diff --git a/.github/workflows/blackducksca-workflow.yml b/.github/workflows/blackducksca-workflow.yml new file mode 100644 index 00000000..1994df43 --- /dev/null +++ b/.github/workflows/blackducksca-workflow.yml @@ -0,0 +1,40 @@ +name: Black Duck Security Scan +on: + push: + branches: + - main + - master + - develop + - stage + - release + pull_request: + branches: + - main + - master + - develop + - stage + - release + workflow_dispatch: {} +jobs: + blackducksca: + runs-on: ubuntu-latest + steps: + - name: Checkout Source + uses: actions/checkout@v4 + - name: Black Duck Security Scan + id: black-duck-security-scan + uses: blackduck-inc/black-duck-security-scan@v2 + env: + DETECT_PROJECT_NAME: MK-${{ github.event.repository.name }} + with: + blackducksca_url: ${{ vars.BLACKDUCKSCA_URL }} + blackducksca_token: ${{ secrets.BLACKDUCKSCA_TOKEN }} + blackducksca_waitForScan: true + mark_build_status: failure + include_diagnostics: false + blackducksca_prComment_enabled: false + blackducksca_fixpr_enabled: false + blackducksca_reports_sarif_create: false + blackducksca_upload_sarif_report: false + blackducksca_scan_failure_severities: 'BLOCKER,CRITICAL' + detect_args: "--detect.excluded.detector.types=GIT" diff --git a/.github/workflows/polaris-workflow.yml b/.github/workflows/polaris-workflow.yml new file mode 100644 index 00000000..7e57aa64 --- /dev/null +++ b/.github/workflows/polaris-workflow.yml @@ -0,0 +1,38 @@ +name: Polaris Security Scan +on: + push: + branches: + - main + - master + - develop + - stage + - release + pull_request: + branches: + - main + - master + - develop + - stage + - release + workflow_dispatch: {} +jobs: + polaris: + runs-on: ubuntu-latest + steps: + - name: Checkout Source + uses: actions/checkout@v4 + - name: Polaris Security Scan + id: polaris-scan + uses: blackduck-inc/black-duck-security-scan@v2 + with: + polaris_server_url: ${{ vars.POLARIS_URL }} + polaris_access_token: ${{ secrets.POLARIS_ACCESS_TOKEN }} + polaris_application_name: mkoishi-application + polaris_project_name: MK-java-sec-code + polaris_assessment_types: SAST + polaris_waitForScan: true + mark_build_status: failure + include_diagnostics: false + polaris_prComment_enabled: false + polaris_reports_sarif_create: false + polaris_upload_sarif_report: false diff --git a/.github/workflows/synopsys-blackduck.yml b/.github/workflows/synopsys-blackduck.yml new file mode 100644 index 00000000..b3c606bf --- /dev/null +++ b/.github/workflows/synopsys-blackduck.yml @@ -0,0 +1,42 @@ +# Obsolte workflow file but to be kept for reference purpose +name: Synopsys Security Testing for Black Duck + +on: + push: + branches: [ master, main ] + + pull_request: + branches: [ master, main ] + +jobs: + build: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v3 + - name: Synopsys Action + uses: synopsys-sig/synopsys-action@v1.1.0 + with: + blackduck_apiToken: ${{ secrets.BLACKDUCK_API_TOKEN }} + blackduck_url: ${{ secrets.BLACKDUCK_URL }} + + # Optional parameter. By default, pushes will initiate a full "intelligent" scan and pull requests + # will initiate a rapid scan. + blackduck_scan_full: true + # Required parameter if blackduck_automation_fixpr is enabled + # Make sure GITHUB_TOKEN have appropriate permissions + github_token: ${{ secrets.MY_GITHUB_TOKEN }} + # Optional parameter. By default, create fix pull requests if vulnerabilities are reported + # Passing false will disable fix pull request creation + blackduck_automation_fixpr: false + # Optional parameter. The values could be. ALL|NONE|BLOCKER|CRITICAL|MAJOR|MINOR|OK|TRIVIAL|UNSPECIFIED + # Single parameter + #blackduck_scan_failure_severities: "ALL" + # multiple parameters + #blackduck_scan_failure_severities: "NONE" + blackduck_scan_failure_severities: "BLOCKER,CRITICAL" + blackduck_automation_prcomment: true + # Optional parameter, but usually specified - the location of the Synopsys Bridge software + # The Synopsys Bridge software distribution is platform specific - this must match the host OS + # of your runner. For example in this case, we are using the latest version for Linux. + #bridge_download_url: ${{ env.LINUX_BRIDGE_URL }} diff --git a/screwdriver.yaml b/screwdriver.yaml new file mode 100644 index 00000000..a86b0144 --- /dev/null +++ b/screwdriver.yaml @@ -0,0 +1,66 @@ +# inherit. In our example, we state that all our Jobs will use the same Docker +# container for building in. +shared: + # Docker image to use as the desired build container. This typically takes the + # form of "repo_name". Alternatively, you can define the image as + # "repo_name:tag_label". + # + # (Source: https://hub.docker.com/r/library/buildpack-deps/) + image: maven:3.8.5-openjdk-17 + +# Job definition block +# "main" is a default job that all pipelines have +jobs: + # Jobs are defined by name. + # All pipelines have "main" implicitly defined. The definitions in your + # screwdriver.yaml file will override the implied defaults. + main: + # Requires is a single job name or array of job names that will trigger the job to run. + # Jobs defined with "requires: ~pr" are started by pull-request events. + # Jobs defined with "requires: ~commit" are started by push events. + # Jobs defined with "requires: ~sd@123:main" are started by job "main" from pipeline "123". + # Jobs defined with "requires: main" are started after "main" is done. + # Jobs defined with "requires: [deploy-west, deploy-east] are started after "deploy-west" and "deploy-east" are both done running successfully. + requires: [~pr, ~commit] + # Steps is the list of commands to execute. + steps: + # Each step takes the form "step_name: command_to_run". + # The "step_name" is a convenient label to reference it by. The + # "command_to_run" is the single command that is executed during this + # step. Environment variables will be passed between steps, within + # the same job (as shown below). + - export: export BRINGUP="We're bringing up the build env now!" + - console: echo $BRINGUP + - mkdir: mkdir -p /opt/node + - node: curl -fsSL https://nodejs.org/dist/v16.16.0/node-v16.16.0-linux-x64.tar.gz -o /opt/node/node-v16.16.0-linux-x64.tar.gz + - tar: tar -xzf /opt/node/node-v16.16.0-linux-x64.tar.gz + - path: PATH="${PATH}:/opt/node/node-v16.16.0-linux-x64/bin" + # Metadata is a structured key/value storage of relevant information about a build. + # Metadata will be shared with subsequent builds in the same workflow. + # You can set any key using the command "meta set ". + #- set-metadata: meta set example.coverage 99.95 + # We define another Job called "second_job". In this Job, we intend on running + # a different set of commands. + build: + requires: main + steps: + # The "make_target" step calls a Makefile target to perform some set of + # actions. This is incredibly useful when you need to perform a multi-line + # command. + - export: export BUILDING="We are building now!" + - console: echo $BUILDING + - sleep 300 + - build: mvn clean compile + # You can get metadata that was set using the command "meta get ". + #- get-metadata: meta get example + # The "run_arbitrary_script" executes a script. This is an alternative to + # a Makefile target where you want to run a series of commands related to + # this step + #- run_arbitrary_script: ./my_script.sh + test: + requires: build + steps: + - export: export TESTING="We are SASTing now!" + - console: echo $TESTING + - teardown-1: echo "Good-bye" + - teardown-2: rm -rf /var/lib/apt/lists/* diff --git a/src/main/ipd-code-tagging-test-2.py b/src/main/ipd-code-tagging-test-2.py new file mode 100644 index 00000000..3e52f716 --- /dev/null +++ b/src/main/ipd-code-tagging-test-2.py @@ -0,0 +1,9 @@ +def calculate_average(numbers): + if not numbers: + return 0 # Avoid division by zero + return sum(numbers) / len(numbers) + +# Example usage: +my_list = [10, 20, 30, 40] +average = calculate_average(my_list) +print("The calculated average is:", average) diff --git a/src/main/ipd-code-tagging-test-3.py b/src/main/ipd-code-tagging-test-3.py new file mode 100644 index 00000000..85ffc885 --- /dev/null +++ b/src/main/ipd-code-tagging-test-3.py @@ -0,0 +1,8 @@ +def multiply_numbers(*numbers): + result = 1 + for num in numbers: + result *= num + print("The multiplication result is:", result) + +# Example usage: +multiply_numbers(2, 5, 3) # Output: The multiplication result is: 30 \ No newline at end of file diff --git a/src/main/ipd-code-tagging-test-4.py b/src/main/ipd-code-tagging-test-4.py new file mode 100644 index 00000000..ef2e3be7 --- /dev/null +++ b/src/main/ipd-code-tagging-test-4.py @@ -0,0 +1,24 @@ +# Population numbers (approximate, as of 2025) +china_population = 1411750000 +japan_population = 124300000 +south_korea_population = 51780000 +thailand_population = 71700000 +indonesia_population = 279100000 +nepal_population = 30700000 +india_population = 1426250000 + +populations = [ + china_population, + japan_population, + south_korea_population, + thailand_population, + indonesia_population, + nepal_population, + india_population +] + +total_population = sum(populations) +average_population = total_population / len(populations) + +print("Total population:", total_population) +print("Average population:", average_population) \ No newline at end of file diff --git a/src/main/ipd-code-tagging-test.py b/src/main/ipd-code-tagging-test.py new file mode 100644 index 00000000..0d709b0d --- /dev/null +++ b/src/main/ipd-code-tagging-test.py @@ -0,0 +1,13 @@ +def process_numbers(numbers): + # Calculate sum of even numbers + even_sum = sum(num for num in numbers if num % 2 == 0) + # Calculate average of all numbers + average = sum(numbers) / len(numbers) if numbers else 0 + print("Average of all numbers:", average) + return even_sum + +# Example usage: +input_str = input("Enter numbers separated by spaces: ") +numbers = list(map(int, input_str.split())) +result = process_numbers(numbers) +print("Sum of even numbers:", result) \ No newline at end of file diff --git a/src/main/java/org/joychou/util/JwtUtils.java b/src/main/java/org/joychou/util/JwtUtils.java index bb33642e..dbfb5c20 100644 --- a/src/main/java/org/joychou/util/JwtUtils.java +++ b/src/main/java/org/joychou/util/JwtUtils.java @@ -85,7 +85,7 @@ public static Boolean verifyTokenByJavaJwt(String token) { public static String getNicknameByJavaJwt(String token) { // If the signature is not verified, there will be security issues. if (!verifyTokenByJavaJwt(token)) { - log.error("token is invalid"); + log.error("Token is invalid"); return null; } return JWT.decode(token).getClaim("nickname").asString();