Semgrep SAST กับ Stream Processing — วิธีใช้

Semgrep SAST

Semgrep Static Application Security Testing วิเคราะห์โค้ดหาช่องโหว่ Security Pattern Matching 30+ ภาษา เร็ว CI/CD Community Rules 3000+ กฎ

เนื้อหาเกี่ยวข้อง — ดูเพิ่มเติมเรื่อง Prometheus Alertmanager DNS Management

Stream Processing ประมวลผล Real-time ทันที Kafka Streams Flink Spark Streaming Event Processing Analytics IoT Log Processing

เนื้อหาเกี่ยวข้อง — อ่านต่อ: TensorRT Optimization Machine Learning Pipeline

CI/CD Integration

# cicd_semgrep.py — Semgrep in CI/CD

# GitHub Actions
# name: Security Scan
# on: [push, pull_request]
# jobs:
#   semgrep:
#     runs-on: ubuntu-latest
#     steps:
#       - uses: actions/checkout@v4
#       - name: Semgrep Scan
#         uses: returntocorp/semgrep-action@v1
#         with:
#           config: >-
#             p/security-audit
#             p/owasp-top-ten
#             p/python
#             ./custom-rules/
#         env:
#           SEMGREP_APP_TOKEN: }

# GitLab CI
# semgrep:
#   image: returntocorp/semgrep
#   script:
#     - semgrep ci --config auto --config ./custom-rules/
#   rules:
#     - if: $CI_MERGE_REQUEST_ID

cicd_integration = {
    "GitHub Actions": {
        "action": "returntocorp/semgrep-action@v1",
        "config": "p/security-audit, p/owasp-top-ten, custom rules",
        "trigger": "Push, Pull Request",
    },
    "GitLab CI": {
        "action": "returntocorp/semgrep Docker image",
        "config": "semgrep ci --config auto",
        "trigger": "Merge Request",
    },
    "Jenkins": {
        "action": "semgrep ci in Pipeline step",
        "config": "semgrep --config auto --json > report.json",
        "trigger": "PR Build",
    },
    "Pre-commit Hook": {
        "action": "semgrep in .pre-commit-config.yaml",
        "config": "semgrep --config ./custom-rules/",
        "trigger": "Before Commit",
    },
}

print("Semgrep CI/CD Integration:")
for platform, info in cicd_integration.items():
    print(f"\n  [{platform}]")
    for key, value in info.items():
        print(f"    {key}: {value}")

# Semgrep vs Other SAST Tools
comparison = {
    "Semgrep": {"speed": "เร็วมาก", "rules": "Pattern Matching (ง่าย)", "focus": "Security", "cost": "Free CLI / Paid Cloud"},
    "SonarQube": {"speed": "ปานกลาง", "rules": "Complex (Java-based)", "focus": "Quality + Security", "cost": "Free Community / Paid"},
    "CodeQL": {"speed": "ช้า (Deep Analysis)", "rules": "Query Language (ซับซ้อน)", "focus": "Security", "cost": "Free for OSS"},
    "Snyk Code": {"speed": "เร็ว", "rules": "AI-powered", "focus": "Security", "cost": "Free Tier / Paid"},
}

print(f"\n\nSAST Tools Comparison:")
for tool, info in comparison.items():
    print(f"  {tool}: Speed={info['speed']} | Rules={info['rules']} | {info['cost']}")

Best Practices

Custom Rules: เขียน Rules เฉพาะสำหรับ Stream Processing ของทีม
Pre-commit: ใช้ Semgrep เป็น Pre-commit Hook ตรวจก่อน Commit
SASL_SSL: ใช้ SASL_SSL สำหรับ Kafka ทุกครั้ง
Schema Validation: ใช้ Avro/Protobuf Validate ข้อมูลใน Stream
Secrets: ห้าม Hardcode Credentials ใช้ Environment Variables
Audit: Log ทุก Security Event ใน Stream Pipeline

Semgrep คืออะไร

SAST วิเคราะห์โค้ดหาช่องโหว่ Security Pattern Matching 30+ ภาษา เร็ว CI/CD Community Rules 3000+ กฎ ฟรี Open Source

แนะนำเพิ่มเติม — อีบุ๊กการลงทุน SiamCafeBook

เนื้อหาเกี่ยวข้อง — ทำความเข้าใจ LocalAI Self-hosted Interview Preparation