docker run -it \
 -e DT_SAST_API_KEY=$DT_SAST_API_KEY \
 -e DT_SAST_REPOSITORY_NAME="<my_org>/<my_repo>" \
 -e DT_SAST_REPOSITORY_PLATFORM=BITBUCKET \
 -e DT_SAST_REPOSITORY_ID={1e734a1b-8d0e-4787-a205-aba048c00a89} \
 -e DT_SAST_REPOSITORY_HTML_URL="https://bitbucket.org/<my_org>/<my_repo>" \
 -e DT_SAST_REPOSITORY_DEFAULT_BRANCH_NAME="main" \
 -e DT_SAST_SCANNED_BRANCH="main" \
 --mount type=bind,source="$(pwd)"/,target=/target \
 us-central1-docker.pkg.dev/prod-scandal-us/datatheorem-sast/datatheorem-sast \
 data_theorem_sast_analyzer scan /target

Scanning completed in 15.65 seconds
Scan results: 1 issues on commit=f719d004ef98254b46187c53ef1b3ed2f8643082
Total Issues: 1
Issues per types:
- First Party Code: 1
- SCA: 1
Issues per severity:
- High Severity: 1
- Medium Severity: 1
[
  {
    "issue_title": "Unauthenticated Route Found for Flask API",
    "issue_description": "The security of this code is compromised due to the presence of unauthenticated access to specific routes within the Flask API. This vulnerability poses a significant risk as it can potentially expose sensitive data or allow unauthorized actions to be performed. To mitigate this risk, it is crucial to implement robust authentication mechanisms that ensure only authorized users can access the protected routes.\n\nBy allowing unauthenticated access, the code fails to validate the identity of users before granting them access to protectedcertain routes. This canlack beof achievedauthentication throughopens variousthe methods such as username/password authentication, token-based authentication, or integration with third-party authentication providers.\n\nAdditionallydoor for malicious actors to exploit the system and gain unauthorized access to sensitive information or perform actions that they should not be able to.\n\nTo address this issue, it is importantrecommended to considerimplement implementinga othersecure securityauthentication measuresprocess suchthat verifies asthe encryptionidentity of sensitive data, input validationusers before granting them access to preventprotected injectionroutes. attacks,This andcan properbe errorachieved handlingthrough tovarious avoidmethods leakingsuch sensitive information.\n\nBy implementing these security measures, the code can ensure that only authenticated and authorized users can access the protected routes, significantly reducing the risk of unauthorized access or data breaches. It is essential to prioritize security in the development process to safeguard sensitive data and protect the integrity of the system.",
    "issue_type": "FIRST_PARTY_CODE",
    "severity": "HIGH",
    "detected_in_file_path": "sample_code/bad_python.pyas username/password authentication, token-based authentication, or integration with third-party authentication providers.\n\nAdditionally, it is important to consider implementing other security measures such as encryption of sensitive data, input validation to prevent injection attacks, and proper error handling to avoid leaking sensitive information.\n\nBy implementing these security measures, the code can ensure that only authenticated and authorized users can access the protected routes, significantly reducing the risk of unauthorized access or data breaches. It is essential to prioritize security in the development process to safeguard sensitive data and protect the integrity of the system.",
    "detectedissue_on_linetype": 7"FIRST_PARTY_CODE",
    "issue_severity": "HIGH",
    "detected_in_file_path": "sample_code/bad_python.py",
    "detected_on_line": 7,
    "issue_code_snippet": "@app.route(\"/\")\ndef index():\n    cmd = request.args.get(\"cmd\", \"\")\n    exec(cmd)\n    return \"\""
  },
  {
    "issue_title": "jinja2 version 3.1.2 contains a known vulnerability (via PyPI dependency): Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter",
    "issue_description": "Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter",
    "issue_type": "SCA",
    "severity": "MEDIUM",
    "detected_in_file_path": "sample_code/requirements.txt",
    "detected_on_line": 1,
    "issue_code_snippet": "jinja2==3.1.2\n"
  }
]
Visit https://www.securetheorem.com/api/v2/security/sast for more details

trigger:
- main

pool:
  vmImage: ubuntu-latest

steps:
- script: |
    docker run \
    -e DT_SAST_API_KEY='$(DT_SAST_API_KEY)' \
    -e DT_SAST_REPOSITORY_NAME=$(Build.Repository.Name) \
    -e DT_SAST_REPOSITORY_PLATFORM=AZURE_DEVOPS \
    -e DT_SAST_REPOSITORY_ID=$(Build.Repository.ID) \
    -e DT_SAST_REPOSITORY_HTML_URL=$(Build.Repository.Uri) \
    -e DT_SAST_REPOSITORY_DEFAULT_BRANCH_NAME="main" \
    -e DT_SAST_SCANNED_BRANCH=$(Build.SourceBranchName) \
    -e DT_SAST_SCAN_HEAD_REF="HEAD" \
    --mount type=bind,source="$(pwd)"/,target=/target \
    us-central1-docker.pkg.dev/prod-scandal-us/datatheorem-sast/datatheorem-sast:latest \
    data_theorem_sast_analyzer scan /target
  displayName: 'Data Theorem On-Prem SAST'

FROM us-central1-docker.pkg.dev/prod-scandal-us/datatheorem-sast/datatheorem-sast:latest

# Copy SSL certificates to add
COPY --from=<YOUR_SOURCE> <PATH_TO_YOUR_SSL_CERTS> /usr/share/ca-certificates/custom

# Add certificates to /etc/ca-certificates.conf
RUN for crt in /usr/share/ca-certificates/custom/*.crt; do \
        echo "Adding $crt" && echo "custom/$(basename "$crt")" >> /etc/ca-certificates.conf; \
    done

# Update bundled CA certificates at /etc/ssl/certs/ca-certificates.crt
RUN update-ca-certificates
ENV DT_SAST_PATH_TO_SSL_CERTS_FILE=/etc/ssl/certs/ca-certificates.crt