Add ShiftLeft build rules

[yuval-piiano]

This pull request enables build rules. You can read more about build rules here. The build rules are controlled by the shiftleft.yml file in the repository.

Visit shiftleft.io to see the security findings for this repository.

We've done a few things on your behalf

• Forked this demo application
• Generated a unique secret SHIFTLEFT_ACCESS_TOKEN to allow GitHub Actions in this repository to communicate with the ShiftLeft API
• Committed a GitHub Action that will invoke ShiftLeft CORE's NextGen Static Application Security Testing (NG SAST) on all future pull requests on this repository
• Created this pull request that demonstrates build rules. It also adds a status check that displays the result of the GitHub Action

Questions? Comments? Want to learn more? Get in touch with us or check out our documentation.

[github-actions]

Checking analysis of application shiftleft-java-demo against 3 build rules.

Using sl version 0.9.1632 (3f5a7a36070b01cc0876e665bfc14e07c4b1dac4).

Checking findings on scan 1.

Results per rule:

• Allow no critical findings: FAIL
  (48 matched vulnerabilities; configured threshold is 0).

  First 5 findings:

  ID	CVSS	Rating	CVE	Title
  26	10.0	critical	GMS-2022-560	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework.boot:spring-boot-starter-web.
  216	10.0	critical	GMS-2022-559	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-core.
  221	10.0	critical	GMS-2022-558	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-beans.
  231	10.0	critical	CVE-2018-14721	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to b…
  23	9.8	critical	CVE-2022-22965	Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability known as Spring4Shell.

  Severity rating	Count
  Critical	48
  High	0
  Medium	0
  Low	0

  Finding Type	Count
  Oss_vuln	41
  Container	4
  Vuln	3

  Category	Count
  Directory Traversal	2
  Remote Code Execution	1

  OWASP 2021 Category	Count
  A01-Broken-Access-Control	2
  A03-Injection	1

• Allow one OSS or container finding: FAIL
  (173 matched vulnerabilities; configured threshold is 1).

  First 5 findings:

  ID	CVSS	Rating	CVE	Title
  26	10.0	critical	GMS-2022-560	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework.boot:spring-boot-starter-web.
  216	10.0	critical	GMS-2022-559	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-core.
  221	10.0	critical	GMS-2022-558	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-beans.
  231	10.0	critical	CVE-2018-14721	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to b…
  23	9.8	critical	CVE-2022-22965	Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability known as Spring4Shell.

  Severity rating	Count
  Critical	45
  High	82
  Medium	43
  Low	3

  Finding Type	Count
  Oss_vuln	143
  Container	30

• Allow no reachable OSS vulnerability: FAIL
  (35 matched vulnerabilities; configured threshold is 0).

  First 5 findings:

  ID	CVSS	Rating	CVE	Title
  90	9.8	critical	CVE-2020-1938	When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as havin…
  107	9.8	critical	CVE-2018-8014	The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure…
  157	9.8	critical	CVE-2017-5651	The refactoring of the HTTP connectors introduced a regression in the send file processing. If the file processing completed quickly, it is possible for t…
  150	9.1	critical	CVE-2017-5648	Some calls to application listeners in Apache Tomcat did not use the appropriate facade object. When running an untrusted application under a SecurityMana…
  104	8.1	high	CVE-2019-0232	When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is v…

  Severity rating	Count
  Critical	4
  High	17
  Medium	13
  Low	1

3 rules failed.