Developer

azure-pipelines.yml

@@ -0,0 +1,69 @@
+# Starter pipeline
+# Start with a minimal pipeline that you can customize to build and deploy your code.
+# Add steps that build, run tests, deploy, and more:
+# https://aka.ms/yaml
+
+trigger:
+- master
+
+pool:
+  vmImage: ubuntu-latest
+
+
+stages:
+- stage: SAST
+  jobs:
+  - job:
+    steps:
+    - task: Maven@4 
+      inputs:
+        mavenPomFile: 'pom.xml'
+        publishJUnitResults: true
+        testResultsFiles: '**/surefire-reports/TEST-*.xml'
+        javaHomeOption: 'JDKVersion'
+        mavenVersionOption: 'Default'
+        mavenAuthenticateFeed: false
+        effectivePomSkip: false
+        sonarQubeRunAnalysis: false
+    - task: SonarCloudPrepare@1
+      inputs:
+        SonarCloud: 'Sonarcloud'
+        organization: 'fabianes00'
+        projectKey: 'Fabianes00_spring-boot-kubernetes'
+        projectName: 'spring-boot-kubernetes'
+    - task: Maven@4
+      inputs:
+        mavenPomFile: 'pom.xml'
+        publishJUnitResults: true
+        testResultsFiles: '**/surefire-reports/TEST-*.xml'
+        javaHomeOption: 'JDKVersion'
+        mavenVersionOption: 'Default'
+        mavenAuthenticateFeed: false
+        effectivePomSkip: false
+        sonarQubeRunAnalysis: true
+        sqMavenPluginVersionChoice: 'latest'
+
+    - task: sonarcloud-buildbreaker@2
+      inputs:
+        SonarCloud: 'Sonarcloud'
+        organization: 'fabianes00'
+
+- stage: SCA
+  jobs:
+  - job:
+    steps:
+    - task: Maven@4 
+      inputs:
+        mavenPomFile: 'pom.xml'
+        publishJUnitResults: true
+        testResultsFiles: '**/surefire-reports/TEST-*.xml'
+        javaHomeOption: 'JDKVersion'
+        mavenVersionOption: 'Default'
+        mavenAuthenticateFeed: false
+        effectivePomSkip: false
+        sonarQubeRunAnalysis: false
+    - task: dependency-check-build-task@6
+      inputs:
+        projectName: 'spring-boot-kubernetes'
+        scanPath: '$(Build.SourcesDirectory)/target'
+        format: 'HTML'

src/main/Credentials.java

@@ -0,0 +1,7 @@
+import org.h2.security.SHA256;
+
+public class Credentials {
+  String inputString = "s3cr37";
+  byte[] key         = inputString.getBytes();
+  SHA256.getHMAC(key, message);  // Noncompliant
+}

src/main/java/org/soyphea/k8s/Credentials2.java

@@ -0,0 +1,30 @@
+package org.soyphea.k8s;
+
+public class Credentials2 {
+  /*
+  public void getCredentials() {
+    String inputString = "s3cr37";
+    byte[] key         = inputString.getBytes();
+  }
+
+  protected void doGet(HttpServletRequest req, HttpServletResponse resp) {
+    String input = req.getParameter("input");
+
+    ScriptEngineManager manager = new ScriptEngineManager();
+    ScriptEngine engine = manager.getEngineByName("JavaScript");
+    engine.eval(input); // Noncompliant
+  }
+  */
+
+  public void run(javax.servlet.http.HttpServletRequest request) throws ClassNotFoundException {
+      String name = request.getParameter("name");
+      Class clazz = Class.forName(name);  // Noncompliant
+  }
+
+  public void run2(javax.servlet.http.HttpServletRequest request) throws ClassNotFoundException {
+      String name = request.getParameter("name");
+      Class clazz = Class.forName(name);  // Noncompliant
+
+
+  }
+}