Add sample scan files for GitLab Dependency Scanning (DefectDojo#69)

LOLCATATONIA · Feb 3, 2021 · fbfd9ef · fbfd9ef
1 parent f0a4e74
commit fbfd9ef
Show file tree

Hide file tree

Showing 5 changed files with 847 additions and 0 deletions.
diff --git a/gitlab_dep_scan/README.md b/gitlab_dep_scan/README.md
@@ -0,0 +1,10 @@
+# GitLab Dependency Scanning
+
+GitLab Dependency Scanning integrates into GitLab's Continuous Integration and leverages FLOSS scanning tools to automatically find security vulnerabilities in dependencies. For more information please see [supported languages and package managers](https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#supported-languages-and-package-managers). It then reads the results of those tools and creates a report in a common JSON format.
+
+## Analyzer Data
+It is important to note that these different tools do not leverage the same *properties* for their scanner output. For more information please see [analyzers data](https://docs.gitlab.com/ee/user/application_security/dependency_scanning/analyzers.html#analyzers-data).
+
+### Additional Resources
+* [GitLab Dependency Scanning](https://docs.gitlab.com/ee/user/application_security/dependency_scanning/)
+* [GitLab Dependency Scanning Analyzers](https://docs.gitlab.com/ee/user/application_security/dependency_scanning/analyzers.html)
diff --git a/gitlab_dep_scan/gl-dependency-scanning-report-0-vuln.json b/gitlab_dep_scan/gl-dependency-scanning-report-0-vuln.json
@@ -0,0 +1,27 @@
+{
+  "version": "3.0.0",
+  "vulnerabilities": [],
+  "remediations": [],
+  "dependency_files": [
+    {
+      "path": "service/go.sum",
+      "package_manager": "go",
+      "dependencies": []
+    }
+  ],
+  "scan": {
+    "scanner": {
+      "id": "gemnasium",
+      "name": "Gemnasium",
+      "url": "https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium",
+      "vendor": {
+        "name": "GitLab"
+      },
+      "version": "2.24.1"
+    },
+    "type": "dependency_scanning",
+    "start_time": "2020-12-23T13:44:07",
+    "end_time": "2020-12-23T13:44:08",
+    "status": "success"
+  }
+}
diff --git a/gitlab_dep_scan/gl-dependency-scanning-report-1-vuln-missing-component.json b/gitlab_dep_scan/gl-dependency-scanning-report-1-vuln-missing-component.json
@@ -0,0 +1,74 @@
+{
+  "version": "3.0.0",
+  "vulnerabilities": [
+    {
+      "id": "2d8b607cb56d9866c73cdcf33a016f64b4fa37d909c1dd300037b1ac026a3ca5",
+      "category": "dependency_scanning",
+      "name": "XML Entity Expansion",
+      "message": "XML Entity Expansion in gopkg.in/yaml.v2",
+      "description": "go-yaml is vulnerable to a Billion Laughs Attack.",
+      "cve": "service/go.sum:gopkg.in/yaml.v2:gemnasium:7368f513-0aa9-4e34-a08d-40ea81f48e0e",
+      "severity": "Unknown",
+      "solution": "Upgrade to version 2.2.3 or above.",
+      "scanner": {
+        "id": "gemnasium",
+        "name": "Gemnasium"
+      },
+      "location": {
+        "file": "service/go.sum",
+        "dependency": {
+          "package": { }
+        }
+      },
+      "identifiers": [
+        {
+          "type": "gemnasium",
+          "name": "Gemnasium-7368f513-0aa9-4e34-a08d-40ea81f48e0e",
+          "value": "7368f513-0aa9-4e34-a08d-40ea81f48e0e",
+          "url": "https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/blob/master/go/gopkg.in/yaml.v2/GMS-2019-2.yml"
+        }
+      ],
+      "links": [
+        {
+          "url": "https://github.com/docker/cli/pull/2117"
+        }
+      ]
+    }
+  ],
+  "remediations": [],
+  "dependency_files": [
+    {
+      "path": "service/go.sum",
+      "package_manager": "go",
+      "dependencies": [
+        {
+          "package": {
+            "name": "gopkg.in/yaml.v2"
+          },
+          "version": "v2.2.2"
+        },
+        {
+          "package": {
+            "name": "gopkg.in/yaml.v2"
+          },
+          "version": "v2.2.4"
+        }
+      ]
+    }
+  ],
+  "scan": {
+    "scanner": {
+      "id": "gemnasium",
+      "name": "Gemnasium",
+      "url": "https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium",
+      "vendor": {
+        "name": "GitLab"
+      },
+      "version": "2.24.1"
+    },
+    "type": "dependency_scanning",
+    "start_time": "2020-12-23T13:43:48",
+    "end_time": "2020-12-23T13:43:49",
+    "status": "success"
+  }
+}
diff --git a/gitlab_dep_scan/gl-dependency-scanning-report-1-vuln.json b/gitlab_dep_scan/gl-dependency-scanning-report-1-vuln.json
@@ -0,0 +1,77 @@
+{
+  "version": "3.0.0",
+  "vulnerabilities": [
+    {
+      "id": "2d8b607cb56d9866c73cdcf33a016f64b4fa37d909c1dd300037b1ac026a3ca5",
+      "category": "dependency_scanning",
+      "name": "XML Entity Expansion",
+      "message": "XML Entity Expansion in gopkg.in/yaml.v2",
+      "description": "go-yaml is vulnerable to a Billion Laughs Attack.",
+      "cve": "service/go.sum:gopkg.in/yaml.v2:gemnasium:7368f513-0aa9-4e34-a08d-40ea81f48e0e",
+      "severity": "Unknown",
+      "solution": "Upgrade to version 2.2.3 or above.",
+      "scanner": {
+        "id": "gemnasium",
+        "name": "Gemnasium"
+      },
+      "location": {
+        "file": "service/go.sum",
+        "dependency": {
+          "package": {
+            "name": "gopkg.in/yaml.v2"
+          },
+          "version": "v2.2.2"
+        }
+      },
+      "identifiers": [
+        {
+          "type": "gemnasium",
+          "name": "Gemnasium-7368f513-0aa9-4e34-a08d-40ea81f48e0e",
+          "value": "7368f513-0aa9-4e34-a08d-40ea81f48e0e",
+          "url": "https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/blob/master/go/gopkg.in/yaml.v2/GMS-2019-2.yml"
+        }
+      ],
+      "links": [
+        {
+          "url": "https://github.com/docker/cli/pull/2117"
+        }
+      ]
+    }
+  ],
+  "remediations": [],
+  "dependency_files": [
+    {
+      "path": "service/go.sum",
+      "package_manager": "go",
+      "dependencies": [
+        {
+          "package": {
+            "name": "gopkg.in/yaml.v2"
+          },
+          "version": "v2.2.2"
+        },
+        {
+          "package": {
+            "name": "gopkg.in/yaml.v2"
+          },
+          "version": "v2.2.4"
+        }
+      ]
+    }
+  ],
+  "scan": {
+    "scanner": {
+      "id": "gemnasium",
+      "name": "Gemnasium",
+      "url": "https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium",
+      "vendor": {
+        "name": "GitLab"
+      },
+      "version": "2.24.1"
+    },
+    "type": "dependency_scanning",
+    "start_time": "2020-12-23T13:43:48",
+    "end_time": "2020-12-23T13:43:49",
+    "status": "success"
+  }
+}