Что такое Snyk?

 1# Установка через npm
 2npm install -g snyk
 3
 4# Или через Homebrew (macOS)
 5brew install snyk/tap/snyk
 6
 7# Или скачать бинарник
 8curl -Lo snyk https://github.com/snyk/snyk/releases/latest/download/snyk-linux
 9chmod +x snyk
10sudo mv snyk /usr/local/bin/
11
12# Python проекты
13pip install snyk
14# poetry add --group dev snyk
15poetry add --group dev snyk

 1# Аутентификация
 2snyk auth
 3
 4# Или с токеном
 5snyk auth YOUR_API_TOKEN
 6
 7# Тестирование проекта
 8snyk test
 9
10# Тестирование с высоким уровнем детализации
11snyk test --severity-threshold=high
12
13# Мониторинг проекта
14snyk monitor

 1# Python проекты
 2snyk test --file=requirements.txt
 3snyk test --file=Pipfile
 4snyk test --file=pyproject.toml
 5
 6# Node.js проекты
 7snyk test --file=package.json
 8snyk test --file=yarn.lock
 9
10# Java проекты
11snyk test --file=pom.xml
12snyk test --file=build.gradle
13
14# Все файлы в проекте
15snyk test --all-projects

 1# Сканирование Docker образа
 2snyk container test python:3.9
 3
 4# Сканирование локального образа
 5snyk container test myapp:latest
 6
 7# Сканирование с Dockerfile
 8snyk container test myapp:latest --file=Dockerfile
 9
10# Мониторинг образа
11snyk container monitor python:3.9
12
13# Получение рекомендаций по базовому образу
14snyk container test python:3.9 --exclude-base-image-vulns

 1# Сканирование Terraform файлов
 2snyk iac test terraform/
 3
 4# Сканирование Kubernetes манифестов
 5snyk iac test k8s/
 6
 7# Сканирование CloudFormation
 8snyk iac test cloudformation.yaml
 9
10# Сканирование с настраиваемыми правилами
11snyk iac test --rules=custom-rules/

 1# GitHub Actions
 2name: Security Scan
 3on: [push, pull_request]
 4
 5jobs:
 6  security:
 7    runs-on: ubuntu-latest
 8    steps:
 9      - uses: actions/checkout@v3
10      
11      - name: Setup Node.js
12        uses: actions/setup-node@v3
13        with:
14          node-version: '16'
15          
16      - name: Install dependencies
17        run: npm ci
18        
19      - name: Run Snyk to check for vulnerabilities
20        uses: snyk/actions/node@master
21        env:
22          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
23        with:
24          args: --severity-threshold=high

 1# .gitlab-ci.yml
 2stages:
 3  - security
 4
 5snyk-scan:
 6  stage: security
 7  image: snyk/snyk:python
 8  script:
 9    - snyk auth $SNYK_TOKEN
10    - snyk test --severity-threshold=high
11    - snyk monitor
12  only:
13    - merge_requests
14    - master

 1# .snyk файл для игнорирования уязвимостей
 2# Snyk (https://snyk.io) policy file
 3version: v1.25.0
 4
 5# Игнорирование конкретных уязвимостей
 6ignore:
 7  SNYK-PYTHON-REQUESTS-1234567:
 8    - '*':
 9        reason: False positive - not exploitable in our context
10        expires: 2024-12-31T23:59:59.999Z
11
12# Патчи
13patch:
14  SNYK-JS-LODASH-567890:
15    - lodash:
16        patched: '2023-01-01T00:00:00.000Z'
17
18# Языковые настройки
19language-settings:
20  python: '3.9'

 1# Автоматическое исправление уязвимостей
 2snyk fix
 3
 4# Создание PR с исправлениями
 5snyk fix --pr
 6
 7# Обновление зависимостей до безопасных версий
 8snyk fix --upgrade
 9
10# Применение патчей Snyk
11snyk protect

1# VS Code - установка расширения
2# Extensions -> Snyk Security
3
4# JetBrains IDE (IntelliJ, PyCharm)
5# Plugins -> Snyk Security
6
7# Настройка токена в IDE
8# Preferences -> Tools -> Snyk -> API Token

 1# Python скрипт для получения отчетов через API
 2import requests
 3import json
 4
 5def get_snyk_projects(org_id, api_token):
 6    headers = {
 7        'Authorization': f'token {api_token}',
 8        'Content-Type': 'application/json'
 9    }
10    
11    url = f'https://snyk.io/api/v1/orgs/{org_id}/projects'
12    response = requests.get(url, headers=headers)
13    
14    return response.json()
15
16def get_project_issues(org_id, project_id, api_token):
17    headers = {
18        'Authorization': f'token {api_token}',
19        'Content-Type': 'application/json'
20    }
21    
22    url = f'https://snyk.io/api/v1/orgs/{org_id}/projects/{project_id}/issues'
23    response = requests.get(url, headers=headers)
24    
25    return response.json()
26
27# Использование
28org_id = "your-org-id"
29api_token = "your-api-token"
30
31projects = get_snyk_projects(org_id, api_token)
32for project in projects['projects']:
33    issues = get_project_issues(org_id, project['id'], api_token)
34    print(f"Project: {project['name']}")
35    print(f"Issues: {len(issues['issues'])}")
36    print("---")

 1# Flask приложение для обработки Snyk webhooks
 2from flask import Flask, request, jsonify
 3import json
 4
 5app = Flask(__name__)
 6
 7@app.route('/snyk-webhook', methods=['POST'])
 8def handle_snyk_webhook():
 9    payload = request.get_json()
10    
11    if payload.get('project'):
12        project_name = payload['project']['name']
13        
14        if payload.get('newIssues'):
15            new_issues = len(payload['newIssues'])
16            print(f"New vulnerabilities found in {project_name}: {new_issues}")
17            
18            # Отправка уведомления в Slack, Teams и т.д.
19            send_notification(project_name, new_issues)
20    
21    return jsonify({'status': 'received'})
22
23def send_notification(project, issues_count):
24    # Реализация отправки уведомления
25    pass
26
27if __name__ == '__main__':
28    app.run(debug=True)

 1# Snyk Controller для Kubernetes
 2apiVersion: v1
 3kind: Secret
 4metadata:
 5  name: snyk-secret
 6type: Opaque
 7data:
 8  snykToken: <base64-encoded-token>
 9---
10apiVersion: apps/v1
11kind: Deployment
12metadata:
13  name: snyk-controller
14spec:
15  replicas: 1
16  selector:
17    matchLabels:
18      app: snyk-controller
19  template:
20    metadata:
21      labels:
22        app: snyk-controller
23    spec:
24      containers:
25      - name: snyk-controller
26        image: snyk/kubernetes-monitor
27        env:
28        - name: SNYK_TOKEN
29          valueFrom:
30            secretKeyRef:
31              name: snyk-secret
32              key: snykToken
33        - name: SNYK_CLUSTER_NAME
34          value: "production-cluster"