Add AppSec custom SAST rules
What does this MR do and why?
Related to https://gitlab.com/gitlab-com/gl-security/appsec/appsec-team/-/issues/232
This adds a couple of jobs to our pipelines that run custom SAST rules with semgrep and ping appsec when they are detected in the MR. Semgrep only scans the files changed in the MR. The rules are based on patterns that previously led to vulnerabilities, these are identified in the metadata
attributes in the rule definitions https://gitlab.com/gitlab-com/gl-security/appsec/sast-custom-rules/-/blob/main/appsec-pings/rules.yml.
This also pushes the findings to the vulnerability report, but there's some customization on top of it. This customization is needed because
- We don't support incremental scanning and have no plans to do so at the moment #9815 (closed)
- We don't have security approvals in place which is required to prevent vulnerabilities from entering the code base https://gitlab.com/gitlab-com/www-gitlab-com/-/issues/12296
When we have those two things we can remove the customization, but in the meantime we'll develop this low-noise rule set to shift left and detect some vulnerabilities earlier and in an automated way.
Screenshots or screen recordings
See this thread !88484 (comment 968468041)
How to set up and validate locally
N/A
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
-
I have evaluated the MR acceptance checklist for this MR.