diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000000000000000000000000000000000000..70900256334d3cdd58eea0549d94d287e00b4931
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,61 @@
+include:
+ template: Dependency-Scanning.gitlab-ci.yml
+ template: Container-Scanning.gitlab-ci.yml
+ template: SAST.gitlab-ci.yml
+ template: DAST.gitlab-ci.yml
+ template: License-Scanning.gitlab-ci.yml
+
+dependency_scanning:
+ tags:
+ - qa
+ - test
+ script:
+ - echo "Skipped"
+ artifacts:
+ reports:
+ dependency_scanning: gl-dependency-scanning-report.json
+
+container_scanning:
+ tags:
+ - qa
+ - test
+ only: null # Template defaults to feature branches only
+ variables:
+ GIT_STRATEGY: fetch # Template defaults to none, which stops fetching the premade report
+ script:
+ - echo "Skipped"
+ artifacts:
+ reports:
+ container_scanning: gl-container-scanning-report.json
+
+sast:
+ tags:
+ - qa
+ - test
+ only: null # Template defaults to feature branches only
+ script:
+ - echo "Skipped"
+ artifacts:
+ reports:
+ sast: gl-sast-report.json
+
+dast:
+ tags:
+ - qa
+ - test
+ only: null # Template defaults to feature branches only
+ script:
+ - echo "Skipped"
+ artifacts:
+ reports:
+ dast: gl-dast-report.json
+
+license_scanning:
+ tags:
+ - qa
+ - test
+ script:
+ - echo "Skipped"
+ artifacts:
+ reports:
+ license_scanning: gl-license-scanning-report.json
diff --git a/gl-container-scanning-report.json b/gl-container-scanning-report.json
new file mode 100644
index 0000000000000000000000000000000000000000..0becd2925c661cbab78c3adcd68d66b00148c892
--- /dev/null
+++ b/gl-container-scanning-report.json
@@ -0,0 +1,289 @@
+{
+ "version": "2.3",
+ "vulnerabilities": [
+ {
+ "category": "container_scanning",
+ "message": "CVE-2017-18269 in glibc",
+ "description": "Short description to match in specs",
+ "cve": "debian:9:glibc:CVE-2017-18269",
+ "severity": "Critical",
+ "confidence": "Unknown",
+ "solution": "Upgrade glibc from 2.24-11+deb9u3 to 2.24-11+deb9u4",
+ "scanner": {
+ "id": "klar",
+ "name": "klar"
+ },
+ "location": {
+ "dependency": {
+ "package": {
+ "name": "glibc"
+ },
+ "version": "2.24-11+deb9u3"
+ },
+ "operating_system": "debian:9",
+ "image": "registry.gitlab.com/gitlab-org/security-products/dast/webgoat-8.0@sha256:bc09fe2e0721dfaeee79364115aeedf2174cce0947b9ae5fe7c33312ee019a4e"
+ },
+ "identifiers": [
+ {
+ "type": "cve",
+ "name": "CVE-2017-18269",
+ "value": "CVE-2017-18269",
+ "url": "https://security-tracker.debian.org/tracker/CVE-2017-18269"
+ }
+ ],
+ "links": [
+ {
+ "url": "https://security-tracker.debian.org/tracker/CVE-2017-18269"
+ }
+ ]
+ },
+ {
+ "category": "container_scanning",
+ "message": "CVE-2017-16997 in glibc",
+ "description": "elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the \"./\" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.",
+ "cve": "debian:9:glibc:CVE-2017-16997",
+ "severity": "Critical",
+ "confidence": "Unknown",
+ "solution": "Upgrade glibc from 2.24-11+deb9u3 to 2.24-11+deb9u4",
+ "scanner": {
+ "id": "klar",
+ "name": "klar"
+ },
+ "location": {
+ "dependency": {
+ "package": {
+ "name": "glibc"
+ },
+ "version": "2.24-11+deb9u3"
+ },
+ "operating_system": "debian:9",
+ "image": "registry.gitlab.com/gitlab-org/security-products/dast/webgoat-8.0@sha256:bc09fe2e0721dfaeee79364115aeedf2174cce0947b9ae5fe7c33312ee019a4e"
+ },
+ "identifiers": [
+ {
+ "type": "cve",
+ "name": "CVE-2017-16997",
+ "value": "CVE-2017-16997",
+ "url": "https://security-tracker.debian.org/tracker/CVE-2017-16997"
+ }
+ ],
+ "links": [
+ {
+ "url": "https://security-tracker.debian.org/tracker/CVE-2017-16997"
+ }
+ ]
+ },
+ {
+ "category": "container_scanning",
+ "message": "CVE-2018-1000001 in glibc",
+ "description": "In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.",
+ "cve": "debian:9:glibc:CVE-2018-1000001",
+ "severity": "High",
+ "confidence": "Unknown",
+ "scanner": {
+ "id": "klar",
+ "name": "klar"
+ },
+ "location": {
+ "dependency": {
+ "package": {
+ "name": "glibc"
+ },
+ "version": "2.24-11+deb9u3"
+ },
+ "operating_system": "debian:9",
+ "image": "registry.gitlab.com/gitlab-org/security-products/dast/webgoat-8.0@sha256:bc09fe2e0721dfaeee79364115aeedf2174cce0947b9ae5fe7c33312ee019a4e"
+ },
+ "identifiers": [
+ {
+ "type": "cve",
+ "name": "CVE-2018-1000001",
+ "value": "CVE-2018-1000001",
+ "url": "https://security-tracker.debian.org/tracker/CVE-2018-1000001"
+ }
+ ],
+ "links": [
+ {
+ "url": "https://security-tracker.debian.org/tracker/CVE-2018-1000001"
+ }
+ ]
+ },
+ {
+ "category": "container_scanning",
+ "message": "CVE-2016-10228 in glibc",
+ "description": "The iconv program in the GNU C Library (aka glibc or libc6) 2.25 and earlier, when invoked with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.",
+ "cve": "debian:9:glibc:CVE-2016-10228",
+ "severity": "Medium",
+ "confidence": "Unknown",
+ "scanner": {
+ "id": "klar",
+ "name": "klar"
+ },
+ "location": {
+ "dependency": {
+ "package": {
+ "name": "glibc"
+ },
+ "version": "2.24-11+deb9u3"
+ },
+ "operating_system": "debian:9",
+ "image": "registry.gitlab.com/gitlab-org/security-products/dast/webgoat-8.0@sha256:bc09fe2e0721dfaeee79364115aeedf2174cce0947b9ae5fe7c33312ee019a4e"
+ },
+ "identifiers": [
+ {
+ "type": "cve",
+ "name": "CVE-2016-10228",
+ "value": "CVE-2016-10228",
+ "url": "https://security-tracker.debian.org/tracker/CVE-2016-10228"
+ }
+ ],
+ "links": [
+ {
+ "url": "https://security-tracker.debian.org/tracker/CVE-2016-10228"
+ }
+ ]
+ },
+ {
+ "category": "container_scanning",
+ "message": "CVE-2018-18520 in elfutils",
+ "description": "An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.",
+ "cve": "debian:9:elfutils:CVE-2018-18520",
+ "severity": "Low",
+ "confidence": "Unknown",
+ "scanner": {
+ "id": "klar",
+ "name": "klar"
+ },
+ "location": {
+ "dependency": {
+ "package": {
+ "name": "elfutils"
+ },
+ "version": "0.168-1"
+ },
+ "operating_system": "debian:9",
+ "image": "registry.gitlab.com/gitlab-org/security-products/dast/webgoat-8.0@sha256:bc09fe2e0721dfaeee79364115aeedf2174cce0947b9ae5fe7c33312ee019a4e"
+ },
+ "identifiers": [
+ {
+ "type": "cve",
+ "name": "CVE-2018-18520",
+ "value": "CVE-2018-18520",
+ "url": "https://security-tracker.debian.org/tracker/CVE-2018-18520"
+ }
+ ],
+ "links": [
+ {
+ "url": "https://security-tracker.debian.org/tracker/CVE-2018-18520"
+ }
+ ]
+ },
+ {
+ "category": "container_scanning",
+ "message": "CVE-2010-4052 in glibc",
+ "description": "Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.",
+ "cve": "debian:9:glibc:CVE-2010-4052",
+ "severity": "Low",
+ "confidence": "Unknown",
+ "scanner": {
+ "id": "klar",
+ "name": "klar"
+ },
+ "location": {
+ "dependency": {
+ "package": {
+ "name": "glibc"
+ },
+ "version": "2.24-11+deb9u3"
+ },
+ "operating_system": "debian:9",
+ "image": "registry.gitlab.com/gitlab-org/security-products/dast/webgoat-8.0@sha256:bc09fe2e0721dfaeee79364115aeedf2174cce0947b9ae5fe7c33312ee019a4e"
+ },
+ "identifiers": [
+ {
+ "type": "cve",
+ "name": "CVE-2010-4052",
+ "value": "CVE-2010-4052",
+ "url": "https://security-tracker.debian.org/tracker/CVE-2010-4052"
+ }
+ ],
+ "links": [
+ {
+ "url": "https://security-tracker.debian.org/tracker/CVE-2010-4052"
+ }
+ ]
+ },
+ {
+ "category": "container_scanning",
+ "message": "CVE-2018-16869 in nettle",
+ "description": "A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.",
+ "cve": "debian:9:nettle:CVE-2018-16869",
+ "severity": "Unknown",
+ "confidence": "Unknown",
+ "scanner": {
+ "id": "klar",
+ "name": "klar"
+ },
+ "location": {
+ "dependency": {
+ "package": {
+ "name": "nettle"
+ },
+ "version": "3.3-1"
+ },
+ "operating_system": "debian:9",
+ "image": "registry.gitlab.com/gitlab-org/security-products/dast/webgoat-8.0@sha256:bc09fe2e0721dfaeee79364115aeedf2174cce0947b9ae5fe7c33312ee019a4e"
+ },
+ "identifiers": [
+ {
+ "type": "cve",
+ "name": "CVE-2018-16869",
+ "value": "CVE-2018-16869",
+ "url": "https://security-tracker.debian.org/tracker/CVE-2018-16869"
+ }
+ ],
+ "links": [
+ {
+ "url": "https://security-tracker.debian.org/tracker/CVE-2018-16869"
+ }
+ ]
+ },
+ {
+ "category": "container_scanning",
+ "message": "CVE-2018-18311 in perl",
+ "description": "Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.",
+ "cve": "debian:9:perl:CVE-2018-18311",
+ "severity": "Unknown",
+ "confidence": "Unknown",
+ "solution": "Upgrade perl from 5.24.1-3+deb9u3 to 5.24.1-3+deb9u5",
+ "scanner": {
+ "id": "klar",
+ "name": "klar"
+ },
+ "location": {
+ "dependency": {
+ "package": {
+ "name": "perl"
+ },
+ "version": "5.24.1-3+deb9u3"
+ },
+ "operating_system": "debian:9",
+ "image": "registry.gitlab.com/gitlab-org/security-products/dast/webgoat-8.0@sha256:bc09fe2e0721dfaeee79364115aeedf2174cce0947b9ae5fe7c33312ee019a4e"
+ },
+ "identifiers": [
+ {
+ "type": "cve",
+ "name": "CVE-2018-18311",
+ "value": "CVE-2018-18311",
+ "url": "https://security-tracker.debian.org/tracker/CVE-2018-18311"
+ }
+ ],
+ "links": [
+ {
+ "url": "https://security-tracker.debian.org/tracker/CVE-2018-18311"
+ }
+ ]
+ }
+ ],
+ "remediations": []
+}
diff --git a/gl-dast-report.json b/gl-dast-report.json
new file mode 100644
index 0000000000000000000000000000000000000000..4549844d8b1b8d21533ec7ee447d11dadb740f89
--- /dev/null
+++ b/gl-dast-report.json
@@ -0,0 +1 @@
+{"@generated": "Thu, 12 Sep 2019 22:57:16", "@version": "D-2019-09-02", "site": [{"@port": "80", "@host": "gitlab-org-security-products-tests-webgoat.review-get-dast-r-vqezi1.35.194.50.105.xip.io", "@name": "http://gitlab-org-security-products-tests-webgoat.review-get-dast-r-vqezi1.35.194.50.105.xip.io", "alerts": [{"count": "2", "riskdesc": "Low (Medium)", "name": "Cookie Without SameSite Attribute", "reference": "https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site
", "sourceid": "3", "confidence": "2", "alert": "Cookie Without SameSite Attribute", "instances": [{"evidence": "Set-Cookie: JSESSIONID", "uri": "http://gitlab-org-security-products-tests-webgoat.review-get-dast-r-vqezi1.35.194.50.105.xip.io/robots.txt", "param": "JSESSIONID", "method": "GET"}, {"evidence": "Set-Cookie: JSESSIONID", "uri": "http://gitlab-org-security-products-tests-webgoat.review-get-dast-r-vqezi1.35.194.50.105.xip.io/", "param": "JSESSIONID", "method": "GET"}], "pluginid": "10054", "riskcode": "1", "wascid": "13", "solution": "Ensure that the SameSite attribute is set to either 'lax' or ideally 'strict' for all cookies.
", "cweid": "16", "desc": "A cookie has been set without the SameSite attribute, which means that the cookie can be sent as a result of a 'cross-site' request. The SameSite attribute is an effective counter measure to cross-site request forgery, cross-site script inclusion, and timing attacks.
"}, {"count": "5", "riskdesc": "Informational (Low)", "name": "Timestamp Disclosure - Unix", "reference": "https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure
http://projects.webappsec.org/w/page/13246936/Information%20Leakage
", "otherinfo": "80000000, which evaluates to: 1972-07-14 22:13:20
", "sourceid": "3", "confidence": "1", "alert": "Timestamp Disclosure - Unix", "instances": [{"evidence": "80000000", "uri": "http://gitlab-org-security-products-tests-webgoat.review-get-dast-r-vqezi1.35.194.50.105.xip.io/plugins/bootstrap/css/bootstrap.min.css", "method": "GET"}, {"evidence": "33333333", "uri": "http://gitlab-org-security-products-tests-webgoat.review-get-dast-r-vqezi1.35.194.50.105.xip.io/plugins/bootstrap/css/bootstrap.min.css", "method": "GET"}, {"evidence": "00000000", "uri": "http://gitlab-org-security-products-tests-webgoat.review-get-dast-r-vqezi1.35.194.50.105.xip.io/plugins/bootstrap/css/bootstrap.min.css", "method": "GET"}, {"evidence": "66666667", "uri": "http://gitlab-org-security-products-tests-webgoat.review-get-dast-r-vqezi1.35.194.50.105.xip.io/plugins/bootstrap/css/bootstrap.min.css", "method": "GET"}, {"evidence": "42857143", "uri": "http://gitlab-org-security-products-tests-webgoat.review-get-dast-r-vqezi1.35.194.50.105.xip.io/plugins/bootstrap/css/bootstrap.min.css", "method": "GET"}], "pluginid": "10096", "riskcode": "0", "wascid": "13", "solution": "Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
", "cweid": "200", "desc": "A timestamp was disclosed by the application/web server - Unix
"}, {"count": "4", "riskdesc": "Low (Medium)", "name": "Absence of Anti-CSRF Tokens", "reference": "http://projects.webappsec.org/Cross-Site-Request-Forgery
http://cwe.mitre.org/data/definitions/352.html
", "otherinfo": "No known Anti-CSRF token [anticsrf, CSRFToken, __RequestVerificationToken, csrfmiddlewaretoken, authenticity_token, OWASP_CSRFTOKEN, anoncsrf, csrf_token, _csrf, _csrfSecret] was found in the following HTML form: [Form 1: \"username\" \"password\" \"matchingPassword\" \"agree\" ].
", "sourceid": "3", "confidence": "2", "alert": "Absence of Anti-CSRF Tokens", "instances": [{"evidence": "