DAST（动态应用安全测试）#

name: DAST Security Scan

on:
  schedule:
    # 每周一凌晨执行
    - cron: '0 2 * * 1'
  workflow_dispatch:
    inputs:
      target_url:
        description: 'Target URL'
        required: true
        default: 'https://staging.example.com'

jobs:
  zap_scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Run ZAP Scan
        uses: zaproxy/action-baseline@v0.9.0
        with:
          target: ${{ inputs.target_url }}
          cmd_options: '-j'  # 使用 Spider + AJAX Spider
          
      - name: Upload ZAP Report
        uses: actions/upload-artifact@v4
        with:
          name: zap-report
          path: zap_report.html

# ZAP 认证配置示例
authentication:
  method: form
  parameters:
    url: https://example.com/login
    username: test@example.com
    password: testpass123
    submitFields: submit,login
  
  verification:
    method: regex
    pattern: "Welcome, .*"
    loggedOutRegex: "Login|Unauthorized"

# 使用 Selenium 处理复杂认证
script:
  - name: multi-step-auth.js
    type: httpsender

openapi: 3.0.0
info:
  title: Payment API
  version: 1.0.0
paths:
  /api/v1/payment:
    post:
      security:
        - BearerAuth: []
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                cardNumber:
                  type: string
                cvv:
                  type: string
      responses:
        '200':
          description: Payment successful

stages:
  - test
  - security
  - deploy

# 环境准备
prepare_environment:
  stage: test
  script:
    - docker-compose up -d
    - wait-for-it.sh service:8080 --timeout=30
  environment:
    name: staging

# DAST 扫描
dast_scan:
  stage: security
  image: owasp/zap2docker-stable:latest
  variables:
    TARGET_URL: "https://staging.example.com"
    ZAP_API_KEY: $ZAP_API_KEY
  script:
    - |
      # 启动 ZAP 守护进程
      zap.sh -daemon -port 8080 -config api.key=$ZAP_API_KEY &
      ZAP_PID=$!
      
      # 等待 ZAP 启动
      sleep 10
      
      # 导入 OpenAPI 规范（如果存在）
      if [ -f api/openapi.yaml ]; then
        curl -X POST "http://localhost:8080/JSON/openapi/action/importFile/?file=/zap/wrk/api/openapi.yaml"
      fi
      
      # 爬取目标
      curl -X POST "http://localhost:8080/JSON/spider/action/scan/?url=$TARGET_URL"
      
      # 等待爬取完成
      while [ $(curl "http://localhost:8080/JSON/spider/view/status/?scanId=0" | jq -r '.status') != "100" ]; do
        sleep 5
      done
      
      # 主动扫描
      curl -X POST "http://localhost:8080/JSON/ascan/action/scan/?url=$TARGET_URL&recurse=true"
      
      # 等待扫描完成（最多 30 分钟）
      for i in {1..360}; do
        status=$(curl "http://localhost:8080/JSON/ascan/view/status/?scanId=0" | jq -r '.status')
        if [ "$status" = "100" ]; then
          break
        fi
        sleep 5
      done
      
      # 生成报告
      curl "http://localhost:8080/JSON/core/view/htmlreport" > zap_report.html
      curl "http://localhost:8080/JSON/core/view/jsonreport" > zap_report.json
      
      # 关闭 ZAP
      kill $ZAP_PID
  artifacts:
    reports:
      dast: zap_report.json
    paths:
      - zap_report.html
    expire_in: 1 week
    when: always
  allow_failure: true  # 漏洞不影响部署，仅告警

# 扫描结果阈值检查
security_gate:
  stage: security
  script:
    - |
      HIGH_COUNT=$(cat zap_report.json | jq '[.site[].alerts[] | select(.riskdesc | contains("High"))] | length')
      echo "High risk vulnerabilities: $HIGH_COUNT"
      
      if [ $HIGH_COUNT -gt 0 ]; then
        echo "Security gate failed: Found $HIGH_COUNT high risk vulnerabilities"
        exit 1
      fi
  rules:
    - if: $CI_MERGE_REQUEST_ID
  needs:
    - dast_scan

# 每天增量扫描（基于变更）
dast_incremental:
  stage: security
  image: owasp/zap2docker-stable:latest
  script:
    - |
      # 获取最近 24 小时变更的 URL
      CHANGED_URLS=$(cat git-changes.txt)
      
      # 只扫描变更的端点
      for url in $CHANGED_URLS; do
        curl -X POST "http://localhost:8080/JSON/ascan/action/scan/?url=$url"
      done
      
      # 生成增量报告
      zap-baseline.py -t https://example.com -l INFO -J zap-incremental.json