1
sdlc_security:
2
  phases:
3
    requirements:
4
      - threat_modeling
5
      - security_requirements
6
      - abuse_case_design
7

8
    design:
9
      - secure_design_review
10
      - architecture_analysis
11

12
    implementation:
13
      - secure_coding_guidelines
14
      - sast_scan
15
      - secret_detection
16

17
    testing:
18
      - dast_scan
19
      - sca_scan
20
      - penetration_testing
21

22
    deployment:
23
      - image_scanning
24
      - compliance_check
25
      - signing

1
# SonarQube 配置
2
sonar_project:
3
  quality_gate:
4
    bugs: 0
5
    vulnerabilities: 0
6
    code_smells: < 10
7
    security_hotspots: reviewed
8

9
  rules:
10
    - security: |
11
        S5131  # XSS
12
        S3649  # SQL Injection
13
        S2083  # Path Traversal
14

15
  exclusions:
16
    - "**/*test*.java"
17
    - "**/*.min.js"

1
// 漏洞示例
2
public class UserController {
3

4
    // SQL 注入
5
    @GetMapping("/user")
6
    public User getUser(@RequestParam("id") String id) {
7
        // 漏洞：直接拼接 SQL
8
        String sql = "SELECT * FROM users WHERE id = " + id;
9
        return jdbc.query(sql);
10

11
        // 修复：使用参数化查询
12
        String sql = "SELECT * FROM users WHERE id = ?";
13
        return jdbc.query(sql, id);
14
    }
15

16
    // XSS 漏洞
17
    @PostMapping("/user")
18
    public String createUser(@RequestParam("name") String name) {
19
        // 漏洞：直接输出
20
        return name;  // <script>alert(1)</script>
21

22
        // 修复：输出编码
23
        return HtmlEncoder.encode(name);
24
    }
25
}

1
# golangci-lint 配置
2
linters_settings:
3
  gosec:
4
    excludes:
5
      - G104 # 未处理的错误
6
      - G204 # 命令执行
7
    rules:
8
      - G101: password_detected
9
      - G102: binds_to_all_interfaces
10
      - G103: audit_Binding_WriteTimeout
11

12
  revive:
13
    rules:
14
      - name: var-naming
15
        severity: warning

1
zap_scan:
2
  # 扫描策略
3
  scan_policy:
4
    - name: "API Scan"
5
      types:
6
        - url
7
        - body
8
        - response
9

10
  # 认证配置
11
  authentication:
12
    type: form
13
    login_url: /api/login
14
    username_field: email
15
    password_field: password
16

17
  # 扫描范围
18
  contexts:
19
    - name: api_context
20
      urls:
21
        - https://api.example.com/*
22
      inc_funcs:
23
        - /admin/*
24
      excl_funcs:
25
        - /health/*

1
# API Fuzz 配置
2
api_fuzzing:
3
  # 变异策略
4
  fuzzing:
5
    - type: inject
6
      payload: "' OR 1=1 --"
7

8
    - type: length
9
      min: 0
10
      max: 1000000
11

12
    - type: type
13
      convert_to:
14
        - integer
15
        - float
16
        - null
17

18
  # 检测目标
19
  targets:
20
    - endpoint: /api/users/{id}
21
      methods:
22
        - GET
23
        - PUT
24
        - DELETE

1
# Trivy 配置
2
trivy_scan:
3
  # 漏洞数据库
4
  db:
5
    repository: ghcr.io/aquasecurity/trivy-db
6

7
  # 扫描类型
8
  scans:
9
    - type: rootfs
10
      roots: /
11
    - type: filesystem
12
    - type: image
13

14
  # 阻断策略
15
  exit_policy:
16
    - vulnerability:
17
        type: CVSS
18
        score: 9.0
19
        action: block
20
      - type: package
21
        name: openssl
22
        action: block

1
# Go modules 依赖管理
2
go_mod:
3
  # 校验依赖哈希
4
  sumdb: sum.golang.org
5

6
  # 私有模块
7
  private:
8
    - gitlab.example.com
9
    - proxy.golang.org
10

11
  # 依赖版本锁定
12
  require:
13
    - module: github.com/gin-gonic/gin
14
      version: v1.9.1
15
      hash: h1:4CR1mq6....

1
license_check:
2
  # 禁止的许可证
3
  prohibited:
4
    - GPL-3.0
5
    - AGPL-3.0
6
    - LGPL-2.1
7

8
  # 需要审核的许可证
9
  review_required:
10
    - MPL-2.0
11
    - CDDL-1.0
12
    - EUPL-1.2
13

14
  # 允许的许可证
15
  allowed:
16
    - Apache-2.0
17
    - MIT
18
    - BSD-2-Clause
19
    - BSD-3-Clause

1
# 多阶段构建
2
FROM golang:1.21-alpine AS builder
3

4
# 复制源码
5
COPY . .
6

7
# 编译
8
RUN CGO_ENABLED=0 go build -o myapp
9

10
# 运行时镜像
11
FROM alpine:3.19
12

13
# 非 root 用户
14
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
15

16
# 健康检查
17
HEALTHCHECK --interval=30s CMD wget -qO- http://localhost:8080/health
18

19
# 复制二进制
20
COPY --from=builder /myapp /usr/local/bin/
21

22
# 切换用户
23
USER appuser
24

25
ENTRYPOINT ["myapp"]

1
# Cosign 签名
2
# 生成密钥对
3
cosign generate-key-pair
4

5
# 签名镜像
6
cosign sign --key cosign.key myregistry/myimage:tag
7

8
# 验证镜像
9
cosign verify --key cosign.pub myregistry/myimage:tag

1
# Kyverno 策略
2
kyverno_policies:
3
  - name: require-non-root
4
    rules:
5
      - name: check-containers
6
        match:
7
          resources:
8
            kinds:
9
              - Pod
10
        validate:
11
          pattern: |
12
            spec:
13
              securityContext:
14
                runAsNonRoot: true
15

16
  - name: restrict-privileges
17
    rules:
18
      - name: privileged-containers
19
        match:
20
          resources:
21
            kinds:
22
              - Pod
23
        validate:
24
          pattern: |
25
            spec:
26
              (containers[]):
27
                securityContext:
28
                  (privileged): "false"

1
sbom_generation:
2
  # 生成格式
3
  formats:
4
    - spdx
5
    - cyclonedx
6
    - cdx
7

8
  # 工具
9
  tools:
10
    - syft
11
    - cdxgen
12
    - spdx-sbom-generator
13

14
  # CI/CD 集成
15
  ci_integration:
16
    - github_actions: true
17
    - gitlab_ci: true

1
# Renovate 配置
2
renovate:
3
  onboarding: false
4
  extends:
5
    - "config:recommended"
6

7
  packageRules:
8
    - matchPackagePatterns:
9
        - "*"
10
      groupName: "all"
11
      schedule:
12
        - "before 5am"
13

14
    - matchDepTypes:
15
        - indirect
16
      enabled: false
17

18
    - matchUpdateTypes:
19
        - security
20
      automerge: true

1
# 密钥管理
2
secret_management:
3
  # Vault 配置
4
  hashicorp_vault:
5
    address: https://vault.example.com
6
    auth_method: kubernetes
7
    role: app-deployment
8

9
  # GitOps
10
  argocd:
11
    sealed_secrets: true
12
    external_secrets_operator: true

1
# 工作流安全
2
name: Security Scan
3

4
on:
5
  push:
6
    branches: [main]
7

8
jobs:
9
  security:
10
    runs-on: ubuntu-latest
11
    steps:
12
      - uses: actions/checkout@v3
13

14
      - name: Run Trivy
15
        uses: aquasecurity/trivy-action@main
16
        with:
17
          scan-type: fs
18
          severity: CRITICAL,HIGH
19

20
      - name: Run Semgrep
21
        uses: returntocorp/semgrep-action@v1

1
sangfor_devsecops:
2
  # 集成 SCA
3
  sca:
4
    enabled: true
5
    block_on_critical: true
6

7
  # 集成 SAST
8
  sast:
9
    enabled: true
10
    quality_gate: true
11

12
  # 集成容器安全
13
  container:
14
    scan_on_build: true
15
    block_on_malware: true