Skip to content

SAST vulnerabilities are not being surfaced in MR view and IaC scanning floods results

Summary

When the IaC scanner (kics) is enabled along with the SAST scanner (semgrep), the vulnerability Merge Request View does not display the SAST scanner results, just the IaC ones.

Steps to reproduce

  1. Enable SAST and IaC scanning on your pipeline
include:
  - template: Jobs/SAST.gitlab-ci.yml
  - template: Jobs/SAST-IaC.gitlab-ci.yml

  1. Introduce an MR with both SAST and IaC vulnerabilities

  2. Wait for the pipeline to complete

  3. Take a look at the MR view and notice that no SAST vulnerabilities are displayed, but there are many IaC vulnerabilities

  4. Open the Full Report

  5. Scroll to the bottom and notice some SAST vulnerabilities from Semgrep/bandit/etc. detected

Example Project

I have created https://gitlab.com/fjdiaz/secure-iac-bug-review in order to confirm this case. You can see the Merge-Request https://gitlab.com/fjdiaz/secure-iac-bug-review/-/merge_requests/1 to replicate the above behavior.

What is the current bug behavior?

Regular SAST vulnerabilities are not displayed along with IaC vulnerabilities in the MR-view. Note: both are present in the full-report.

What is the expected correct behavior?

Both SAST and IaC vulnerabilities should be present in the MR-view and full report.

Relevant logs and/or screenshots

Viewing the MR view scanner widget
view-mr-vulns

Full report of the same MR
full-report

Output of checks

This bug happens on GitLab.com

MR with issue: https://gitlab.com/fjdiaz/secure-iac-bug-review/-/merge_requests/1
SAST job output: https://gitlab.com/fjdiaz/secure-iac-bug-review/-/jobs/4303664425
IAC job output: https://gitlab.com/fjdiaz/secure-iac-bug-review/-/jobs/4303664427

Possible fixes

I believe this may be caused by the gl-sast-report.json report either being overwritten or not generated properly.

My suggestion for the best experience would be to separate SAST scanner results from IaC scanner results. I suggest this because:

  • SAST vulnerabilities may be handled by different personas than IaC vulnerabilities (AppSec vs. Infra team)
  • The separation makes it easy to make a plan on what to resolve
  • IaC vulnerabilities are unique to infrastructure
Edited by Fern