Skip to content

Update files that require AppSec reviews

Dominic Couture requested to merge dcouture-codeowners-appsec into master

What does this MR do and why?

Related to https://gitlab.com/gitlab-com/gl-security/appsec/appsec-team/-/issues/263

Following https://gitlab.com/gitlab-com/gl-security/security-operations/sirt/operations/-/issues/2167 we introduced !84141 (merged) which added required approval by ~"group::authentication and authorization" for our Auth-related code.

In the same vein, this requires AppSec reviews for changes on the files that are central to our security and protect us from large classes of vulnerabilities.

At this time this is a very limited list:

  • The main CSP configuration which limits cross-site scripting (XSS) exploitation
  • Gitlab::UrlBlocker which protects us against server-side request forgery (SSRF)
  • The DOMPurify configuration which is important for our XSS defense

Screenshots or screen recordings

N/A

How to set up and validate locally

N/A

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Dominic Couture

Merge request reports