Skip to content

Commit ad5d086

Browse files
leftrightleftleftrightleft
committed
Initial update for Go
1 parent 58e61e6 commit ad5d086

File tree

1 file changed

+210
-1
lines changed

1 file changed

+210
-1
lines changed

‎README.md

+210-1
Original file line numberDiff line numberDiff line change
@@ -1 +1,210 @@
1-
# advanced-security-go
1+
# Code Scanning Go Tutorial
2+
3+
Welcome to the Code Scanning Go Tutorial! This tutorial will take you through how to set up Github Advanced Security: Code Scanning as well as interpret results that it may find. The following repository contains SQL injection vulnerability for demonstration purpose.
4+
5+
## Introduction
6+
7+
Code scanning is a feature that you use to analyze the code in a GitHub repository to find security vulnerabilities and coding errors. Any problems identified by the analysis are shown in GitHub.
8+
9+
You can use code scanning with CodeQL, a semantic code analysis engine. CodeQL treats code as data, allowing you to find potential vulnerabilities in your code with greater confidence than traditional static analyzers.
10+
11+
This tutorial with use CodeQL Analysis with Code Scanning in order to search for vulnerabilities within your code.
12+
13+
<!--- TODO: Update this section with Go specific instructions
14+
## Instructions
15+
<details>
16+
<summary>Fork this repo</summary>
17+
<p>
18+
19+
Begin by [forking this repo](https://docs.github.com/en/free-pro-team@latest/github/getting-started-with-github/fork-a-repo).
20+
</p>
21+
</details>
22+
23+
<details>
24+
<summary>Enable Code Scanning</summary>
25+
<p>
26+
27+
#### Security tab
28+
29+
Click on the `Security` tab.
30+
31+
32+
<img src="images/00-repo-security-tab.png" width="70%"/>
33+
34+
#### Set up code scanning
35+
36+
Click `Set up code scanning`.
37+
38+
<img src="images/01-repo-secruity-setup-code-scanning.png" width="70%"/>
39+
40+
#### Setup Workflow
41+
42+
Click the `Setup this workflow` button by CodeQL Analysis.
43+
44+
<img src="images/02-repo-security-setup-codeql-workflow.png" width="70%"/>
45+
46+
This will create a GitHub Actions Workflow file with CodeQL already set up. Since Python is an interpreted language you do not need to add any additional compile flags. See the [documentation](https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system) if you would like to configure CodeQL Analysis with a 3rd party CI system instead of using GitHub Actions.
47+
</p>
48+
</details>
49+
50+
<details>
51+
52+
<summary>Actions Workflow file</summary>
53+
<p>
54+
55+
#### Actions Workflow
56+
57+
The Actions Workflow file contains a number of different sections including:
58+
1. Checking out the repository
59+
2. Initializing the CodeQL Action
60+
3. Running the CodeQL Analysis
61+
62+
<img src="images/03-actions-sample-workflow.png" width="80%"/>
63+
64+
Click `Start Commit` -> `Commit this file` to commit the changes to _main_ branch.
65+
</p>
66+
</details>
67+
68+
<details>
69+
70+
<summary>Workflow triggers</summary>
71+
<p>
72+
73+
#### Workflow triggers
74+
75+
There are a [number of events](https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows) that can trigger a GitHub Actions workflow. In this example, the workflow will be triggered on
76+
77+
<img src="images/04-actions-sample-events.png" width="50%"/>
78+
79+
- push to _main_ branch
80+
- pull request to merge to _main_ branch
81+
- on schedule, at 6:33 every Thursday
82+
83+
Setting up the new CodeQL workflow and committing it to _main_ branch in the step above will trigger the scan.
84+
85+
</p>
86+
</details>
87+
88+
89+
<details>
90+
<summary>GitHub Actions Progress</summary>
91+
92+
<p>
93+
94+
#### GitHub Actions Progress
95+
96+
Click `Actions` tab -> `CodeQL`
97+
98+
Click the specific workflow run. You can view the progress of the Workflow run until the analysis completes.
99+
100+
<img src="images/05-actions-completed.png" width="80%"/>
101+
102+
</p>
103+
</details>
104+
105+
<details>
106+
<summary>Security Issues</summary>
107+
<p>
108+
109+
Once the Workflow has completed, click the `Security` tab -> ` Code Scanning Alerts`. An security alert "Query built from user-controlled sources" should be visible.
110+
111+
#### Security Alert View
112+
113+
Clicking on the security alert will provide details about the security alert including: <br/>
114+
<ul>
115+
<li>A description of the issue </li>
116+
<li>A tag to the CWE that it is connected to as well as the type of alert (Error, Warning, Note)</li>
117+
<li>The line of code that triggered the security alert</li>
118+
<li>The ability to dismiss the alert depending on certain conditions (`False positive`? `Won't fix`? `Used in tests`?)</li>
119+
</ul>
120+
<img src="images/06-security-codeql-alert.png" width="80%"/>
121+
122+
#### Security Alert Description
123+
124+
Click `Show more` to view a full desciption of the alert including examples and links to additional information.
125+
126+
<img src="images/07-security-codeql-show-more.png" width="80%"/>
127+
128+
#### Security Full Description
129+
130+
<img width="80%" src="images/08-security-codeql-full-desc.png">
131+
132+
</p>
133+
</details>
134+
135+
<details>
136+
<summary>Show Paths</summary>
137+
<p>
138+
139+
#### Show Paths Button
140+
141+
CodeQL Analysis is able to trace the dataflow path from source to sink and gives you the ability to view the path traversal within the alert.
142+
143+
Click `show paths` in order to see the dataflow path that resulted in this alert.
144+
145+
<img src="images/09-security-codeql-show-paths.png" width="80%"/>
146+
147+
#### Show Paths View
148+
149+
<img src="images/10-security-codeql-show-paths-details.png" width="80%"/>
150+
151+
</p>
152+
</details>
153+
154+
<details>
155+
<p>
156+
157+
<summary>Fix the Security Alert</summary>
158+
159+
In order to fix this specific alert, we will need to ensure parameters used in the SQL query is validated and sanitized.
160+
161+
Click on the `Code` tab and [Edit](https://docs.github.com/en/free-pro-team@latest/github/managing-files-in-a-repository/editing-files-in-your-repository) the file [`routes.py`](./server/routes.py) in the `server` folder, replace the content with the file [`fixme`](./fixme).
162+
163+
<img src="images/11-fix-source-code.png" width="30%"/>
164+
165+
Click `Create a new branch for this commit and start a pull request`, name the branch `fix-sql-injection`, and create the Pull Request.
166+
167+
#### Pull Request Status Check
168+
169+
In the Pull Request, you will notice that the CodeQL Analysis has started as a status check. Wait until it completes.
170+
171+
<img src="images/12-fix-pr-in-progress.png" width="80%"/>
172+
173+
#### Security Alert Details
174+
175+
After the Workflow has completed click on `Details` by the `Code Scanning Results / CodeQL` status check.
176+
177+
<img src="images/13-fix-pr-done.png" width="80%"/>
178+
179+
#### Fixed Alert
180+
181+
Notice that Code Scanning has detected that this Pull Request will fix the SQL injection vulnerability that was detected before.
182+
183+
<img src="images/14-fix-detail.png" width="80%"/>
184+
185+
Merge the Pull Request. After the Pull Request has been merged, another Workflow will kick off to scan the repository for any vulnerabilties.
186+
187+
#### Closed Security Alerts
188+
189+
After the final Workflow has completed, navigate back to the `Security` tab and click `Closed`. Notice that the **Query built from user-controlled sources** security alert now shows up as a closed issue.
190+
191+
<img src="images/15-fixed-alert.png" width="80%"/>
192+
193+
#### Traceability
194+
195+
Click on the security alert and notice that it details when the fix was made, by whom, and the specific commit. This provides full traceability to detail when and how a security alert was fixed and exactly what was changed to remediate the issue.
196+
197+
<img src="images/16-fix-history.png" width="80%"/>
198+
199+
</p>
200+
</details>
201+
-->
202+
203+
## Next Steps
204+
205+
Ready to talk about advanced security features for GitHub Enterprise? [Contact Sales](https://enterprise.github.com/contact) for more information!
206+
207+
Check out [GitHub's Security feature page](https://github.com/features/security) for more security features embedded into GitHub.
208+
209+
Check out the Code Scanning [documentation](https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning) for additional configuration options and technical details.
210+

0 commit comments

Comments
 (0)