feat: Add Python SAST workflow with three security analysis tools

Implements Issue #5 - Python SAST workflow that combines:
- Dependency scanning (pip-audit) for CVE detection
- Security linting (Bandit) for vulnerability patterns
- Type checking (Mypy) for type safety issues

## Changes

**New Modules:**
- `DependencyScanner`: Scans Python dependencies for known CVEs using pip-audit
- `BanditAnalyzer`: Analyzes Python code for security issues using Bandit
- `MypyAnalyzer`: Checks Python code for type safety issues using Mypy

**New Workflow:**
- `python_sast`: Temporal workflow that orchestrates all three SAST tools
  - Runs tools in parallel for fast feedback (3-5 min vs hours for fuzzing)
  - Generates unified SARIF report with findings from all tools
  - Supports configurable severity/confidence thresholds

**Updates:**
- Added SAST dependencies to Python worker (bandit, pip-audit, mypy)
- Updated module __init__.py files to export new analyzers
- Added type_errors.py test file to vulnerable_app for Mypy validation

## Testing

Workflow tested successfully on vulnerable_app:
-  Bandit: Detected 9 security issues (command injection, unsafe functions)
-  Mypy: Detected 5 type errors
-  DependencyScanner: Ran successfully (no CVEs in test dependencies)
-  SARIF export: Generated valid SARIF with 14 total findings
This commit is contained in:
tduhamel42
2025-10-22 15:28:19 +02:00
parent 0ed6809d94
commit 6abf4ef71d
11 changed files with 1556 additions and 2 deletions
@@ -0,0 +1,62 @@
#!/usr/bin/env python3
# Copyright (c) 2025 FuzzingLabs
#
# Licensed under the Business Source License 1.1 (BSL). See the LICENSE file
# at the root of this repository for details.
#
# After the Change Date (four years from publication), this version of the
# Licensed Work will be made available under the Apache License, Version 2.0.
# See the LICENSE-APACHE file or http://www.apache.org/licenses/LICENSE-2.0
#
# Additional attribution and requirements are provided in the NOTICE file.
"""
Test file with type errors for Mypy testing.
"""
from typing import List, Dict
def add_numbers(a: int, b: int) -> int:
"""Add two integers"""
# Type error: returning string instead of int
return str(a + b)
def process_items(items: List[str]) -> None:
"""Process a list of strings"""
# Type error: iterating over None
for item in items:
print(item.upper())
# Type error: passing int to function expecting string list
process_items(123)
def get_user_data() -> Dict[str, str]:
"""Get user data"""
# Type error: returning wrong type
return ["user1", "user2"]
def calculate_total(numbers: List[int]) -> float:
"""Calculate total"""
# Type error: calling method that doesn't exist
return numbers.sum()
class User:
def __init__(self, name: str, age: int):
self.name = name
self.age = age
def create_user(name: str, age: int) -> User:
"""Create a user"""
# Type error: returning dict instead of User
return {"name": name, "age": age}
# Missing type annotations
def unsafe_function(x, y):
return x + y