Skip to content

Update DAST CI template to include new DAST API analyzer

Michael Eddington requested to merge 284683-add-peach-api-to-dast-tmplt into master

What does this MR do?

Adds new DAST API analyzer utilizing GitLab's API Security scanner. The new job is in beta behind the DAST_API_BETA variable.

  • Updated DAST.latest ci template
  • Added tests for latest DAST CI template
  • Added dast_api tests for DAST.latest ci templates

Relates to #284683 (closed)

CI Template

  1. These changes are backwards compatible and only made to the latest version. The the new dast_api job is behind a variable DAST_API_BETA.
  2. A spec file has been added for latest version with additional tests for dast_api job.
  3. Test project for DAST.latest ci template:
    1. Project: https://gitlab.com/gitlab-org/security-products/tests/api-fuzzing-e2e/dast-har/-/tree/mike-test-latest-template
    2. Template: https://gitlab.com/gitlab-org/security-products/tests/api-fuzzing-e2e/dast-har/-/blob/mike-test-latest-template/DAST.latest.gitlab-ci.yml
    3. Pipeline: https://gitlab.com/gitlab-org/security-products/tests/api-fuzzing-e2e/dast-har/-/pipelines/271676452
    4. image

Screenshots (strongly suggested)

NOTE: Latest CI template doesn't show up in list. This is also the case prior to changes.

image

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team
Edited by Michael Eddington

Merge request reports