huncode/progcode
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

revise May 2023 static analysis articles
Build and deploy / deploy (push) Successful in 16s
Details

Browse Source
This commit is contained in:
huncode
2026-07-31 14:49:05 +03:00
parent b56f7e94b9
commit bb964e1f54
7 changed files with 833 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/public/assets/editorial/2023/static-analysis-2023-decision-gate.svg
+57
View File
@@ -0,0 +1,57 @@
<svg xmlns="http://www.w3.org/2000/svg" width="960" height="575" viewBox="0 0 960 575" role="img" aria-labelledby="title desc">
<title id="title">Гейт решения для шумного правила статического анализа</title>
<desc id="desc">После проверки rule, result и context выбирается одно из трёх действий: keep, tune или ограниченное suppress. Для suppress требуются точный fingerprint и срок. Глобальное отключение находится за пределами этого гейта, rollback возвращает предыдущую видимость учебного плана.</desc>
<rect width="960" height="575" rx="32" fill="#F8FAFC"/>
<rect x="32" y="28" width="896" height="66" rx="18" fill="#312E81"/>
<text x="64" y="68" fill="#F8FAFC" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="28" font-weight="700">Явное решение вместо выключателя</text>
<text x="64" y="86" fill="#DDD6FE" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="15">Гейт не меняет CI: он фиксирует, что именно будет проверено и как вернуться назад</text>
<rect x="48" y="132" width="248" height="146" rx="20" fill="#E0F2FE" stroke="#0284C7" stroke-width="2"/>
<text x="74" y="171" fill="#075985" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="22" font-weight="700">Входная запись</text>
<text x="74" y="205" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="17">rule revision + result fingerprint</text>
<text x="74" y="233" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="17">asset + boundary + owner + scope</text>
<text x="74" y="260" fill="#075985" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="14" font-weight="700">неполный context → сначала собрать</text>
<path d="M310 205H361" fill="none" stroke="#64748B" stroke-width="5" stroke-linecap="round"/>
<path d="M353 193L369 205L353 217" fill="none" stroke="#64748B" stroke-width="5" stroke-linecap="round" stroke-linejoin="round"/>
<polygon points="470,126 570,205 470,284 370,205" fill="#FEF3C7" stroke="#D97706" stroke-width="2"/>
<text x="421" y="198" fill="#92400E" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18" font-weight="700">context</text>
<text x="427" y="222" fill="#92400E" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18" font-weight="700">полный?</text>
<path d="M583 205H626" fill="none" stroke="#64748B" stroke-width="5" stroke-linecap="round"/>
<path d="M618 193L634 205L618 217" fill="none" stroke="#64748B" stroke-width="5" stroke-linecap="round" stroke-linejoin="round"/>
<rect x="648" y="132" width="264" height="146" rx="20" fill="#DCFCE7" stroke="#16A34A" stroke-width="2"/>
<text x="675" y="171" fill="#166534" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="22" font-weight="700">Evidence решения</text>
<text x="675" y="205" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="17">owner · reason · reviewBy</text>
<text x="675" y="233" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="17">scope · expiry — для suppress</text>
<text x="675" y="260" fill="#166534" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="14" font-weight="700">applied: not-applied-by-fixture</text>
<path d="M780 292V327" fill="none" stroke="#64748B" stroke-width="5" stroke-linecap="round"/>
<path d="M768 319L780 335L792 319" fill="none" stroke="#64748B" stroke-width="5" stroke-linecap="round" stroke-linejoin="round"/>
<rect x="48" y="350" width="240" height="118" rx="20" fill="#E0E7FF" stroke="#4F46E5" stroke-width="2"/>
<text x="76" y="390" fill="#3730A3" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="24" font-weight="700">keep</text>
<text x="76" y="423" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="17">сигнал остаётся видимым</text>
<text x="76" y="450" fill="#475569" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="15">следующий шаг: triage</text>
<rect x="312" y="350" width="240" height="118" rx="20" fill="#F3E8FF" stroke="#9333EA" stroke-width="2"/>
<text x="340" y="390" fill="#6B21A8" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="24" font-weight="700">tune</text>
<text x="340" y="423" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="17">revision + rule diff</text>
<text x="340" y="450" fill="#475569" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="15">rollback: предыдущий diff</text>
<rect x="576" y="350" width="240" height="118" rx="20" fill="#FFF7ED" stroke="#EA580C" stroke-width="2"/>
<text x="604" y="390" fill="#9A3412" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="24" font-weight="700">suppress</text>
<text x="604" y="423" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="17">exact fingerprint + expiry</text>
<text x="604" y="450" fill="#475569" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="15">rollback: снять exception</text>
<rect x="832" y="350" width="80" height="118" rx="20" fill="#FFF1F2" stroke="#E11D48" stroke-width="2"/>
<path d="M844 366L900 450M900 366L844 450" stroke="#E11D48" stroke-width="6" stroke-linecap="round"/>
<text x="847" y="391" fill="#9F1239" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="12" font-weight="700">global</text>
<text x="843" y="409" fill="#9F1239" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="12" font-weight="700">policy</text>
<text x="850" y="442" fill="#9F1239" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="12">отдельно</text>
<rect x="48" y="498" width="864" height="42" rx="16" fill="#0F172A"/>
<text x="76" y="525" fill="#F8FAFC" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">Rollback возвращает видимость учебного плана; реальная конфигурация, CI и security outcome не меняются fixture.</text>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 6.8 KiB

web/public/assets/editorial/2023/static-analysis-2023-rule-context.svg
+63
View File
@@ -0,0 +1,63 @@
<svg xmlns="http://www.w3.org/2000/svg" width="960" height="590" viewBox="0 0 960 590" role="img" aria-labelledby="title desc">
<title id="title">Границы данных между правилом, SARIF result и контекстом</title>
<desc id="desc">Схема разделяет поля, которые описывает правило, формат SARIF, результат и location, от отдельного проектного контекста. Явное решение появляется только после соединения слоёв.</desc>
<rect width="960" height="590" rx="32" fill="#F8FAFC"/>
<rect x="32" y="28" width="896" height="66" rx="18" fill="#172554"/>
<text x="64" y="68" fill="#F8FAFC" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="28" font-weight="700">SARIF и context: разные владельцы фактов</text>
<text x="64" y="86" fill="#BFDBFE" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="15">Формат передаёт сигнал; проектная запись объясняет, что с ним делать</text>
<rect x="48" y="142" width="180" height="292" rx="20" fill="#E0F2FE" stroke="#0284C7" stroke-width="2"/>
<text x="72" y="181" fill="#075985" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="23" font-weight="700">Rule</text>
<rect x="72" y="201" width="143" height="27" rx="13" fill="#BAE6FD"/>
<text x="86" y="220" fill="#075985" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="13" font-weight="700">policy author</text>
<text x="72" y="264" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">id</text>
<text x="72" y="296" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">revision</text>
<text x="72" y="328" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">category</text>
<text x="72" y="360" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">default level</text>
<text x="72" y="402" fill="#475569" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="15">называет гипотезу</text>
<path d="M242 288H256" fill="none" stroke="#64748B" stroke-width="5" stroke-linecap="round"/>
<path d="M248 276L264 288L248 300" fill="none" stroke="#64748B" stroke-width="5" stroke-linecap="round" stroke-linejoin="round"/>
<rect x="270" y="142" width="180" height="292" rx="20" fill="#FEF3C7" stroke="#D97706" stroke-width="2"/>
<text x="294" y="181" fill="#92400E" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="23" font-weight="700">SARIF log</text>
<rect x="294" y="201" width="132" height="27" rx="13" fill="#FDE68A"/>
<text x="306" y="220" fill="#92400E" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="13" font-weight="700">tool producer</text>
<text x="294" y="264" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">version 2.1.0</text>
<text x="294" y="296" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">tool.driver</text>
<text x="294" y="328" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">rules[]</text>
<text x="294" y="360" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">results[]</text>
<text x="294" y="402" fill="#475569" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="15">передаёт структуру</text>
<path d="M464 288H478" fill="none" stroke="#64748B" stroke-width="5" stroke-linecap="round"/>
<path d="M470 276L486 288L470 300" fill="none" stroke="#64748B" stroke-width="5" stroke-linecap="round" stroke-linejoin="round"/>
<rect x="492" y="142" width="180" height="292" rx="20" fill="#F3E8FF" stroke="#9333EA" stroke-width="2"/>
<text x="516" y="181" fill="#6B21A8" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="23" font-weight="700">Result</text>
<rect x="516" y="201" width="132" height="27" rx="13" fill="#E9D5FF"/>
<text x="528" y="220" fill="#6B21A8" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="13" font-weight="700">analysis output</text>
<text x="516" y="264" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">ruleId + level</text>
<text x="516" y="296" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">message</text>
<text x="516" y="328" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">fingerprint</text>
<text x="516" y="360" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">URI + line</text>
<text x="516" y="402" fill="#475569" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="15">указывает на место</text>
<path d="M686 288H700" fill="none" stroke="#64748B" stroke-width="5" stroke-linecap="round"/>
<path d="M692 276L708 288L692 300" fill="none" stroke="#64748B" stroke-width="5" stroke-linecap="round" stroke-linejoin="round"/>
<rect x="714" y="142" width="198" height="292" rx="20" fill="#DCFCE7" stroke="#16A34A" stroke-width="2"/>
<text x="738" y="181" fill="#166534" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="23" font-weight="700">Контекст</text>
<rect x="738" y="201" width="150" height="27" rx="13" fill="#BBF7D0"/>
<text x="751" y="220" fill="#166534" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="13" font-weight="700">component owner</text>
<text x="738" y="264" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">asset</text>
<text x="738" y="296" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">entry point</text>
<text x="738" y="328" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">boundary</text>
<text x="738" y="360" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">owner + scope</text>
<text x="738" y="402" fill="#166534" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="15" font-weight="700">добавляет reviewer</text>
<path d="M170 471H794" fill="none" stroke="#475569" stroke-width="4" stroke-linecap="round"/>
<path d="M786 459L802 471L786 483" fill="none" stroke="#475569" stroke-width="4" stroke-linecap="round" stroke-linejoin="round"/>
<rect x="274" y="446" width="420" height="52" rx="18" fill="#0F172A"/>
<text x="345" y="479" fill="#F8FAFC" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="20" font-weight="700">Решение: keep · tune · suppress</text>
<text x="48" y="548" fill="#64748B" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="15">Synthetic схема: rule и SARIF не доказывают запуск, reachability, exploitability или outcome безопасности.</text>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 7.5 KiB

web/public/assets/editorial/2023/static-analysis-2023-triage-funnel.svg
+61
View File
@@ -0,0 +1,61 @@
<svg xmlns="http://www.w3.org/2000/svg" width="960" height="560" viewBox="0 0 960 560" role="img" aria-labelledby="title desc">
<title id="title">Воронка triage для сигнала статического анализа</title>
<desc id="desc">Правило и SARIF result проходят через проверку формы и контекста. На выходе разрешены keep, tune и ограниченное suppress; глобальное отключение вынесено за пределы обычного решения.</desc>
<rect width="960" height="560" rx="32" fill="#F8FAFC"/>
<rect x="32" y="28" width="896" height="66" rx="18" fill="#0F172A"/>
<text x="64" y="68" fill="#F8FAFC" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="32" font-weight="700">Разбор сигнала: сначала контекст</text>
<text x="64" y="86" fill="#CBD5E1" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="15">Учебная воронка: сигнал не становится security verdict автоматически</text>
<rect x="48" y="132" width="196" height="214" rx="20" fill="#E0F2FE" stroke="#0284C7" stroke-width="2"/>
<text x="72" y="172" fill="#075985" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="22" font-weight="700">1. Вход</text>
<text x="72" y="207" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">rule id + revision</text>
<text x="72" y="236" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">SARIF result</text>
<text x="72" y="265" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">URI + строка</text>
<rect x="72" y="288" width="145" height="32" rx="16" fill="#BAE6FD"/>
<text x="87" y="310" fill="#075985" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="14" font-weight="700">ещё не finding</text>
<path d="M258 239H302" fill="none" stroke="#64748B" stroke-width="5" stroke-linecap="round"/>
<path d="M294 227L310 239L294 251" fill="none" stroke="#64748B" stroke-width="5" stroke-linecap="round" stroke-linejoin="round"/>
<rect x="316" y="132" width="196" height="214" rx="20" fill="#FEF3C7" stroke="#D97706" stroke-width="2"/>
<text x="340" y="172" fill="#92400E" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="22" font-weight="700">2. Форма</text>
<text x="340" y="207" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">версия формата</text>
<text x="340" y="236" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">rule ↔ result</text>
<text x="340" y="265" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">fingerprint</text>
<rect x="340" y="288" width="145" height="32" rx="16" fill="#FDE68A"/>
<text x="354" y="310" fill="#92400E" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="14" font-weight="700">контракт, не риск</text>
<path d="M526 239H570" fill="none" stroke="#64748B" stroke-width="5" stroke-linecap="round"/>
<path d="M562 227L578 239L562 251" fill="none" stroke="#64748B" stroke-width="5" stroke-linecap="round" stroke-linejoin="round"/>
<rect x="584" y="132" width="196" height="214" rx="20" fill="#DCFCE7" stroke="#16A34A" stroke-width="2"/>
<text x="608" y="172" fill="#166534" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="22" font-weight="700">3. Контекст</text>
<text x="608" y="207" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">asset + entry point</text>
<text x="608" y="236" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">trust boundary</text>
<text x="608" y="265" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18">owner + scope</text>
<rect x="608" y="288" width="145" height="32" rx="16" fill="#BBF7D0"/>
<text x="623" y="310" fill="#166534" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="14" font-weight="700">собирает человек</text>
<path d="M794 239H838" fill="none" stroke="#64748B" stroke-width="5" stroke-linecap="round"/>
<path d="M830 227L846 239L830 251" fill="none" stroke="#64748B" stroke-width="5" stroke-linecap="round" stroke-linejoin="round"/>
<rect x="806" y="132" width="106" height="214" rx="20" fill="#EDE9FE" stroke="#7C3AED" stroke-width="2"/>
<text x="826" y="172" fill="#5B21B6" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="22" font-weight="700">4.</text>
<text x="826" y="202" fill="#5B21B6" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18" font-weight="700">Выбор</text>
<text x="826" y="235" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="17">keep</text>
<text x="826" y="263" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="17">tune</text>
<text x="826" y="291" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="17">suppress</text>
<rect x="48" y="390" width="564" height="104" rx="20" fill="#FFFFFF" stroke="#CBD5E1" stroke-width="2"/>
<text x="76" y="422" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="19" font-weight="700">Перед действием: owner · причина · reviewBy</text>
<text x="76" y="451" fill="#0F172A" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="18" font-weight="700">точный scope и rollback</text>
<text x="76" y="478" fill="#475569" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="15">Неполный context оставляет сигнал видимым и создаёт задачу на недостающий факт.</text>
<rect x="642" y="390" width="270" height="104" rx="20" fill="#FFF1F2" stroke="#E11D48" stroke-width="2"/>
<circle cx="674" cy="428" r="14" fill="#E11D48"/>
<path d="M668 422L680 434M680 422L668 434" stroke="#FFFFFF" stroke-width="3" stroke-linecap="round"/>
<text x="699" y="435" fill="#9F1239" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="19" font-weight="700">не: global disable</text>
<text x="699" y="463" fill="#9F1239" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="15">другой масштаб решения</text>
<text x="48" y="530" fill="#64748B" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif" font-size="15">Synthetic схема: она не показывает запуск scanner, реальные findings, coverage или outcome безопасности.</text>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 7.1 KiB