2019-09-13 09:26:31 -04:00
|
|
|
# Read more about this feature here: https://docs.gitlab.com/ee/user/application_security/sast/
|
2019-03-07 22:39:35 -05:00
|
|
|
#
|
|
|
|
# Configure the scanning tool through the environment variables.
|
|
|
|
# List of the variables: https://gitlab.com/gitlab-org/security-products/sast#settings
|
|
|
|
# How to set: https://docs.gitlab.com/ee/ci/yaml/#variables
|
|
|
|
|
2019-09-25 14:06:17 -04:00
|
|
|
variables:
|
2020-05-11 14:09:55 -04:00
|
|
|
# Setting this variable will affect all Security templates
|
|
|
|
# (SAST, Dependency Scanning, ...)
|
|
|
|
SECURE_ANALYZERS_PREFIX: "registry.gitlab.com/gitlab-org/security-products/analyzers"
|
|
|
|
|
2020-10-16 17:09:08 -04:00
|
|
|
SAST_DEFAULT_ANALYZERS: "bandit, brakeman, gosec, spotbugs, flawfinder, phpcs-security-audit, security-code-scan, nodejs-scan, eslint, sobelow, pmd-apex, kubesec, mobsf"
|
2020-06-11 08:08:54 -04:00
|
|
|
SAST_EXCLUDED_PATHS: "spec, test, tests, tmp"
|
2019-11-11 04:06:38 -05:00
|
|
|
SAST_ANALYZER_IMAGE_TAG: 2
|
2019-11-19 19:06:22 -05:00
|
|
|
SCAN_KUBERNETES_MANIFESTS: "false"
|
2019-09-25 14:06:17 -04:00
|
|
|
|
|
|
|
sast:
|
2019-03-07 22:39:35 -05:00
|
|
|
stage: test
|
2019-09-18 10:02:45 -04:00
|
|
|
artifacts:
|
|
|
|
reports:
|
|
|
|
sast: gl-sast-report.json
|
2020-05-12 14:07:54 -04:00
|
|
|
rules:
|
2020-09-04 17:08:41 -04:00
|
|
|
- when: never
|
2019-03-07 22:39:35 -05:00
|
|
|
variables:
|
2020-04-24 08:10:16 -04:00
|
|
|
SEARCH_MAX_DEPTH: 4
|
2019-03-07 22:39:35 -05:00
|
|
|
script:
|
2020-09-04 17:08:41 -04:00
|
|
|
- echo "$CI_JOB_NAME is used for configuration only, and its script should not be executed"
|
|
|
|
- exit 1
|
2019-09-18 10:02:45 -04:00
|
|
|
|
2019-12-19 13:07:48 -05:00
|
|
|
.sast-analyzer:
|
2019-09-25 14:06:17 -04:00
|
|
|
extends: sast
|
2020-09-04 17:08:41 -04:00
|
|
|
allow_failure: true
|
2020-05-12 14:07:54 -04:00
|
|
|
rules:
|
2020-09-04 17:08:41 -04:00
|
|
|
- if: $SAST_DISABLED
|
2020-05-12 14:07:54 -04:00
|
|
|
when: never
|
2020-07-24 17:09:16 -04:00
|
|
|
- if: $CI_COMMIT_BRANCH
|
2019-09-18 10:02:45 -04:00
|
|
|
script:
|
|
|
|
- /analyzer run
|
|
|
|
|
|
|
|
bandit-sast:
|
2019-12-19 13:07:48 -05:00
|
|
|
extends: .sast-analyzer
|
2019-09-18 10:02:45 -04:00
|
|
|
image:
|
2020-08-27 20:10:34 -04:00
|
|
|
name: "$SAST_ANALYZER_IMAGE"
|
2020-08-26 17:10:19 -04:00
|
|
|
variables:
|
|
|
|
SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/bandit:$SAST_ANALYZER_IMAGE_TAG"
|
2020-05-12 14:07:54 -04:00
|
|
|
rules:
|
2020-09-04 17:08:41 -04:00
|
|
|
- if: $SAST_DISABLED
|
2020-05-12 14:07:54 -04:00
|
|
|
when: never
|
|
|
|
- if: $CI_COMMIT_BRANCH &&
|
|
|
|
$SAST_DEFAULT_ANALYZERS =~ /bandit/
|
|
|
|
exists:
|
|
|
|
- '**/*.py'
|
2019-09-18 10:02:45 -04:00
|
|
|
|
|
|
|
brakeman-sast:
|
2019-12-19 13:07:48 -05:00
|
|
|
extends: .sast-analyzer
|
2019-09-18 10:02:45 -04:00
|
|
|
image:
|
2020-08-27 20:10:34 -04:00
|
|
|
name: "$SAST_ANALYZER_IMAGE"
|
2020-08-26 17:10:19 -04:00
|
|
|
variables:
|
|
|
|
SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/brakeman:$SAST_ANALYZER_IMAGE_TAG"
|
2020-05-12 14:07:54 -04:00
|
|
|
rules:
|
2020-09-04 17:08:41 -04:00
|
|
|
- if: $SAST_DISABLED
|
2020-05-12 14:07:54 -04:00
|
|
|
when: never
|
|
|
|
- if: $CI_COMMIT_BRANCH &&
|
|
|
|
$SAST_DEFAULT_ANALYZERS =~ /brakeman/
|
|
|
|
exists:
|
2020-05-28 08:08:10 -04:00
|
|
|
- 'config/routes.rb'
|
2019-09-18 10:02:45 -04:00
|
|
|
|
|
|
|
eslint-sast:
|
2019-12-19 13:07:48 -05:00
|
|
|
extends: .sast-analyzer
|
2019-09-18 10:02:45 -04:00
|
|
|
image:
|
2020-08-26 17:10:19 -04:00
|
|
|
name: "$SAST_ANALYZER_IMAGE"
|
|
|
|
variables:
|
|
|
|
SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/eslint:$SAST_ANALYZER_IMAGE_TAG"
|
2020-05-12 14:07:54 -04:00
|
|
|
rules:
|
2020-09-04 17:08:41 -04:00
|
|
|
- if: $SAST_DISABLED
|
2020-05-12 14:07:54 -04:00
|
|
|
when: never
|
|
|
|
- if: $CI_COMMIT_BRANCH &&
|
|
|
|
$SAST_DEFAULT_ANALYZERS =~ /eslint/
|
|
|
|
exists:
|
|
|
|
- '**/*.html'
|
|
|
|
- '**/*.js'
|
2020-07-13 23:09:24 -04:00
|
|
|
- '**/*.jsx'
|
2020-07-16 20:09:37 -04:00
|
|
|
- '**/*.ts'
|
|
|
|
- '**/*.tsx'
|
2019-09-18 10:02:45 -04:00
|
|
|
|
|
|
|
flawfinder-sast:
|
2019-12-19 13:07:48 -05:00
|
|
|
extends: .sast-analyzer
|
2019-09-18 10:02:45 -04:00
|
|
|
image:
|
2020-08-27 20:10:34 -04:00
|
|
|
name: "$SAST_ANALYZER_IMAGE"
|
2020-08-26 17:10:19 -04:00
|
|
|
variables:
|
|
|
|
SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/flawfinder:$SAST_ANALYZER_IMAGE_TAG"
|
2020-05-12 14:07:54 -04:00
|
|
|
rules:
|
2020-09-04 17:08:41 -04:00
|
|
|
- if: $SAST_DISABLED
|
2020-05-12 14:07:54 -04:00
|
|
|
when: never
|
|
|
|
- if: $CI_COMMIT_BRANCH &&
|
|
|
|
$SAST_DEFAULT_ANALYZERS =~ /flawfinder/
|
|
|
|
exists:
|
|
|
|
- '**/*.c'
|
|
|
|
- '**/*.cpp'
|
2019-09-18 10:02:45 -04:00
|
|
|
|
2019-11-19 19:06:22 -05:00
|
|
|
kubesec-sast:
|
2019-12-19 13:07:48 -05:00
|
|
|
extends: .sast-analyzer
|
2019-11-19 19:06:22 -05:00
|
|
|
image:
|
2020-08-26 17:10:19 -04:00
|
|
|
name: "$SAST_ANALYZER_IMAGE"
|
|
|
|
variables:
|
|
|
|
SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/kubesec:$SAST_ANALYZER_IMAGE_TAG"
|
2020-05-12 14:07:54 -04:00
|
|
|
rules:
|
2020-09-04 17:08:41 -04:00
|
|
|
- if: $SAST_DISABLED
|
2020-05-12 14:07:54 -04:00
|
|
|
when: never
|
|
|
|
- if: $CI_COMMIT_BRANCH &&
|
2019-11-19 19:06:22 -05:00
|
|
|
$SAST_DEFAULT_ANALYZERS =~ /kubesec/ &&
|
|
|
|
$SCAN_KUBERNETES_MANIFESTS == 'true'
|
|
|
|
|
2019-09-18 10:02:45 -04:00
|
|
|
gosec-sast:
|
2019-12-19 13:07:48 -05:00
|
|
|
extends: .sast-analyzer
|
2019-09-18 10:02:45 -04:00
|
|
|
image:
|
2020-08-26 17:10:19 -04:00
|
|
|
name: "$SAST_ANALYZER_IMAGE"
|
|
|
|
variables:
|
|
|
|
SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/gosec:$SAST_ANALYZER_IMAGE_TAG"
|
2020-05-12 14:07:54 -04:00
|
|
|
rules:
|
2020-09-04 17:08:41 -04:00
|
|
|
- if: $SAST_DISABLED
|
2020-05-12 14:07:54 -04:00
|
|
|
when: never
|
|
|
|
- if: $CI_COMMIT_BRANCH &&
|
|
|
|
$SAST_DEFAULT_ANALYZERS =~ /gosec/
|
|
|
|
exists:
|
|
|
|
- '**/*.go'
|
2019-09-18 10:02:45 -04:00
|
|
|
|
2020-10-16 17:09:08 -04:00
|
|
|
mobsf-android-sast:
|
|
|
|
extends: .sast-analyzer
|
|
|
|
services:
|
|
|
|
- name: opensecurity/mobile-security-framework-mobsf:latest
|
|
|
|
alias: mobsf
|
|
|
|
image:
|
|
|
|
name: "$SAST_ANALYZER_IMAGE"
|
|
|
|
variables:
|
|
|
|
SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/mobsf:$SAST_ANALYZER_IMAGE_TAG"
|
2020-10-26 17:08:22 -04:00
|
|
|
MOBSF_API_KEY: key
|
2020-10-16 17:09:08 -04:00
|
|
|
rules:
|
|
|
|
- if: $SAST_DISABLED
|
|
|
|
when: never
|
|
|
|
- if: $CI_COMMIT_BRANCH &&
|
|
|
|
$SAST_DEFAULT_ANALYZERS =~ /mobsf/ &&
|
|
|
|
$SAST_EXPERIMENTAL_FEATURES == 'true'
|
|
|
|
exists:
|
|
|
|
- '**/AndroidManifest.xml'
|
|
|
|
|
|
|
|
mobsf-ios-sast:
|
|
|
|
extends: .sast-analyzer
|
|
|
|
services:
|
|
|
|
- name: opensecurity/mobile-security-framework-mobsf:latest
|
|
|
|
alias: mobsf
|
|
|
|
image:
|
|
|
|
name: "$SAST_ANALYZER_IMAGE"
|
|
|
|
variables:
|
|
|
|
SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/mobsf:$SAST_ANALYZER_IMAGE_TAG"
|
2020-10-26 17:08:22 -04:00
|
|
|
MOBSF_API_KEY: key
|
2020-10-16 17:09:08 -04:00
|
|
|
rules:
|
|
|
|
- if: $SAST_DISABLED
|
|
|
|
when: never
|
|
|
|
- if: $CI_COMMIT_BRANCH &&
|
|
|
|
$SAST_DEFAULT_ANALYZERS =~ /mobsf/ &&
|
|
|
|
$SAST_EXPERIMENTAL_FEATURES == 'true'
|
|
|
|
exists:
|
|
|
|
- '**/*.xcodeproj/*'
|
|
|
|
|
2019-09-18 10:02:45 -04:00
|
|
|
nodejs-scan-sast:
|
2019-12-19 13:07:48 -05:00
|
|
|
extends: .sast-analyzer
|
2019-09-18 10:02:45 -04:00
|
|
|
image:
|
2020-08-26 17:10:19 -04:00
|
|
|
name: "$SAST_ANALYZER_IMAGE"
|
|
|
|
variables:
|
|
|
|
SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/nodejs-scan:$SAST_ANALYZER_IMAGE_TAG"
|
2020-05-12 14:07:54 -04:00
|
|
|
rules:
|
2020-09-04 17:08:41 -04:00
|
|
|
- if: $SAST_DISABLED
|
2020-05-12 14:07:54 -04:00
|
|
|
when: never
|
|
|
|
- if: $CI_COMMIT_BRANCH &&
|
|
|
|
$SAST_DEFAULT_ANALYZERS =~ /nodejs-scan/
|
|
|
|
exists:
|
2020-05-28 08:08:10 -04:00
|
|
|
- 'package.json'
|
2019-09-18 10:02:45 -04:00
|
|
|
|
|
|
|
phpcs-security-audit-sast:
|
2019-12-19 13:07:48 -05:00
|
|
|
extends: .sast-analyzer
|
2019-09-18 10:02:45 -04:00
|
|
|
image:
|
2020-08-26 17:10:19 -04:00
|
|
|
name: "$SAST_ANALYZER_IMAGE"
|
|
|
|
variables:
|
|
|
|
SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/phpcs-security-audit:$SAST_ANALYZER_IMAGE_TAG"
|
2020-05-12 14:07:54 -04:00
|
|
|
rules:
|
2020-09-04 17:08:41 -04:00
|
|
|
- if: $SAST_DISABLED
|
2020-05-12 14:07:54 -04:00
|
|
|
when: never
|
|
|
|
- if: $CI_COMMIT_BRANCH &&
|
|
|
|
$SAST_DEFAULT_ANALYZERS =~ /phpcs-security-audit/
|
|
|
|
exists:
|
|
|
|
- '**/*.php'
|
2019-09-18 10:02:45 -04:00
|
|
|
|
|
|
|
pmd-apex-sast:
|
2019-12-19 13:07:48 -05:00
|
|
|
extends: .sast-analyzer
|
2019-09-18 10:02:45 -04:00
|
|
|
image:
|
2020-08-26 17:10:19 -04:00
|
|
|
name: "$SAST_ANALYZER_IMAGE"
|
|
|
|
variables:
|
|
|
|
SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/pmd-apex:$SAST_ANALYZER_IMAGE_TAG"
|
2020-05-12 14:07:54 -04:00
|
|
|
rules:
|
2020-09-04 17:08:41 -04:00
|
|
|
- if: $SAST_DISABLED
|
2020-05-12 14:07:54 -04:00
|
|
|
when: never
|
|
|
|
- if: $CI_COMMIT_BRANCH &&
|
|
|
|
$SAST_DEFAULT_ANALYZERS =~ /pmd-apex/
|
|
|
|
exists:
|
|
|
|
- '**/*.cls'
|
2019-09-18 10:02:45 -04:00
|
|
|
|
|
|
|
security-code-scan-sast:
|
2019-12-19 13:07:48 -05:00
|
|
|
extends: .sast-analyzer
|
2019-09-18 10:02:45 -04:00
|
|
|
image:
|
2020-08-26 17:10:19 -04:00
|
|
|
name: "$SAST_ANALYZER_IMAGE"
|
|
|
|
variables:
|
|
|
|
SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/security-code-scan:$SAST_ANALYZER_IMAGE_TAG"
|
2020-05-12 14:07:54 -04:00
|
|
|
rules:
|
2020-09-04 17:08:41 -04:00
|
|
|
- if: $SAST_DISABLED
|
2020-05-12 14:07:54 -04:00
|
|
|
when: never
|
|
|
|
- if: $CI_COMMIT_BRANCH &&
|
|
|
|
$SAST_DEFAULT_ANALYZERS =~ /security-code-scan/
|
|
|
|
exists:
|
|
|
|
- '**/*.csproj'
|
|
|
|
- '**/*.vbproj'
|
2019-09-18 10:02:45 -04:00
|
|
|
|
|
|
|
sobelow-sast:
|
2019-12-19 13:07:48 -05:00
|
|
|
extends: .sast-analyzer
|
2019-09-18 10:02:45 -04:00
|
|
|
image:
|
2020-08-26 17:10:19 -04:00
|
|
|
name: "$SAST_ANALYZER_IMAGE"
|
|
|
|
variables:
|
|
|
|
SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/sobelow:$SAST_ANALYZER_IMAGE_TAG"
|
2020-05-12 14:07:54 -04:00
|
|
|
rules:
|
2020-09-04 17:08:41 -04:00
|
|
|
- if: $SAST_DISABLED
|
2020-05-12 14:07:54 -04:00
|
|
|
when: never
|
|
|
|
- if: $CI_COMMIT_BRANCH &&
|
|
|
|
$SAST_DEFAULT_ANALYZERS =~ /sobelow/
|
|
|
|
exists:
|
2020-05-28 08:08:10 -04:00
|
|
|
- 'mix.exs'
|
2019-09-18 10:02:45 -04:00
|
|
|
|
|
|
|
spotbugs-sast:
|
2019-12-19 13:07:48 -05:00
|
|
|
extends: .sast-analyzer
|
2019-09-18 10:02:45 -04:00
|
|
|
image:
|
2020-08-26 17:10:19 -04:00
|
|
|
name: "$SAST_ANALYZER_IMAGE"
|
|
|
|
variables:
|
|
|
|
SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/spotbugs:$SAST_ANALYZER_IMAGE_TAG"
|
2020-05-12 14:07:54 -04:00
|
|
|
rules:
|
2020-10-16 17:09:08 -04:00
|
|
|
- if: $SAST_DEFAULT_ANALYZERS =~ /mobsf/ &&
|
|
|
|
$SAST_EXPERIMENTAL_FEATURES == 'true'
|
|
|
|
exists:
|
|
|
|
- '**/AndroidManifest.xml'
|
|
|
|
when: never
|
2020-09-04 17:08:41 -04:00
|
|
|
- if: $SAST_DISABLED
|
2020-05-12 14:07:54 -04:00
|
|
|
when: never
|
|
|
|
- if: $CI_COMMIT_BRANCH &&
|
|
|
|
$SAST_DEFAULT_ANALYZERS =~ /spotbugs/
|
|
|
|
exists:
|
|
|
|
- '**/*.groovy'
|
|
|
|
- '**/*.java'
|
|
|
|
- '**/*.scala'
|