Коммит 01a28ead создал по автору Ash McKenzie's avatar Ash McKenzie
Просмотр файлов

Merge branch '10798-remove-dind-req-for-dast' into 'master' 

Remove dind from dast template

See merge request gitlab-org/gitlab-ce!28083
владельцы 632b137d 37c8f37c
Скрыть пробелы
Построчно Рядом
changelogs/unreleased/10798-remove-dind-req-for-dast.yml 0 → 100644
Просмотр файла @ 01a28ead
---
title: Remove dind from DAST template
merge_request: 28083
author:
type: changed
doc/user/application_security/dast/index.md
Просмотр файла @ 01a28ead
......@@ -47,10 +47,7 @@ applications while you are developing and testing your applications.
## Requirements
To run a DAST job, you need GitLab Runner with the
[`docker`](https://docs.gitlab.com/runner/executors/docker.html#use-docker-in-docker-with-privileged-mode) or
[`kubernetes`](https://docs.gitlab.com/runner/install/kubernetes.html#running-privileged-containers-for-the-runners)
executor running in privileged mode. If you're using the shared Runners on GitLab.com,
this is enabled by default.
[`docker` executor](https://docs.gitlab.com/runner/executors/docker.html).
## Configuring DAST
......
lib/gitlab/ci/templates/Security/DAST.gitlab-ci.yml
Просмотр файла @ 01a28ead
# Read more about this feature here: https://docs.gitlab.com/ee/user/project/merge_requests/dast.html
# Read more about this feature here: https://docs.gitlab.com/ee/user/application_security/dast/
# Configure the scanning tool through the environment variables.
# List of the variables: https://gitlab.com/gitlab-org/security-products/dast#settings
......@@ -12,46 +12,29 @@ stages:
dast:
stage: dast
image: docker:stable
image:
name: "registry.gitlab.com/gitlab-org/security-products/dast:$CI_SERVER_VERSION_MAJOR-$CI_SERVER_VERSION_MINOR-stable"
variables:
DOCKER_DRIVER: overlay2
# URL to scan:
# DAST_WEBSITE: https://example.com/
#
# Time limit for target availability (scan is attempted even when timeout):
# DAST_TARGET_AVAILABILITY_TIMEOUT: 60
#
# Set these variables to scan with an authenticated user:
# DAST_AUTH_URL: https://example.com/sign-in
# DAST_USERNAME: john.doe@example.com
# DAST_PASSWORD: john-doe-password
# DAST_USERNAME_FIELD: session[user] # the name of username field at the sign-in HTML form
# DAST_PASSWORD_FIELD: session[password] # the name of password field at the sign-in HTML form
# DAST_AUTH_EXCLUDE_URLS: http://example.com/sign-out,http://example.com/sign-out-2 # optional: URLs to skip during the authenticated scan; comma-separated, no spaces in between
#
# Perform ZAP Full Scan, which includes both passive and active scanning:
# DAST_FULL_SCAN_ENABLED: "true"
allow_failure: true
services:
- docker:stable-dind
script:
- export DAST_WEBSITE=${DAST_WEBSITE:-$(cat environment_url.txt)}
- export DAST_VERSION=${SP_VERSION:-$(echo "$CI_SERVER_VERSION" | sed 's/^\([0-9]*\)\.\([0-9]*\).*/\1-\2-stable/')}
- |
if ! docker info &>/dev/null; then
if [ -z "$DOCKER_HOST" -a "$KUBERNETES_PORT" ]; then
export DOCKER_HOST='tcp://localhost:2375'
fi
fi
- |
function dast_run() {
docker run \
--env DAST_FULL_SCAN_ENABLED \
--env DAST_TARGET_AVAILABILITY_TIMEOUT \
--volume "$PWD:/output" \
--volume /var/run/docker.sock:/var/run/docker.sock \
-w /output \
"registry.gitlab.com/gitlab-org/security-products/dast:$DAST_VERSION" \
/analyze -t $DAST_WEBSITE \
"$@"
}
- |
if [ -n "$DAST_AUTH_URL" ]
then
dast_run \
--auth-url $DAST_AUTH_URL \
--auth-username $DAST_USERNAME \
--auth-password $DAST_PASSWORD \
--auth-username-field $DAST_USERNAME_FIELD \
--auth-password-field $DAST_PASSWORD_FIELD \
--auth-exclude-urls $DAST_AUTH_EXCLUDE_URLS
else
dast_run
fi
- /analyze -t $DAST_WEBSITE
artifacts:
reports:
dast: gl-dast-report.json
......
Поддерживает Markdown
0% или .
You are about to add 0 people to the discussion. Proceed with caution.
Сначала завершите редактирование этого сообщения!
Пожалуйста, зарегистрируйтесь или чтобы прокомментировать