136 lines
4.6 KiB
Bash
Executable file
136 lines
4.6 KiB
Bash
Executable file
#!/bin/bash
|
||
|
||
# Local Security Testing Script
|
||
# Run SAST and basic security checks locally before pushing
|
||
|
||
set -e
|
||
|
||
echo "🔒 Starting Local Security Tests..."
|
||
echo ""
|
||
|
||
# Colors for output
|
||
RED='\033[0;31m'
|
||
GREEN='\033[0;32m'
|
||
YELLOW='\033[1;33m'
|
||
NC='\033[0m' # No Color
|
||
|
||
# Function to print colored output
|
||
print_status() {
|
||
echo -e "${2}${1}${NC}"
|
||
}
|
||
|
||
# 1. NPM Audit
|
||
print_status "📦 Running NPM Audit..." "$YELLOW"
|
||
echo "Backend:"
|
||
cd backend
|
||
npm audit --audit-level=moderate || true
|
||
cd ..
|
||
|
||
echo ""
|
||
echo "Frontend:"
|
||
cd frontend
|
||
npm audit --audit-level=moderate || true
|
||
cd ..
|
||
echo ""
|
||
|
||
# 2. ESLint Security Check
|
||
print_status "🔍 Running ESLint Security Scan..." "$YELLOW"
|
||
echo "Installing eslint-plugin-security if needed..."
|
||
cd backend
|
||
npm install --save-dev eslint eslint-plugin-security 2>/dev/null || true
|
||
npx eslint . --ext .js || print_status "⚠️ Backend ESLint issues found" "$YELLOW"
|
||
cd ..
|
||
|
||
cd frontend
|
||
npm install --save-dev eslint eslint-plugin-security eslint-plugin-react eslint-plugin-react-hooks 2>/dev/null || true
|
||
npx eslint . --ext .js,.jsx || print_status "⚠️ Frontend ESLint issues found" "$YELLOW"
|
||
cd ..
|
||
echo ""
|
||
|
||
# 3. Sensitive Data Check
|
||
print_status "🔐 Checking for sensitive data..." "$YELLOW"
|
||
if grep -r -i "password.*=" --include="*.js" --include="*.jsx" --exclude-dir="node_modules" . | grep -v "password.*process.env" | grep -v "password.*req.body" | grep -v "password:" | grep -v "// password"; then
|
||
print_status "⚠️ Potential hardcoded passwords found" "$RED"
|
||
else
|
||
print_status "✅ No hardcoded passwords detected" "$GREEN"
|
||
fi
|
||
|
||
if grep -r "api[_-]?key.*=.*['\"][a-zA-Z0-9]" --include="*.js" --include="*.jsx" --exclude-dir="node_modules" . | grep -v "process.env"; then
|
||
print_status "⚠️ Potential hardcoded API keys found" "$RED"
|
||
else
|
||
print_status "✅ No hardcoded API keys detected" "$GREEN"
|
||
fi
|
||
echo ""
|
||
|
||
# 4. SQL Injection Check
|
||
print_status "💉 Checking for SQL injection vulnerabilities..." "$YELLOW"
|
||
if grep -r "db.run\|db.all\|db.get" --include="*.js" backend/ | grep -v "?" | grep -v "\[" | grep "\`"; then
|
||
print_status "⚠️ Potential SQL injection vulnerabilities found (template literals)" "$RED"
|
||
else
|
||
print_status "✅ No obvious SQL injection issues" "$GREEN"
|
||
fi
|
||
echo ""
|
||
|
||
# 5. XSS Check
|
||
print_status "🌐 Checking for XSS vulnerabilities..." "$YELLOW"
|
||
if grep -r "dangerouslySetInnerHTML\|innerHTML" --include="*.js" --include="*.jsx" frontend/src/ ; then
|
||
print_status "⚠️ Potential XSS vulnerabilities found" "$YELLOW"
|
||
else
|
||
print_status "✅ No obvious XSS issues" "$GREEN"
|
||
fi
|
||
echo ""
|
||
|
||
# 6. Dependency Check
|
||
print_status "📚 Checking dependency versions..." "$YELLOW"
|
||
outdated_backend=$(cd backend && npm outdated || true)
|
||
outdated_frontend=$(cd frontend && npm outdated || true)
|
||
|
||
if [ ! -z "$outdated_backend" ] || [ ! -z "$outdated_frontend" ]; then
|
||
print_status "⚠️ Outdated dependencies found. Run 'npm outdated' for details" "$YELLOW"
|
||
else
|
||
print_status "✅ All dependencies up to date" "$GREEN"
|
||
fi
|
||
echo ""
|
||
|
||
# 7. Docker Security (if Docker is available)
|
||
if command -v docker &> /dev/null; then
|
||
print_status "🐳 Checking Docker configuration..." "$YELLOW"
|
||
|
||
if grep -q "latest" Dockerfile; then
|
||
print_status "⚠️ Using 'latest' tag in Dockerfile is not recommended" "$YELLOW"
|
||
fi
|
||
|
||
if ! grep -q "USER" Dockerfile; then
|
||
print_status "⚠️ Dockerfile doesn't specify non-root USER" "$YELLOW"
|
||
else
|
||
print_status "✅ Dockerfile uses non-root user" "$GREEN"
|
||
fi
|
||
else
|
||
print_status "ℹ️ Docker not available, skipping Docker checks" "$YELLOW"
|
||
fi
|
||
echo ""
|
||
|
||
# 8. Environment Variables Check
|
||
print_status "🔑 Checking environment configuration..." "$YELLOW"
|
||
if [ -f ".env" ]; then
|
||
print_status "⚠️ .env file found - ensure it's in .gitignore!" "$YELLOW"
|
||
if grep -q ".env" .gitignore; then
|
||
print_status "✅ .env is in .gitignore" "$GREEN"
|
||
else
|
||
print_status "❌ .env NOT in .gitignore - SECURITY RISK!" "$RED"
|
||
fi
|
||
else
|
||
print_status "✅ No .env file in root directory" "$GREEN"
|
||
fi
|
||
echo ""
|
||
|
||
# Summary
|
||
print_status "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" "$GREEN"
|
||
print_status "✅ Local security checks completed!" "$GREEN"
|
||
print_status "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" "$GREEN"
|
||
echo ""
|
||
print_status "💡 For comprehensive security testing:" "$YELLOW"
|
||
echo " 1. Push to GitHub to trigger automated SAST/DAST scans"
|
||
echo " 2. Run 'npm run security:full' for detailed reports"
|
||
echo " 3. Review GitHub Security tab for vulnerability alerts"
|
||
echo ""
|