simplesecurity 2023

Combine multiple popular python security tools and generate reports or output into different formats

SimpleSecurity

Combine multiple popular python security tools and generate reports or output into different formats

Plugins (these require the plugin executable in the system path. e.g. bandit requires bandit to be in the system path...)

• bandit
• safety
• dodgy
• dlint
• semgrep

Formats

• ansi (for terminal)
• json
• markdown
• csv
• sarif

Example Use

See below for the output if you run simplesecurity in this directory

Help

usage: __main__.py [-h] [--format FORMAT] [--plugin PLUGIN] [--file FILE] [--level LEVEL] [--confidence CONFIDENCE]
                   [--no-colour] [--high-contrast] [--fast] [--zero]

Combine multiple popular python security tools...

and generate reports or output into different formats.

optional arguments:
  -h, --help            show this help message and exit
  --format FORMAT, -f FORMAT
                        Output format. One of ansi, json, markdown, csv. default=ansi
  --plugin PLUGIN, -p PLUGIN
                        Plugin to use. One of bandit, safety, dodgy, dlint, semgrep, all, default=all
  --file FILE, -o FILE  Filename to write to (omit for stdout)
  --level LEVEL, -l LEVEL
                        Minimum level/ severity to show
  --confidence CONFIDENCE, -c CONFIDENCE
                        Minimum confidence to show
  --no-colour, -z       No ANSI colours
  --high-contrast, -Z   High contrast colours
  --fast, --skip        Skip long running jobs. Will omit plugins with long run time (applies to -p all only)
  --zero, -0            Return non zero exit code if any security vulnerabilities are found

You can also import this into your own project and use any of the functions in the DOCS

Table of Contents

• Example Use
  • Help
• Developer Notes
  • Generate semgrep_sec.yaml
• Documentation
• Install With PIP
• Language information
  • Built for
• Install Python on Windows
  • Chocolatey
  • Windows - Python.org
• Install Python on Linux
  • Apt
  • Dnf
• Install Python on MacOS
  • Homebrew
  • MacOS - Python.org
• How to run
  • Windows
  • Linux/ MacOS
• Building
• Testing
• Download Project
  • Clone
    • Using The Command Line
    • Using GitHub Desktop
  • Download Zip File
• Community Files
  • Licence
  • Changelog
  • Code of Conduct
  • Contributing
  • Security
  • Support
  • Rationale

Developer Notes

Generate semgrep_sec.yaml

1. Clone https://github.com/returntocorp/semgrep-rules

2. cd to semgrep-rules/python

3. do

   cat **/security/**/*.yaml >> semgrep_sec.yaml
   cat **/security/*.yaml >> semgrep_sec.yaml
   

4. Find and replace rules: with `` apart from the first instance

5. Reformat with ctrl+shift+i

6. replace simplesecurity/semgrep_sec.yaml with the new one

Documentation

A high-level overview of how the documentation is organized organized will help you know where to look for certain things:

• The Technical Reference documents APIs and other aspects of the machinery. This documentation describes how to use the classes and functions at a lower level and assume that you have a good high-level understanding of the software.

Install With PIP

"Slim" Build: Install bandit, dlint, dodgy, poetry, and safety with pipx

pip install simplesecurity

Otherwise:

pip install simplesecurity[full]

Head to https://pypi.org/project/SimpleSecurity/ for more info

Language information

Built for

This program has been written for Python versions 3.8 - 3.11 and has been tested with both 3.8 and 3.11

Install Python on Windows

Chocolatey

choco install python

Windows - Python.org

To install Python, go to https://www.python.org/downloads/windows/ and download the latest version.

Install Python on Linux

Apt

sudo apt install python3.x

Dnf

sudo dnf install python3.x

Install Python on MacOS

Homebrew

brew install python@3.x

MacOS - Python.org

To install Python, go to https://www.python.org/downloads/macos/ and download the latest version.

How to run

Windows

• Module py -3.x -m [module] or [module] (if module installs a script)

• File py -3.x [file] or ./[file]

Linux/ MacOS

• Module python3.x -m [module] or [module] (if module installs a script)

• File python3.x [file] or ./[file]

Building

This project uses https://github.com/FHPythonUtils/FHMake to automate most of the building. This command generates the documentation, updates the requirements.txt and builds the library artefacts

Note the functionality provided by fhmake can be approximated by the following

handsdown  --cleanup -o documentation/reference
poetry export -f requirements.txt --output requirements.txt
poetry export -f requirements.txt --with dev --output requirements_optional.txt
poetry build

fhmake audit can be run to perform additional checks

Testing

For testing with the version of python used by poetry use

poetry run pytest

Alternatively use tox to run tests over python 3.8 - 3.11

tox

Download Project

Clone

Using The Command Line

1. Press the Clone or download button in the top right

2. Copy the URL (link)

3. Open the command line and change directory to where you wish to clone to

4. Type 'git clone' followed by URL in step 2

   git clone https://github.com/FHPythonUtils/SimpleSecurity
   

More information can be found at https://help.github.com/en/articles/cloning-a-repository

Using GitHub Desktop

1. Press the Clone or download button in the top right
2. Click open in desktop
3. Choose the path for where you want and click Clone

More information can be found at https://help.github.com/en/desktop/contributing-to-projects/cloning-a-repository-from-github-to-github-desktop

Download Zip File

1. Download this GitHub repository
2. Extract the zip archive
3. Copy/ move to the desired location

Community Files

Licence

MIT License Copyright (c) FredHappyface (See the LICENSE for more information.)

Changelog

See the Changelog for more information.

Code of Conduct

Online communities include people from many backgrounds. The Project contributors are committed to providing a friendly, safe and welcoming environment for all. Please see the Code of Conduct for more information.

Contributing

Contributions are welcome, please see the Contributing Guidelines for more information.

Security

Thank you for improving the security of the project, please see the Security Policy for more information.

Support

Thank you for using this project, I hope it is of use to you. Please be aware that those involved with the project often do so for fun along with other commitments (such as work, family, etc). Please see the Support Policy for more information.

Rationale

The rationale acts as a guide to various processes regarding projects such as the versioning scheme and the programming styles used. Please see the Rationale for more information.