Add asset links to API Fuzzing security report
Problem
API Fuzzing faults include two assets that will be exposed in the UI. The assets are artifacts of the job.
The fields have been added to the backend code, and the report schema. All that is left is identifying how to generate the asset links.
Relates to #260432 (closed)
Proposal
Two asset types of asset links are needed, download all artifacts and individual file artifacts. The asset links can be constructed by the scanner as they are deterministic.
Example download all artifacts for job:
https://gitlab.com/gitlab-org/security-products/demos/api-fuzzing-poc/-/jobs/739364672/artifacts/download
Example download single artifact for job:
https://gitlab.com/gitlab-org/security-products/demos/api-fuzzing-poc/-/jobs/739364672/artifacts/file/gl-api_fuzzing-logs.log
Change EndPoint to include scheme
Currently the target endpoint (server) definition lumps all schemes together. This makes it impossible to reconstruct the full URL as the scheme isn't recorded with the actual requests being sent.
To allow actual requests to be re-constructed correctly for the assets, the EndPoint will be keyed as the base url instead of url authority (host:port).
Add new FUZZAPI_REPORT_ASSET_PATH variable
A new variable is needed to provide the path to save report assets to. This folder is where report assets will be saved too. The CI template will use this variable to pickup the assets.
Tasks
-
Generate assets on disk -
Add asset links to security report -
Update template to pass project path and job id to scanner engine -
If UX works with asset fields, update docs -
Generate new default sqlite db -
Disable debug messages in py lib
/cc @sethgitlab @stkerr