Skip to content

Tune NodeJS Scan primary Identifiers

Craig Smith requested to merge craigmsmith-tune-nodejs-primary-ids into main

What does this MR do?

This is a no-op change as the NodeJS Scan rules are not yet deployed by the deploy script.

This MR updates the ID and primary identifier of the nodejs_scan ruleset. These changes mean a generated ruleset will look like:

rules:
- id: nodejs_scan.javascript-crypto-rule-node_aes_ecb
  patterns:
  ...
  message: ...
  languages:
  - javascript
  severity: ERROR
  metadata:
    owasp: A9:2017-Using Components with Known Vulnerabilities
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    security-severity: HIGH
    primary_identifier: nodejs_scan.javascript-crypto-rule-node_aes_ecb
    secondary_identifiers:
    - name: NodeJS Scan ID javascript-crypto-rule-node_aes_ecb
      type: njsscan_rule_type
      value: javascript-crypto-rule-node_aes_ecb

The main purpose of this MR is to have concise primary identifiers.

What are the relevant issue numbers?

gitlab-org/gitlab#395487 (closed)

Does this MR meet the acceptance criteria?

Edited by Adam Cohen

Merge request reports