Commit 70a99a0c authored by GitLab Bot's avatar GitLab Bot
Browse files

Add latest changes from gitlab-org/gitlab@13-4-stable-ee

parent 3c0ee806b5ac
......@@ -14,5 +14,5 @@ indent_size = 2
indent_style = space
charset = utf-8
[*.{md,markdown}]
[*.{md,markdown,js.snap}]
trim_trailing_whitespace = false
......@@ -17,6 +17,7 @@ settings:
config: './config/webpack.config.js'
rules:
import/no-commonjs: error
import/no-default-export: off
no-underscore-dangle:
- error
- allow:
......@@ -35,7 +36,7 @@ rules:
# Disabled for now, to make the plugin-vue 4.5 -> 5.0 update smoother
vue/no-confusing-v-for-v-if: error
vue/no-use-v-if-with-v-for: off
vue/no-v-html: off
vue/no-v-html: error
vue/use-v-on-exact: off
# all offenses of no-jquery/no-animate-toggle are false positives ( $toast.show() )
no-jquery/no-animate-toggle: off
......
......@@ -71,6 +71,7 @@ eslint-report.html
/builds*
/.gitlab_workhorse_secret
/.gitlab_pages_secret
/.gitlab_kas_secret
/webpack-report/
/knapsack/
/rspec_flaky/
......@@ -93,513 +94,6 @@ webpack-dev-server.json
.solargraph.yml
apollo.config.js
/tmp/matching_foss_tests.txt
/tmp/matching_tests.txt
ee/changelogs/unreleased-ee
# Likely anything 2017 was removed in bac4d96dcfc, 381b706559b, or cfae6ec2647
db/schema_migrations/2014*
db/schema_migrations/2015*
db/schema_migrations/2016*
db/schema_migrations/2017*
# Removed in 02ea9bc792b9236ea8854154ea5caef1a03b07b4
db/schema_migrations/20171230123729
db/schema_migrations/20180101160629
db/schema_migrations/20180101160630
db/schema_migrations/20180102220145
db/schema_migrations/20180103123548
db/schema_migrations/20180104131052
db/schema_migrations/20180105212544
db/schema_migrations/20180109183319
db/schema_migrations/20180113220114
db/schema_migrations/20180115094742
db/schema_migrations/20180115113902
db/schema_migrations/20180115201419
db/schema_migrations/20180116193854
db/schema_migrations/20180119121225
db/schema_migrations/20180119135717
db/schema_migrations/20180119160751
db/schema_migrations/20180122154930
db/schema_migrations/20180122162010
db/schema_migrations/20180125214301
db/schema_migrations/20180129193323
db/schema_migrations/20180201102129
db/schema_migrations/20180201110056
db/schema_migrations/20180201145907
db/schema_migrations/20180204200836
db/schema_migrations/20180206200543
db/schema_migrations/20180208183958
db/schema_migrations/20180209115333
db/schema_migrations/20180209165249
db/schema_migrations/20180212030105
db/schema_migrations/20180212101828
db/schema_migrations/20180212101928
db/schema_migrations/20180212102028
db/schema_migrations/20180213131630
db/schema_migrations/20180214093516
db/schema_migrations/20180214155405
db/schema_migrations/20180215181245
db/schema_migrations/20180216120000
db/schema_migrations/20180216120010
db/schema_migrations/20180216120020
db/schema_migrations/20180216120030
db/schema_migrations/20180216120040
db/schema_migrations/20180216120050
db/schema_migrations/20180216121020
db/schema_migrations/20180216121030
db/schema_migrations/20180219153455
db/schema_migrations/20180220150310
db/schema_migrations/20180221151752
db/schema_migrations/20180222043024
db/schema_migrations/20180223120443
db/schema_migrations/20180223124427
db/schema_migrations/20180223144945
db/schema_migrations/20180226050030
db/schema_migrations/20180227182112
db/schema_migrations/20180228172924
db/schema_migrations/20180301010859
db/schema_migrations/20180301084653
db/schema_migrations/20180302152117
db/schema_migrations/20180305095250
db/schema_migrations/20180305100050
db/schema_migrations/20180305144721
db/schema_migrations/20180306074045
db/schema_migrations/20180306134842
db/schema_migrations/20180306164012
db/schema_migrations/20180307012445
db/schema_migrations/20180308052825
db/schema_migrations/20180308125206
db/schema_migrations/20180309121820
db/schema_migrations/20180309160427
db/schema_migrations/20180314100728
db/schema_migrations/20180314145917
db/schema_migrations/20180315160435
db/schema_migrations/20180319190020
db/schema_migrations/20180320182229
db/schema_migrations/20180323150945
db/schema_migrations/20180326202229
db/schema_migrations/20180327101207
db/schema_migrations/20180330121048
db/schema_migrations/20180403035759
db/schema_migrations/20180405101928
db/schema_migrations/20180405142733
db/schema_migrations/20180408143354
db/schema_migrations/20180408143355
db/schema_migrations/20180409170809
db/schema_migrations/20180413022611
db/schema_migrations/20180416155103
db/schema_migrations/20180417090132
db/schema_migrations/20180417101040
db/schema_migrations/20180417101940
db/schema_migrations/20180418053107
db/schema_migrations/20180420010016
db/schema_migrations/20180420010616
db/schema_migrations/20180420080616
db/schema_migrations/20180423204600
db/schema_migrations/20180424090541
db/schema_migrations/20180424134533
db/schema_migrations/20180424151928
db/schema_migrations/20180424160449
db/schema_migrations/20180425075446
db/schema_migrations/20180425131009
db/schema_migrations/20180425205249
db/schema_migrations/20180426102016
db/schema_migrations/20180430101916
db/schema_migrations/20180430143705
db/schema_migrations/20180502122856
db/schema_migrations/20180503131624
db/schema_migrations/20180503141722
db/schema_migrations/20180503150427
db/schema_migrations/20180503175053
db/schema_migrations/20180503175054
db/schema_migrations/20180503193542
db/schema_migrations/20180503193953
db/schema_migrations/20180503200320
db/schema_migrations/20180504195842
db/schema_migrations/20180507083701
db/schema_migrations/20180508055821
db/schema_migrations/20180508100222
db/schema_migrations/20180508102840
db/schema_migrations/20180508135515
db/schema_migrations/20180511090724
db/schema_migrations/20180511131058
db/schema_migrations/20180511174224
db/schema_migrations/20180512061621
db/schema_migrations/20180514161336
db/schema_migrations/20180515005612
db/schema_migrations/20180515121227
db/schema_migrations/20180517082340
db/schema_migrations/20180523042841
db/schema_migrations/20180523125103
db/schema_migrations/20180524132016
db/schema_migrations/20180529093006
db/schema_migrations/20180529152628
db/schema_migrations/20180530135500
db/schema_migrations/20180531185349
db/schema_migrations/20180531220618
db/schema_migrations/20180601213245
db/schema_migrations/20180603190921
db/schema_migrations/20180604123514
db/schema_migrations/20180607071808
db/schema_migrations/20180608091413
db/schema_migrations/20180608110058
db/schema_migrations/20180608201435
db/schema_migrations/20180612103626
db/schema_migrations/20180613081317
db/schema_migrations/20180625113853
db/schema_migrations/20180626125654
db/schema_migrations/20180628124813
db/schema_migrations/20180629153018
db/schema_migrations/20180629191052
db/schema_migrations/20180702120647
db/schema_migrations/20180702124358
db/schema_migrations/20180702134423
db/schema_migrations/20180704145007
db/schema_migrations/20180704204006
db/schema_migrations/20180705160945
db/schema_migrations/20180706223200
db/schema_migrations/20180710162338
db/schema_migrations/20180711103851
db/schema_migrations/20180711103922
db/schema_migrations/20180713092803
db/schema_migrations/20180717125853
db/schema_migrations/20180718005113
db/schema_migrations/20180720023512
db/schema_migrations/20180722103201
db/schema_migrations/20180723135214
db/schema_migrations/20180726172057
db/schema_migrations/20180807153545
db/schema_migrations/20180808162000
db/schema_migrations/20180809195358
db/schema_migrations/20180813101999
db/schema_migrations/20180813102000
db/schema_migrations/20180814153625
db/schema_migrations/20180815040323
db/schema_migrations/20180815160409
db/schema_migrations/20180815170510
db/schema_migrations/20180815175440
db/schema_migrations/20180816161409
db/schema_migrations/20180816193530
db/schema_migrations/20180824202952
db/schema_migrations/20180826111825
db/schema_migrations/20180831164905
db/schema_migrations/20180831164907
db/schema_migrations/20180831164908
db/schema_migrations/20180831164909
db/schema_migrations/20180831164910
db/schema_migrations/20180901171833
db/schema_migrations/20180901200537
db/schema_migrations/20180902070406
db/schema_migrations/20180906101639
db/schema_migrations/20180907015926
db/schema_migrations/20180910115836
db/schema_migrations/20180910153412
db/schema_migrations/20180910153413
db/schema_migrations/20180912111628
db/schema_migrations/20180913142237
db/schema_migrations/20180914162043
db/schema_migrations/20180914201132
db/schema_migrations/20180916011959
db/schema_migrations/20180917172041
db/schema_migrations/20180924141949
db/schema_migrations/20180924190739
db/schema_migrations/20180924201039
db/schema_migrations/20180925200829
db/schema_migrations/20180927073410
db/schema_migrations/20181002172433
db/schema_migrations/20181005110927
db/schema_migrations/20181005125926
db/schema_migrations/20181006004100
db/schema_migrations/20181008145341
db/schema_migrations/20181008145359
db/schema_migrations/20181008200441
db/schema_migrations/20181009190428
db/schema_migrations/20181010133639
db/schema_migrations/20181010235606
db/schema_migrations/20181013005024
db/schema_migrations/20181014203236
db/schema_migrations/20181015155839
db/schema_migrations/20181016141739
db/schema_migrations/20181016152238
db/schema_migrations/20181017001059
db/schema_migrations/20181019032400
db/schema_migrations/20181019032408
db/schema_migrations/20181019105553
db/schema_migrations/20181022135539
db/schema_migrations/20181022173835
db/schema_migrations/20181023104858
db/schema_migrations/20181023144439
db/schema_migrations/20181025115728
db/schema_migrations/20181026091631
db/schema_migrations/20181026143227
db/schema_migrations/20181027114222
db/schema_migrations/20181028120717
db/schema_migrations/20181030135124
db/schema_migrations/20181030154446
db/schema_migrations/20181031145139
db/schema_migrations/20181031190558
db/schema_migrations/20181031190559
db/schema_migrations/20181101091005
db/schema_migrations/20181101091124
db/schema_migrations/20181101144347
db/schema_migrations/20181101191341
db/schema_migrations/20181105201455
db/schema_migrations/20181106135939
db/schema_migrations/20181107054254
db/schema_migrations/20181108091549
db/schema_migrations/20181112103239
db/schema_migrations/20181115140140
db/schema_migrations/20181116050532
db/schema_migrations/20181116141415
db/schema_migrations/20181116141504
db/schema_migrations/20181119081539
db/schema_migrations/20181119132520
db/schema_migrations/20181120082911
db/schema_migrations/20181120091639
db/schema_migrations/20181120151656
db/schema_migrations/20181121101842
db/schema_migrations/20181121101843
db/schema_migrations/20181121111200
db/schema_migrations/20181122160027
db/schema_migrations/20181123042307
db/schema_migrations/20181123135036
db/schema_migrations/20181123144235
db/schema_migrations/20181126150622
db/schema_migrations/20181126153547
db/schema_migrations/20181128123704
db/schema_migrations/20181129104854
db/schema_migrations/20181129104944
db/schema_migrations/20181130102132
db/schema_migrations/20181203002526
db/schema_migrations/20181205171941
db/schema_migrations/20181211092510
db/schema_migrations/20181211092514
db/schema_migrations/20181212104941
db/schema_migrations/20181212171634
db/schema_migrations/20181219130552
db/schema_migrations/20181219145520
db/schema_migrations/20181219145521
# Removed in 71a3b0e470c64fccbb902390b1f856ee1547a978
db/schema_migrations/20190225160300
# Removed in 44f9d16edca328e5bb234b853f0d670ee0b30a26
db/schema_migrations/20200615101135
# Removed in cfae6ec2647
db/schema_migrations/20180502134117
db/schema_migrations/20180521162137
db/schema_migrations/20180619121030
db/schema_migrations/20180723130817
db/schema_migrations/20180906051323
db/schema_migrations/20180913051323
db/schema_migrations/20180916014356
db/schema_migrations/20181014121030
db/schema_migrations/20181204154019
db/schema_migrations/20180103234731
db/schema_migrations/20180104001824
db/schema_migrations/20180105233807
db/schema_migrations/20180109150457
db/schema_migrations/20180115013218
db/schema_migrations/20180126165535
db/schema_migrations/20180131104538
db/schema_migrations/20180201101405
db/schema_migrations/20180201192230
db/schema_migrations/20180206184810
db/schema_migrations/20180215143644
db/schema_migrations/20180225180932
db/schema_migrations/20180302230551
db/schema_migrations/20180307164427
db/schema_migrations/20180308234102
db/schema_migrations/20180314174825
db/schema_migrations/20180317020334
db/schema_migrations/20180320142552
db/schema_migrations/20180325034910
db/schema_migrations/20180329230151
db/schema_migrations/20180401213713
db/schema_migrations/20180416112831
db/schema_migrations/20180416205949
db/schema_migrations/20180419031622
db/schema_migrations/20180419171038
db/schema_migrations/20180423165301
db/schema_migrations/20180502124117
db/schema_migrations/20180502125859
db/schema_migrations/20180503154922
db/schema_migrations/20180520211048
db/schema_migrations/20180524115107
db/schema_migrations/20180531031410
db/schema_migrations/20180531221734
db/schema_migrations/20180607154422
db/schema_migrations/20180607154516
db/schema_migrations/20180607154645
db/schema_migrations/20180612175636
db/schema_migrations/20180615152524
db/schema_migrations/20180621100024
db/schema_migrations/20180621100025
db/schema_migrations/20180623053658
db/schema_migrations/20180626171125
db/schema_migrations/20180702114215
db/schema_migrations/20180702181530
db/schema_migrations/20180709153607
db/schema_migrations/20180709183353
db/schema_migrations/20180709184533
db/schema_migrations/20180711014025
db/schema_migrations/20180711014026
db/schema_migrations/20180718100455
db/schema_migrations/20180719161844
db/schema_migrations/20180720082636
db/schema_migrations/20180720120716
db/schema_migrations/20180720120726
db/schema_migrations/20180720121404
db/schema_migrations/20180723023517
db/schema_migrations/20180723081631
db/schema_migrations/20180723134433
db/schema_migrations/20180724161450
db/schema_migrations/20180803001726
db/schema_migrations/20180803041220
db/schema_migrations/20180806145747
db/schema_migrations/20180823132905
db/schema_migrations/20180831134049
db/schema_migrations/20180831152625
db/schema_migrations/20180910104020
db/schema_migrations/20180910105100
db/schema_migrations/20180912113336
db/schema_migrations/20180917145556
db/schema_migrations/20180917171038
db/schema_migrations/20180917171533
db/schema_migrations/20180917171534
db/schema_migrations/20180917171535
db/schema_migrations/20180917213751
db/schema_migrations/20180917214204
db/schema_migrations/20180920043317
db/schema_migrations/20180924070647
db/schema_migrations/20180926101838
db/schema_migrations/20180926140319
db/schema_migrations/20180930171532
db/schema_migrations/20181001172126
db/schema_migrations/20181001172651
db/schema_migrations/20181004131020
db/schema_migrations/20181004131025
db/schema_migrations/20181012151642
db/schema_migrations/20181017131623
db/schema_migrations/20181022131445
db/schema_migrations/20181025000427
db/schema_migrations/20181025030732
db/schema_migrations/20181026085436
db/schema_migrations/20181028092114
db/schema_migrations/20181028092115
db/schema_migrations/20181105122803
db/schema_migrations/20181114163403
db/schema_migrations/20181121174028
db/schema_migrations/20181121175359
db/schema_migrations/20181123090058
db/schema_migrations/20181123100058
db/schema_migrations/20181126125616
db/schema_migrations/20181127130125
db/schema_migrations/20181127133629
db/schema_migrations/20181127203117
db/schema_migrations/20181201151856
db/schema_migrations/20181203154104
db/schema_migrations/20181204031328
db/schema_migrations/20181204031329
db/schema_migrations/20181204031330
db/schema_migrations/20181204031331
db/schema_migrations/20181204135519
db/schema_migrations/20181204135932
db/schema_migrations/20181205093951
db/schema_migrations/20181206121338
db/schema_migrations/20181220163029
db/schema_migrations/20181221135205
db/schema_migrations/20181228140935
db/schema_migrations/20190110200434
db/schema_migrations/20190111183834
db/schema_migrations/20190114040404
db/schema_migrations/20190114040405
db/schema_migrations/20190121140418
db/schema_migrations/20190121140658
db/schema_migrations/20190122101816
db/schema_migrations/20190123211816
db/schema_migrations/20190128104236
db/schema_migrations/20190128172533
db/schema_migrations/20190129013538
db/schema_migrations/20190130164903
db/schema_migrations/20190218031401
db/schema_migrations/20190218144405
db/schema_migrations/20190219134239
db/schema_migrations/20190219210244
db/schema_migrations/20190220112238
db/schema_migrations/20190222105948
db/schema_migrations/20190222110418
db/schema_migrations/20190225173106
db/schema_migrations/20190226154144
db/schema_migrations/20190228134845
db/schema_migrations/20190301095211
db/schema_migrations/20190301182031
db/schema_migrations/20190302144241
db/schema_migrations/20190304020812
db/schema_migrations/20190304223216
db/schema_migrations/20190304223220
db/schema_migrations/20190305162221
db/schema_migrations/20190318020549
db/schema_migrations/20190318021429
db/schema_migrations/20190318120957
db/schema_migrations/20190320162221
db/schema_migrations/20190321103531
db/schema_migrations/20190322145954
db/schema_migrations/20190327085945
db/schema_migrations/20190328210840
db/schema_migrations/20190401150745
db/schema_migrations/20190401150746
db/schema_migrations/20190402112450
db/schema_migrations/20180309215236
db/schema_migrations/20180314172513
db/schema_migrations/20180417102933
db/schema_migrations/20180502130136
db/schema_migrations/20180509091305
db/schema_migrations/20180605213516
db/schema_migrations/20180608150653
db/schema_migrations/20180618193715
db/schema_migrations/20180713171825
db/schema_migrations/20180815043102
db/schema_migrations/20180914195058
db/schema_migrations/20181014131030
db/schema_migrations/20181115140251
db/schema_migrations/20181116100917
db/schema_migrations/20181204040404
db/schema_migrations/20181206121340
db/schema_migrations/20181215161939
db/schema_migrations/20181220165848
db/schema_migrations/20190111231855
# Removed in ef1efa0f650
db/schema_migrations/20180406204716
db/schema_migrations/20180521171529
db/schema_migrations/20180831164904
# Removed in 28ac2d30498
db/schema_migrations/20180202111106
# Removed in b87dcc238a8
db/schema_migrations/20181218192239
# Removed in various revert commits
db/schema_migrations/20180115094742
db/schema_migrations/20180115113902
db/schema_migrations/20190107151029
db/schema_migrations/20190114184258
db/schema_migrations/20190228092516
db/schema_migrations/20190311132500
db/schema_migrations/20190311132527
db/schema_migrations/20190703001116
db/schema_migrations/20190703001120
db/schema_migrations/20190724091326
db/schema_migrations/20190801072937
db/schema_migrations/20191004134055
db/schema_migrations/20191029060358
db/schema_migrations/20191029061556
db/schema_migrations/20191220102807
db/schema_migrations/20200123092602
db/schema_migrations/20200123101859
db/schema_migrations/20200127111953
db/schema_migrations/20200127131953
db/schema_migrations/20200127141953
db/schema_migrations/20200127151953
db/schema_migrations/20200206111847
db/schema_migrations/20200214173000
db/schema_migrations/20200214174519
db/schema_migrations/20200214174607
db/schema_migrations/20200309105539
db/schema_migrations/20200615203153
......@@ -7,6 +7,7 @@ stages:
- post-test
- review-prepare
- review
- dast
- qa
- post-qa
- pages
......@@ -104,3 +105,4 @@ include:
- local: .gitlab/ci/yaml.gitlab-ci.yml
- local: .gitlab/ci/releases.gitlab-ci.yml
- local: .gitlab/ci/notify.gitlab-ci.yml
- local: .gitlab/ci/dast.gitlab-ci.yml
......@@ -10,13 +10,13 @@
/doc/ @gl-docsteam
/doc/administration/monitoring/ @aqualls
/doc/development/ @marcia @mjang1
/doc/development/documentation/ @mikelewis
/doc/development/documentation/ @cnorris
/doc/ci @marcel.amirault @sselhorn
/doc/operations @aqualls @eread
/doc/user/clusters @aqualls
/doc/user/infrastructure @aqualls
/doc/user/project/clusters @aqualls
/doc/.vale/ @marcel.amirault @eread @aqualls @mikelewis
/doc/.vale/ @marcel.amirault @eread @aqualls @cnorris
[Docs Create]
/doc/user/project/merge_requests/allow_collaboration.md @marcia
......@@ -165,12 +165,15 @@
/.gitlab/ci/ @gl-quality/eng-prod
/.gitlab/ci/docs.gitlab-ci.yml @gl-quality/eng-prod @gl-docsteam
/.gitlab/ci/releases.gitlab-ci.yml @gl-quality/eng-prod @gitlab-org/delivery
/.gitlab/ci/dast.gitlab-ci.yml @dappelt @ngeorge1 @gl-quality/eng-prod
/.gitlab/ci/reports.gitlab-ci.yml @gitlab-com/gl-security/appsec @gl-quality/eng-prod
/.gitlab/CODEOWNERS @gl-quality/eng-prod
Dangerfile @gl-quality/eng-prod
/danger/ @gl-quality/eng-prod
/lib/gitlab/danger/ @gl-quality/eng-prod
/scripts/ @gl-quality/eng-prod
/scripts/frontend/ @gl-quality/eng-prod @gitlab-org/maintainers/frontend
/scripts/review_apps/seed-dast-test-data.sh @dappelt @ngeorge1 @gl-quality/eng-prod
.editorconfig @gl-quality/eng-prod
[End-to-end]
......@@ -192,9 +195,11 @@ Dangerfile @gl-quality/eng-prod
# Secure & Threat Management ownership delineation
# https://about.gitlab.com/handbook/engineering/development/threat-management/delineate-secure-threat-management.html#technical-boundaries
[Secure]
/ee/app/models/vulnerability.rb @gitlab-org/secure/threat-insights-backend-team
/ee/app/finders/security/ @gitlab-org/secure/threat-insights-backend-team
/ee/app/models/security/ @gitlab-org/secure/threat-insights-backend-team
/ee/app/models/vulnerabilities/ @gitlab-org/secure/threat-insights-backend-team
/ee/app/models/vulnerability.rb @gitlab-org/secure/threat-insights-backend-team
/ee/lib/api/vulnerabilit*.rb @gitlab-org/secure/threat-insights-backend-team
/ee/lib/gitlab/ci/parsers/license_compliance/ @gitlab-org/secure/composition-analysis-be
/ee/lib/gitlab/ci/parsers/security/ @gitlab-org/secure/composition-analysis-be @gitlab-org/secure/dynamic-analysis-be @gitlab-org/secure/static-analysis-be @gitlab-org/secure/fuzzing-be
/ee/lib/gitlab/ci/reports/coverage_fuzzing/ @gitlab-org/secure/fuzzing-be
......
.dast_conf:
tags:
- prm
# For scheduling dast job
extends:
- .reports:schedule-dast
image:
name: "registry.gitlab.com/gitlab-org/security-products/dast:$DAST_VERSION"
resource_group: dast_scan
variables:
DAST_USERNAME_FIELD: "user[login]"
DAST_PASSWORD_FIELD: "user[password]"
DAST_FULL_SCAN_ENABLED: "true"
DAST_SPIDER_MINS: 0
# TBD pin to a version
DAST_VERSION: 1.22.1
# -Xmx is used to set the JVM memory to 6GB to prevent DAST OutOfMemoryError.
DAST_ZAP_CLI_OPTIONS: "-Xmx6144m"
DAST_RULES: "41,42,43,10027,10032,10041,10042,10045,10047,10052,10053,10057,10061,10096,10097,10104,10106,20012,20014,20015,20016,20017,20018,40019,40020,40021,40024,40025,40027,40029,40032,90001,90019,10109,10026,10028,10029,10030,10031,10033,10034,10035,10036,10038,10039,10043,10044,10048,10050,10051,10058,10062,10095,10107,10108,30003,40013,40022,40023,40028,90021,90023,90024,90025,90027,90028,10003,50003,0,2,3,6,7,10010,10011,10015,10017,10019,10020,10021,10023,10024,10025,10037,10040,10054,10055,10056,10098,10105,10202,20019,30001,30002,40003,40008,40009,40012,40014,40016,40017,40018,50000,50001,90011,90020,90022,90033"
before_script:
- 'export DAST_WEBSITE="${DAST_WEBSITE:-$(cat environment_url.txt)}"'
- 'export DAST_AUTH_URL="${DAST_WEBSITE}/users/sign_in"'
- 'export DAST_PASSWORD="${REVIEW_APPS_ROOT_PASSWORD}"'
# Below three lines can be removed once https://gitlab.com/gitlab-org/gitlab/-/issues/230687 is fixed
- mkdir -p /zap/xml
- 'sed -i "84 s/true/false/" /zap/xml/config.xml'
- cat /zap/xml/config.xml
# Help pages are excluded from scan as they are static pages.
# profile/two_factor_auth is excluded from scan to prevent 2FA from being turned on from user profile, which will reduce coverage.
- 'export DAST_AUTH_EXCLUDE_URLS="${DAST_WEBSITE}/help/.*,${DAST_WEBSITE}/profile/two_factor_auth,${DAST_WEBSITE}/users/sign_out"'
- enable_rule () { read all_rules; rule=$1; echo $all_rules | sed -r "s/(,)?$rule(,)?/\1-1\2/" ; }
# Sort ids in DAST_RULES ascendingly, which is required when using DAST_RULES as argument to enable_rule
- 'DAST_RULES=$(echo $DAST_RULES | tr "," "\n" | sort -n | paste -sd ",")'
needs: ["review-deploy"]
stage: dast
# Default job timeout set to 90m and dast rules needs 2h to so that it won't timeout.
timeout: 2h
# Add retry because of intermittent connection problems. See https://gitlab.com/gitlab-org/gitlab/-/issues/244313
retry: 1
artifacts:
paths:
- gl-dast-report.json # GitLab-specific
reports:
dast: gl-dast-report.json
expire_in: 1 week # GitLab-specific