4 ms·

The security testing feature is definitely interesting but I wonder how it performs as that by itself is a non-trivial task. It can be done for sure but it take

by _pdp_ 9y ago

The security testing feature is definitely interesting but I wonder how it performs as that by itself is a non-trivial task. It can be done for sure but it takes a lot of resources and care to make it useful. EDIT: I would like to add that if this feature is in fact really useful and it works, the price for the GitLab Ultimate is justified if the license does not restrict you to the number of targets you can test. It can be used as a service and could potentially replace other infrastructure in a typical corp environment that is used mainly by the security team. But as I said earlier, this is a non-trivial task. EDIT 2: This is my last edit. We use GitLab CI internally and it is quite nice although it is not without issues. There are some really funky problems. But it works and I love the fact that it is integrated into the GitLab product. Except for TravisCI which makes it trivial, most other CI tools are very difficult to setup and maintain and for small teams this is yet another annoying thing to do. As a startup, I can say it is very useful.

theptip 9y ago
The DAST feature uses ZAP under the covers, their integration is a thin trigger around that tool. You can already use it for free outside of GL. https://hub.docker.com/r/owasp/zap2docker-stable/ https://hub.docker.com/r/owasp/zap2docker-stable/ https://docs.gitlab.com/ee/ci/examples/dast.html https://docs.gitlab.com/ee/ci/examples/dast.html
- _pdp_ 9y ago
  I was suspecting that. Thanks for sharing this info. It will be really nice if you guys implement ways to swap the built-in DAST tool. My startup is actually going to release something really cool and useful in the next couple of weeks and it will be awesome if we can provide features to be compatible with GitLab.
  - theptip 9y ago
    I think you just need to drop a JSON file with the right format into the `artifacts` directory. That said, this integration isn't really adding much over just defining a build step that runs the check (unless you're using AutoDevops to have this run on all your repos). You could just provide a Gitlab/other CI config snippet for users to run the tool.
    - _pdp_ 9y ago
      Of course, and that will work. However, what if the vulnerability artefacts need to be converted into issues in GitLab? That will require a much deeper integration then printing the details in the build log. Dropping a file will be easy. We can provide just a switch for that.
  - sytse 9y ago
    Interesting. If you want to integrate it there are instructions in the docs https://docs.gitlab.com/ee/user/project/merge_requests/dast.html https://docs.gitlab.com/ee/user/project/merge_requests/dast.... (use gl-dast-report.json to send results back). If your product is as cool as you say it is we would love to add it to GitLab by default and run both ZAProxy and yours by default.
    - _pdp_ 9y ago
      Thanks. I will have a look. Btw, the tool will be a black-box vulnerability scanner but just like ZAP, it will be able to proxy as well - all nicely packaged with minimal dependencies and no framebuffer rendering - so it should be snappy.
      - theptip 9y ago
        Is there a repo I can follow along at? Sounds interesting.
      - deleted 9y ago
        [deleted]
sytse 9y ago
GitLab Ultimate does not restrict the number of targets you can test. What are the funky problems you encountered?
- _pdp_ 9y ago
  Most of the problems are around docker not cleaning up after itself. Eventually, the discs get full and then we have to manually clean things up. Another problem is that for whatever reason CI cannot checkout the git repo so the build fails. Not sure why - we have not investigated yet. There is also an issue with setting up the variables. Sometimes it 500s on save. I will try to get someone to plug those in as actual defects in your backlog. Btw, when I say funky, I don't mean bad. I mean mild annoyance.
  - ayufan 9y ago
    Ok. So most of these problems are related to Runner and Docker Containers for builds: 1. You can make Runner to not create cache containers with Advanced Settings and `disable_cache` option, 2. As for Git Repo, you can force Runner to retry cloning, 3. 500 with variables is new to me, let us know if you manage to get a stack trace from this error. Kamil, GitLab CI/CD Lead

by _pdp_ 9y ago

theptip 9y ago

The DAST feature uses ZAP under the covers, their integration is a thin trigger around that tool. You can already use it for free outside of GL. https://hub.docker.com/r/owasp/zap2docker-stable/ https://hub.docker.com/r/owasp/zap2docker-stable/ https://docs.gitlab.com/ee/ci/examples/dast.html https://docs.gitlab.com/ee/ci/examples/dast.html

_pdp_ 9y ago
I was suspecting that. Thanks for sharing this info. It will be really nice if you guys implement ways to swap the built-in DAST tool. My startup is actually going to release something really cool and useful in the next couple of weeks and it will be awesome if we can provide features to be compatible with GitLab.
- theptip 9y ago
  I think you just need to drop a JSON file with the right format into the `artifacts` directory. That said, this integration isn't really adding much over just defining a build step that runs the check (unless you're using AutoDevops to have this run on all your repos). You could just provide a Gitlab/other CI config snippet for users to run the tool.
  - _pdp_ 9y ago
    Of course, and that will work. However, what if the vulnerability artefacts need to be converted into issues in GitLab? That will require a much deeper integration then printing the details in the build log. Dropping a file will be easy. We can provide just a switch for that.
- sytse 9y ago
  Interesting. If you want to integrate it there are instructions in the docs https://docs.gitlab.com/ee/user/project/merge_requests/dast.html https://docs.gitlab.com/ee/user/project/merge_requests/dast.... (use gl-dast-report.json to send results back). If your product is as cool as you say it is we would love to add it to GitLab by default and run both ZAProxy and yours by default.
  - _pdp_ 9y ago
    Thanks. I will have a look. Btw, the tool will be a black-box vulnerability scanner but just like ZAP, it will be able to proxy as well - all nicely packaged with minimal dependencies and no framebuffer rendering - so it should be snappy.
    - theptip 9y ago
      Is there a repo I can follow along at? Sounds interesting.
    - deleted 9y ago
      [deleted]

sytse 9y ago

GitLab Ultimate does not restrict the number of targets you can test. What are the funky problems you encountered?

_pdp_ 9y ago
Most of the problems are around docker not cleaning up after itself. Eventually, the discs get full and then we have to manually clean things up. Another problem is that for whatever reason CI cannot checkout the git repo so the build fails. Not sure why - we have not investigated yet. There is also an issue with setting up the variables. Sometimes it 500s on save. I will try to get someone to plug those in as actual defects in your backlog. Btw, when I say funky, I don't mean bad. I mean mild annoyance.
- ayufan 9y ago
  Ok. So most of these problems are related to Runner and Docker Containers for builds: 1. You can make Runner to not create cache containers with Advanced Settings and `disable_cache` option, 2. As for Git Repo, you can force Runner to retry cloning, 3. 500 with variables is new to me, let us know if you manage to get a stack trace from this error. Kamil, GitLab CI/CD Lead