Azure DevOps Pipeline’larında Otomatik NuGet Zafiyet Taraması (DevSecOps)

# templates/nuget-vulnerability-scan.yml
parameters:
  - name: workingDirectory
    type: string
    default: '$(System.DefaultWorkingDirectory)'
  - name: severityThreshold
    type: string
    default: 'Critical,High'
  - name: failOnNotFound
    type: boolean
    default: false

steps:
  - task: PowerShell@2
    displayName: 'Scan and fail on vulnerable NuGet packages'
    inputs:
      targetType: 'inline'
      script: |
        $workingDir = "${{ parameters.workingDirectory }}"
        $severityList = "${{ parameters.severityThreshold }}" -split ',' | ForEach-Object { $_.Trim() }
        $failOnNotFound = [System.Convert]::ToBoolean("${{ parameters.failOnNotFound }}")

        Write-Host "Tarama dizini    : $workingDir"
        Write-Host "Fail eden seviyeler: $($severityList -join ', ')"

        $projects = Get-ChildItem -Path $workingDir -Recurse -Filter "*.csproj" -ErrorAction SilentlyContinue

        if (-not $projects -or $projects.Count -eq 0) {
          $msg = "Hic csproj dosyasi bulunamadi: $workingDir"
          if ($failOnNotFound) {
            Write-Host "##vso[task.logissue type=error]$msg"
            exit 1
          } else {
            Write-Host "##vso[task.logissue type=warning]$msg"
            exit 0
          }
        }

        Write-Host "Taranacak proje sayisi: $($projects.Count)"
        $projects | ForEach-Object { Write-Host " - $($_.FullName)" }

        $findings = @()

        foreach ($proj in $projects) {
          Write-Host "Taraniyor: $($proj.FullName)"
          $vulnJsonPath = Join-Path $env:AGENT_TEMPDIRECTORY "vuln_$($proj.BaseName)_$([guid]::NewGuid().ToString('N')).json"

          dotnet list "$($proj.FullName)" package --vulnerable --include-transitive --format json | Out-File $vulnJsonPath -Encoding utf8

          $content = Get-Content $vulnJsonPath -Raw -ErrorAction SilentlyContinue
          if (-not $content) { continue }

          try { $json = $content | ConvertFrom-Json } catch {
            Write-Host "##[warning]$($proj.Name) icin JSON parse edilemedi, atlaniyor."
            continue
          }
          if (-not $json.projects) { continue }

          foreach ($project in $json.projects) {
            foreach ($fw in $project.frameworks) {

              foreach ($pkg in @($fw.topLevelPackages)) {
                if ($pkg.vulnerabilities) {
                  foreach ($v in $pkg.vulnerabilities) {
                    if ($v.severity -in $severityList) {
                      $findings += [pscustomobject]@{
                        Project    = $proj.Name
                        Package    = $pkg.id
                        Resolved   = $pkg.resolvedVersion
                        Severity   = $v.severity
                        Advisory   = $v.advisoryurl
                        Type       = 'TopLevel'
                        UpdateHint = "PackageReference'i direkt guncelleyin: $($pkg.id)"
                      }
                    }
                  }
                }
              }

              foreach ($pkg in @($fw.transitivePackages)) {
                if ($pkg.vulnerabilities) {
                  foreach ($v in $pkg.vulnerabilities) {
                    if ($v.severity -in $severityList) {
                      $whyOutput = dotnet nuget why "$($proj.FullName)" "$($pkg.id)" 2>&1 | Out-String
                      $findings += [pscustomobject]@{
                        Project    = $proj.Name
                        Package    = $pkg.id
                        Resolved   = $pkg.resolvedVersion
                        Severity   = $v.severity
                        Advisory   = $v.advisoryurl
                        Type       = 'Transitive'
                        UpdateHint = $whyOutput.Trim()
                      }
                    }
                  }
                }
              }
            }
          }
        }

        if ($findings.Count -gt 0) {
          Write-Host "##vso[task.logissue type=error]NuGet guvenlik zaafiyeti bulundu ($($severityList -join '/'))!"
          Write-Host ""
          foreach ($item in $findings) {
            Write-Host "============================================================"
            Write-Host "Proje    : $($item.Project)"
            Write-Host "Paket    : $($item.Package) ($($item.Resolved))"
            Write-Host "Seviye   : $($item.Severity)"
            Write-Host "Advisory : $($item.Advisory)"
            Write-Host "Tip      : $($item.Type)"
            if ($item.Type -eq 'Transitive') {
              Write-Host "--- Bagimlilik zinciri (hangi paketi guncellemelisiniz) ---"
              Write-Host $item.UpdateHint
            } else {
              Write-Host "Aksiyon  : $($item.UpdateHint)"
            }
            Write-Host ""
          }
          exit 1
        } else {
          Write-Host "Belirtilen seviyede ($($severityList -join '/')) zafiyet bulunamadi."
        }

steps:
  - task: NuGetCommand@2
    name: 'NugetUpdate'
    inputs:
      restoreSolution: '${{ parameters.solutionFileName }}'
      feedsToUse: 'config'
      continueOnError: true
      includeNuGetOrg: true

  - template: templates/nuget-vulnerability-scan.yml

  - task: DotNetCoreCLI@2
    displayName: 'Publish Project'
    condition: and(succeeded(), ne(${{ parameters.createImage }}, true))
    inputs:
      command: publish
      projects: '**/${{ parameters.ProjectFileName }}'
      publishWebProjects: False
      arguments: '--configuration $(BuildConfiguration) --output $(Build.ArtifactStagingDirectory)'
      zipAfterPublish: True