Add ShiftLeft build rules

[ongamse]

This pull request enables build rules. You can read more about build rules here. The build rules are controlled by the shiftleft.yml file in the repository.

Visit app.shiftleft.io to see the security findings for this repository.

We've done a few things on your behalf

• Forked this demo application
• Generated a unique secret SHIFTLEFT_ACCESS_TOKEN to allow GitHub Actions in this repository to communicate with the Qwiet (Shiftleft) API
• Committed a GitHub Action that will invoke Qwiet preZero's Static Application Security Testing (SAST) on all future pull requests on this repository
• Created this pull request that demonstrates build rules. It also adds a status check that displays the result of the GitHub Action

Questions? Comments? Want to learn more? Get in touch with us or check out our documentation.

[github-actions]

Checking analysis of application shiftleft-csharp-demo against 3 build rules.

Using sl version 0.9.1979 (50693a35ee8ed9923aa33e99254627cfe3cd570b).

Checking findings on scan 1.

Results per rule:

• Allow no critical findings: FAIL
  (3 matched vulnerabilities; configured threshold is 0).

  Findings:

  ID	CVSS	Rating	Title
  39	9.0	critical	Directory Traversal: Attacker-controlled Data Used in File Path in CustomersController.Get
  40	9.0	critical	Directory Traversal: Attacker-controlled Data Used in File Path via value in CustomersController.Serialization
  41	9.0	critical	SQL Injection: Attacker-controlled Data Used in SQL Query via sql in CustomersController.Get

  Severity rating	Count
  Critical	3
  High	0
  Medium	0
  Low	0

  Category	Count
  Directory Traversal	2
  SQL Injection	1

  OWASP 2021 Category	Count
  A01-Broken-Access-Control	2
  A03-Injection	1

• Allow one OSS or container finding: FAIL
  (5 matched vulnerabilities; configured threshold is 1).

  Findings:

  ID	CVSS	Rating	CVE	Title
  43	7.5	high	CVE-2018-8292	An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Informati…
  44	7.5	high	CVE-2018-0764	Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0. 1.1 and 2.0 allow a denial of service…
  45	7.5	high	CVE-2018-0765	A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka ".NET and .NET Core Denial of Service Vulnerability."…
  46	5.9	medium	CVE-2022-34716	Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. An information disclosure vulnera…
  42	5.8	medium	CVE-2022-41064	Microsoft is releasing this security advisory to provide information about a vulnerability in .NET, .NET Core and .NET Framework's System.Data.SqlClient and…

  Severity rating	Count
  Critical	0
  High	3
  Medium	2
  Low	0

  CVE	Count
  CVE-2022-41064	1
  CVE-2022-34716	1
  CVE-2018-8292	1
  CVE-2018-0765	1
  CVE-2018-0764	1

• Allow no reachable OSS vulnerability: pass
  (0 matched vulnerabilities; configured threshold is 0).

2 rules failed.