GitHub GitHub Checkout, 27 Oct 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Your Automated Security Review - GitHub Code Scanning - GitHub Checkout

Description

Enabling GitHub Code Scanning is like inviting a team of security researchers to review your every pull request. By configuring Code Scanning with either CodeQL or one of our static code analysis partners you can make sure that all of your code is reviewed seamlessly for security vulnerabilities before going to production.

5:45 - demo - enable the feature
8:37 - demo - review scan results

GitHub Code Scanning goes GA
https://github.blog/2020-09-30-code-scanning-is-now-available/

Code Scanning partners
https://github.blog/2020-10-07-announcing-third-party-code-scanning-tools-infrastructure-as-code-and-container-scanning/

Code Scanning set up
https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning

Learning CodeQL
https://securitylab.github.com/tools/codeql

Justin Hutchings:
GitHub - https://github.com/jhutchings1
Twitter - https://twitter.com/jhutchings0

Sasha Rosenbaum:
GitHub - https://github.com/DivineOps
Twitter - https://twitter.com/DivineOps

As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub

Thanks!

Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
Google+: http://google.com/+github
LinkedIn: http://linkedin.com/company/github

About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com

A

Hello and welcome to github checkout our topic this week is github code scanning and my guest today is justin hutchins justin. Do you want to introduce yourself.

B

Sure I'm justin hutchings, I am a staff product manager here at github, I've been working on our security team for about two years and I've been working on our code scanning product for about a year since we made the acquisition of semel um sorry about that. You can hear my cat trying to join in um yeah.

A

I hope he makes a guest appearance that would be cool. He.

B

Could he could he's uh he's an ornery little guy um yeah.

A

So code scanning.

B

Is is fantastic? You know, I said, we've been working on it for about a year we made an acquisition last fall of a company called semel that had been working in the space for a long time, and uh you know now we all work together as one big happy family in github.

A

All right, that's awesome, so I do know we went ga with code scanning just a few weeks ago, um but I know some folks might not even know what the future is all about. So do you mind telling us about that.

B

Sure so code scanning is sort of as a platform piece for github. It's how we integrate static analysis, security, testing uh tools, and so the way you should think of that is when you write your own code, there's a good chance. You'll introduce a vulnerable pattern. These things happen all the time and code scanning makes it really easy by integrating with your ci system and integrating with your github repo, to show you any places where you might have made mistakes and incorporated any sort of common failures. We do this.

B

As I said, during your ci run, we expose those results in your pull requests, as well as in your repo in the security tab, to help make sure that you understand these things before they make it into your production branch.

A

So just need to go into your repository and enable a particular action that right runs code scanning and then you're all set.

B

That's right: yeah! If you go to the security tab on any public repo you'll find a button that says set up code scanning and you'll get a selection of options from us and our marketplace. Partners that do code scanning analysis. So codeql is our first party offering, but there's also a whole slew of options from partners that do things like container scanning or infrastructure, as code scanning or even scanning other languages that we do not.

A

That's very awesome, so you mentioned code ql and I know cork: yellow is kind of standalone in the family of static code analysis tool because it's its own programming language. So um can you talk a little bit about? What's so special about gokul.

B

Yeah you know I mentioned that this was all an acquisition, and you know it's interesting to think back. Codeql was actually developed by a professor and a bunch of the phd candidates at the university of oxford in the uk.

B

They spun it out and they created a company and they had this amazing data flow analysis system and it turns out when you have a system that understands how data flows through different programs, it's extremely powerful for security, and they built out an entire programming language to allow you to go and specify queries to go and look for certain behaviors. You know so, if you're looking for data that comes from a user input that goes straight into a database field, you know that's a classic sql injection vulnerability.

B

Those could be hard to spot. Sometimes, if you don't know that you know code, you know, seven classes away is actually making its way all the way, through unchanged into your sql statement right here, and so those are things that are really hard to spot, but they're extremely high impact in terms of what kind of security vulnerabilities they can cause.

A

And so I do know that um basically, ql actually only highlights things when they're in use. So if I just you know, do something like a sql query that takes a parameter, but it's not coming from the outside world. That is fine and it's not going to get flagged. But if that parameter is actually somewhere like four functions up the chain is used in user input. Then it's going to flag it. So do we see that it kind of reduces the false positive on positives on the cytochord analysis, yeah.

B

That's certainly our goal is to make sure that whatever we present, you is as real as it can be, and so we do the a process that we call threat, modeling internally, where we think about all of the different places that data could come from and we come up with a model for what that kind of data is, whether that's you know from a network endpoint. Did it come from an https source or an unsecured source?

B

We look at what kind of libraries you know data flows to, and so we we end up being able to categorize with much higher precision what kind of data you're dealing with and how it's going to be consumed on the other side- um and this is a it's an iterative process, one of the things that's beautiful about codeql and the queries we use is they're all open source.

B

So if you go to github.com github codeql you'll see all of the security queries that we actually use in the product are there and if there's a scenario that we got wrong or that needs to be more precise. You know you can set it as a pr and and we're happy to look at that.

A

So that's fantastic and it kind of goes very much with the github approach to everything right, open source. It have community contributions, build a community around us and have everybody help everybody build better software. um So we've talked about the feature for a little bit and I'm really excited to see a demo of how it actually works.

B

Yeah, let's do it, let's um pull up code scanning. You know one of the best ways to think about code scanning is actually just to go through the setup process here. So I have a repo.

B

This is a template that I have that has some vulnerabilities in it, um but I haven't configured code scanning on it before um and so I'm going to pop over to the security tab and you'll see I have a setup code scanning button and you'll see exactly what I mentioned before. You can see codeql right here at the top, as well as a bunch of products from marketplace partners, and this set is going to change depending on the languages that are in your repo. We tailor that to what's actually applicable to you.

B

So you know if you're, a javascript repo you're not going to see break man for ruby analysis, because it just wouldn't make sense. um Oh.

A

That's really cool.

B

Yeah so we'll go into code ql and we actually have a workflow that's set up already, and you know most of the time you don't need to make changes to this at all. We detect the languages you use, we detect your default branches and you know we auto build most projects if you're using like a you, know a c or c plus project and you're, using an exotic, build system, and you don't have a make file. There's a chance.

B

You'll have to come in here and make some small changes where you swap out the auto build and you you know, run whatever commands. You would normally run to build it, but most users. You know this just works for in this case. This I know, will work just right off the bat and so I'm going to commit it directly to our default branch here, and so, when you do this, the first time, what's going to happen, actions will pick this up.

B

You can see that it's already scheduled the job and it's going to run through this workflow against my default branch. Now, I'm not doing any code changes here.

B

I won't demonstrate sort of the pull request experience, but one of the things that's really clever that we do is we actually make sure that when you do a pull request and make changes to your code, even though all of the vulnerabilities for the code base exist in your pull request, we only flag things if they're net new in the code, you wrote- which is a really interesting and awesome kind of thing, because if you're used to running linters or other sorts of tools, you're probably used to seeing you commit to a new repo for the first time and the maintainers might know about a hundred things that are wrong and they just know to ignore them.

B

Because you know that's just the what you do, um but you're gonna get a whole bunch of errors, and so we built this in. So you don't see those errors the maintainers have been ignoring. You only see the stuff that you actually introduced, which is uh it makes it much easier to actually get the things fixed.

A

That is like a really good thing, because you can get 500 different errors on the first command and that can be really frustrating with the static code analysis tools. So that sounds like an improvement.

B

So, while we're waiting, you know, I should tell you what's kind of going on here, so we initialize codeql, which is really just about getting the environment prepared. um This is javascript, so there's no build it's a you know, interpreted language and then, when we did, this perform coql analysis step. What it did is it scanned all the code in the repo it built out a graph database that understands all the code paths in the project and then we ran 64 standard queries against this repo for certain bad security.

B

Behaviors- and you know that's fully configurable, you can add more. You can take some away, but you know that set is what we think of as the most severe and the most precise security vulnerabilities, um and so once it finished the analysis, it uploaded a file in a format called serif. It's a standard, interchange format for static analysis, results that went to the cloud and we processed that on our side, and so I can pop in and you can see the security tab.

B

We've got four alerts here um and we can go and have a look at what these are. So you know it says that I'm missing some rate limiting here, um oh sure, yeah. So this route handler is doing database access, but yeah we don't have any kind of rate limiting, which is bad because it could cause a denial of service to your your back end.

A

And this is something that's really easy to miss like if you're just developing, you might not be thinking about this in terms of like how can your application be attacked.

B

Exactly and that's exactly the problem is you know, these kind of errors are really easy to create, but they're extremely hard to spot, and that's where you want to have a static analysis tool, double checking your work in case you make one of these really common mistakes, and so you know this has a great example on how I can actually fix that you know using express- and you know, adding some validation here, and so you know every one of our alerts is going to have the same kind of you know carefully written guidance from security experts on how to mitigate these vulnerabilities.

A

So it's basically as if I have a security, professional checking, my pull request. Only that's automation, doing that.

B

Exactly exactly and if you're using this, you know, we can prevent a lot of the cves that have been added to projects. You probably use like we scan for about a quarter of the recent cves for the entire javascript ecosystem, which it might sound small. But when you, when you've, seen all the alerts that have come through, it's a ton of vulnerabilities that you can prevent ever having uh occur in your code.

A

That sounds fantastic, so in the actually actually also sounded really really easy to configure and run, and just pretty painless for someone to go and add that to their repo. I know you mentioned public repos. Is there a difference for private reapers? How do I enable this feature.

B

Yeah, so the product works exactly the same for private repos, except it's a paid product that we sell for for github, enterprise customers, and so, if you're doing this on your your work code, um definitely have whoever purchases um or manages your github relationship reach out to the sales team. And we can definitely hook you up with an opportunity to try it out against your private code and see if it's something that you want to purchase.

A

That sounds great, and also you mentioned the there's, a list of partners that we work with to, um in addition to coql that you could use for code scanning. um What are would you like to highlight any of them? You.

B

Know one of the things that I think is so exciting about this. You know I mentioned we use this standard called serif to deal with our our interchange between the the tools and the product, and this gives us the opportunity to bring in lots and lots of different analysis tools, the things that are really impactful that we've seen out. There are tools that are scanning your containers, so you know you could use anchor or sneak or aquasec trivia. You know all those are going to scan your docker files.

B

Every time you push to see if there are any vulnerabilities in the image that you're running your code in we've also seen some really great compilations of open source tools, so codec or shift left or bringing together. You know tools that analyze, php or python, or you know a number of other languages just to give you a little bit more defense in depth, because every tool is going to focus on sort of a different opinion about what security is, and so you can stack these sort of things really easily to get.

B

You know a security analysis system. That's going to meet your needs really well.

A

That sounds fantastic, um so obviously we're gonna chat um share all the links um in the show notes for where you can sign up how you can reach out to us about the future, how you can enable it- and things like that, um and thank you justin for bringing this to our customers um and to open source repos, and thank you for being here with me. um This has been pretty awesome.

A

This has been get up check out. Please hit the subscribe button for more videos, we're going to bring you some more amazing content in the next few weeks. Bye thanks.