Devsecops Essentials: کاهش آسیب پذیری های اولیه با Sonarqube و OWASP وابستگی

⇒ wget https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-4.2.0.1873-linux.zip
⇒ unzip sonar-scanner-cli-4.2.0.1873-linux.zip

⇒ sudo mv sonar-scanner-4.2.0.1873-linux/ /opt/

⇒ sudo nano /opt/sonar-scanner-4.2.0.1873-linux/conf/sonar-scanner.properties

sonar.host.url=
sonar.login=user.name
sonar.password=*****passwd****

⇒ sudo nano /etc/profile.d/sonar-scanner.sh
##Add path in sonar-scanner.sh file and save the file : 
export PATH=”/opt/sonar-scanner-4.2.0.1873-linux/bin:$PATH”

# must be unique in a given SonarQube instance(project_key)
sonar.projectKey=
# This is the name and version displayed in the SonarQube UI. Was mandatory prior to SonarQube 6.1.
sonar.projectName=
sonar.projectVersion=0.0.1

# Path is relative to the sonar-project.properties file. Replace "\" by "https://dev.to/" on Windows.
# If not set, SonarQube starts looking for source code from the directory containing 
# the sonar-project.properties file.

sonar.sources=src/main/java
sonar.projectBaseDir=. 
# Encoding of the source code. Default is default system encoding
sonar.sourceEncoding=UTF-8
sonar.binaries=target/classes/
sonar.java.binaries=target/classes/

#!/bin/bash

# Configuration Variables
SONAR_LOGIN=""
SONAR_PASSWORD="sonar_login_pass"
SONAR_HOST=""
SONAR_SOURCE="src/main/java"
SONAR_BINARIES="target/classes/"
SONAR_JAVA_BINARIES="target/classes/"
SONAR_EXCLUSIONS="**/*DaoImpl.java,**/target/classes/*"

# Run SonarQube analysis
echo "Running SonarQube analysis..."
export _JAVA_OPTIONS="-Xms512m -Xmx1g" # You can set this as per your configuration 

# if you are using cli then below part is not required in script just provide the command: sonar-scanner

if mvn clean verify sonar:sonar \
    -Dsonar.projectKey= \
    -Dsonar.host.url="$SONAR_HOST" \
    -Dsonar.login="$SONAR_LOGIN" \
    -Dsonar.password="$SONAR_PASSWORD" \
    -Dsonar.sources="$SONAR_SOURCE" \
    -Dsonar.binaries="$SONAR_BINARIES" \
    -Dsonar.java.binaries="$SONAR_JAVA_BINARIES" \
    -Dsonar.exclusions="$SONAR_EXCLUSIONS"; then
    echo "SonarQube analysis completed successfully."
else
    echo "SonarQube analysis failed. Please check the errors above."
    exit 1
fi

# Change directory back (if necessary)
cd .. || { echo "Failed to change directory."; exit 1; }
Code language: PHP (php)
Add the Script to Your CI/CD Pipeline:
pipeline {
    agent any    stages {
        stage('SonarQube Analysis') {
            steps {
                script {
                    sh 'chmod +x sonar-scan.sh' // Make the script executable
                    sh './sonar-scan.sh' // Execute the SonarScanner script
                }
            }
        }
        stage('Build') {
            steps {
                // Your build commands here (e.g., mvn clean install)
            }
        }
    }
}

build.sh
#!/bin/bash

# Step 1: Install dependencies and verify Maven installation
echo "Updating system and verifying Maven installation..."
if mvn -v; then
    echo "Maven is installed."
else
    echo "Maven is not installed. Please install Maven to proceed."
    exit 1
fi

# Step 2: Build the Maven project
echo "Building the Maven project and running OWASP dependency check..."
if mvn -B -s pom.xml -Dmaven.test.skip=true -Pdev clean install org.owasp:dependency-check-maven:aggregate; then
    echo "Build successful."
else
    echo "Build failed. Please check the errors above."
    exit 1
fi

##

pipeline {
    agent any
    stages {
        stage('Build') {
            steps {
                script {
                    sh 'chmod +x build.sh' // Make the script executable
                    sh './build.sh' // Execute the build script
                }

            }
        }
    }
}

pipeline {
    agent any
    stages {
        stage('SonarQube Analysis') {
            steps {
                script {
                    sh 'chmod +x sonar-scan.sh' // Make the script executable
                    sh './sonar-scan.sh' // Execute the SonarScanner script
                }
            }
        }
        stage('Build') {
            steps {
                script {
                    sh 'chmod +x build.sh' // Make the script executable
                    sh './build.sh' // Execute the build script
                }
           }
        }
    }
}