Method for realizing SAST defect identification and distribution based on DevOps environment
By automating the pipeline process of SAST tools in the DevOps environment, the automated identification and distribution of SAST defects are achieved, and the problem of inefficient manual management in the existing technology is solved, and code security and development efficiency are improved.
Patent Information
- Application Number
- CN202411398310.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-09
- Publication Date
- 2025-01-07
AI Technical Summary
In the DevOps environment, the defect identification and distribution process of existing SAST tools lacks automation, resulting in the development team needing to manually manage and distribute detection results, which is inefficient and difficult to efficiently manage and repair security defects.
By submitting the code to the code repository, triggering the DevOps pipeline, automatically compiling and uploading it to the SAST platform for secure scanning, using the API interface to feedback and associate the scan results to the DevOps platform, realizing the automatic identification and distribution of defects, including the number of defect lines and submitting personnel Related to the version, integrate the defect management platform for centralized management.
It realizes automated management and precise distribution of SAST defects, reduces manual operations, improves code security detection and repair efficiency, and ensures the efficiency and overall security of software development.
Smart Images
Figure CN119271210A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to a method for identifying and distributing code defects, and in particular to a method for implementing SAST defect identification and distribution based on a DevOps environment. Background Art
[0002] Code security is a crucial factor in the modern software development process. With the widespread adoption of DevOps practices, the software development, testing, and deployment cycles have been greatly shortened, and development teams need to deliver high-quality software products faster. However, as the delivery speed increases, security vulnerabilities in the code may also increase, posing a serious challenge to software security.
[0003] Static Application Security Testing (SAST) is a technology used to detect security vulnerabilities in code in the early stages of development. SAST tools can identify potential security issues without executing the program by analyzing source code, bytecode, or binary files. Due to its early detection, SAST can help development teams discover and fix security vulnerabilities in the early stages of software development, thereby reducing repair costs and risks.
[0004] However, in traditional development processes, the introduction of SAST is usually manual and time-sensitive. Developers or security teams usually need to manually run SAST tools, analyze detection results, and distribute discovered defects to relevant developers for repair. This manual way of managing and distributing defects is not only inefficient, but also easily leads to some defects being missed or not repaired in time. In addition, as the code base expands and the project becomes more complex, the workload and complexity of manually processing SAST detection results increase significantly, making it difficult for development teams to efficiently manage and repair security defects.
[0005] In order to meet these challenges, in recent years, some teams have tried to integrate SAST tools into DevOps pipelines to achieve automated security testing and defect management. However, the existing integration methods are usually relatively rudimentary and lack automated classification, management, and distribution mechanisms for defects, resulting in a large number of SAST detection results still needing to be processed manually. This not only increases the burden on the development team, but also affects development efficiency and the overall security of the software.
[0006] Therefore, how to achieve automated management of SAST defects and accurate distribution of defects in a DevOps environment, reduce manual operations, and improve the efficiency of code security detection and repair has become an urgent problem to be solved in the current software development field. Summary of the invention
[0007] The technical problem to be solved by the present invention is to overcome the deficiencies of the prior art and provide a method for implementing SAST defect identification and distribution based on a DevOps environment.
[0008] To solve the above technical problems, the technical solution proposed in the present invention is: a method for implementing SAST defect identification and distribution based on DevOps environment, comprising the following steps: 1) Submit the code to the code repository to trigger the DevOps pipeline. The DevOps pipeline first pulls the latest submitted code from the code repository and automatically compiles the code to generate an executable file. 2) The DevOps pipeline uploads the generated executable file and source code to the SAST platform; calls the SAST platform's code defect scanning API interface; the SAST platform performs a security scan on the uploaded source code and executable file to detect potential security vulnerabilities and coding defects; 3) After the security scan of the SAST platform is completed, the results of the security scan are fed back to the DevOps platform; the DevOps platform records and / or associates the vulnerability codes found in the security scan; 4) The SAST platform distributes the information recorded in step 3) and / or associated information, and distributes the defect code and the content of the information record to relevant personnel according to the content of the information association.
[0009] In the above-mentioned method for implementing SAST defect identification and distribution based on DevOps environment, preferably, the information record in step 3) includes the starting line number of the defect, the ending line number of the defect and the name of the file where the defect is located.
[0010] In the above-mentioned method for implementing SAST defect identification and distribution based on DevOps environment, preferably, the information association in step 3) includes the association between code defects, code submitters, code submission time and code versions.
[0011] The above-mentioned method for implementing SAST defect identification and distribution based on DevOps environment preferably establishes a defect management platform in step 4), and the SAST platform feeds back the information recorded in step 3) and / or related information to the defect management platform.
[0012] In the above-mentioned method for implementing SAST defect identification and distribution based on DevOps environment, preferably, the defect management platform distributes the recorded information according to the associated information.
[0013] Compared with the prior art, the advantages of the present invention are: the method of the present invention for realizing SAST defect identification and distribution based on DevOps environment can automatically distribute the vulnerability code information scanned by the SAST platform to relevant personnel, thereby ensuring the efficiency of software development and the overall security of the software. BRIEF DESCRIPTION OF THE DRAWINGS
[0014] Figure 1 The present invention is a flow chart of a method for implementing SAST defect identification and distribution based on a DevOps environment.
[0015] Figure 2 This is a schematic diagram of the operation between various modules of the DevOps pipeline in Example 1.
[0016] Figure 3 This is a schematic diagram of the operation of the security scanning platform, defect management and distribution platform, and code management platform after they are associated in Example 1.
[0017] Figure 4 This is an example of transmitting the results back to the DevOps platform through callback after the SAST platform completes the scan in Example 1.
[0018] Figure 5 This is an example of the DevOps platform in Example 1 associating defect information with code submission records. DETAILED DESCRIPTION
[0019] In order to facilitate the understanding of the present invention, the present invention will be described more comprehensively and carefully in combination with preferred embodiments below, but the protection scope of the present invention is not limited to the following specific embodiments.
[0020] It should be noted that when an element is described as being "fixed, fixed, connected or connected to" another element, it can be directly fixed, fixed, connected or connected to the other element, or it can be indirectly fixed, fixed, connected or connected to the other element through other intermediate connectors.
[0021] Unless otherwise defined, all the professional terms used below have the same meanings as those generally understood by those skilled in the art. The professional terms used herein are only for the purpose of describing specific embodiments and are not intended to limit the scope of protection of the present invention.
[0022] A method for implementing SAST defect identification and distribution based on DevOps environment, such as Figure 1 As shown, the following steps are included: 1) Submit the code to the code repository to trigger the DevOps pipeline. The DevOps pipeline first pulls the latest submitted code from the code repository and automatically compiles the code to generate an executable file. 2) The DevOps pipeline uploads the generated executable file and source code to the SAST platform; calls the SAST platform's code defect scanning API interface; the SAST platform performs a security scan on the uploaded source code and executable file to detect potential security vulnerabilities and coding defects; 3) After the security scan on the SAST platform is completed, the results of the security scan are fed back to the DevOps platform; the DevOps platform records and / or associates the vulnerability code found in the security scan. The information recorded in step 3) includes the start line number of the defect, the end line number of the defect, and the name of the file where the defect is located; the information association in step 3) includes the association of code defects, code submitters, code submission time, and code versions.
[0023] In the present invention, after the SAST platform completes the scan, it will call back the DevOps platform through the notification interface address pre-configured on the SAST platform. After receiving the scan results, the DevOps platform records the number of lines of code for vulnerabilities found in the scan, and can also associate the defect code with the code version number. Then associate these defective codes to the code repository. Specifically, based on the code files and code functions that scan out the vulnerabilities, the pipeline automatically uses the git command: gitblame -L <defect start line number>, <defect end line number> <defect file name> to find the specific submission person, submission time, submission version and other information. The specific submission person information, submission time and submission version information of these codes are obtained in the above manner. Then the code defects, code submission personnel, code submission time and code version are associated for storage and reporting.
[0024] Existing SAST tools all work independently. After a security scan finds a problem, it is impossible to know who specifically wrote the code. The generated defects cannot be effectively and automatically found to the corresponding code developer. The project leader needs to manually confirm and distribute the defects manually, which greatly reduces the timeliness of confirming code vulnerabilities and fixing defects. At the same time, the defects scanned out cannot be associated with the project version, and it is impossible to effectively count the vulnerabilities and defects that appear in each version of the project, and effectively evaluate and manage the project quality.
[0025] 4) The SAST platform distributes the information recorded in step 3) and / or the associated information, and distributes the defect code and the content of the information record to relevant personnel according to the content of the information association. In step 4), a defect management platform is established, and the SAST platform feeds back the information recorded in step 3) and / or the associated information to the defect management platform. The defect management platform distributes the recorded information according to the associated information.
[0026] In the present invention, in step 4), the DevOps platform triggers the API interface of the defect management platform, and reports the code defects, the number of related code lines, the last submitted code version, the last submitter, and the basic information of the personnel to the defect management platform. The defect management platform is responsible for centrally collecting, sorting and summarizing all defects. In this way, the project management, defect management, vulnerability platform and code repository are efficiently linked, and the entire life cycle of the entire project security vulnerability is effectively managed.
[0027] In the present invention, the DevOps pipeline can also integrate the email system to send detailed defect reports to the relevant code submitters, reminding them to fix the vulnerabilities as soon as possible. In addition, the email will be attached with a detailed report generated by the SAST scan to help developers quickly locate and fix problems.
[0028] In the present invention, after the defect collection is completed, the defect management platform will create a corresponding defect record in the corresponding software development project management platform, and associate it with the code submitter and the submitted code version to form a complete code vulnerability defect management process.
[0029] Through continuous analysis of defect data, the system can evaluate each developer's development skills and security awareness, such as defect repair efficiency and vulnerability introduction frequency. These analysis results can provide decision support for team managers, help identify training needs, optimize team structure, and improve overall development efficiency and code security. Example
[0030] This embodiment provides a method for implementing SAST defect identification and distribution based on a DevOps environment. The operation diagram between the various modules of the DevOps pipeline is as follows: Figure 2 As shown, the following steps are included: 1. Code submission: Developers submit the code to the code repository.
[0031] For example, submit through the git command and then push to the code repository: git add . git commit -m submits business code git push origin master.
[0032] 2. Pipeline triggering: The DevOps pipeline automatically pulls the latest code and compiles it.
[0033] For example, after the pipeline receives the code push message, it first downloads the source code through the git command, and then uses the compilation command mvn package to package the Java source code git clone cd helloworld mvn clean package -Dmaven.test.skip=true.
[0034] 3. File upload and scanning: After successful compilation, the pipeline uploads the executable file and source code to the SAST platform and triggers a security scan. After the pipeline is compiled successfully, the source code and compiled package are uploaded to the security platform through commands, and then a security scan is performed.
[0035] 4. Scan result processing: After the SAST (static application security testing) platform completes the scan, it transmits the result back to the DevOps platform through callback. Figure 4 shown.
[0036] 5. Defect data association: The DevOps platform associates defect information with code submission records to obtain information about the defect location, submitter, and submitted version.
[0037] For example, the defect platform scans and finds that there is a defect in line 87 of the StatisticController.java file, so the information can be associated through the code repository command. Figure 5 shown.
[0038] The pipeline executes the command to query the developer of the class and code to which the defect belongs git blame -L 87,87 hdzr-admin / src / main / java / com / hdzr / web / controller / statistic / StatisticController.java Defect code information that can be obtained according to the git command: db75e5abc (version number) wx_fangli (developer) 2024-06-12 16:25:24 (submission time) 87 (number of code lines) Bind relevant information to the defect number 6. Defect reporting: The DevOps platform triggers the defect management platform interface to report the defect data.
[0039] Example: The pipeline reports directly to the project management platform based on the defective version and code submission information.
[0040] The schematic diagram of the operation of the security scanning platform, defect management and distribution platform, and code management platform after being associated in this embodiment is as follows: Figure 3 shown.
[0041] In this embodiment, the DevOps pipeline can also integrate the email system to send detailed defect reports to relevant code submitters, reminding them to fix the vulnerabilities as soon as possible. In addition, the email will be attached with a detailed report generated by the SAST scan to help developers quickly locate and fix problems.
[0042] In this embodiment, after the defect collection is completed, the defect management platform will create a corresponding defect record in the corresponding software development project management platform, and associate it with the code submitter and the submitted code version to form a complete code vulnerability defect management process.
[0043] Through continuous analysis of defect data, the system can evaluate each developer's development skills and security awareness, such as defect repair efficiency and vulnerability introduction frequency. These analysis results can provide decision support for team managers, help identify training needs, optimize team structure, and improve overall development efficiency and code security.
Claims
1. A method for implementing SAST defect identification and distribution based on DevOps environment, characterized in that: The following steps are involved: 1) Submit the code to the code repository to trigger the DevOps pipeline. The DevOps pipeline first pulls the latest submitted code from the code repository and automatically compiles the code to generate an executable file. 2) The DevOps pipeline uploads the generated executable file to the SAST platform along with the source code; Call the SAST platform's code defect scanning API interface; the SAST platform performs security scans on uploaded source code and executable files to detect potential security vulnerabilities and coding defects; 3) After the security scan of the SAST platform is completed, the results of the security scan are fed back to the DevOps platform; the DevOps platform records and / or associates the vulnerability codes found in the security scan; 4) The SAST platform distributes the information recorded in step 3) and / or associated information, and distributes the defect code and the content of the information record to relevant personnel according to the content of the information association.
2. The method for implementing SAST defect identification and distribution based on DevOps environment according to claim 1, characterized in that: The information recorded in step 3) includes the starting line number of the defect, the ending line number of the defect and the name of the file where the defect is located.
3. The method for implementing SAST defect identification and distribution based on DevOps environment according to claim 1, characterized in that: The information association in step 3) includes the association between code defects, code submitters, code submission time and code versions.
4. The method for implementing SAST defect identification and distribution based on DevOps environment according to claim 1, characterized in that: In step 4), a defect management platform is established, and the SAST platform feeds back the information recorded in step 3) and / or related information to the defect management platform.
5. The method for implementing SAST defect identification and distribution based on DevOps environment according to claim 4 is characterized in that: The defect management platform distributes the recorded information according to the associated information.