Blocking insecure code with locking
Systems and methods for preventing vulnerable software assets from being deployed by modifying the underlying source code in such a way that a build of the software asset will fail. In one aspect of the present disclosure, a system for securing software artifacts in a repository comprises a repository interface communicably coupleable to a software repository to retrieve an original artifact usable for building a software asset, and to replace the original artifact in the software repository with a modified artifact. A security scanner is configured to initiate a security scan of the original artifact and produce an output indicating the presence of a security vulnerability in the original artifact. An encoder is configured to reversibly modify the original artifact to produce the modified artifact, the modified artifact unusable for building the software asset.
1. A system for securing software artifacts in a repository comprising:
computing hardware of at least one processor and a memory operably coupled to the at least one processor; and
instructions that, when executed on the at least one processor, cause the at least one processor to implement:
a repository interface communicably coupleable to a software repository to retrieve an original artifact usable for building a software asset, and to replace the original artifact in the software repository with a modified artifact;
a security scanner configured to initiate a security scan of the original artifact and produce an output indicating the presence of a security vulnerability in the original artifact; and
an encoder configured to reversibly modify the original artifact to produce the modified artifact, the modified artifact unusable for building the software asset.
2. The system of claim 1 , wherein the security scanner is operably coupled to a static analysis tool, and is configured to initiate the security scan by providing the original artifact to the static analysis tool and produce the output indicating the presence of a security vulnerability in the original artifact based on the output of the static analysis tool.
3. The system of claim 1 , wherein the modified artifact comprises remediation instructions.
4. The system of claim 1 , wherein the modified artifact comprises an encoding of the original artifact using an encoding scheme selected from the group consisting of: Base64 and ROT13.
5. The system of claim 1 , wherein the modified artifact comprises a compressed copy of the original artifact.
6. The system of claim 1 , wherein the modified artifact comprises an encrypted copy of the original artifact.
7. The system of claim 1 , wherein the security scanner is further configured to receive one or more parameters indicating whitelisted portions of the original artifact, and to not report the presence of security vulnerabilities contained within the whitelisted portions of the original artifact.
8. The system of claim 7 , wherein the one or more parameters are received from a configuration file.
9. The system of claim 7 , wherein the one or more parameters are received from the original artifact.
10. A method for securing software artifacts in a repository comprising:
retrieving, from a software repository, an original artifact usable for building a software asset;
initiating a security scan of the original artifact and producing an output indicating the presence of a security vulnerability in the original artifact;
reversibly modifying the original artifact to produce a modified artifact, the modified artifact unusable for building the software asset; and
replacing the original artifact in the software repository with the modified artifact.
11. The method of claim 10 , wherein initiating the security scan comprises providing the original artifact to a static analysis tool; and
wherein the output indicating the presence of a security vulnerability in the original artifact is produced based on the output of the static analysis tool.
12. The method of claim 10 , wherein the modified artifact comprises remediation instructions.
13. The method of claim 10 , wherein the modified artifact comprises an encoding of the original artifact using an encoding scheme selected from the group consisting of: Base64 and ROT13.
14. The method of claim 10 , wherein the modified artifact comprises a compressed copy of the original artifact.
15. The method of claim 10 , wherein the modified artifact comprises an encrypted copy of the original artifact.
16. The method of claim 10 , wherein the security scanner is further configured to receive one or more parameters indicating whitelisted portions of the original artifact, and to not report the presence of security vulnerabilities contained within the whitelisted portions of the original artifact.
17. The method of claim 16 , wherein the one or more parameters are received from a configuration file.
18. The method of claim 16 , wherein the one or more parameters are received from the original artifact.
19. A non-transitory, computer-readable medium storing instructions capable of causing a computer to execute a method for securing software artifacts in a repository, the method comprising:
retrieving, from a software repository, an original artifact usable for building a software asset;
initiating a security scan of the original artifact and producing an output indicating the presence of a security vulnerability in the original artifact;
reversibly modifying the original artifact to produce a modified artifact, the modified artifact unusable for building the software asset; and
replacing the original artifact in the software repository with the modified artifact.