Skip to content

Create api fuzzer CI template

Problem

Scanners run using a CI template that is included by the customer. API Fuzzer doesn't have a template which prevents usage of the scanner.

Proposal

Create a template similar to the other scanners.

  • Scanner configuration via environment variables
  • Support optional images provided by the user: worker, target
  • Support testing external targets
  • Verifies feature is enabled

The most relevant template to mimic would be

https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Security/DAST.gitlab-ci.yml

Tasks:

  1. Support pre/post scripts
    1. FUZZAPI_D_PRE_SCRIPT - (optional) Pre script runs after docker login and docker network create, but before we start the scanning image container.
    2. FUZZAPI_D_POST_SCRIPT - (optional) Post script runs after scanning image container is started. This is the 1. [ ] Support target if provided (optional)
    3. FUZZAPI_D_TARGET_IMAGE
    4. FUZZAPI_D_TARGET_ENV
    5. FUZZAPI_D_TARGET_VOLUME
    6. FUZZAPI_D_TARGET_PORTS
  2. Support worker if provided (optional)
    1. FUZZAPI_D_WORKER_IMAGE
    2. FUZZAPI_D_WORKER_ENV
    3. FUZZAPI_D_WORKER_VOLUME
    4. FUZZAPI_D_WORKER_PORTS
  3. Set defaults when possible
  4. Update features check for fuzzing
  5. Misc docker
    1. FUZZAPI_D_NETWORK - (optional) Name of docker network, defaults to “testing-net” place to start your target(s) and kick off scanning if using our CLI tools.
  6. Check into correct repo https://gitlab.com/gitlab-org/gitlab/-/tree/master/lib/gitlab/ci/templates/Security
Edited by Michael Eddington