Skip to content

feat: gitlab dependency scanner report format #5919#5920

Merged
jeremylong merged 6 commits intodependency-check:mainfrom
niklasfi:gitlab-dependency-scan
Nov 21, 2023
Merged

feat: gitlab dependency scanner report format #5919#5920
jeremylong merged 6 commits intodependency-check:mainfrom
niklasfi:gitlab-dependency-scan

Conversation

@niklasfi
Copy link
Copy Markdown
Contributor

@niklasfi niklasfi commented Sep 3, 2023

Fixes Issue #5919

Description of Change

As described in #5919, I am working on adding a new report format to DependencyCheck that can be directly fed to GitLab to be used as a dependency scanner in ci/cd-pipelines.

Have test cases been added to cover the new functionality?

no

@boring-cyborg boring-cyborg Bot added the core changes to core label Sep 3, 2023
@niklasfi niklasfi changed the title #5919 feat: gitlab dependency scanner report format feat: gitlab dependency scanner report format #5919 Sep 3, 2023
@niklasfi
Copy link
Copy Markdown
Contributor Author

niklasfi commented Sep 3, 2023 •
edited
Loading

Hi, I would gladly receive some feedback on my pull request.

  1. Are you interested in adding a GitLab report format to DependencyCheck?
  2. Do you agree the best way to implement it is by adding a template and a new report format?
  3. Do you have any pointers on (some of) the missing fields?
  4. Do you think it's still a good idea to merge this even if some fields of the target format are not available right now?
  5. Would you accept pull requests adding the additionally needed information to the template engine's context?
  6. Are additional tests needed? If so: what do you think is a good test template to start with? The other report formats probably have tests as well, right?

aikebah
aikebah reviewed Sep 4, 2023
View reviewed changes
Copy link
Copy Markdown
Collaborator

@aikebah aikebah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some preliminary feedback. Based on the various comments you already put in I think it needs some further investigation into resolving the various issues with the GitLab report format versus the information we currently have available to make it so mature that I would vote for inclusion.

Nevertheless I'm in favor of the initiative, and even if we can't reach to an acceptable level of support the efforts to try and achieve as much as reasonbly possible are useful for anyone wanting to embed DependencyCheck into GitLab dependency-scanning.

If not as a formally supported format people could always use a partially completed and syntactically working template as their own report format (using the VSL as a custom-format report - see jeremylong/DependencyCheck#5824 (comment) for some details on that approach)

Comment thread core/src/main/resources/templates/gitlabReport.vsl Outdated
Comment thread core/src/main/resources/templates/gitlabReport.vsl Outdated
Comment thread core/src/main/resources/templates/gitlabReport.vsl
Comment thread core/src/main/resources/templates/gitlabReport.vsl Outdated
jeremylong
jeremylong requested changes Oct 8, 2023
View reviewed changes
Copy link
Copy Markdown
Collaborator

@jeremylong jeremylong left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please see the comments from @aikebah.

@niklasfi niklasfi force-pushed the gitlab-dependency-scan branch from 374b003 to e71d434 Compare October 9, 2023 11:32
@niklasfi
Copy link
Copy Markdown
Contributor Author

niklasfi commented Oct 10, 2023

hi @jeremylong @aikebah sorry for taking so long to respond to your well thought out remarks on the pull request. I have implemented the changes as you suggested except for the dependency_files section. There I don't really know how to best proceed.

@niklasfi niklasfi force-pushed the gitlab-dependency-scan branch from 4566340 to 9856592 Compare October 10, 2023 07:17
@jeremylong
Copy link
Copy Markdown
Collaborator

jeremylong commented Oct 14, 2023

@niklasfi thanks! Supporting this format shows that we might be missing a field on the dependency object: source. Where the source would be something like: pom.xml, poetry.lock, path/to/some.jar. We could then add dependencies to the array grouped on source. I think this information would be useful for other reasons as well. I'll file an enhancement request.

@jeremylong jeremylong mentioned this pull request Oct 14, 2023
Open
@niklasfi niklasfi force-pushed the gitlab-dependency-scan branch from 8c7ec11 to 74be57c Compare November 9, 2023 10:55
@niklasfi
Copy link
Copy Markdown
Contributor Author

niklasfi commented Nov 9, 2023 •
edited
Loading

fyi we have set up a fork of this project on our private gitlab and are now using the generated SNAPSHOT builds in our piples. I can report it's working as is, with the known restrictions (source file is kind of a lie). In the process of setting this up, I found a couple more bugs. That is where the extra commits come from.

This is what it looks like on our internal gitlab now (for the ant subfolder of this repo).

image

@niklasfi niklasfi force-pushed the gitlab-dependency-scan branch from 74be57c to 29033c0 Compare November 16, 2023 18:05
@jeremylong jeremylong added this to the 9.0.0 milestone Nov 18, 2023
@jeremylong
Copy link
Copy Markdown
Collaborator

jeremylong commented Nov 18, 2023

Sorry for the delays - I will include this in the 9.0.0 release.

@niklasfi @jeremylong
feat: gitlab report format
8e75742 
add report format "GitLab", which conforms to [1] and can be consumed by gitlab to generate SAST vulnerability reports [2].,

[1] https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/raw/v15.0.6/dist/dependency-scanning-report-format.json?ref_type=tags
[2] https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#reports-json-format
@niklasfi @jeremylong
[feat] re-organize identifiers to links, links from htmlReport.vsl
0576d1a
@niklasfi @jeremylong
[bug] remove solution (it's optional after all)
1cadf43
@niklasfi @jeremylong
[bug] errant comma does not conform to json spec
e225abd
@niklasfi @jeremylong
[bug] another errant comma
1bbc54e
@niklasfi @jeremylong
[bug] severity needs to be of the form "Medium", not "MEDIUM"
5d6a6fd
@jeremylong jeremylong force-pushed the gitlab-dependency-scan branch from 29033c0 to 5d6a6fd Compare November 21, 2023 11:04
@jeremylong jeremylong merged commit d3a6797 into dependency-check:main Nov 21, 2023
This was referenced Nov 28, 2023
Closed
Merged
@marcelstoer marcelstoer mentioned this pull request Dec 26, 2023
Closed
@github-actions github-actions Bot locked as resolved and limited conversation to collaborators Dec 12, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@aikebah aikebah aikebah left review comments

@jeremylong jeremylong jeremylong approved these changes

Assignees

No one assigned

Labels

core changes to core

Projects

None yet

Milestone

9.0.0

Development

Successfully merging this pull request may close these issues.

3 participants

@niklasfi @jeremylong @aikebah