549 lines (466 loc) · 22.4 KB

ZeroDAST v2 — Full Implementation Checklist

Phase 0: Project Scaffolding

Create root directory structure under c:\Java Developer\DAST\
Create .gitignore (node_modules, reports/, *.tar, .env, /tmp/)
Create LICENSE (Apache-2.0)
Initialize git repo (git init)
Initial commit: "chore: initialize ZeroDAST project scaffold"

Phase 1: Demo App (Self-Validating DAST Target)

1.1 Package Setup

Create demo-app/package.json
- Dependencies: express, pg, jsonwebtoken, bcryptjs, swagger-jsdoc, swagger-ui-express, helmet, cors
- Dev dependencies: eslint, jest (for CI lint/test steps)
- Scripts: start, lint, test
Create demo-app/.dockerignore (node_modules, npm-debug.log, .git)

1.2 Core Application

1.3 Middleware

Create demo-app/src/middleware/auth.js
- JWT verification from Authorization header
- Extract userId and role to req.user
- Return 401 on missing/invalid token
Create demo-app/src/middleware/errorHandler.js
- INTENTIONAL VULN: Returns stack trace in error responses (info disclosure)
- Add // codeql[js/stack-trace-exposure] suppression comment

1.4 Route Files

1.5 Dockerfile

Create demo-app/Dockerfile
- Multi-stage build (builder -> production)
- FROM node:20-alpine for both stages
- npm install --omit=dev in builder
- Non-root user in production stage (USER node)
- HEALTHCHECK using wget -qO- (Alpine lacks curl)
- EXPOSE 8080

1.6 Commit

Git commit: "feat(demo-app): add Express app with intentional vulnerability surfaces for DAST validation"

Phase 2: Database Seed System

2.1 Schema & Seed Data

2.2 Overlay System

Create db/seed/overlay.sql.example
- Template with comments: what's allowed vs forbidden
- Example INSERT for adding test data for a new feature
- Clear explanation of validation rules

2.3 AST-Based Validator

2.4 Validator Tests

2.5 Commit

Git commit: "feat(db): add schema, mock data, overlay system, and AST-based SQL validator with 15+ bypass test cases"

Phase 3: Security Scripts

3.1 Runtime Environment

3.2 Auth Bootstrap

Create scripts/bootstrap-auth.sh
- Accept APP_URL parameter (default: http://untrusted-app:8080)
- Login as alice@test.local
- Parse JSON response with jq or Node.js fallback
- v2 FIX: Validate token extraction (exit 1 if login fails)
- Save token to /tmp/zap-auth-token.txt
- Also bootstrap Bob's token for authz tests
- Save Bob's token to /tmp/zap-auth-token-bob.txt

3.3 Delta Detection

Create scripts/delta-detect.sh
- Read changed files via git diff --name-only origin/main...HEAD
- Route file pattern matching (*/routes/*, */controllers/*)
- v2 FIX: Regex \.(get|post|put|delete|patch)\s*\( (leading dot!)
- Core file detection triggers FULL scan (middleware, db, index, Dockerfile)
- Fail-safe: if no routes found AND no core changes -> FULL
- Deduplicate and output endpoint paths

3.4 Delta Scan Generator

Create scripts/generate-delta-scan.sh
- Read delta endpoint list from file
- Generate ZAP Automation Framework YAML with includePaths regexes
- If input is "FULL", copy full automation.yaml instead
- Output to /tmp/zap-config.yaml

3.5 AuthZ Tests

Create scripts/authz-tests.sh
- Login as Alice, login as Bob
- Alice tries Bob's private document -> 200/204 means IDOR detected
- Bob tries DELETE Alice's document -> 200/204 means IDOR detected
- Bob tries to update Alice's user profile
- Output: list of IDOR findings
- Exit 0 always (demo/default mode)
- Support EXPECT_IDOR=true|false for demo vs hardened apps

3.6 Self-Validation

Create scripts/verify-canaries.sh
- Read reports/zap-report.json
- Check for expected findings: "SQL Injection", "Cross Site Scripting", "Application Error Disclosure"
- Found -> pass, missing -> fail pipeline with coverage gap message

3.7 Report Parser

Create scripts/parse-zap-report.js
- Read ZAP JSON report
- Count by risk level (Critical/High/Medium/Low/Informational)
- v2 FIX: Configurable fail level via ZAP_FAIL_LEVEL env var (default: High)
- Generate markdown summary table for PR comment
- Return exit code 1 if findings exceed fail level

3.8 Delta Detection Tests

Create tests/test_delta_detect.sh
- Test: router.get('/api/users') matches -> extracts /api/users
- Test: app.post('/api/auth/login') matches -> extracts /api/auth/login
- Test: middleware change triggers FULL
- Test: Dockerfile change triggers FULL
- Test: non-route JS file -> no match -> FULL (fail-safe)

3.9 Commit

Git commit: "feat(security): add Docker network isolation, container hardening, delta detection, authz tests, and canary verification"

Phase 4: ZAP Configuration

4.1 Version Pinning

Create security/zap/.zap-version
- Contains pinned version number (e.g., 2.17.0)

4.2 Automation Config

4.3 Scan Policy

Create security/zap/scan-policy.yaml
- KEEP rules: XSS, SQLi, CORS, traversal-style checks
- Filter the policy toward the demo tech stack and away from irrelevant stacks

4.4 Baseline Suppression

Create security/zap/.zap-baseline.json
- Suppress known informational alerts from demo app
- Document each suppression with rationale

4.5 Commit

Git commit: "feat(zap): add pinned ZAP config with passive+active scan, auth injection, and tech-stack filtering"

Phase 5: GitHub Actions Workflows

5.1 CI Workflow (Lane 1: Untrusted)

5.2 DAST PR Workflow (Lane 2: Trusted)

5.3 DAST Nightly Workflow

5.4 Commit

Git commit: feat(ci): add 3-workflow DAST pipeline with privilege isolation, Docker network isolation, and configurable fail levels

Phase 6: AI-Driven Repo Inspection Prompts

6.1 Prompts

6.2 Commit

Git commit: "feat(ai): add 5 structured AI prompts for universal repo adaptation and post-scan triage"

Phase 7: Documentation

7.1 Root README

Create README.md
- Project name, tagline, architecture diagram (ASCII art)
- v2 FIX: "Self-benchmarked via AlphaSudo/sbtr-benchmark" (not "certified")
- Quick Start (5 steps)
- Comparison table: T1/T2/T3/T4
- ?? WARNING: Demo app is intentionally vulnerable - never deploy to production
- License badge, status badges

7.2 Architecture Doc

Create docs/ARCHITECTURE.md
- 3-layer defense model with diagrams
- v2 FIX: "Privilege Isolation" not "Temporal Isolation" in security layers
- Docker --internal network explanation
- Data flow between workflows
- Speed lever explanations

7.3 Quick Start

Create docs/QUICK_START.md
- Prerequisites: Docker, Node.js 20+, Python 3.8+
- Step-by-step local setup
- Copy-paste YAML for different frameworks
- Common pitfalls (CRLF line endings, workflow name mismatch)

7.4 Contributing Security

Create docs/CONTRIBUTING_SECURITY.md
- How to write overlay.sql for new features
- Allowed/forbidden statement whitelist
- Why ON CONFLICT DO UPDATE is forbidden
- What happens when validation fails
- Sparse checkout path requirements

7.5 Supply Chain Rules

Create docs/SUPPLY_CHAIN_RULES.md
- 6-Rule Framework from AlphaSudo/sbtr-benchmark
- How each rule is implemented in workflows
- Rule 4b exception for DAST (sandboxed binary crossing) - documented
- Mapping to SBTR benchmark tiers

7.6 Threat Model

Create docs/THREAT_MODEL.md
- All attack vectors (poisoned seed, poisoned code, container escape, token hijacking)
- Mitigation for each
- v2 NEW: Fork PR behavior documented ("fork PRs get DAST only after merge - intentional")
- Residual risk: hypervisor escape (GitHub's problem)
- ZAP on --internal network nuance (trusted image, but documented)

7.7 Tier Comparison

Create docs/TIER_COMPARISON.md
- T1 vs T2 vs T3 (us) vs T4
- v2 FIX: Scores labeled as self-benchmarked
- Scan time, security score, cost, complexity
- When to upgrade from T3 to T4

7.8 AI Setup Guide

Create docs/AI_GUIDED_SETUP.md
- How to use the AI prompts
- Workflow: Inspect -> Generate -> Adapt -> Validate
- Dry-run mode: verify auth bootstrap before full scan
- Examples for Node.js, Python, Java, Go

7.9 Commit

Git commit: "docs: add comprehensive documentation covering architecture, security, setup, and AI-guided adaptation"

Phase 8: Local Development Tools

8.1 Docker Compose

Create docker-compose.yml
- DB service: postgres:16-alpine with explicit healthcheck
- App service: builds from ./demo-app, depends on healthy DB
- ZAP service: pinned version, profiles: ["dast"], network mode
- All env vars (DATABASE_URL, JWT_SECRET = throwaway values)
- Port mappings: 5432 (DB), 8080 (App)

8.2 Makefile

Create Makefile
- make build — build demo-app Docker image
- make up — start DB + app, wait for healthy
- make seed — run schema.sql + mock_data.sql
- make dast — full local DAST (up + seed + auth + ZAP)
- make validate FILE=overlay.sql — run AST validator
- make test — run pytest for validator + bash tests for delta
- make authz — run authz tests
- make clean — docker compose down -v --remove-orphans

8.3 Local DAST Runner

Create scripts/run-dast-local.sh
- Local wrapper runs build -> isolated runtime -> auth bootstrap -> ZAP scan -> verify canaries -> report
- Trap handler for cleanup on exit/error
- Print summary at end

8.4 Commit

Git commit: "feat(dev): add docker-compose, Makefile, and local DAST runner for developer testing"

Phase 9: Verification & Validation

9.1 Unit Tests

Run pip install pglast==6.* pytest
Run pytest tests/test_validate_overlay.py -v - all 15+ tests pass
Run bash tests/test_delta_detect.sh - all regex tests pass

9.2 Local Full DAST

Run integrated local DAST path (make dast / scripts/run-dast-local.sh) - build, app startup, DB seed, and full ZAP scan complete
- Verify ZAP finds: SQL Injection ?
- Verify ZAP finds: Cross Site Scripting ?
- Verify ZAP finds: Application Error Disclosure ?
Run bash scripts/verify-canaries.sh - all canaries pass
Run bash scripts/authz-tests.sh - IDOR surfaces confirmed

9.3 Network Isolation Verification

Start app on --internal network
From app container: wget -qO- https://httpbin.org/get fails
From app container: TCP connect to dast-db:5432 succeeds

9.4 Container Hardening Verification

Verify --read-only works with Node.js demo app (no crash)
Verify --pids-limit=512 sufficient under ZAP load
Verify --memory=1g sufficient (no OOM kills)

9.5 Overlay Bypass Testing

Submit INSERT INTO users SELECT * FROM pg_shadow - validator rejects
Submit CREATE FUNCTION evil() - validator rejects
Submit file with \copy command - validator rejects
Submit file > 100KB - validator rejects
Submit valid INSERT - validator accepts

9.6 Line Ending Check

Verify all .sh files have Unix line endings (LF, not CRLF)
Add .gitattributes if needed: *.sh text eol=lf

9.7 Final Commit

Git commit: "test: verify all security layers, canary detection, and overlay bypass rejection"

Phase 10: Polish & Ship

10.1 Final Review

Review all @<SHA> placeholders - replace with real pinned SHAs
Review all // codeql[...] suppression comments are present on intentional vulns
Review workflow_run workflow name matches exactly
Review .gitattributes for line endings
Run full make dast one final time - clean run

10.2 Git Tags

Tag: v0.1.0 — first local-validated release

10.3 Pre-Public Checklist (for when we go public)

3 consecutive successful E2E runs locally
Test fork PR path (only ci.yml runs - no DAST, no secrets)
Test merge to main (dast-nightly triggers full scan)
Test malicious overlay PR (validator blocks)
Measure actual CI time: target 5-9 min delta, 15-25 min full
Create SECURITY.md for public repo
Push to AlphaSudo/zerodast

Summary

Phase	Items	Est. Time
0. Scaffolding	5	15 min
1. Demo App	23	~4 hours
2. DB Seed	12	~2 hours
3. Security Scripts	15	~3 hours
4. ZAP Config	5	~3 hours
5. Workflows	14	~4 hours
6. AI Prompts	6	~2 hours
7. Documentation	10	~2 hours
8. Local Tools	4	~1 hour
9. Verification	12	~2 hours
10. Polish	5	~30 min
Total	111 items	~21 hours