4 ms·
I was suspecting that. Thanks for sharing this info. It will be really nice if you guys implement ways to swap the built-in DAST tool. My startup is actually go
by _pdp_ 9y ago
I was suspecting that. Thanks for sharing this info. It will be really nice if you guys implement ways to swap the built-in DAST tool. My startup is actually going to release something really cool and useful in the next couple of weeks and it will be awesome if we can provide features to be compatible with GitLab.
- theptip 9y agoI think you just need to drop a JSON file with the right format into the `artifacts` directory. That said, this integration isn't really adding much over just defining a build step that runs the check (unless you're using AutoDevops to have this run on all your repos). You could just provide a Gitlab/other CI config snippet for users to run the tool.
- _pdp_ 9y agoOf course, and that will work. However, what if the vulnerability artefacts need to be converted into issues in GitLab? That will require a much deeper integration then printing the details in the build log. Dropping a file will be easy. We can provide just a switch for that.
- sytse 9y agoInteresting. If you want to integrate it there are instructions in the docs https://docs.gitlab.com/ee/user/project/merge_requests/dast.html https://docs.gitlab.com/ee/user/project/merge_requests/dast.... (use gl-dast-report.json to send results back). If your product is as cool as you say it is we would love to add it to GitLab by default and run both ZAProxy and yours by default.
- _pdp_ 9y agoThanks. I will have a look. Btw, the tool will be a black-box vulnerability scanner but just like ZAP, it will be able to proxy as well - all nicely packaged with minimal dependencies and no framebuffer rendering - so it should be snappy.
- theptip 9y agoIs there a repo I can follow along at? Sounds interesting.
- deleted 9y ago[deleted]