Conducting Regular Security Audits in Odoo: Finding Vulnerabilities

# Install
pip install bandit

# Scan your Odoo modules
bandit -r /odoo/addons/custom_module/

# Example output:
# >> Issue: [B608:hardcoded_sql_string]
#    Possible SQL injection vector
#    Location: models/invoice.py, line 45
#    Severity: HIGH
#    Confidence: MEDIUM

# Generate report
bandit -r /odoo/addons/ -f json > bandit-report.json

# ❌ VULNERABLE: Hardcoded SQL
query = "SELECT * FROM res_partner WHERE id = " + str(partner_id)

# ✅ SECURE: Use ORM
partner = self.env['res.partner'].browse(partner_id)

# ❌ VULNERABLE: Hardcoded credentials
password = "admin123"
api_key = "sk_live_123456789"

# ✅ SECURE: Use environment variables
import os
password = os.environ.get('DB_PASSWORD')
api_key = os.environ.get('STRIPE_API_KEY')

# ❌ VULNERABLE: Pickle deserialization (code execution risk)
import pickle
data = pickle.loads(untrusted_data)

# ✅ SECURE: Use JSON
import json
data = json.loads(untrusted_data)

# Install
pip install safety

# Check for vulnerable packages
safety check > safety-report.txt

# Example output:
# [CRITICAL] django 3.0.0 has vulnerability CVE-2021-44720
# Upgrade to: django>=3.2.9
#
# [HIGH] requests 2.28.0 has vulnerability CVE-2023-32681
# Upgrade to: requests>=2.29.0

# Check specific requirements file
safety check -r requirements.txt

# Install SonarQube (Docker)
docker run -d --name sonarqube \
  -p 9000:9000 \
  sonarqube:latest

# Configure project
cat > sonar-project.properties << EOF
sonar.projectKey=odoo_custom
sonar.projectName=Odoo Custom Modules
sonar.sources=/odoo/addons/custom_modules
sonar.language=python
sonar.python.bandit.reportPath=bandit-report.json
EOF

# Run analysis
sonar-scanner \
  -Dsonar.host.url=http://localhost:9000 \
  -Dsonar.login=admin:password

# Access dashboard: http://localhost:9000

# Step 1: Collect all code
find /odoo/addons -name "*.py" -type f > codelist.txt
echo "Found $(wc -l < codelist.txt) Python files to scan"

# Step 2: Run automated scans
bandit -r /odoo/addons -f json > bandit-report.json
safety check -r /odoo/requirements.txt > safety-report.txt

# Step 3: Review results
grep -i "HIGH\|CRITICAL" bandit-report.json
grep -i "CRITICAL" safety-report.txt

# Step 4: Create findings list
cat > audit-findings-q1.md << EOF
# Q1 2025 Security Audit

## Critical Issues (Fix within 7 days)
1. SQL injection in payment_processor.py (Line 45)
   - Severity: CRITICAL
   - Impact: Database compromise
   - Fix: Use ORM instead of raw SQL

2. Hardcoded API key in integration_module.py (Line 123)
   - Severity: CRITICAL
   - Impact: API compromise
   - Fix: Use environment variable

## High Issues (Fix within 30 days)
3. Missing input validation in invoice.py
4. Outdated cryptography library (CVE-2025-xxxx)
5. Weak password policy configuration

## Medium Issues (Fix within 90 days)
6. Missing error logging in sales module
7. Insufficient rate limiting on API endpoint
EOF

# Fix all CRITICAL issues first
# Example fix: SQL injection

# BEFORE (vulnerable):
invoice_id = request.params['id']
invoices = self.env.cr.execute(
    "SELECT * FROM account_invoice WHERE id = " + invoice_id
)

# AFTER (secure):
invoice_id = request.params.get('id', 0)
invoices = self.env['account.invoice'].search([('id', '=', invoice_id)])

# Test the fix
python -m pytest tests/test_invoice_security.py -v

# Re-scan to verify fix
bandit -r /odoo/addons/custom_module/ | grep "payment_processor.py"
# Output: (No HIGH/CRITICAL issues found)

# Deploy to staging
git commit -m "Fix: SQL injection in payment_processor.py"
git push origin main

# Run full regression tests
pytest tests/ -v --cov

# Re-run all scans to verify fixes
bandit -r /odoo/addons -f json > bandit-report-fixed.json
safety check -r /odoo/requirements.txt > safety-report-fixed.txt

# Generate executive summary
cat > audit-summary-q1.md << EOF
# Q1 2025 Security Audit Summary

## Timeline
- Start Date: 2025-01-01
- Completion: 2025-03-31
- Total Effort: 26 hours

## Findings by Severity
- Critical: 2 (RESOLVED)
- High: 3 (RESOLVED)
- Medium: 7 (RESOLVED)
- Low: 12 (RESOLVED)

## Key Improvements
✓ Eliminated all SQL injection risks
✓ Secured hardcoded credentials
✓ Updated 15 vulnerable dependencies
✓ Implemented input validation on all APIs
✓ Strengthened password policy

## Vulnerability Metrics
Before Audit: 24 vulnerabilities
After Audit: 0 vulnerabilities
Remediation Rate: 100%

## Recommendations
1. Implement automated scanning in CI/CD pipeline
2. Conduct security training for development team
3. Schedule penetration test for Q2 2025
4. Implement WAF (Web Application Firewall)
EOF

# .github/workflows/security-audit.yml
name: Security Audit

on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      # SAST Scanning
      - name: Bandit Security Scan
        run: |
          pip install bandit
          bandit -r . -f json > bandit-report.json
      
      # Dependency Check
      - name: Safety Dependency Check
        run: |
          pip install safety
          safety check --json > safety-report.json
      
      # Quality Scanning
      - name: SonarQube Analysis
        uses: SonarSource/sonarqube-scan-action@master
        env:
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
      
      # Fail if critical issues found
      - name: Check for Critical Issues
        run: |
          critical_count=$(grep -c '"severity": "CRITICAL"' bandit-report.json || true)
          if [ $critical_count -gt 0 ]; then
            echo "Found $critical_count critical issues!"
            exit 1
          fi