Skip to content

Add AppSec custom SAST rules

Dominic Couture requested to merge dcouture-custom-appsec-sast-rules into master

What does this MR do and why?

Related to https://gitlab.com/gitlab-com/gl-security/appsec/appsec-team/-/issues/232

This adds a couple of jobs to our pipelines that run custom SAST rules with semgrep and ping appsec when they are detected in the MR. Semgrep only scans the files changed in the MR. The rules are based on patterns that previously led to vulnerabilities, these are identified in the metadata attributes in the rule definitions https://gitlab.com/gitlab-com/gl-security/appsec/sast-custom-rules/-/blob/main/appsec-pings/rules.yml.

This also pushes the findings to the vulnerability report, but there's some customization on top of it. This customization is needed because

  1. We don't support incremental scanning and have no plans to do so at the moment #9815 (closed)
  2. We don't have security approvals in place which is required to prevent vulnerabilities from entering the code base https://gitlab.com/gitlab-com/www-gitlab-com/-/issues/12296

When we have those two things we can remove the customization, but in the meantime we'll develop this low-noise rule set to shift left and detect some vulnerabilities earlier and in an automated way.

Screenshots or screen recordings

See this thread !88484 (comment 968468041)

How to set up and validate locally

N/A

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Dominic Couture

Merge request reports