Skip to content

Add AppSec custom SAST rules

Dominic Couture requested to merge dcouture-custom-appsec-sast-rules-2 into master

What does this MR do and why?

This is the second take for this MR, the original version was reverted !88484 (merged)

Related to https://gitlab.com/gitlab-com/gl-security/appsec/appsec-team/-/issues/232

This adds a couple of jobs to our pipelines that run custom SAST rules with semgrep and ping appsec when they are detected in the MR. Semgrep only scans the files changed in the MR. The rules are based on patterns that previously led to vulnerabilities, these are identified in the metadata attributes in the rule definitions https://gitlab.com/gitlab-com/gl-security/appsec/sast-custom-rules/-/blob/main/appsec-pings/rules.yml.

This also pushes the findings to the vulnerability report, but there's some customization on top of it. This customization is needed because

  1. We don't support incremental scanning and have no plans to do so at the moment #9815 (closed)
  2. We don't have security approvals in place which is required to prevent vulnerabilities from entering the code base https://gitlab.com/gitlab-com/www-gitlab-com/-/issues/12296

When we have those two things we can remove the customization, but in the meantime we'll develop this low-noise rule set to shift left and detect some vulnerabilities earlier and in an automated way.

Screenshots or screen recordings

These are strongly recommended to assist reviewers and reduce the time to merge your change.

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Dominic Couture

Merge request reports