41 lines
956 B
Bash
Executable File
41 lines
956 B
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[0;33m'
|
|
NC='\033[0m'
|
|
|
|
TARGET="${1:-.}"
|
|
errors=0
|
|
|
|
echo "=== SAST Scan ==="
|
|
|
|
if ! command -v semgrep &>/dev/null; then
|
|
printf "${RED}✗${NC} semgrep not installed\n"
|
|
exit 2
|
|
fi
|
|
|
|
has_python=$(find "$TARGET" -name "*.py" -not -path "*/.*" | head -1)
|
|
has_go=$(find "$TARGET" -name "*.go" -not -path "*/.*" | head -1)
|
|
|
|
if [ -z "$has_python" ] && [ -z "$has_go" ]; then
|
|
printf "${YELLOW}!${NC} No Python or Go files found — skipping\n"
|
|
exit 0
|
|
fi
|
|
|
|
configs=""
|
|
if [ -n "$has_python" ]; then
|
|
configs="--config=p/python --config=p/owasp-top-ten"
|
|
fi
|
|
if [ -n "$has_go" ]; then
|
|
configs="$configs --config=p/golang --config=p/owasp-top-ten"
|
|
fi
|
|
|
|
if semgrep scan $configs "$TARGET" --quiet 2>/dev/null; then
|
|
printf "${GREEN}✓${NC} No security issues found\n"
|
|
exit 0
|
|
else
|
|
printf "${RED}✗${NC} Security issues detected — review semgrep output above\n"
|
|
exit 1
|
|
fi |