Version Control Code Quarantine and Security Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current version control systems, such as Git, do not update security scans when code is downloaded, potentially allowing vulnerable code to be accessed despite being secure at the time of upload, due to lack of ongoing vulnerability checks.
Innovation Solution
Implementing a quarantine directory system that runs security scans (SCA, SAST, DAST) on code before allowing upload or download, using user-defined thresholds to determine code safety, and only permitting access if vulnerabilities are below the defined level.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security scans are run only at upload time, then the upload process is fast and simple, but vulnerable code can be downloaded later without detection
Solution Approach 1:
The system performs security scans in advance at upload time and stores the scan results with the code in the repository. When code is downloaded, the pre-stored scan results are retrieved and presented to the user, eliminating the need for real-time scanning at download time while maintaining security assurance.
Solution Approach 2:
The system provides feedback by storing and presenting security scan results with the code. The scan results include vulnerability information that is made available to users during download, creating a feedback loop that informs users about the security status of the code without requiring additional scanning operations.
2Reliability
If security scans are run at download time, then vulnerable code is detected, but the download process becomes slower and more complex
Solution Approach 1:
Security scanning is performed in advance during the upload process, and the results are cached and stored with the code in the repository. This preliminary action eliminates the need for scanning at download time, maintaining fast download speeds while ensuring security through the pre-computed scan results.
Solution Approach 2:
The system creates a copy of the security scan results and stores them alongside the code in the repository. When code is downloaded, instead of performing a new scan, the system transfers the copied scan results to the user, significantly reducing the time and resources required during the download process.
3Productivity
If code is allowed to be downloaded without re-scanning, then download is fast and simple, but new vulnerabilities discovered after upload cannot be detected
Solution Approach 1:
The system implements a feedback mechanism where security scan results are stored with the code and made available during download. This allows the system to provide continuous security information feedback to users, enabling them to be aware of vulnerability status without requiring re-scanning, thus maintaining both efficiency and security.
Solution Approach 2:
The system maintains continuous security monitoring by storing scan results that remain valid over time. The useful action of security scanning continues implicitly through the stored results, allowing the system to maintain security assurance without interrupting the download process with additional scanning operations.
Data Source
AI summary
Obtain a command to download code from a version control system repository server. Responsive to the obtained command, quarantining the code and run a security scan on the code while it is quarantined. Based on an acceptable result of the security scan, release the quarantine and permit download of the code.