<!-- The first four sections: "Problem to solve", "Intended users", "User experience goal", and "Proposal", are strongly recommended, while the rest of the sections can be filled out during the problem validation or breakdown phase. However, keep in mind that providing complete and relevant information early helps our product team validate the problem and start working on a solution. --> ### Problem to solve To complete [Custom Rulesets for SAST Analyzers](https://gitlab.com/groups/gitlab-org/-/epics/4179) we should provide the ability to modify specific rules for our individual ~"Category:SAST" and ~"Category:Secret Detection" analyzers, allowing overrides of properties. ### Intended users * [Sasha (Software Developer)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#sasha-software-developer) * [Rachel (Release Manager)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#rachel-release-manager) * [Alex (Security Operations Engineer)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#alex-security-operations-engineer) ### User experience goal Better data quality for users in better aligning rule properties with organization expectations. ### Proposal - Update [SAST rules configuration file specification](https://gitlab.com/gitlab-org/gitlab/-/issues/229579#links-references) to allow individual rules values to be overridden; i.e. `severity = High`. These rules must match the primary identifier [as defined by a given analyzer](https://gitlab.com/gitlab-org/security-products/analyzers/gosec/-/blob/6358c2cf956f4efe9ec5790c53aab7504d7c313c/convert.go#L197-201) (Perhaps `Value`?) - Allowlist of override-able attributes: `name`, `message`, `description`, `severity`, ~`confidence`~ - Validate supported override values - Update [`analyzers/command/run.go`](https://gitlab.com/gitlab-org/security-products/analyzers/common/-/blob/ad4512e178763acd1d3214e64045bdfd0a69a8be/command/run.go#L148-150) to override any returned findings with values specified in configuration file Update analyzers to enable modifying preexisting rules - [x] [brakeman](https://gitlab.com/gitlab-org/security-products/analyzers/brakeman#how-to-update-the-upstream-scanner) - [x] [phpcs-security-audit](https://gitlab.com/gitlab-org/security-products/analyzers/phpcs-security-audit#how-to-update-the-upstream-scanner) - [x] [security-code-scan](https://gitlab.com/gitlab-org/security-products/analyzers/security-code-scan#how-to-update-the-upstream-scanner) - [x] [bandit](https://gitlab.com/gitlab-org/security-products/analyzers/bandit#how-to-update-the-upstream-scanner) - [x] [eslint](https://gitlab.com/gitlab-org/security-products/analyzers/eslint#how-to-update-the-upstream-scanner) - [x] [mobSF](https://gitlab.com/gitlab-org/security-products/analyzers/mobsf) - [x] [flawfinder](https://gitlab.com/gitlab-org/security-products/analyzers/flawfinder#how-to-update-the-upstream-scanner) - [x] [gosec](https://gitlab.com/gitlab-org/security-products/analyzers/gosec#how-to-update-the-upstream-scanner) - [x] [sobelow](https://gitlab.com/gitlab-org/security-products/analyzers/sobelow#how-to-update-the-upstream-scanner) - [x] [semgrep](https://gitlab.com/gitlab-org/security-products/analyzers/semgrep#how-to-update-the-upstream-scanner) - [x] [kubesec](https://gitlab.com/gitlab-org/security-products/analyzers/kubesec#kubesec-analyzer) - [x] [kics](https://gitlab.com/gitlab-org/security-products/analyzers/kics/) - [x] [nodejs-scan](https://gitlab.com/gitlab-org/security-products/analyzers/nodejs-scan#how-to-update-the-upstream-scanner) - [x] [secrets](https://gitlab.com/gitlab-org/security-products/analyzers/secrets#how-to-update-the-upstream-scanner) - [x] [pmd-apex](https://gitlab.com/gitlab-org/security-products/analyzers/pmd-apex#how-to-update-the-upstream-scanner) - [x] [spotbugs](https://gitlab.com/gitlab-org/security-products/analyzers/spotbugs#how-to-update-the-upstream-scanner) #### Example ```toml [spotbugs] [[spotbugs.ruleset]] # Properties I'm overriding below severity = "Low" description = "Predictable random number generator detected, but I don't really care because this is a PoC to demonstrate crackable password hashes" # Filter on identifier [spotbugs.ruleset.identifier] type = "find_sec_bugs_type" # not needed but for readability value = "PREDICTABLE_RANDOM" ``` ### Further details <!-- Include use cases, benefits, goals, or any other details that will help us understand the problem better. --> ### Permissions and Security No change to permissions ### Documentation - Document functionality within [Static Application Security Testing docs](https://docs.gitlab.com/ee/user/application_security/sast/index.html) - Document functionality within [Secret Detection Testing docs](https://docs.gitlab.com/ee/user/application_security/secret_detection) ### Availability & Testing - Add test ensuring overridden rule generates findings matching the override value ### What does success look like, and how can we measure that? Rules can be disabled if considered insignificant to users ### What is the type of buyer? ~"GitLab Ultimate" ### Is this a cross-stage feature? <!-- Communicate if this change will affect multiple Stage Groups or product areas. We recommend always start with the assumption that a feature request will have an impact into another Group. Loop in the most relevant PM and Product Designer from that Group to provide strategic support to help align the Group's broader plan and vision, as well as to avoid UX and technical debt. https://about.gitlab.com/handbook/product/#cross-stage-features --> ### Links / references <!-- triage-serverless v3 PLEASE DO NOT REMOVE THIS SECTION --> *This page may contain information related to upcoming products, features and functionality. It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes. Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features, or functionality remain at the sole discretion of GitLab Inc.* <!-- triage-serverless v3 PLEASE DO NOT REMOVE THIS SECTION -->