Automated Security Testing: Building a Continuous Security Validation Framework

        ┌─────────────────────┐
        │  Manual Pentests   │  ← Quarterly/Annual
        │   (Comprehensive)   │
        └─────────────────────┘
               ▲
               │
        ┌──────────────────────┐
        │   DAST/IAST Tests    │  ← Weekly/PR
        │  (Dynamic Scanning)   │
        └──────────────────────┘
               ▲
               │
        ┌──────────────────────────┐
        │  SAST + SCA Scans        │  ← Every Commit/PR
        │ (Static Analysis)         │
        └──────────────────────────┘
               ▲
               │
        ┌────────────────────────────────┐
        │  Security Unit Tests           │  ← Every Commit
        │  (Input Validation, AuthZ)     │
        └────────────────────────────────┘

// tests/security/authorization.test.ts
import { describe, it, expect } from '@jest/globals';
import { checkUserAccess } from '../auth/authorization';

describe('Authorization Security Tests', () => {
  it('should deny access to resources without ownership', async () => {
    const user = { id: 'user-123', role: 'user' };
    const resource = { id: 'doc-456', ownerId: 'user-789' };
    
    const hasAccess = await checkUserAccess(user, resource, 'read');
    
    expect(hasAccess).toBe(false);
  });

  it('should prevent privilege escalation via role modification', async () => {
    const user = { id: 'user-123', role: 'user' };
    
    // Attempt to modify role in request
    const modifiedUser = { ...user, role: 'admin' };
    
    const hasAdminAccess = await checkUserAccess(modifiedUser, {}, 'admin:panel');
    
    // Should verify against DB, not trust client data
    expect(hasAdminAccess).toBe(false);
  });

  it('should sanitize SQL inputs to prevent injection', () => {
    const maliciousInput = "1' OR '1'='1";
    
    expect(() => {
      queryUser(maliciousInput);
    }).not.toThrow();
    
    // Should use parameterized queries
    expect(queryUser(maliciousInput)).toBeNull();
  });
});

// tests/security/crypto.test.ts
describe('Cryptography Security Tests', () => {
  it('should use strong password hashing (bcrypt with cost >= 12)', async () => {
    const password = 'TestP@ssw0rd';
    const hash = await hashPassword(password);
    
    // Verify bcrypt format
    expect(hash).toMatch(/^$2[aby]$d{2}$/);
    
    // Extract cost factor
    const cost = parseInt(hash.split('$')[2]);
    expect(cost).toBeGreaterThanOrEqual(12);
  });

  it('should use cryptographically secure random for tokens', () => {
    const token1 = generateToken();
    const token2 = generateToken();
    
    expect(token1).not.toEqual(token2);
    expect(token1.length).toBeGreaterThanOrEqual(32);
    
    // Should use crypto.randomBytes, not Math.random()
    expect(token1).toMatch(/^[a-f0-9]{64}$/);
  });

  it('should reject weak encryption algorithms', () => {
    expect(() => {
      encrypt('data', 'DES'); // Weak cipher
    }).toThrow('Unsupported algorithm');
    
    expect(() => {
      encrypt('data', 'AES-256-GCM'); // Strong cipher
    }).not.toThrow();
  });
});

# .semgrep/rules/custom-security.yml
rules:
  - id: hardcoded-secret
    pattern: |
      const $VAR = "$SECRET"
    message: Possible hardcoded secret detected
    severity: ERROR
    languages: [javascript, typescript]
    
  - id: sql-injection-risk
    pattern: |
      db.query("... " + $INPUT + " ...")
    message: Potential SQL injection - use parameterized queries
    severity: ERROR
    fix: db.query("... ?", [$INPUT])
    
  - id: missing-authentication
    pattern: |
      app.$METHOD($PATH, async ($REQ, $RES) => {
        ...
      })
    pattern-not-inside: |
      app.$METHOD($PATH, authenticateMiddleware, ...)
    message: Route missing authentication middleware
    severity: WARNING
    
  - id: weak-crypto
    pattern-either:
      - pattern: crypto.createCipher($ALG, ...)
      - pattern: crypto.pbkdf2($PASS, $SALT, $ITER, ...)
        metavariable-comparison:
          comparison: $ITER < 100000
    message: Weak cryptography detected
    severity: ERROR

# GitHub Actions workflow
name: Dependency Security Scan

on:
  schedule:
    - cron: '0 2 * * *'  # Daily at 2 AM
  pull_request:

jobs:
  sca-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: NPM Audit
        run: |
          npm audit --audit-level=high --json > npm-audit.json
          npm audit --audit-level=high
        continue-on-error: true
        
      - name: Snyk Test
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high --json-file-output=snyk-results.json
          
      - name: OWASP Dependency Check
        run: |
          docker run --rm -v $(pwd):/src owasp/dependency-check \
            --scan /src --format JSON --out /src/dependency-check-report.json
            
      - name: Grype Scan
        uses: anchore/scan-action@v3
        with:
          path: "."
          fail-build: true
          severity-cutoff: high
          
      - name: License Compliance
        run: |
          npx license-checker --json --out licenses.json
          npx license-compliance-checker --allow MIT,Apache-2.0,BSD-3-Clause
          
      - name: Upload Results
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: snyk-results.json

# ZAP automation framework configuration
# zap-config.yml

env:
  contexts:
    - name: "staging-app"
      urls:
        - "https://staging.company.com"
      includePaths:
        - "https://staging.company.com/api/.*"
      authentication:
        method: "json"
        loginUrl: "https://staging.company.com/api/auth/login"
        loginBody: '{"username":"[email protected]","password":"test123"}'
        loggedInIndicator: "\Qtoken\E"
        
jobs:
  - type: "passiveScan-config"
    parameters:
      maxAlertsPerRule: 10
      scanOnlyInScope: true
      
  - type: "spider"
    parameters:
      maxDuration: 10
      maxDepth: 5
      
  - type: "activeScan"
    parameters:
      maxRuleDurationInMins: 5
      maxScanDurationInMins: 30
      scanPolicyName: "API-Scan-Policy"
      
  - type: "report"
    parameters:
      template: "traditional-json-plus"
      reportDir: "/zap/reports"
      reportFile: "zap-report"
      
  - type: "alertFilter"
    alertFilters:
      - ruleId: 10202  # Absence of Anti-CSRF tokens
        newRisk: "Info"  # Downgrade if using JWT
      - ruleId: 90022  # Application Error Disclosure
        url: "https://staging.company.com/health"
        newRisk: "Info"  # Health endpoint expected

// tests/security/regressions.test.ts
describe('Security Regression Tests', () => {
  it('CVE-2024-001: Should prevent path traversal in file upload', async () => {
    const response = await request(app)
      .post('/api/upload')
      .attach('file', Buffer.from('test'), '../../../etc/passwd');
    
    expect(response.status).toBe(400);
    expect(response.body.error).toContain('Invalid filename');
  });

  it('CVE-2024-002: Should validate JWT signature before trusting claims', async () => {
    const tamperedToken = createTamperedJWT({ userId: 'admin', role: 'admin' });
    
    const response = await request(app)
      .get('/api/admin/users')
      .set('Authorization', `Bearer ${tamperedToken}`);
    
    expect(response.status).toBe(401);
  });

  it('Issue-#1234: Should rate-limit password reset requests', async () => {
    const requests = Array(6).fill(null).map(() =>
      request(app).post('/api/auth/reset-password').send({ email: '[email protected]' })
    );
    
    const responses = await Promise.all(requests);
    const tooManyRequests = responses.filter(r => r.status === 429);
    
    expect(tooManyRequests.length).toBeGreaterThan(0);
  });
});