Sign inSign up

mateusperdigao/secure-code-tools

By mateusperdigao

•Updated over 1 year ago

A container with several security tools

Image
Security
0

135

mateusperdigao/secure-code-tools repository overview

⁠secure-code-tools

A Docker-based security and code analysis toolbox with:

  • Bandit: Python static analyzer (with SARIF support)
  • Cloc: Count lines of code
  • Lizard: Cyclomatic complexity analyzer
  • Trivy: Vulnerability scanner (files, dependencies, container images)
  • CodeQL: Code analysis tool for finding vulnerabilities in code (*only linux and windows)
  • Multi-language package manager support: Auto-generate lock files for analysis

⁠Tools Installed

ToolDescriptionCommand Example
BanditPython security linter with SARIF outputbandit -r /src -f sarif -o /src/bandit.sarif
ClocCount lines of codecloc /src
LizardCode complexity analysislizard /src
TrivyVulnerability scanningtrivy fs /src
PoetryPython dependency manager (lock file generator)poetry lock
PipenvPython environment and dependency managerpipenv lock
npmNode.js package managernpm install --package-lock-only
YarnAlternative Node.js package manageryarn install --mode update-lockfile
GoGo dependency and module managergo mod tidy
BundlerRuby dependency managerbundle lock
ComposerPHP dependency managercomposer update --lock
CargoRust package managercargo generate-lockfile
.NET CLIC#/.NET project restore & lock file generationdotnet restore --use-lock-file
CodeQLCode analysis tool for detecting vulnerabilities and bugscodeql database analyze /src --format=csv --output=/src/codeql-results.csv

⁠Run Code Analysis and Security Tools

Bandit (with SARIF)

docker run --rm -v $(pwd):/src secure-code-tools bandit -r /src -f sarif -o /src/bandit-output.sarif

Cloc

docker run --rm -v $(pwd):/src secure-code-tools cloc /src

Lizard

docker run --rm -v $(pwd):/src secure-code-tools lizard /src

Trivy (Filesystem Scan)

docker run --rm -v $(pwd):/src secure-code-tools trivy fs /src

CodeQL

For Linux/Windows: To run CodeQL queries on your project, you first need to create a database and analyze it.

  1. Create a CodeQL database:
docker run --rm -v $(pwd):/src secure-code-tools codeql database create /src/codeql-db --language=python
  1. Analyze the database with CodeQL:
docker run --rm -v $(pwd):/src secure-code-tools codeql database analyze /src/codeql-db --format=csv --output=/src/codeql-results.csv

⁠Generate Lock Files for Dependency Scanning

Node.js (npm):

docker run --rm -v $(pwd):/src secure-code-tools npm install

Node.js (Yarn):

docker run --rm -v $(pwd):/src secure-code-tools yarn install

Python (Poetry):

docker run --rm -v $(pwd):/src secure-code-tools poetry lock

Python (Pipenv):

docker run --rm -v $(pwd):/src secure-code-tools pipenv lock

Go

docker run --rm -v $(pwd):/src secure-code-tools go mod tidy

Ruby (Bundler):

docker run --rm -v $(pwd):/src secure-code-tools bundle lock

PHP (Composer):

docker run --rm -v $(pwd):/src secure-code-tools composer update --lock

Rust (Cargo):

docker run --rm -v $(pwd):/src secure-code-tools cargo generate-lockfile

C# (.NET):

docker run --rm -v $(pwd):/src secure-code-tools dotnet restore --use-lock-file

Tag summary

Content type

Image

Digest

sha256:423f976f8…

Size

894.3 MB

Last updated

over 1 year ago

docker pull mateusperdigao/secure-code-tools:mac