Postmortem: A Checkmarx 10.0 False Positive Caused a Critical Deployment to Be Delayed for 24 Hours

package com.example.payment.controller;

import com.example.payment.dto.PaymentRequest;
import com.example.payment.dto.PaymentResponse;
import com.example.payment.service.PaymentService;
import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.tags.Tag;
import jakarta.validation.Valid;
import jakarta.validation.constraints.NotNull;
import jakarta.validation.constraints.Pattern;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.validation.annotation.Validated;
import org.springframework.web.bind.annotation.*;

import java.util.List;

@RestController
@RequestMapping(\"/api/v1/payments\")
@Tag(name = \"Payment Controller\", description = \"Endpoints for processing payment transactions\")
@Validated
public class PaymentController {
    private static final Logger log = LoggerFactory.getLogger(PaymentController.class);
    private final PaymentService paymentService;

    // Autowire via constructor for testability (Checkmarx 10.0 flagged this as \"Insecure Dependency Injection\" - false positive)
    @Autowired
    public PaymentController(PaymentService paymentService) {
        this.paymentService = paymentService;
    }

    @GetMapping(\"/transactions\")
    @Operation(summary = \"List transactions by status\", description = \"Returns paginated transactions filtered by status code\")
    public ResponseEntity> listTransactionsByStatus(
            @RequestParam
            @NotNull(message = \"Status code cannot be null\")
            @Pattern(regexp = \"^(PENDING|COMPLETED|FAILED|REFUNDED)$\", message = \"Status must be one of: PENDING, COMPLETED, FAILED, REFUNDED\")
            String statusCode,
            @RequestParam(defaultValue = \"0\") int page,
            @RequestParam(defaultValue = \"20\") int size) {
        try {
            log.info(\"Fetching transactions with status: {}, page: {}, size: {}\", statusCode, page, size);
            // Checkmarx 10.0 incorrectly flagged statusCode as tainted and used in SQL query without sanitization
            // Actual implementation uses JPA Specification with typed parameters, no raw SQL
            List transactions = paymentService.getTransactionsByStatus(statusCode, page, size);
            return ResponseEntity.ok(transactions);
        } catch (IllegalArgumentException e) {
            log.error(\"Invalid status code provided: {}\", statusCode, e);
            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(null);
        } catch (Exception e) {
            log.error(\"Failed to fetch transactions for status: {}\", statusCode, e);
            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body(null);
        }
    }

    @PostMapping(\"/process\")
    @Operation(summary = \"Process new payment\", description = \"Validates and processes a payment request\")
    public ResponseEntity processPayment(@Valid @RequestBody PaymentRequest request) {
        try {
            PaymentResponse response = paymentService.processPayment(request);
            log.info(\"Successfully processed payment with ID: {}\", response.transactionId());
            return ResponseEntity.status(HttpStatus.CREATED).body(response);
        } catch (IllegalArgumentException e) {
            log.error(\"Invalid payment request: {}\", request, e);
            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(null);
        } catch (Exception e) {
            log.error(\"Failed to process payment request: {}\", request, e);
            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body(null);
        }
    }
}

#!/usr/bin/env python3
\"\"\"
Checkmarx Scan Result Filter
Filters out known false positives from Checkmarx 10.0 SAST scans using a predefined ruleset.
Requires: requests>=2.31.0, python-dotenv>=1.0.0
\"\"\"

import os
import sys
import json
import logging
from typing import List, Dict, Optional
from dotenv import load_dotenv
import requests
from requests.exceptions import RequestException

# Configure logging
logging.basicConfig(
    level=logging.INFO,
    format=\"%(asctime)s - %(name)s - %(levelname)s - %(message)s\"
)
logger = logging.getLogger(__name__)

# Load environment variables from .env file
load_dotenv()

# Checkmarx API configuration (canonical GitHub repo for client: https://github.com/checkmarx/checkmarx-python-client)
CHECKMARX_BASE_URL = os.getenv(\"CHECKMARX_BASE_URL\", \"https://checkmarx.example.com\")
CHECKMARX_CLIENT_ID = os.getenv(\"CHECKMARX_CLIENT_ID\")
CHECKMARX_CLIENT_SECRET = os.getenv(\"CHECKMARX_CLIENT_SECRET\")
FALSE_POSITIVE_RULES_PATH = os.getenv(\"FALSE_POSITIVE_RULES_PATH\", \"false_positives.json\")

class CheckmarxFilterError(Exception):
    \"\"\"Custom exception for Checkmarx filtering errors\"\"\"
    pass

def get_access_token() -> str:
    \"\"\"Retrieve OAuth2 access token from Checkmarx API\"\"\"
    token_url = f\"{CHECKMARX_BASE_URL}/auth/token\"
    payload = {
        \"client_id\": CHECKMARX_CLIENT_ID,
        \"client_secret\": CHECKMARX_CLIENT_SECRET,
        \"grant_type\": \"client_credentials\"
    }
    try:
        response = requests.post(token_url, json=payload, timeout=10)
        response.raise_for_status()
        return response.json()[\"access_token\"]
    except RequestException as e:
        logger.error(f\"Failed to retrieve access token: {e}\")
        raise CheckmarxFilterError(f\"Authentication failed: {e}\") from e
    except KeyError as e:
        logger.error(f\"Access token not found in response: {e}\")
        raise CheckmarxFilterError(f\"Invalid token response: {e}\") from e

def fetch_scan_results(scan_id: str, token: str) -> List[Dict]:
    \"\"\"Fetch SAST findings for a given scan ID\"\"\"
    results_url = f\"{CHECKMARX_BASE_URL}/sast/scans/{scan_id}/results\"
    headers = {\"Authorization\": f\"Bearer {token}\"}
    try:
        response = requests.get(results_url, headers=headers, timeout=30)
        response.raise_for_status()
        return response.json().get(\"results\", [])
    except RequestException as e:
        logger.error(f\"Failed to fetch scan results for scan {scan_id}: {e}\")
        raise CheckmarxFilterError(f\"Result fetch failed: {e}\") from e

def load_false_positive_rules() -> List[Dict]:
    \"\"\"Load known false positive rules from JSON file\"\"\"
    try:
        with open(FALSE_POSITIVE_RULES_PATH, \"r\") as f:
            return json.load(f)
    except FileNotFoundError as e:
        logger.warning(f\"False positive rules file not found at {FALSE_POSITIVE_RULES_PATH}, using empty ruleset\")
        return []
    except json.JSONDecodeError as e:
        logger.error(f\"Invalid JSON in false positive rules file: {e}\")
        raise CheckmarxFilterError(f\"Invalid rules file: {e}\") from e

def is_false_positive(finding: Dict, rules: List[Dict]) -> bool:
    \"\"\"Check if a finding matches any false positive rule\"\"\"
    for rule in rules:
        # Match on CWE ID, file path pattern, and query name
        cwe_match = finding.get(\"cweId\") == rule.get(\"cweId\")
        path_match = rule.get(\"filePathPattern\") in finding.get(\"fileName\", \"\")
        query_match = finding.get(\"queryName\") == rule.get(\"queryName\")
        if cwe_match and path_match and query_match:
            logger.debug(f\"Finding {finding.get('id')} matched false positive rule {rule.get('id')}\")
            return True
    return False

def filter_findings(scan_id: str) -> List[Dict]:
    \"\"\"Main filtering workflow: auth -> fetch -> filter -> return real findings\"\"\"
    if not CHECKMARX_CLIENT_ID or not CHECKMARX_CLIENT_SECRET:
        raise CheckmarxFilterError(\"Missing Checkmarx client ID or secret in environment variables\")

    try:
        token = get_access_token()
        logger.info(f\"Successfully authenticated to Checkmarx API\")
        raw_findings = fetch_scan_results(scan_id, token)
        logger.info(f\"Fetched {len(raw_findings)} raw findings for scan {scan_id}\")
        fp_rules = load_false_positive_rules()
        logger.info(f\"Loaded {len(fp_rules)} false positive rules\")
        real_findings = [f for f in raw_findings if not is_false_positive(f, fp_rules)]
        logger.info(f\"Filtered out {len(raw_findings) - len(real_findings)} false positives, returning {len(real_findings)} real findings\")
        return real_findings
    except CheckmarxFilterError:
        raise
    except Exception as e:
        logger.error(f\"Unexpected error filtering scan {scan_id}: {e}\")
        raise CheckmarxFilterError(f\"Unexpected error: {e}\") from e

if __name__ == \"__main__\":
    if len(sys.argv) != 2:
        logger.error(\"Usage: python checkmarx_filter.py \")
        sys.exit(1)
    scan_id = sys.argv[1]
    try:
        filtered = filter_findings(scan_id)
        print(json.dumps(filtered, indent=2))
    except CheckmarxFilterError as e:
        logger.error(f\"Filtering failed: {e}\")
        sys.exit(1)

package com.example.payment.controller;

import com.example.payment.dto.PaymentResponse;
import com.example.payment.service.PaymentService;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.extension.ExtendWith;
import org.mockito.InjectMocks;
import org.mockito.Mock;
import org.mockito.junit.jupiter.MockitoExtension;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;

import java.util.Arrays;
import java.util.List;

import static org.junit.jupiter.api.Assertions.*;
import static org.mockito.ArgumentMatchers.anyString;
import static org.mockito.ArgumentMatchers.eq;
import static org.mockito.Mockito.when;

@ExtendWith(MockitoExtension.class)
class PaymentControllerTest {
    @Mock
    private PaymentService paymentService;

    @InjectMocks
    private PaymentController paymentController;

    private static final String VALID_STATUS = \"COMPLETED\";
    private static final String INVALID_STATUS = \"INVALID_STATUS\";
    private static final int DEFAULT_PAGE = 0;
    private static final int DEFAULT_SIZE = 20;

    private List mockTransactions;

    @BeforeEach
    void setUp() {
        mockTransactions = Arrays.asList(
                new PaymentResponse(\"txn_123\", \"COMPLETED\", 100.0, \"USD\"),
                new PaymentResponse(\"txn_456\", \"COMPLETED\", 200.0, \"EUR\")
        );
    }

    @Test
    void listTransactionsByStatus_ValidStatus_ReturnsOkResponse() {
        // Arrange
        when(paymentService.getTransactionsByStatus(eq(VALID_STATUS), eq(DEFAULT_PAGE), eq(DEFAULT_SIZE)))
                .thenReturn(mockTransactions);

        // Act
        ResponseEntity> response = paymentController.listTransactionsByStatus(
                VALID_STATUS, DEFAULT_PAGE, DEFAULT_SIZE
        );

        // Assert
        assertEquals(HttpStatus.OK, response.getStatusCode());
        assertNotNull(response.getBody());
        assertEquals(2, response.getBody().size());
        assertTrue(response.getBody().stream().allMatch(txn -> VALID_STATUS.equals(txn.status())));
    }

    @Test
    void listTransactionsByStatus_InvalidStatus_ReturnsBadRequest() {
        // Arrange: no need to mock service, validation happens before service call
        // Act
        ResponseEntity> response = paymentController.listTransactionsByStatus(
                INVALID_STATUS, DEFAULT_PAGE, DEFAULT_SIZE
        );

        // Assert
        assertEquals(HttpStatus.BAD_REQUEST, response.getStatusCode());
        assertNull(response.getBody());
    }

    @Test
    void listTransactionsByStatus_ServiceThrowsException_ReturnsInternalServerError() {
        // Arrange
        when(paymentService.getTransactionsByStatus(anyString(), anyInt(), anyInt()))
                .thenThrow(new RuntimeException(\"Database connection failed\"));

        // Act
        ResponseEntity> response = paymentController.listTransactionsByStatus(
                VALID_STATUS, DEFAULT_PAGE, DEFAULT_SIZE
        );

        // Assert
        assertEquals(HttpStatus.INTERNAL_SERVER_ERROR, response.getStatusCode());
        assertNull(response.getBody());
    }

    @Test
    void listTransactionsByStatus_NullStatus_ReturnsBadRequest() {
        // Act
        ResponseEntity> response = paymentController.listTransactionsByStatus(
                null, DEFAULT_PAGE, DEFAULT_SIZE
        );

        // Assert
        assertEquals(HttpStatus.BAD_REQUEST, response.getStatusCode());
        assertNull(response.getBody());
    }

    @Test
    void processPayment_ValidRequest_ReturnsCreatedResponse() {
        // Arrange
        PaymentRequest validRequest = new PaymentRequest(\"user_123\", 100.0, \"USD\", \"4111111111111111\");
        PaymentResponse mockResponse = new PaymentResponse(\"txn_789\", \"PENDING\", 100.0, \"USD\");
        when(paymentService.processPayment(validRequest)).thenReturn(mockResponse);

        // Act
        ResponseEntity response = paymentController.processPayment(validRequest);

        // Assert
        assertEquals(HttpStatus.CREATED, response.getStatusCode());
        assertNotNull(response.getBody());
        assertEquals(\"txn_789\", response.getBody().transactionId());
    }
}

{
  \"id\": \"fp_20240312_001\",
  \"cweId\": \"89\",
  \"queryName\": \"SQL_Injection_Taint_Analysis\",
  \"filePathPattern\": \"com/example/payment/controller/PaymentController.java\",
  \"reason\": \"StatusCode is validated via @Pattern annotation before being passed to JPA Specification, no raw SQL used\",
  \"validatedBy\": \"jane.doe@example.com\",
  \"validatedDate\": \"2024-03-12\",
  \"expiresDate\": \"2024-09-12\"
}

package checkmarx.gate

import future.keywords.if
import future.keywords.in

default allow = false

# Allow if no critical findings
allow if {
    count(critical_findings) == 0
}

# Block if any high confidence critical findings
allow if {
    high_confidence_critical := [f | f := critical_findings[_]; f.confidence == \"High\"]
    count(high_confidence_critical) > 0
    # Require manual approval via GitHub PR label
    \"security-approved\" in input.pr.labels
}

# Warn but don't block for medium confidence critical findings
allow if {
    medium_confidence_critical := [f | f := critical_findings[_]; f.confidence == \"Medium\"]
    count(medium_confidence_critical) > 0
}

# Log low confidence critical findings, don't block
allow if {
    low_confidence_critical := [f | f := critical_findings[_]; f.confidence == \"Low\"]
    count(low_confidence_critical) > 0
}

critical_findings[f] if {
    f := input.findings[_]
    f.severity == \"Critical\"
}

jobs:
  unit-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run unit tests
        run: ./mvnw test

  checkmarx-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Checkmarx Scan
        uses: checkmarx/ast-github-action@v2
        with:
          base-url: ${{ secrets.CHECKMARX_BASE_URL }}
          tenant: ${{ secrets.CHECKMARX_TENANT }}
          client-id: ${{ secrets.CHECKMARX_CLIENT_ID }}
          client-secret: ${{ secrets.CHECKMARX_CLIENT_SECRET }}
          additional-params: --scan-preset \"SAST Default\" --exclude \"**/src/test/**,**/lombok/**\"