161 lines
4.2 KiB
Bash
Executable File
161 lines
4.2 KiB
Bash
Executable File
#!/bin/bash
|
|
# Vollstaendiger Dependency Security Scan
|
|
|
|
set -e
|
|
|
|
# Farben
|
|
RED='\033[0;31m'
|
|
YELLOW='\033[1;33m'
|
|
GREEN='\033[0;32m'
|
|
BLUE='\033[0;34m'
|
|
NC='\033[0m'
|
|
|
|
echo -e "${BLUE}================================${NC}"
|
|
echo -e "${BLUE}Dependency Security Scanner${NC}"
|
|
echo -e "${BLUE}================================${NC}"
|
|
echo ""
|
|
|
|
# Package Manager erkennen
|
|
if [ -f "pnpm-lock.yaml" ]; then
|
|
PKG_MANAGER="pnpm"
|
|
elif [ -f "yarn.lock" ]; then
|
|
PKG_MANAGER="yarn"
|
|
elif [ -f "package-lock.json" ]; then
|
|
PKG_MANAGER="npm"
|
|
else
|
|
PKG_MANAGER="npm"
|
|
fi
|
|
|
|
echo "Package Manager: $PKG_MANAGER"
|
|
echo ""
|
|
|
|
# Temporaere Dateien
|
|
AUDIT_FILE=$(mktemp)
|
|
OUTDATED_FILE=$(mktemp)
|
|
|
|
# ================================
|
|
# 1. VULNERABILITY AUDIT
|
|
# ================================
|
|
echo -e "${YELLOW}[1/3] Pruefe Sicherheitsluecken...${NC}"
|
|
|
|
case "$PKG_MANAGER" in
|
|
"pnpm")
|
|
pnpm audit --json > "$AUDIT_FILE" 2>/dev/null || true
|
|
;;
|
|
"yarn")
|
|
yarn audit --json > "$AUDIT_FILE" 2>/dev/null || true
|
|
;;
|
|
"npm")
|
|
npm audit --json > "$AUDIT_FILE" 2>/dev/null || true
|
|
;;
|
|
esac
|
|
|
|
# Audit Ergebnisse parsen
|
|
if [ -s "$AUDIT_FILE" ]; then
|
|
CRITICAL=$(jq '.metadata.vulnerabilities.critical // 0' "$AUDIT_FILE" 2>/dev/null || echo "0")
|
|
HIGH=$(jq '.metadata.vulnerabilities.high // 0' "$AUDIT_FILE" 2>/dev/null || echo "0")
|
|
MODERATE=$(jq '.metadata.vulnerabilities.moderate // 0' "$AUDIT_FILE" 2>/dev/null || echo "0")
|
|
LOW=$(jq '.metadata.vulnerabilities.low // 0' "$AUDIT_FILE" 2>/dev/null || echo "0")
|
|
TOTAL=$((CRITICAL + HIGH + MODERATE + LOW))
|
|
else
|
|
CRITICAL=0
|
|
HIGH=0
|
|
MODERATE=0
|
|
LOW=0
|
|
TOTAL=0
|
|
fi
|
|
|
|
echo ""
|
|
echo "Vulnerabilities gefunden:"
|
|
echo -e " ${RED}Critical: $CRITICAL${NC}"
|
|
echo -e " ${RED}High: $HIGH${NC}"
|
|
echo -e " ${YELLOW}Moderate: $MODERATE${NC}"
|
|
echo -e " Low: $LOW"
|
|
echo ""
|
|
|
|
# ================================
|
|
# 2. OUTDATED CHECK
|
|
# ================================
|
|
echo -e "${YELLOW}[2/3] Pruefe veraltete Pakete...${NC}"
|
|
|
|
case "$PKG_MANAGER" in
|
|
"pnpm")
|
|
pnpm outdated --json > "$OUTDATED_FILE" 2>/dev/null || true
|
|
;;
|
|
"npm")
|
|
npm outdated --json > "$OUTDATED_FILE" 2>/dev/null || true
|
|
;;
|
|
"yarn")
|
|
yarn outdated --json > "$OUTDATED_FILE" 2>/dev/null || true
|
|
;;
|
|
esac
|
|
|
|
if [ -s "$OUTDATED_FILE" ]; then
|
|
OUTDATED_COUNT=$(jq 'length' "$OUTDATED_FILE" 2>/dev/null || echo "0")
|
|
echo "Veraltete Pakete: $OUTDATED_COUNT"
|
|
|
|
if [ "$OUTDATED_COUNT" -gt 0 ]; then
|
|
echo ""
|
|
echo "Top 10 veraltete Pakete:"
|
|
jq -r 'to_entries | .[:10][] | " \(.key): \(.value.current // "?") -> \(.value.latest // "?")"' "$OUTDATED_FILE" 2>/dev/null || true
|
|
fi
|
|
else
|
|
OUTDATED_COUNT=0
|
|
echo "Keine veralteten Pakete gefunden."
|
|
fi
|
|
|
|
echo ""
|
|
|
|
# ================================
|
|
# 3. SCORE BERECHNEN
|
|
# ================================
|
|
echo -e "${YELLOW}[3/3] Berechne Security Score...${NC}"
|
|
|
|
SCORE=$((100 - (CRITICAL * 25) - (HIGH * 10) - (MODERATE * 3) - (LOW * 1)))
|
|
if [ $SCORE -lt 0 ]; then SCORE=0; fi
|
|
|
|
echo ""
|
|
echo -e "${BLUE}================================${NC}"
|
|
echo -e "${BLUE}ERGEBNIS${NC}"
|
|
echo -e "${BLUE}================================${NC}"
|
|
echo ""
|
|
|
|
if [ $SCORE -ge 90 ]; then
|
|
echo -e "Security Score: ${GREEN}$SCORE/100${NC}"
|
|
elif [ $SCORE -ge 70 ]; then
|
|
echo -e "Security Score: ${YELLOW}$SCORE/100${NC}"
|
|
else
|
|
echo -e "Security Score: ${RED}$SCORE/100${NC}"
|
|
fi
|
|
|
|
echo ""
|
|
echo "Zusammenfassung:"
|
|
echo " Vulnerabilities: $TOTAL"
|
|
echo " Veraltete Pakete: $OUTDATED_COUNT"
|
|
|
|
# ================================
|
|
# EMPFEHLUNGEN
|
|
# ================================
|
|
echo ""
|
|
echo -e "${BLUE}Empfehlungen:${NC}"
|
|
|
|
if [ "$CRITICAL" -gt 0 ] || [ "$HIGH" -gt 0 ]; then
|
|
echo -e " ${RED}DRINGEND: Fuehre '$PKG_MANAGER audit fix' aus${NC}"
|
|
fi
|
|
|
|
if [ "$OUTDATED_COUNT" -gt 10 ]; then
|
|
echo -e " ${YELLOW}Updates verfuegbar: '$PKG_MANAGER update'${NC}"
|
|
fi
|
|
|
|
if [ "$TOTAL" -eq 0 ] && [ "$OUTDATED_COUNT" -lt 5 ]; then
|
|
echo -e " ${GREEN}Alles in Ordnung! Dependencies sind sicher.${NC}"
|
|
fi
|
|
|
|
# Cleanup
|
|
rm -f "$AUDIT_FILE" "$OUTDATED_FILE"
|
|
|
|
# Exit mit Fehler bei kritischen Issues
|
|
if [ "$CRITICAL" -gt 0 ]; then
|
|
exit 1
|
|
fi
|