You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: _labs/lab1.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -38,7 +38,7 @@ Although Dependabot isn't part of the GitHub Advanced Security product suite, it
38
38
39
39
40
40
41
-
<imgsrc="images/lab-1-1-1.png"/>
41
+
42
42
</details>
43
43
44
44
### Exercise 2: Enable Code Scanning
@@ -50,19 +50,19 @@ Although Dependabot isn't part of the GitHub Advanced Security product suite, it
50
50
- By default, it will scan the JavaScript code, use the default CodeQL queries (for highest precision), and scan the default branch on push, pull request, and on a weekly schedule.
51
51
52
52
<details>
53
-
<imgsrc="images/lab-1-2-1.png"/>
53
+
54
54
</details>
55
55
56
56
4. Click the **Enable CodeQL** button to save the settings and enable Code Scanning.
57
57
58
58
<details>
59
-
<imgsrc="images/lab-1-2-2.png"/>
59
+
60
60
</details>
61
61
62
62
5. Ensure that **Copilot Autofix** is enabled (in the **Code Scanning --> Tools** section).
63
63
64
64
<details>
65
-
<imgsrc="images/lab-1-2-3.png"/>
65
+
66
66
</details>
67
67
68
68
> [!NOTE]
@@ -82,7 +82,7 @@ Although Dependabot isn't part of the GitHub Advanced Security product suite, it
82
82
- In Private and internal repositories in organizations using GitHub Enterprise Cloud with GitHub Advanced Security enabled, you can change this to only allow select users/teams (or no one) to bypass secret scanning push protection.
Copy file name to clipboardExpand all lines: _labs/lab2.md
+14-14Lines changed: 14 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,13 +8,13 @@ Now that we have all of the security feature enabled, let's review the security
8
8
2. Click **Dependabot** under the **Vulnerability alerts** heading.
9
9
10
10
<details>
11
-
<imgsrc="images/lab-2-1-1.png"/>
11
+
12
12
</details>
13
13
14
14
3. You should see a number of Dependabot alerts with various severities. Click on one of the alerts to see more information about it.
15
15
16
16
<details>
17
-
<imgsrc="images/lab-2-1-2.png"/>
17
+
18
18
</details>
19
19
20
20
4. When reviewing a Dependabot alert, you can see the following information (see if you can locate this information in the alert you opened):
@@ -30,7 +30,7 @@ Now that we have all of the security feature enabled, let's review the security
30
30
- The alert timeline (for example, it should show that Dependabot just recently opened the alert. Once you close an alert, it will show who and when closed it here too).
31
31
32
32
<details>
33
-
<imgsrc="images/lab-2-1-3.png"/>
33
+
34
34
</details>
35
35
36
36
5. You can manually close an alert by clicking on the **Dismiss alert** button in the upper right hand corner. It's not recommended to close alerts manually, but there may be times where this is helpful (for example, the code that contains the alert is not used).
@@ -53,14 +53,14 @@ Now that we have all of the security feature enabled, let's review the security
53
53
- Reviewing the **Critical** and **High** security alerts is another great place to start when prioritizing.
54
54
55
55
<details>
56
-
<imgsrc="images/lab-2-1-4.png"/>
56
+
57
57
</details>
58
58
59
59
9. If you put your cursor in the search box (should have `is:open` by default), there are additional filter options. Some of the common filter options are **scope** (runtime or development) and **has** (for example, `has:patch`).
60
60
10. Update the search query to `is:open has:patch`. This will filter out all of the alerts that don't have a patch available and only show alerts where there is a non-vulnerable version to upgrade to.
61
61
62
62
<details>
63
-
<imgsrc="images/lab-2-1-5.png"/>
63
+
64
64
</details>
65
65
66
66
@@ -69,13 +69,13 @@ Now that we have all of the security feature enabled, let's review the security
69
69
12. Add a rule to snooze any alerts that do not have a fix available. Choose the "gear" icon and select the `New rule` button. Name the rule `Snooze when no patch available`, add a target metadata for all npm packages: `ecosystem:npm` and ensure the `Dismiss Alerts` - `Until patch is available` is selected. Next, select `Create rule`.
70
70
71
71
<details>
72
-
<imgsrc="images/lab-2-1-6.png"/>
72
+
73
73
</details>
74
74
75
75
13. Navigating back to the **Security** tab / **Dependabot** under the **Vulnerability alerts** heading. You will see `1 Closed` heading. Select this to find your alert `Command Injection in marsdb` without any fix has now been `Dismissed` as `auto-dismissed`. The audit log will note `Repository rule created and Snooze when no patch available was applied`
76
76
77
77
<details>
78
-
<imgsrc="images/lab-2-1-7.png"/>
78
+
79
79
</details>
80
80
81
81
## Exercise 2: Reviewing Code Scanning alerts
@@ -84,15 +84,15 @@ Now that we have all of the security feature enabled, let's review the security
84
84
2. We should have a number of alerts. If you don't see any alerts yet, skip ahead to the next exercise and come back to this one. More than likely, the code scanning workflow hasn't finished yet (it takes between 2-5 minutes to run).
85
85
86
86
<details>
87
-
<imgsrc="images/lab-2-2-1.png"/>
87
+
88
88
</details>
89
89
90
90
3. If there are code scanning alerts, spend a few moments reviewing them. We can **filter/sort** by severity, tool, language, and a few other options, just like with Dependabot alerts.
91
91
4. A common search/filter to use is **Autofilter** to filter out the alerts with a **test** tag (code scanning violations found in test files). This can help you focus on the alerts that are more likely to be real vulnerabilities.
92
92
5. To use the autofilter filter, paste this into the search box: `is:open branch:main autofilter:true` (or type/select it by hand).
93
93
94
94
<details>
95
-
<imgsrc="images/lab-2-2-2.png"/>
95
+
96
96
</details>
97
97
98
98
6. Scroll down and let's click on one of the SQL injection alerts. These can be found by searching for the title **Database query built from user-controlled sources**.
@@ -107,7 +107,7 @@ Now that we have all of the security feature enabled, let's review the security
107
107
- The affected branch
108
108
109
109
<details>
110
-
<imgsrc="images/lab-2-2-3.png"/>
110
+
111
111
</details>
112
112
113
113
8. Click on the **Show paths** link to review the vulnerability from the source to the sink.
@@ -125,7 +125,7 @@ Now that we have all of the security feature enabled, let's review the security
125
125
- The nice thing with code scanning alerts (just like Dependabot alerts) is that once you merge the code that resolves an alert, the alert will be automatically closed. This is because the alert is no longer present in the code.
126
126
127
127
<details>
128
-
<imgsrc="images/lab-2-2-4.png"/>
128
+
129
129
</details>
130
130
131
131
15. We will merge this in change in. But first, we have to wait for the CodeQL workflow to finish running to ensure we aren't introducing any *new* vulnerabilities into the codebase. The workflow run will take 2-5 minutes.
@@ -148,7 +148,7 @@ Now that we have all of the security feature enabled, let's review the security
148
148
2. Under the **Security** tab in the repo, click on the **Secret scanning** view. This will show all of the secret scanning alerts. (This should be empty for you.)
149
149
150
150
<details>
151
-
<imgsrc="images/lab-2-3-1.png"/>
151
+
152
152
</details>
153
153
154
154
3. Viewing a secret scanning alert shows details about the leak
@@ -158,14 +158,14 @@ Now that we have all of the security feature enabled, let's review the security
158
158
- If you re-write history, the secret will still be valid and could be used by an attacker. Also, re-writing history modifies commit hashes and can make traceability more difficult.
159
159
160
160
<details>
161
-
<imgsrc="images/lab-2-3-4.png"/>
161
+
162
162
</details>
163
163
164
164
4. If you view an alert and choose **Verify secret** and this time, it says **secret inactive**. This is a good candidate to **Close as** --> **Revoked**.
165
165
- Unlike Dependabot alerts and Code Scanning alerts, secret scanning alerts are not automatically closed when the secret is removed from the code - whether by a new commit or by re-writing history. This is because the secret was exposed and you don't know who may have seen it. So, you have to manually close the alert once you revoke the token.
Copy file name to clipboardExpand all lines: _labs/lab3.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -39,15 +39,15 @@ models.sequelize.query(`SELECT * FROM Users WHERE email = '${req.body.email || '
39
39
13. After the pull request is created, the code scanning job will have been initiated. You can see the status of the job in the pull request checks. It will take a few minutes to run.
40
40
41
41
<details>
42
-
<imgsrc="images/lab-3-1-3.png"/>
42
+
43
43
</details>
44
44
45
45
10. CodeQL should find the vulnerability, so the check will fail. Also, we should see Copilot create us an autofix on the PR that we can review.
46
46
11. It might take Copilot a few moments to create the autofix.
47
47
12. Review the autofix - we can prevent a vulnerability from entering the repository now with a click of a button! 🎉 ⚠️⚠️ **But don't commit the suggestion yet.** ⚠️⚠️
48
48
49
49
<details>
50
-
<imgsrc="images/lab-3-1-4.png"/>
50
+
51
51
</details>
52
52
53
53
## Exercise 2: Creating a code scanning ruleset
@@ -61,7 +61,7 @@ Without a ruleset (GitHub's new version of branch protections), even though Code
61
61
2. On the left hand list of options, click on **Rules --> Rulesets**.
62
62
63
63
<details>
64
-
<imgsrc="images/lab-3-2-1.png"/>
64
+
65
65
</details>
66
66
67
67
3. Click on **New ruleset ▾ --> New branch ruleset**
@@ -74,14 +74,14 @@ Without a ruleset (GitHub's new version of branch protections), even though Code
74
74
5. Scroll down and click the **Create** button.
75
75
76
76
<details>
77
-
<imgsrc="images/lab-3-2-2.png"/>
77
+
78
78
</details>
79
79
80
80
7. With the ruleset created, both the JavaScript scan has to finish and no vulnerabilities found with CodeQL in order to merge the code.
81
81
8. Navigate back to our open PR. The **Merge pull request** button should now be grayed out, preventing us from merging vulnerable code.
4. Under the **Dependency Review** workflow, click **Configure**.
13
13
14
14
<details>
15
-
<imgsrc="images/lab-4-1-1.png"/>
15
+
16
16
</details>
17
17
18
18
5. Review the action and its defaults on line 32-39. This action can also block specific open source license types.
19
19
6. In the upper right, click on **Commit changes...**
20
20
7. Since we have a ruleset, we have to create a branch and merge this to main via pull request. Create a branch and commit (**Propose changes**) the changes.
21
21
22
22
<details>
23
-
<imgsrc="images/lab-4-1-2.png"/>
23
+
24
24
</details>
25
25
26
26
8. On the next screen, use the Copilot icon in the formatting bar to generate a pull request description.
27
27
28
28
<details>
29
-
<imgsrc="images/lab-4-1-3.png"/>
29
+
30
30
</details>
31
31
32
32
9. Click **Create pull request**.
33
33
10. Wait for the code scanning job to finish. It will take a few minutes to run.
34
34
- You will notice that the Dependency Review workflow ran against this PR and didn't report any issues.
35
35
36
36
<details>
37
-
<imgsrc="images/lab-4-1-4.png"/>
37
+
38
38
</details>
39
39
40
40
11. Merge the PR once the code scanning completes.
17. Search for `dependency-review` and add it (it should show up under **suggestions**).
47
47
48
48
<details>
49
-
<imgsrc="images/lab-4-1-5.png"/>
49
+
50
50
</details>
51
51
52
52
18. Save the changes to the ruleset.
@@ -66,7 +66,7 @@ Now, let's attempt to add a vulnerable dependency to the codebase and test out t
66
66
```
67
67
68
68
<details>
69
-
<imgsrc="images/lab-4-2-1.png"/>
69
+
70
70
</details>
71
71
72
72
6. Click the **Commit changes** button.
@@ -77,7 +77,7 @@ Now, let's attempt to add a vulnerable dependency to the codebase and test out t
77
77
11. It should make a comment to the pull request with a note that it found a vulnerable package dependency. In fact, adding this one package would introduce 3 new vulnerabilities to our codebase.
78
78
79
79
<details>
80
-
<imgsrc="images/lab-4-2-2.png"/>
80
+
81
81
</details>
82
82
83
83
12. Also, the status check will be marked as failed, preventing the pull request from being merged.
Copy file name to clipboardExpand all lines: _labs/lab5.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -20,7 +20,7 @@ Let's use Secret Scanning with push protections to prevent secrets from entering
20
20
13. Push protection should detect the GitHub personal access token and block the push - great!
21
21
22
22
<details>
23
-
In the UI:</br><imgsrc="images/lab-5-1-1.png"/></br></br>
23
+
In the UI:</br></br></br>
24
24
</details>
25
25
26
26
14. Depending on how the settings are configured, we could bypass the push protection and push the secret to the repository. But, we don't want to do that! 🙅♂️ Repository admins and organization owners would receive an email notification if we did.
0 commit comments