Add support for api site profiles in DAST Scan Execution Policies
What does this MR do and why?
The MR enhances the functionality of Dynamic Application Security Testing (DAST) by adding support for API Site Profiles within Scan Execution Policies.
- Key changes:
- Introduces a new template for API scans: 'DAST-On-Demand-API-Scan'.
- Modifies the existing pipeline configuration service to handle both website and API site profiles.
- Updates the logic to choose the appropriate template based on the site profile type (website or API).
- Implementation details:
- Updates the
prepare_on_demand_scan_configurationmethod to use the appropriate template based on the site profile type.
- Updates the
- Why it's important:
- This change allows users to create Scan Execution Policies that can utilize API Site Profiles, expanding the capabilities of DAST scans.
- It provides more flexibility in security testing by supporting different types of site profiles (website and API) within the same policy.
This MR adds support for DAST API Site Profiles used with Scan Execution Policies.
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Screenshots or screen recordings
Screenshots are required for UI changes, and strongly recommended for all other merge requests.
| Before | After |
|---|---|
How to set up and validate locally
- Create new project (ensure you have Ultimate license)
- Go to Secure -> On-demand scans -> New Scan
- Prepare new Scanner and Site profile, in Site profile change the Site type to API and save both profiles.
- Go to Secure -> Policies -> Create new
- Create new Scan Execution Policy, select DAST scan type and choose scanner and site profiles created in previous steps.
- Now when running scans for API site profiles, Scan Execution Policies will use different template and scanner.
Edited by Alan (Maciej) Paruszewski