echo "=====================================" - - # Análisis por controlador + # Guardar métricas generales + total_files=$(ls src/Controllers/*.php | wc -l) + total_lines=$(find src/Controllers -name "*.php" -exec wc -l {} + | tail -1 | awk '{print $1}') + affected_lines=$(jq -r '.results | length' semgrep_results.json) + safe_percentage=$(echo "scale=2; 100 - ($affected_lines * 100 / $total_lines)" | bc) + + # Guardar métricas en archivo + echo "$total_files" > temp_results/total_files + echo "$total_lines" > temp_results/total_lines + echo "$safe_percentage" > temp_results/safe_percentage + + # Analizar cada controlador y guardar resultados for file in src/Controllers/*.php; do - echo -e "\n🔍 Analizando: $(basename $file)" - echo "----------------------------------------" + filename=$(basename $file) - # Contar líneas de código - total_lines=$(wc -l < "$file") - echo " 📝 Líneas totales: $total_lines" + # Crear archivo temporal para cada controlador + echo "=== $filename ===" > "temp_results/$filename.txt" - # Análisis de funciones - echo " 🔧 Funciones detectadas:" - grep -n "function" "$file" | while read -r line; do - echo " • $line" - done + # Guardar líneas totales + wc -l < "$file" >> "temp_results/$filename.txt" - # Extraer hallazgos específicos del archivo - echo " ⚠️ Hallazgos de seguridad:" - jq -r --arg file "$file" ' - .results[] | - select(.path == $file) | - " - Línea \(.start.line): \(.extra.message)\n Severidad: \(.extra.severity)\n Tipo: \(.check_id)\n Código: \(.extra.lines)" - ' semgrep_results.json || echo " ✅ No se encontraron problemas" + # Guardar funciones detectadas + echo "=== FUNCIONES ===" >> "temp_results/$filename.txt" + grep -n "function" "$file" >> "temp_results/$filename.txt" - # Análisis de patrones comunes - echo " 🔍 Patrones detectados:" - { - echo " • Uso de $_POST: $(grep -c "\$_POST" "$file")" - echo " • Uso de $_GET: $(grep -c "\$_GET" "$file")" - echo " • Queries SQL: $(grep -c "query(" "$file")" - echo " • Validaciones: $(grep -c "validate\|sanitize" "$file")" - echo " • Try-Catch blocks: $(grep -c "try {" "$file")" - } + # Guardar patrones + echo "=== PATRONES ===" >> "temp_results/$filename.txt" + echo "POST: $(grep -c "\$_POST" "$file")" >> "temp_results/$filename.txt" + echo "GET: $(grep -c "\$_GET" "$file")" >> "temp_results/$filename.txt" + echo "SQL: $(grep -c "query(" "$file")" >> "temp_results/$filename.txt" + echo "Validaciones: $(grep -c "validate\|sanitize" "$file")" >> "temp_results/$filename.txt" + echo "Try-Catch: $(grep -c "try {" "$file")" >> "temp_results/$filename.txt" done - echo -e "\n🎯 ANÁLISIS DE VULNERABILIDADES" - echo "==============================" - jq -r ' - .results[] | - select(.extra.severity != null) | - " • [\(.extra.severity)] \(.path):\(.start.line) - \(.extra.message)" - ' semgrep_results.json || echo " ✅ No se encontraron vulnerabilidades" - - echo -e "\n🔒 MÉTRICAS DE SEGURIDAD" - echo "=======================" - { - echo " • Archivos analizados: $(ls src/Controllers/*.php | wc -l)" - echo " • Total líneas de código: $(find src/Controllers -name "*.php" -exec wc -l {} + | tail -1 | awk '{print $1}')" - echo " • Hallazgos por severidad:" - jq -r ' - .results[] | - select(.extra.severity != null) | - .extra.severity - ' semgrep_results.json | sort | uniq -c | while read count severity; do - echo " - $severity: $count" - done - } - - echo -e "\n📈 COBERTURA DE ANÁLISIS" - echo "=======================" - total_lines=$(find src/Controllers -name "*.php" -exec wc -l {} + | tail -1 | awk '{print $1}') - affected_lines=$(jq -r '.results | length' semgrep_results.json) - if [ $total_lines -gt 0 ] && [ ! -z "$affected_lines" ]; then - safe_percentage=$(echo "scale=2; 100 - ($affected_lines * 100 / $total_lines)" | bc) - echo " • Líneas totales: $total_lines" - echo " • Líneas afectadas: $affected_lines" - echo " • Código seguro: $safe_percentage%" - fi - - name: Update Semgrep HTML Report run: | mkdir -p public/semgrep @@ -575,28 +541,31 @@ jobs:

Archivos Analizados

-

$(ls src/Controllers/*.php | wc -l) archivos

+

'$(cat temp_results/total_files)' archivos

Total LĂ­neas

-

$(find src/Controllers -name "*.php" -exec wc -l {} + | tail -1 | awk "{print $1}") lĂ­neas

+

'$(cat temp_results/total_lines)' lĂ­neas

CĂłdigo Seguro

-

100.00%

+

'$(cat temp_results/safe_percentage)'%

Hallazgos por Archivo

- $(for file in src/Controllers/*.php; do - filename=$(basename $file) - lines=$(wc -l < "$file") - functions=$(grep -n "function" "$file") - trycatch=$(grep -c "try {" "$file") - queries=$(grep -c "query(" "$file") - validations=$(grep -c "validate\|sanitize" "$file") + '"$(for file in temp_results/*.txt; do + [[ $(basename "$file") == "total_files" ]] && continue + [[ $(basename "$file") == "total_lines" ]] && continue + [[ $(basename "$file") == "safe_percentage" ]] && continue + + filename=$(head -n 1 "$file" | cut -d "=" -f2 | tr -d " ") + lines=$(sed -n "2p" "$file") + functions=$(sed -n "/=== FUNCIONES ===/,/=== PATRONES ===/p" "$file" | grep -v "===") + + patterns=$(tail -n 5 "$file") echo "
" echo "
$filename
" @@ -605,9 +574,7 @@ jobs: echo "
" echo "
    " echo "
  • LĂ­neas totales: $lines
    • " - echo "
  • Try-Catch blocks: $trycatch
    • " - echo "
  • Queries SQL: $queries
    • " - echo "
  • Validaciones: $validations
    • " + echo "
  • $patterns
    • " echo "
" echo "

Funciones detectadas:

" echo "
" @@ -616,20 +583,23 @@ jobs: echo "
" echo "
" echo "
" - done) + done)"'

Notas Adicionales

' > public/semgrep/index.html + # Limpiar archivos temporales + rm -rf temp_results + - name: Install Snyk run: npm install -g snyk