add CI pipeline for security tests and remediation

.brightsec/tests/delete-logout.test.ts

@@ -0,0 +1,39 @@
+import { test, before, after } from 'node:test';
+import { SecRunner } from '@sectester/runner';
+import { AttackParamLocation, HttpMethod } from '@sectester/scan';
+
+const timeout = 40 * 60 * 1000;
+const baseUrl = process.env.BRIGHT_TARGET_URL!;
+
+let runner!: SecRunner;
+
+before(async () => {
+  runner = new SecRunner({
+    hostname: process.env.BRIGHT_HOSTNAME!,
+    projectId: process.env.BRIGHT_PROJECT_ID!
+  });
+
+  await runner.init();
+});
+
+after(() => runner.clear());
+
+test('DELETE /logout', { signal: AbortSignal.timeout(timeout) }, async () => {
+  await runner
+    .createScan({
+      tests: ['csrf', 'http_method_fuzzing', 'xss', 'unvalidated_redirect'],
+      attackParamLocations: [AttackParamLocation.PATH],
+      starMetadata: {
+        code_source: 'NeuraLegion/ruby-example-app:master',
+        databases: ['PostgreSQL'],
+        user_roles: ['admin']
+      },
+      poolSize: +process.env.SECTESTER_SCAN_POOL_SIZE || undefined
+    })
+    .setFailFast(false)
+    .timeout(timeout)
+    .run({
+      method: HttpMethod.DELETE,
+      url: `${baseUrl}/logout`
+    });
+});

.brightsec/tests/delete-posts-1-json.test.ts

@@ -0,0 +1,40 @@
+import { test, before, after } from 'node:test';
+import { SecRunner } from '@sectester/runner';
+import { AttackParamLocation, HttpMethod } from '@sectester/scan';
+
+const timeout = 40 * 60 * 1000;
+const baseUrl = process.env.BRIGHT_TARGET_URL!;
+
+let runner!: SecRunner;
+
+before(async () => {
+  runner = new SecRunner({
+    hostname: process.env.BRIGHT_HOSTNAME!,
+    projectId: process.env.BRIGHT_PROJECT_ID!
+  });
+
+  await runner.init();
+});
+
+after(() => runner.clear());
+
+test('DELETE /posts/1.json', { signal: AbortSignal.timeout(timeout) }, async () => {
+  await runner
+    .createScan({
+      tests: ['csrf', 'bopla', 'id_enumeration', 'sqli'],
+      attackParamLocations: [AttackParamLocation.PATH],
+      starMetadata: {
+        code_source: 'NeuraLegion/ruby-example-app:master',
+        databases: ['PostgreSQL'],
+        user_roles: ['admin']
+      },
+      poolSize: +process.env.SECTESTER_SCAN_POOL_SIZE || undefined
+    })
+    .setFailFast(false)
+    .timeout(timeout)
+    .run({
+      method: HttpMethod.DELETE,
+      url: `${baseUrl}/posts/1.json`,
+      headers: { 'Content-Type': 'application/json' }
+    });
+});

.brightsec/tests/delete-posts-1.test.ts

@@ -0,0 +1,40 @@
+import { test, before, after } from 'node:test';
+import { SecRunner } from '@sectester/runner';
+import { AttackParamLocation, HttpMethod } from '@sectester/scan';
+
+const timeout = 40 * 60 * 1000;
+const baseUrl = process.env.BRIGHT_TARGET_URL!;
+
+let runner!: SecRunner;
+
+before(async () => {
+  runner = new SecRunner({
+    hostname: process.env.BRIGHT_HOSTNAME!,
+    projectId: process.env.BRIGHT_PROJECT_ID!
+  });
+
+  await runner.init();
+});
+
+after(() => runner.clear());
+
+test('DELETE /posts/1', { signal: AbortSignal.timeout(timeout) }, async () => {
+  await runner
+    .createScan({
+      tests: ['csrf', 'bopla', 'id_enumeration', 'sqli'],
+      attackParamLocations: [AttackParamLocation.PATH],
+      starMetadata: {
+        code_source: 'NeuraLegion/ruby-example-app:master',
+        databases: ['PostgreSQL'],
+        user_roles: ['admin']
+      },
+      poolSize: +process.env.SECTESTER_SCAN_POOL_SIZE || undefined
+    })
+    .setFailFast(false)
+    .timeout(timeout)
+    .run({
+      method: HttpMethod.DELETE,
+      url: `${baseUrl}/posts/1`,
+      headers: { 'Content-Type': 'application/json' }
+    });
+});

.brightsec/tests/delete-users-1-json.test.ts

@@ -0,0 +1,40 @@
+import { test, before, after } from 'node:test';
+import { SecRunner } from '@sectester/runner';
+import { AttackParamLocation, HttpMethod } from '@sectester/scan';
+
+const timeout = 40 * 60 * 1000;
+const baseUrl = process.env.BRIGHT_TARGET_URL!;
+
+let runner!: SecRunner;
+
+before(async () => {
+  runner = new SecRunner({
+    hostname: process.env.BRIGHT_HOSTNAME!,
+    projectId: process.env.BRIGHT_PROJECT_ID!
+  });
+
+  await runner.init();
+});
+
+after(() => runner.clear());
+
+test('DELETE /users/1.json', { signal: AbortSignal.timeout(timeout) }, async () => {
+  await runner
+    .createScan({
+      tests: ['csrf', 'bopla', 'id_enumeration', 'sqli'],
+      attackParamLocations: [AttackParamLocation.PATH],
+      starMetadata: {
+        code_source: 'NeuraLegion/ruby-example-app:master',
+        databases: ['PostgreSQL'],
+        user_roles: ['admin']
+      },
+      poolSize: +process.env.SECTESTER_SCAN_POOL_SIZE || undefined
+    })
+    .setFailFast(false)
+    .timeout(timeout)
+    .run({
+      method: HttpMethod.DELETE,
+      url: `${baseUrl}/users/1.json`,
+      headers: { 'Content-Type': 'application/json' }
+    });
+});

.brightsec/tests/delete-users-1.test.ts

@@ -0,0 +1,40 @@
+import { test, before, after } from 'node:test';
+import { SecRunner } from '@sectester/runner';
+import { AttackParamLocation, HttpMethod } from '@sectester/scan';
+
+const timeout = 40 * 60 * 1000;
+const baseUrl = process.env.BRIGHT_TARGET_URL!;
+
+let runner!: SecRunner;
+
+before(async () => {
+  runner = new SecRunner({
+    hostname: process.env.BRIGHT_HOSTNAME!,
+    projectId: process.env.BRIGHT_PROJECT_ID!
+  });
+
+  await runner.init();
+});
+
+after(() => runner.clear());
+
+test('DELETE /users/1', { signal: AbortSignal.timeout(timeout) }, async () => {
+  await runner
+    .createScan({
+      tests: ['csrf', 'bopla', 'id_enumeration', 'sqli'],
+      attackParamLocations: [AttackParamLocation.PATH],
+      starMetadata: {
+        code_source: 'NeuraLegion/ruby-example-app:master',
+        databases: ['PostgreSQL'],
+        user_roles: ['admin']
+      },
+      poolSize: +process.env.SECTESTER_SCAN_POOL_SIZE || undefined
+    })
+    .setFailFast(false)
+    .timeout(timeout)
+    .run({
+      method: HttpMethod.DELETE,
+      url: `${baseUrl}/users/1`,
+      headers: { 'Content-Type': 'application/json' }
+    });
+});

.brightsec/tests/get-login.test.ts

@@ -0,0 +1,39 @@
+import { test, before, after } from 'node:test';
+import { SecRunner } from '@sectester/runner';
+import { AttackParamLocation, HttpMethod } from '@sectester/scan';
+
+const timeout = 40 * 60 * 1000;
+const baseUrl = process.env.BRIGHT_TARGET_URL!;
+
+let runner!: SecRunner;
+
+before(async () => {
+  runner = new SecRunner({
+    hostname: process.env.BRIGHT_HOSTNAME!,
+    projectId: process.env.BRIGHT_PROJECT_ID!
+  });
+
+  await runner.init();
+});
+
+after(() => runner.clear());
+
+test('GET /login', { signal: AbortSignal.timeout(timeout) }, async () => {
+  await runner
+    .createScan({
+      tests: ['csrf', 'xss', 'sqli', 'unvalidated_redirect', 'secret_tokens'],
+      attackParamLocations: [AttackParamLocation.QUERY, AttackParamLocation.HEADER],
+      starMetadata: {
+        code_source: 'NeuraLegion/ruby-example-app:master',
+        databases: ['PostgreSQL'],
+        user_roles: ['admin']
+      },
+      poolSize: +process.env.SECTESTER_SCAN_POOL_SIZE || undefined
+    })
+    .setFailFast(false)
+    .timeout(timeout)
+    .run({
+      method: HttpMethod.GET,
+      url: `${baseUrl}/login`
+    });
+});

.brightsec/tests/get-posts-1-edit.test.ts

@@ -0,0 +1,39 @@
+import { test, before, after } from 'node:test';
+import { SecRunner } from '@sectester/runner';
+import { AttackParamLocation, HttpMethod } from '@sectester/scan';
+
+const timeout = 40 * 60 * 1000;
+const baseUrl = process.env.BRIGHT_TARGET_URL!;
+
+let runner!: SecRunner;
+
+before(async () => {
+  runner = new SecRunner({
+    hostname: process.env.BRIGHT_HOSTNAME!,
+    projectId: process.env.BRIGHT_PROJECT_ID!
+  });
+
+  await runner.init();
+});
+
+after(() => runner.clear());
+
+test('GET /posts/1/edit', { signal: AbortSignal.timeout(timeout) }, async () => {
+  await runner
+    .createScan({
+      tests: ['csrf', 'bopla', 'id_enumeration', 'xss'],
+      attackParamLocations: [AttackParamLocation.PATH],
+      starMetadata: {
+        code_source: 'NeuraLegion/ruby-example-app:master',
+        databases: ['PostgreSQL'],
+        user_roles: ['admin']
+      },
+      poolSize: +process.env.SECTESTER_SCAN_POOL_SIZE || undefined
+    })
+    .setFailFast(false)
+    .timeout(timeout)
+    .run({
+      method: HttpMethod.GET,
+      url: `${baseUrl}/posts/1/edit`
+    });
+});

.brightsec/tests/get-posts-1-json.test.ts

@@ -0,0 +1,40 @@
+import { test, before, after } from 'node:test';
+import { SecRunner } from '@sectester/runner';
+import { AttackParamLocation, HttpMethod } from '@sectester/scan';
+
+const timeout = 40 * 60 * 1000;
+const baseUrl = process.env.BRIGHT_TARGET_URL!;
+
+let runner!: SecRunner;
+
+before(async () => {
+  runner = new SecRunner({
+    hostname: process.env.BRIGHT_HOSTNAME!,
+    projectId: process.env.BRIGHT_PROJECT_ID!
+  });
+
+  await runner.init();
+});
+
+after(() => runner.clear());
+
+test('GET /posts/1.json', { signal: AbortSignal.timeout(timeout) }, async () => {
+  await runner
+    .createScan({
+      tests: ['csrf', 'id_enumeration', 'sqli', 'xss'],
+      attackParamLocations: [AttackParamLocation.PATH],
+      starMetadata: {
+        code_source: 'NeuraLegion/ruby-example-app:master',
+        databases: ['PostgreSQL'],
+        user_roles: ['admin']
+      },
+      poolSize: +process.env.SECTESTER_SCAN_POOL_SIZE || undefined
+    })
+    .setFailFast(false)
+    .timeout(timeout)
+    .run({
+      method: HttpMethod.GET,
+      url: `${baseUrl}/posts/1.json`,
+      headers: { 'Content-Type': 'application/json' }
+    });
+});

.brightsec/tests/get-posts-1.test.ts

@@ -0,0 +1,40 @@
+import { test, before, after } from 'node:test';
+import { SecRunner } from '@sectester/runner';
+import { AttackParamLocation, HttpMethod } from '@sectester/scan';
+
+const timeout = 40 * 60 * 1000;
+const baseUrl = process.env.BRIGHT_TARGET_URL!;
+
+let runner!: SecRunner;
+
+before(async () => {
+  runner = new SecRunner({
+    hostname: process.env.BRIGHT_HOSTNAME!,
+    projectId: process.env.BRIGHT_PROJECT_ID!
+  });
+
+  await runner.init();
+});
+
+after(() => runner.clear());
+
+test('GET /posts/1', { signal: AbortSignal.timeout(timeout) }, async () => {
+  await runner
+    .createScan({
+      tests: ['csrf', 'bopla', 'id_enumeration', 'sqli', 'xss'],
+      attackParamLocations: [AttackParamLocation.PATH],
+      starMetadata: {
+        code_source: 'NeuraLegion/ruby-example-app:master',
+        databases: ['PostgreSQL'],
+        user_roles: ['admin']
+      },
+      poolSize: +process.env.SECTESTER_SCAN_POOL_SIZE || undefined
+    })
+    .setFailFast(false)
+    .timeout(timeout)
+    .run({
+      method: HttpMethod.GET,
+      url: `${baseUrl}/posts/1`,
+      headers: { 'Content-Type': 'application/json' }
+    });
+});