Skip to content

Njsscan update

Zach Rice requested to merge njsscan-update into master

What does this MR do?

This MR updates the nodejs-scan analyzer to use the njsscan OSS project. The njsscan project is currently at v0.1.5 and uses semgrep for linting. This MR also adds custom ruleset support.

A new test project has been created for this update. Below is an example of the security dashboard.Screen_Shot_2020-10-01_at_4.03.48_PM

  • Note 1: there is a nodejsscan and njsscan project. nodejsscan includes a web gui which we don't need, hence why we are using njsscan.
  • Note 2: integration tests have been removed as the QA test cover e2e integration testing
  • Note 3: I know dangebot is saying there are too many changes in this MR and it should be split up into multiple MRs... however, this is an analyzer rewrite so I'm not sure how we would split this up into multiple MRs/what benefit we would get.

What are the relevant issue numbers?

gitlab-org/gitlab#220847 (closed)

Does this MR meet the acceptance criteria?

Edited by Lucas Charles

Merge request reports