Add more appsec vpatch rules (#1134) #206
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Waf Check FP | |
| on: | |
| pull_request: | |
| branches: [ master ] | |
| paths: | |
| - 'appsec-configs/**.yaml' | |
| - 'appsec-configs/**.yml' | |
| - 'appsec-rules/**.yaml' | |
| - 'appsec-rules/**.yml' | |
| - '.github/workflows/waf-check.yaml' | |
| - '.appsec-tests/**' | |
| - 'waf-check/**' | |
| push: | |
| branches: [ master ] | |
| paths: | |
| - 'appsec-configs/**.yaml' | |
| - 'appsec-configs/**.yml' | |
| - 'appsec-rules/**.yaml' | |
| - 'appsec-rules/**.yml' | |
| - '.github/workflows/waf-check.yaml' | |
| - '.appsec-tests/**' | |
| - 'waf-check/**' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build: | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - name: Check out code into the Go module directory | |
| uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v4 | |
| with: | |
| go-version: '1.22' | |
| - name: Split dateset | |
| run: | | |
| cd waf-check && go build -o waf-check | |
| ./waf-check -download -batch -dir-count 6 | |
| - uses: actions/upload-artifact@v4 | |
| name: Upload dataset in artifact | |
| with: | |
| name: waf-check-dataset | |
| path: ./waf-check/dataset/ | |
| retention-days: 1 | |
| run: | |
| runs-on: ubuntu-22.04 | |
| needs: build | |
| strategy: | |
| matrix: | |
| dataset_folder: ["dataset_0","dataset_1","dataset_2","dataset_3","dataset_4","dataset_5"] | |
| steps: | |
| - name: Check out code into the Go module directory | |
| uses: actions/checkout@v4 | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| name: waf-check-dataset | |
| path: waf-check/dataset/ | |
| name: Download dataset from artifact | |
| - uses: actions/setup-go@v4 | |
| with: | |
| go-version: '1.22' | |
| - name: Install requirements | |
| run: | | |
| sudo apt install libre2-dev | |
| - name: Install CrowdSec | |
| run: | | |
| current_pwd=$(pwd) | |
| git clone https://github.com/crowdsecurity/crowdsec.git | |
| cd crowdsec | |
| BUILD_STATIC=1 make release | |
| cd crowdsec-v* | |
| sudo ./wizard.sh --unattended | |
| - name: Setup CrowdSec Appsec | |
| run: | | |
| sudo cp waf-check/config/acquis.yaml /etc/crowdsec/acquis.yaml | |
| sudo cp appsec-rules/*/vpatch-*.yaml /etc/crowdsec/appsec-rules/ | |
| sudo cp appsec-rules/crowdsecurity/base-config.yaml /etc/crowdsec/appsec-rules/ | |
| sudo cp appsec-configs/crowdsecurity/virtual-patching.yaml /etc/crowdsec/appsec-configs/ | |
| sudo systemctl restart crowdsec | |
| - name: Register Remediation Component API Key | |
| run: | | |
| sudo cscli bouncers add hubtestAppsec -k "this_is_a_bad_password" | |
| - name: Start OpenResty Container | |
| run: | | |
| docker compose -f docker/appsec/docker-compose.yaml up -d --build | |
| sleep 3 | |
| - name: Build and Run Waf Check | |
| run: | | |
| cd waf-check && go build -o waf-check && ./waf-check -dataset "dataset/${{ matrix.dataset_folder }}" | |
| - uses: actions/upload-artifact@v4 | |
| if: failure() | |
| name: Upload dataset in artifact | |
| with: | |
| name: waf-check-result | |
| path: ./waf-check/output/ | |
| retention-days: 1 | |
| - uses: geekyeggo/delete-artifact@v4 | |
| if: always() | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| name: waf-check-dataset |