1
# 危险：SQL 注入
2
def get_user(user_id):
3
    query = f"SELECT * FROM users WHERE id = '{user_id}'"
4
    return db.execute(query)
5

6
# 安全：参数化查询
7
def get_user(user_id):
8
    query = "SELECT * FROM users WHERE id = %s"
9
    return db.execute(query, (user_id,))

1
# 危险：硬编码密钥
2
SECRET_KEY = "my-super-secret-key-12345"
3
app.config['SECRET_KEY'] = SECRET_KEY
4

5
# 安全：从环境变量/KMS 获取
6
import os
7
from kms_client import get_secret
8
app.config['SECRET_KEY'] = os.environ.get('APP_SECRET_KEY') or get_secret('app/secret-key')

1
# 危险：明文存储密码
2
def store_password(password):
3
    db.execute("INSERT INTO users (password) VALUES ('%s')" % password)
4

5
# 安全：bcrypt + 盐
6
import bcrypt
7
def store_password(password):
8
    salt = bcrypt.gensalt(rounds=12)  # 工作因子 12，约 250ms
9
    hashed = bcrypt.hashpw(password.encode('utf-8'), salt)
10
    db.execute("INSERT INTO users (password_hash) VALUES (%s)", (hashed,))

1
# 1. 检测 TLS 配置
2
testssl.sh --protocols --ciphers --vulnerabilities target.com
3

4
# 2. 检测弱加密算法
5
nmap --script ssl-enum-ciphers -p 443 target.com
6

7
# 3. 检测证书问题
8
echo | openssl s_client -connect target.com:443 2>/dev/null | \
9
  openssl x509 -noout -text | grep -E "Signature Algorithm|Not After|Issuer"
10

11
# 4. 检测 HTTP 安全头
12
curl -sI https://target.com | grep -iE "strict-transport|content-security|x-frame|x-content-type"
13

14
# 5. 检测 Cookie 安全属性
15
curl -sI https://target.com | grep -i "set-cookie" | \
16
  grep -cE "Secure|HttpOnly|SameSite"

1
# .semgrep.yml — Semgrep 自定义规则
2
rules:
3
  - id: hardcoded-secret
4
    patterns:
5
      - pattern: |
6
          $KEY = "..."
7
      - metavariable-regex:
8
          metavariable: $KEY
9
          regex: "(?i)(password|secret|api_key|token|private_key)"
10
    message: "检测到硬编码密钥，请使用环境变量或 KMS"
11
    severity: ERROR
12
    languages: [python, javascript, java]
13

14
  - id: insecure-random
15
    pattern: random.random()
16
    message: "使用不安全的随机数生成器，请使用 secrets 模块"
17
    severity: WARNING
18
    languages: [python]
19

20
  - id: ecb-mode
21
    pattern: AES.new($KEY, AES.MODE_ECB, ...)
22
    message: "ECB 模式不安全，请使用 AES-GCM"
23
    severity: ERROR
24
    languages: [python]

1
# Trivy 扫描容器镜像和文件系统
2
trivy fs --severity HIGH,CRITICAL ./project
3
trivy image --severity HIGH,CRITICAL myapp:latest
4

5
# Snyk 扫描依赖漏洞
6
snyk test --severity-threshold=high
7
snyk monitor  # 持续监控
8

9
# npm audit 检查 Node.js 依赖
10
npm audit --audit-level=high
11
npm audit fix  # 自动修复
12

13
# Python 依赖安全检查
14
pip audit  # PyPA 官方工具
15
safety check --json  # Safety CLI