2nd/10_Wiki/Topics/Domain_Programming/DevOps_and_Security/SAST.md

id, title, category, status, canonical_id, aliases, duplicate_of, source_trust_level, confidence_score, verification_status, tags, raw_sources, last_reinforced, github_commit, tech_stack

id	title	category	status	canonical_id	aliases	duplicate_of	source_trust_level	confidence_score	verification_status	tags	raw_sources	last_reinforced	github_commit	tech_stack
wiki-2026-0508-sast	SAST	10_Wiki/Topics	verified	self	Static Application Security Testing static analysis source code analysis	none	A	0.95	applied	security sast devsecops static-analysis ci-cd		2026-05-10	pending	language framework multi semgrep-codeql-snyk

SAST

매 한 줄

"매 source 의 reading 없이 의 running". SAST (Static Application Security Testing) 의 source code, bytecode, binary 의 의 inspecting 의 vulnerabilities 의 detecting 의 — 매 runtime 의 없이. 2026 의 dominant tools: Semgrep (rule-based, fast), CodeQL (semantic, deep), Snyk Code (DeepCode AI).

매 핵심

매 SAST 의 기본 mechanics

• AST/CFG/DFG: source 의 parse → AST → control-flow graph → data-flow graph.
• Taint analysis: 매 source (user input) → sink (sql query) 의 path 의 trace.
• Pattern matching: 매 known anti-pattern (e.g., eval(req.body)) 의 detect.
• Symbolic execution (heavy): 매 path constraints 의 SMT solver 의 — 매 CodeQL.

매 modern tools 의 비교

• Semgrep (2026): YAML rules, 매 fast (CI-friendly), 매 OSS + Pro (Semgrep Code).
• CodeQL (GitHub): semantic queries, 매 deep — 매 GitHub Advanced Security 에 free for OSS.
• Snyk Code: AI-augmented (DeepCode), 매 fast, 매 commercial.
• SonarQube: code quality + security 의 hybrid.

매 응용

1. PR-blocking gate (block-on-high).
2. Pre-commit (fast subset).
3. Nightly full scan + Jira issue 의 auto-create.

💻 패턴

Semgrep custom rule (taint TS)

rules:
  - id: dangerous-eval-from-request
    languages: [typescript, javascript]
    severity: ERROR
    message: 매 user input 의 eval 의 — RCE 위험
    mode: taint
    pattern-sources:
      - pattern-either:
          - pattern: req.body
          - pattern: req.query
          - pattern: req.params
    pattern-sinks:
      - pattern-either:
          - pattern: eval(...)
          - pattern: new Function(...)

GitHub Actions — Semgrep CI

name: SAST
on: [pull_request]
jobs:
  semgrep:
    runs-on: ubuntu-latest
    container: returntocorp/semgrep
    steps:
      - uses: actions/checkout@v4
      - run: semgrep ci --config=p/owasp-top-ten --config=.semgrep/
        env:
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

CodeQL query 의 hardcoded secret

import javascript

from StringLiteral s
where s.getValue().regexpMatch("AKIA[0-9A-Z]{16}")
select s, "매 hardcoded AWS key 의 detected"

Pre-commit hook — fast subset

#!/usr/bin/env bash
changed=$(git diff --cached --name-only --diff-filter=ACMR | grep -E '\.(ts|tsx|js|py)$')
[ -z "$changed" ] && exit 0
echo "$changed" | xargs semgrep --config=p/security-audit --error

SARIF upload 의 GitHub code scanning 의

- run: semgrep ci --sarif --output=semgrep.sarif || true
- uses: github/codeql-action/upload-sarif@v3
  with: { sarif_file: semgrep.sarif }

Triage — false positive 의 suppress 의

// nosemgrep: dangerous-eval-from-request
// 매 reason: input 의 zod-validated 의 already
const result = eval(safeMath); // ok

매 결정 기준

상황	Tool
OSS project, 매 fast feedback	Semgrep (free OSS rules)
GitHub repo, 매 deep semantic	CodeQL (GHAS)
polyglot enterprise	Snyk Code or SonarQube
custom org rules 의 heavy	Semgrep Pro

기본값: Semgrep (PR gate, p/owasp-top-ten) + CodeQL (nightly, scheduled).

🔗 Graph

• 부모: CI/CD Pipeline & IDE Security Integration · Application Security
• 변형: 보안 및 시스템 신뢰성 표준 · IAST · SCA_Fundamentals
• 응용: 보안 및 시스템 신뢰성 표준 · Secure SDLC
• Adjacent: CodeQL · Semgrep

🤖 LLM 활용

언제: triaging findings, generating fix PRs (Copilot Autofix style), writing custom rules from natural language. 언제 X: trusting AI-only triage 없이 의 human review — 매 false positives 여전히 30-50%.

❌ 안티패턴

• Block-on-everything: medium severity 의 PR block — devs 의 SAST 의 disable 의.
• No suppression hygiene: nosemgrep 의 reason 없이 spammed.
• Tool-only: SAST 만 — DAST/SCA 없으면 runtime + dependency 의 blind.
• Scan once a quarter: 매 finding backlog 의 explode.

🧪 검증 / 중복

• Verified (Semgrep Registry 2026, GitHub CodeQL docs, OWASP SAST guide).
• 신뢰도 A.

🕓 Changelog

날짜	변경
2026-05-08	Phase 1
2026-05-10	Manual cleanup — Semgrep/CodeQL 의 modern SAST patterns