Warn in logs about Dependency Scanning jobs security risks
Release notes
Problem to solve
As a user with Dependency Scanning jobs running in my project pipeline, I want to be warned when these a scanning job use vulnerability databases that might be outdated. In particular, I want to be warned when:
- The vulnerability DB being used is not the one maintained by GitLab.
- The update of the vulnerability DB has been disabled.
- The scanner has been configured to fetch a particular version/git ref of the vulnerability DB.
I still want to be able to customize Dependency Scanning using supported CI variables.
Further details
Here are the relevant variables:
BUNDLER_AUDIT_UPDATE_DISABLED
BUNDLER_AUDIT_ADVISORY_DB_URL
BUNDLER_AUDIT_ADVISORY_DB_REF_NAME
GEMNASIUM_DB_UPDATE_DISABLED
GEMNASIUM_DB_REMOTE_URL
GEMNASIUM_DB_REF_NAME
RETIREJS_JS_ADVISORY_DB
RETIREJS_NODE_ADVISORY_DB
It might be relevant to warn about RETIREJS_ADVISORY_DB_INSECURE
being set, but this is out of scope.
Implementation plan
This issue is concentrated only on adding this warning to logs. More to expect with #347546 (closed)
- In the Dependency Scanning CI template add a check for the aforementioned CI variables.
- If those variables are set to not-default values, add a message in CI Logs.
- Add a section in the documentation https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#troubleshooting explaining this warning and how to fix it
- Add a link to this documentation to the warning.
This is similar to #337295 (closed).
Availability & Testing
Integration tests to be added to test the scenarios
- The vulnerability DB being used is not the one maintained by GitLab.
- The update of the vulnerability DB has been disabled.
- The scanner has been configured to fetch a particular version/git ref of the vulnerability DB.
Is this a cross-stage feature?
To be checked. It might apply to other security scanning jobs that are highly customizable, and that expose CI variables one could use to exclude vulnerabilities/rules.