summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGitLab Bot <gitlab-bot@gitlab.com>2023-05-10 21:13:10 +0000
committerGitLab Bot <gitlab-bot@gitlab.com>2023-05-10 21:13:10 +0000
commitd9710d79c52bc73438022e79c79cfe3ab35b084b (patch)
tree4ccba377283753036ad28a75d061f7ee61afa806
parent20a86e7f6fd58882025b1c85b21e891d75220da5 (diff)
downloadgitlab-ce-d9710d79c52bc73438022e79c79cfe3ab35b084b.tar.gz
Add latest changes from gitlab-org/gitlab@master
-rw-r--r--.gitlab/ci/rails/rspec-foss-impact.gitlab-ci.yml.erb2
-rw-r--r--.rubocop_todo/style/redundant_begin.yml6
-rw-r--r--Gemfile2
-rw-r--r--Gemfile.checksum2
-rw-r--r--Gemfile.lock4
-rw-r--r--app/assets/javascripts/boards/components/board_content.vue34
-rw-r--r--app/assets/javascripts/ci/runner/admin_runner_show/index.js5
-rw-r--r--app/assets/javascripts/ci/runner/admin_runners/admin_runners_app.vue3
-rw-r--r--app/assets/javascripts/ci/runner/admin_runners/index.js4
-rw-r--r--app/assets/javascripts/ci/runner/components/runner_jobs_empty_state.vue6
-rw-r--r--app/assets/javascripts/ci/runner/components/runner_list_empty_state.vue19
-rw-r--r--app/assets/javascripts/ci/runner/group_runners/group_runners_app.vue3
-rw-r--r--app/assets/javascripts/ci/runner/group_runners/index.js4
-rw-r--r--app/assets/javascripts/content_editor/components/bubble_menus/bubble_menu.vue1
-rw-r--r--app/assets/javascripts/content_editor/components/bubble_menus/link_bubble_menu.vue1
-rw-r--r--app/assets/stylesheets/framework/system_messages.scss5
-rw-r--r--app/assets/stylesheets/framework/variables.scss1
-rw-r--r--app/assets/stylesheets/page_bundles/boards.scss17
-rw-r--r--app/controllers/concerns/metrics_dashboard.rb3
-rw-r--r--app/helpers/ci/runners_helper.rb8
-rw-r--r--app/views/admin/runners/show.html.haml2
-rw-r--r--app/views/layouts/devise.html.haml4
-rw-r--r--app/views/layouts/minimal.html.haml2
-rw-r--r--config/application.rb1
-rw-r--r--config/circuitbox.rb6
-rw-r--r--config/feature_flags/development/draft_quick_action_non_toggle.yml8
-rw-r--r--config/initializers/circuitbox.rb8
-rwxr-xr-xconfig/metrics/counts_28d/20210216184559_ci_templates_total_unique_counts_monthly.yml1
-rw-r--r--config/metrics/counts_28d/20230509140528_p_ci_templates_security_bas_latest_monthly.yml24
-rwxr-xr-xconfig/metrics/counts_7d/20210216184557_ci_templates_total_unique_counts_weekly.yml1
-rw-r--r--config/metrics/counts_7d/20230509140526_p_ci_templates_security_bas_latest_weekly.yml24
-rw-r--r--doc/administration/raketasks/github_import.md3
-rw-r--r--doc/api/import.md27
-rw-r--r--doc/api/project_import_export.md2
-rw-r--r--doc/development/feature_flags/index.md8
-rw-r--r--doc/integration/cas.md76
-rw-r--r--doc/update/index.md12
-rw-r--r--doc/user/admin_area/settings/external_authorization.md6
-rw-r--r--doc/user/application_security/breach_and_attack_simulation/index.md128
-rw-r--r--doc/user/application_security/vulnerability_report/img/project_security_dashboard_status_change_v14_2.pngbin37318 -> 0 bytes
-rw-r--r--doc/user/application_security/vulnerability_report/img/project_security_dashboard_status_change_v16_0.pngbin0 -> 76118 bytes
-rw-r--r--doc/user/application_security/vulnerability_report/index.md7
-rw-r--r--doc/user/group/import/index.md2
-rw-r--r--doc/user/profile/personal_access_tokens.md5
-rw-r--r--doc/user/project/import/bitbucket.md2
-rw-r--r--doc/user/project/import/bitbucket_server.md12
-rw-r--r--doc/user/project/import/fogbugz.md10
-rw-r--r--doc/user/project/import/gitea.md26
-rw-r--r--doc/user/project/import/github.md2
-rw-r--r--doc/user/project/import/index.md5
-rw-r--r--doc/user/project/import/jira.md16
-rw-r--r--doc/user/project/import/manifest.md8
-rw-r--r--doc/user/project/import/repo_by_url.md12
-rw-r--r--doc/user/project/merge_requests/drafts.md2
-rw-r--r--doc/user/project/quick_actions.md2
-rw-r--r--doc/user/project/settings/import_export.md8
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schema_validator.rb34
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/container-scanning-report-format.json741
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/coverage-fuzzing-report-format.json711
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/dast-report-format.json1128
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/dependency-scanning-report-format.json805
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/sast-report-format.json706
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/secret-detection-report-format.json729
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/container-scanning-report-format.json809
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/coverage-fuzzing-report-format.json779
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/dast-report-format.json1196
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/dependency-scanning-report-format.json873
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/sast-report-format.json774
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/secret-detection-report-format.json797
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/container-scanning-report-format.json871
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/coverage-fuzzing-report-format.json841
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/dast-report-format.json1258
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/dependency-scanning-report-format.json935
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/sast-report-format.json836
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/secret-detection-report-format.json859
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/container-scanning-report-format.json904
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/coverage-fuzzing-report-format.json874
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/dast-report-format.json1291
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/dependency-scanning-report-format.json968
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/sast-report-format.json869
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/secret-detection-report-format.json892
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/cluster-image-scanning-report-format.json977
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/container-scanning-report-format.json904
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/coverage-fuzzing-report-format.json874
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/dast-report-format.json1291
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/dependency-scanning-report-format.json968
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/sast-report-format.json869
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/secret-detection-report-format.json892
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/cluster-image-scanning-report-format.json977
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/container-scanning-report-format.json910
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/coverage-fuzzing-report-format.json874
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/dast-report-format.json1291
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/dependency-scanning-report-format.json968
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/sast-report-format.json869
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/secret-detection-report-format.json892
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/cluster-image-scanning-report-format.json977
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/container-scanning-report-format.json910
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/coverage-fuzzing-report-format.json874
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/dast-report-format.json1291
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/dependency-scanning-report-format.json968
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/sast-report-format.json869
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/secret-detection-report-format.json892
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/cluster-image-scanning-report-format.json977
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/container-scanning-report-format.json911
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/coverage-fuzzing-report-format.json874
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/dast-report-format.json1291
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/dependency-scanning-report-format.json968
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/sast-report-format.json869
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/secret-detection-report-format.json892
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/cluster-image-scanning-report-format.json977
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/container-scanning-report-format.json911
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/coverage-fuzzing-report-format.json874
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/dast-report-format.json1291
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/dependency-scanning-report-format.json968
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/sast-report-format.json869
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/secret-detection-report-format.json892
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/cluster-image-scanning-report-format.json977
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/container-scanning-report-format.json911
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/coverage-fuzzing-report-format.json874
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/dast-report-format.json1287
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/dependency-scanning-report-format.json968
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/sast-report-format.json869
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/secret-detection-report-format.json892
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/cluster-image-scanning-report-format.json977
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/container-scanning-report-format.json911
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/coverage-fuzzing-report-format.json874
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/dast-report-format.json1287
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/dependency-scanning-report-format.json968
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/sast-report-format.json869
-rw-r--r--lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/secret-detection-report-format.json892
-rw-r--r--lib/gitlab/ci/templates/Security/BAS.latest.gitlab-ci.yml65
-rw-r--r--lib/gitlab/quick_actions/merge_request_actions.rb12
-rw-r--r--lib/gitlab/usage_data_counters/known_events/ci_templates.yml2
-rw-r--r--lib/sidebars/admin/panel.rb3
-rw-r--r--locale/gitlab.pot23
-rw-r--r--package.json2
-rw-r--r--spec/features/broadcast_messages_spec.rb32
-rw-r--r--spec/frontend/boards/components/board_content_spec.js54
-rw-r--r--spec/frontend/ci/runner/admin_runners/admin_runners_app_spec.js6
-rw-r--r--spec/frontend/ci/runner/components/runner_jobs_empty_state_spec.js10
-rw-r--r--spec/frontend/ci/runner/components/runner_list_empty_state_spec.js17
-rw-r--r--spec/frontend/ci/runner/group_runners/group_runners_app_spec.js6
-rw-r--r--spec/frontend/ci/runner/mock_data.js2
-rw-r--r--spec/frontend/content_editor/components/bubble_menus/bubble_menu_spec.js2
-rw-r--r--spec/helpers/ci/runners_helper_spec.rb8
-rw-r--r--spec/initializers/circuitbox_spec.rb15
-rw-r--r--spec/lib/gitlab/ci/parsers/security/validators/schema_validator_spec.rb176
-rw-r--r--spec/lib/sidebars/admin/panel_spec.rb18
-rw-r--r--spec/services/quick_actions/interpret_service_spec.rb44
-rw-r--r--spec/views/layouts/devise.html.haml_spec.rb10
-rw-r--r--spec/views/layouts/minimal.html.haml_spec.rb13
-rw-r--r--yarn.lock8
152 files changed, 560 insertions, 69497 deletions
diff --git a/.gitlab/ci/rails/rspec-foss-impact.gitlab-ci.yml.erb b/.gitlab/ci/rails/rspec-foss-impact.gitlab-ci.yml.erb
index e7a1ee6022f..84aa67de4c9 100644
--- a/.gitlab/ci/rails/rspec-foss-impact.gitlab-ci.yml.erb
+++ b/.gitlab/ci/rails/rspec-foss-impact.gitlab-ci.yml.erb
@@ -39,7 +39,7 @@ dont-interrupt-me:
RSPEC_TESTS_MAPPING_ENABLED: "true"
script:
- !reference [.base-script, script]
- - rspec_paralellized_job "--tag ~quarantine --tag ~level:migration --tag ~zoekt"
+ - rspec_paralellized_job "--tag ~quarantine --tag ~level:background_migration --tag ~zoekt"
artifacts:
expire_in: 7d
paths:
diff --git a/.rubocop_todo/style/redundant_begin.yml b/.rubocop_todo/style/redundant_begin.yml
deleted file mode 100644
index 8f490002fd6..00000000000
--- a/.rubocop_todo/style/redundant_begin.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-# Cop supports --autocorrect.
-Style/RedundantBegin:
- Exclude:
- - 'app/controllers/concerns/metrics_dashboard.rb'
- - 'ee/lib/gem_extensions/elasticsearch/model/adapter/multiple/records.rb'
diff --git a/Gemfile b/Gemfile
index 5c9ddb710b4..9df24ba2877 100644
--- a/Gemfile
+++ b/Gemfile
@@ -285,7 +285,7 @@ gem 'kubeclient', '~> 4.11.0'
# AI
gem 'ruby-openai', '~> 3.7'
-gem 'circuitbox', '2.0.0.pre5'
+gem 'circuitbox', '2.0.0'
# Sanitize user input
gem 'sanitize', '~> 6.0'
diff --git a/Gemfile.checksum b/Gemfile.checksum
index 944e57d417e..1a719b5533c 100644
--- a/Gemfile.checksum
+++ b/Gemfile.checksum
@@ -77,7 +77,7 @@
{"name":"chef-config","version":"16.10.17","platform":"ruby","checksum":"1f4961e4d6aa4df374f739c6f62ae1d2be03dcff1bd93e56d9c963b8a156747c"},
{"name":"chef-utils","version":"16.10.17","platform":"ruby","checksum":"a74253da6aab8ff92c955549536bdecbc4d1ce8032c8201576f2a8ef4e8ed7b3"},
{"name":"chunky_png","version":"1.3.5","platform":"ruby","checksum":"b6ab1011b2e79bcc973c92deee4110d071d5cd59ed950efcd0aba49a5f57c06d"},
-{"name":"circuitbox","version":"2.0.0.pre5","platform":"ruby","checksum":"033d4820a9b688f0539630b81ae0d707ce8e6ccd34756de31a79063b190ffffc"},
+{"name":"circuitbox","version":"2.0.0","platform":"ruby","checksum":"496e9c1e76496e1e141490085f6cdcc4a8dedc72da8361bef69d8c5423b4da14"},
{"name":"citrus","version":"3.0.2","platform":"ruby","checksum":"4ec2412fc389ad186735f4baee1460f7900a8e130ffe3f216b30d4f9c684f650"},
{"name":"claide","version":"1.1.0","platform":"ruby","checksum":"6d3c5c089dde904d96aa30e73306d0d4bd444b1accb9b3125ce14a3c0183f82e"},
{"name":"claide-plugins","version":"0.9.2","platform":"ruby","checksum":"c7ea78bc067ab23bce8515497cdcdcb8f01c86dadfbe13c44644e382922c1c2e"},
diff --git a/Gemfile.lock b/Gemfile.lock
index 86cf856547c..bfe63db9cba 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -296,7 +296,7 @@ GEM
tomlrb (~> 1.2)
chef-utils (16.10.17)
chunky_png (1.3.5)
- circuitbox (2.0.0.pre5)
+ circuitbox (2.0.0)
citrus (3.0.2)
claide (1.1.0)
claide-plugins (0.9.2)
@@ -1692,7 +1692,7 @@ DEPENDENCIES
capybara-screenshot (~> 1.0.26)
carrierwave (~> 1.3)
charlock_holmes (~> 0.7.7)
- circuitbox (= 2.0.0.pre5)
+ circuitbox (= 2.0.0)
cloud_profiler_agent (~> 0.0.0)!
commonmarker (~> 0.23.6)
concurrent-ruby (~> 1.1)
diff --git a/app/assets/javascripts/boards/components/board_content.vue b/app/assets/javascripts/boards/components/board_content.vue
index ed87a86e5b6..8304dfef527 100644
--- a/app/assets/javascripts/boards/components/board_content.vue
+++ b/app/assets/javascripts/boards/components/board_content.vue
@@ -1,10 +1,8 @@
<script>
import { GlAlert } from '@gitlab/ui';
-import { breakpoints } from '@gitlab/ui/dist/utils';
-import { sortBy, throttle } from 'lodash';
+import { sortBy } from 'lodash';
import Draggable from 'vuedraggable';
import { mapState, mapActions } from 'vuex';
-import { contentTop } from '~/lib/utils/common_utils';
import eventHub from '~/boards/eventhub';
import BoardAddNewColumn from 'ee_else_ce/boards/components/board_add_new_column.vue';
import { defaultSortableOptions } from '~/sortable/constants';
@@ -94,32 +92,12 @@ export default {
beforeDestroy() {
eventHub.$off('updateBoard', this.refetchLists);
},
- mounted() {
- this.setBoardHeight();
-
- this.resizeObserver = new ResizeObserver(
- throttle(() => {
- this.setBoardHeight();
- }, 150),
- );
- this.resizeObserver.observe(document.body);
- },
- unmounted() {
- this.resizeObserver.disconnect();
- },
methods: {
...mapActions(['moveList', 'unsetError']),
afterFormEnters() {
const el = this.canDragColumns ? this.$refs.list.$el : this.$refs.list;
el.scrollTo({ left: el.scrollWidth, behavior: 'smooth' });
},
- setBoardHeight() {
- if (window.innerWidth < breakpoints.md) {
- this.boardHeight = `${window.innerHeight - contentTop()}px`;
- } else {
- this.boardHeight = `${window.innerHeight - this.$el.getBoundingClientRect().top}px`;
- }
- },
refetchLists() {
this.$apollo.queries.boardListsApollo.refetch();
},
@@ -128,7 +106,11 @@ export default {
</script>
<template>
- <div v-cloak data-qa-selector="boards_list">
+ <div
+ v-cloak
+ data-qa-selector="boards_list"
+ class="gl-flex-grow-1 gl-display-flex gl-flex-direction-column gl-min-h-0"
+ >
<gl-alert v-if="errorToDisplay" variant="danger" :dismissible="true" @dismiss="unsetError">
{{ errorToDisplay }}
</gl-alert>
@@ -137,8 +119,7 @@ export default {
v-if="!isSwimlanesOn"
ref="list"
v-bind="draggableOptions"
- class="boards-list gl-w-full gl-py-5 gl-pr-3 gl-white-space-nowrap gl-overflow-x-scroll"
- :style="{ height: boardHeight }"
+ class="boards-list gl-w-full gl-py-5 gl-pr-3 gl-white-space-nowrap gl-overflow-x-auto"
@end="moveList"
>
<board-column
@@ -165,7 +146,6 @@ export default {
:lists="boardListsToUse"
:can-admin-list="canAdminList"
:filters="filterParams"
- :style="{ height: boardHeight }"
@setActiveList="$emit('setActiveList', $event)"
/>
diff --git a/app/assets/javascripts/ci/runner/admin_runner_show/index.js b/app/assets/javascripts/ci/runner/admin_runner_show/index.js
index f34cd5508ce..cbd25819303 100644
--- a/app/assets/javascripts/ci/runner/admin_runner_show/index.js
+++ b/app/assets/javascripts/ci/runner/admin_runner_show/index.js
@@ -17,7 +17,7 @@ export const initAdminRunnerShow = (selector = '#js-admin-runner-show') => {
return null;
}
- const { runnerId, runnersPath, emptyStateImage } = el.dataset;
+ const { runnerId, runnersPath } = el.dataset;
const apolloProvider = new VueApollo({
defaultClient: createDefaultClient(),
@@ -26,9 +26,6 @@ export const initAdminRunnerShow = (selector = '#js-admin-runner-show') => {
return new Vue({
el,
apolloProvider,
- provide: {
- emptyStateImage,
- },
render(h) {
return h(AdminRunnerShowApp, {
props: {
diff --git a/app/assets/javascripts/ci/runner/admin_runners/admin_runners_app.vue b/app/assets/javascripts/ci/runner/admin_runners/admin_runners_app.vue
index 24225acfd08..4d88feebe53 100644
--- a/app/assets/javascripts/ci/runner/admin_runners/admin_runners_app.vue
+++ b/app/assets/javascripts/ci/runner/admin_runners/admin_runners_app.vue
@@ -54,7 +54,6 @@ export default {
RunnerJobStatusBadge,
},
mixins: [glFeatureFlagMixin()],
- inject: ['emptyStateSvgPath', 'emptyStateFilteredSvgPath'],
props: {
newRunnerPath: {
type: String,
@@ -220,8 +219,6 @@ export default {
:registration-token="registrationToken"
:is-search-filtered="isSearchFiltered"
:new-runner-path="newRunnerPath"
- :svg-path="emptyStateSvgPath"
- :filtered-svg-path="emptyStateFilteredSvgPath"
/>
<template v-else>
<runner-list
diff --git a/app/assets/javascripts/ci/runner/admin_runners/index.js b/app/assets/javascripts/ci/runner/admin_runners/index.js
index 881dc3613e9..54eb37f8c90 100644
--- a/app/assets/javascripts/ci/runner/admin_runners/index.js
+++ b/app/assets/javascripts/ci/runner/admin_runners/index.js
@@ -35,8 +35,6 @@ export const initAdminRunners = (selector = '#js-admin-runners') => {
registrationToken,
onlineContactTimeoutSecs,
staleTimeoutSecs,
- emptyStateSvgPath,
- emptyStateFilteredSvgPath,
} = el.dataset;
const { cacheConfig, typeDefs, localMutations } = createLocalState();
@@ -53,8 +51,6 @@ export const initAdminRunners = (selector = '#js-admin-runners') => {
localMutations,
onlineContactTimeoutSecs,
staleTimeoutSecs,
- emptyStateSvgPath,
- emptyStateFilteredSvgPath,
},
render(h) {
return h(AdminRunnersApp, {
diff --git a/app/assets/javascripts/ci/runner/components/runner_jobs_empty_state.vue b/app/assets/javascripts/ci/runner/components/runner_jobs_empty_state.vue
index 68fb38c1a29..c30a824120d 100644
--- a/app/assets/javascripts/ci/runner/components/runner_jobs_empty_state.vue
+++ b/app/assets/javascripts/ci/runner/components/runner_jobs_empty_state.vue
@@ -1,4 +1,6 @@
<script>
+import EMPTY_STATE_SVG_URL from '@gitlab/svgs/dist/illustrations/pipelines_empty.svg?url';
+
import { GlEmptyState } from '@gitlab/ui';
import { s__ } from '~/locale';
@@ -12,12 +14,12 @@ export default {
components: {
GlEmptyState,
},
- inject: ['emptyStateImage'],
+ EMPTY_STATE_SVG_URL,
};
</script>
<template>
- <gl-empty-state :svg-path="emptyStateImage" :title="$options.i18n.title">
+ <gl-empty-state :svg-path="$options.EMPTY_STATE_SVG_URL" :title="$options.i18n.title">
<template #description>
<p>{{ $options.i18n.description }}</p>
</template>
diff --git a/app/assets/javascripts/ci/runner/components/runner_list_empty_state.vue b/app/assets/javascripts/ci/runner/components/runner_list_empty_state.vue
index 087ddafb137..8606c22db34 100644
--- a/app/assets/javascripts/ci/runner/components/runner_list_empty_state.vue
+++ b/app/assets/javascripts/ci/runner/components/runner_list_empty_state.vue
@@ -1,4 +1,7 @@
<script>
+import EMPTY_STATE_SVG_URL from '@gitlab/svgs/dist/illustrations/pipelines_empty.svg?url';
+import FILTERED_SVG_URL from '@gitlab/svgs/dist/illustrations/magnifying-glass.svg?url';
+
import { GlEmptyState, GlLink, GlSprintf, GlModalDirective } from '@gitlab/ui';
import glFeatureFlagMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
import RunnerInstructionsModal from '~/vue_shared/components/runner_instructions/runner_instructions_modal.vue';
@@ -20,16 +23,6 @@ export default {
required: false,
default: false,
},
- svgPath: {
- type: String,
- required: false,
- default: '',
- },
- filteredSvgPath: {
- type: String,
- required: false,
- default: '',
- },
registrationToken: {
type: String,
required: false,
@@ -53,6 +46,8 @@ export default {
},
modalId: 'runners-empty-state-instructions-modal',
svgHeight: 145,
+ EMPTY_STATE_SVG_URL,
+ FILTERED_SVG_URL,
};
</script>
@@ -60,14 +55,14 @@ export default {
<gl-empty-state
v-if="isSearchFiltered"
:title="s__('Runners|No results found')"
- :svg-path="filteredSvgPath"
+ :svg-path="$options.FILTERED_SVG_URL"
:svg-height="$options.svgHeight"
:description="s__('Runners|Edit your search and try again')"
/>
<gl-empty-state
v-else
:title="s__('Runners|Get started with runners')"
- :svg-path="svgPath"
+ :svg-path="$options.EMPTY_STATE_SVG_URL"
:svg-height="$options.svgHeight"
>
<template v-if="registrationToken" #description>
diff --git a/app/assets/javascripts/ci/runner/group_runners/group_runners_app.vue b/app/assets/javascripts/ci/runner/group_runners/group_runners_app.vue
index a4ca44b8e5a..74523bc335f 100644
--- a/app/assets/javascripts/ci/runner/group_runners/group_runners_app.vue
+++ b/app/assets/javascripts/ci/runner/group_runners/group_runners_app.vue
@@ -57,7 +57,6 @@ export default {
RunnerJobStatusBadge,
},
mixins: [glFeatureFlagMixin()],
- inject: ['emptyStateSvgPath', 'emptyStateFilteredSvgPath'],
props: {
newRunnerPath: {
type: String,
@@ -271,8 +270,6 @@ export default {
:registration-token="registrationToken"
:is-search-filtered="isSearchFiltered"
:new-runner-path="newRunnerPath"
- :svg-path="emptyStateSvgPath"
- :filtered-svg-path="emptyStateFilteredSvgPath"
/>
<template v-else>
<runner-list
diff --git a/app/assets/javascripts/ci/runner/group_runners/index.js b/app/assets/javascripts/ci/runner/group_runners/index.js
index 4fcf484317d..a5e2521ede5 100644
--- a/app/assets/javascripts/ci/runner/group_runners/index.js
+++ b/app/assets/javascripts/ci/runner/group_runners/index.js
@@ -23,8 +23,6 @@ export const initGroupRunners = (selector = '#js-group-runners') => {
groupFullPath,
onlineContactTimeoutSecs,
staleTimeoutSecs,
- emptyStateSvgPath,
- emptyStateFilteredSvgPath,
} = el.dataset;
const { cacheConfig, typeDefs, localMutations } = createLocalState();
@@ -42,8 +40,6 @@ export const initGroupRunners = (selector = '#js-group-runners') => {
groupId,
onlineContactTimeoutSecs: parseInt(onlineContactTimeoutSecs, 10),
staleTimeoutSecs: parseInt(staleTimeoutSecs, 10),
- emptyStateSvgPath,
- emptyStateFilteredSvgPath,
},
render(h) {
return h(GroupRunnersApp, {
diff --git a/app/assets/javascripts/content_editor/components/bubble_menus/bubble_menu.vue b/app/assets/javascripts/content_editor/components/bubble_menus/bubble_menu.vue
index 3891274e35e..7c06417e6b3 100644
--- a/app/assets/javascripts/content_editor/components/bubble_menus/bubble_menu.vue
+++ b/app/assets/javascripts/content_editor/components/bubble_menus/bubble_menu.vue
@@ -43,6 +43,7 @@ export default {
this.$emit('hidden', ...args);
this.menuVisible = false;
},
+ appendTo: () => document.body,
},
}),
);
diff --git a/app/assets/javascripts/content_editor/components/bubble_menus/link_bubble_menu.vue b/app/assets/javascripts/content_editor/components/bubble_menus/link_bubble_menu.vue
index 7c5cc1ea6ee..91009fad3f4 100644
--- a/app/assets/javascripts/content_editor/components/bubble_menus/link_bubble_menu.vue
+++ b/app/assets/javascripts/content_editor/components/bubble_menus/link_bubble_menu.vue
@@ -197,7 +197,6 @@ export default {
},
tippyOptions: {
placement: 'bottom',
- appendTo: () => document.body,
},
};
</script>
diff --git a/app/assets/stylesheets/framework/system_messages.scss b/app/assets/stylesheets/framework/system_messages.scss
index 946a241e6dd..703c2ca0dad 100644
--- a/app/assets/stylesheets/framework/system_messages.scss
+++ b/app/assets/stylesheets/framework/system_messages.scss
@@ -44,11 +44,6 @@
&.devise-layout-html body hr.footer-fixed {
bottom: $system-footer-height;
}
-
- .boards-list,
- .board-swimlanes {
- height: calc(100vh - (#{$header-height} + #{$top-bar-height} + #{$performance-bar-height} + #{$system-footer-height} + #{$gl-padding-32}));
- }
}
.fullscreen-layout {
diff --git a/app/assets/stylesheets/framework/variables.scss b/app/assets/stylesheets/framework/variables.scss
index 82da6e959d0..4052227b927 100644
--- a/app/assets/stylesheets/framework/variables.scss
+++ b/app/assets/stylesheets/framework/variables.scss
@@ -688,7 +688,6 @@ $ci-skipped-color: #888;
*/
$issue-boards-font-size: 14px;
$issue-boards-card-shadow: rgba(0, 0, 0, 0.1);
-$issue-boards-filter-height: 68px;
/*
The following heights are used in environment_logs.scss and are used for calculation of the log viewer height.
*/
diff --git a/app/assets/stylesheets/page_bundles/boards.scss b/app/assets/stylesheets/page_bundles/boards.scss
index 8e20299a200..32a6af0dc36 100644
--- a/app/assets/stylesheets/page_bundles/boards.scss
+++ b/app/assets/stylesheets/page_bundles/boards.scss
@@ -6,6 +6,10 @@
}
.boards-app {
+ height: calc(#{$calc-application-viewport-height} - var(--header-height, 48px));
+ display: flex;
+ flex-direction: column;
+
@include media-breakpoint-up(sm) {
transition: width $gl-transition-duration-medium;
width: 100%;
@@ -18,9 +22,14 @@
.boards-list,
.board-swimlanes {
- overflow-x: scroll;
- min-height: 200px;
+ flex-grow: 1;
border-left: 8px solid var(--gray-10, $white);
+
+ min-height: calc(#{$calc-application-viewport-height} - var(--header-height));
+
+ @include media-breakpoint-up(sm) {
+ min-height: 0;
+ }
}
.board {
@@ -196,8 +205,8 @@
padding-top: 10px;
}
- .boards-list {
- height: calc(100vh - #{$issue-boards-filter-height});
+ .boards-app {
+ height: 100vh;
}
// Use !important for these as top and z-index are set on style attribute
diff --git a/app/controllers/concerns/metrics_dashboard.rb b/app/controllers/concerns/metrics_dashboard.rb
index 338c3af235b..7e202235cfa 100644
--- a/app/controllers/concerns/metrics_dashboard.rb
+++ b/app/controllers/concerns/metrics_dashboard.rb
@@ -79,7 +79,7 @@ module MetricsDashboard
end
def starred_dashboards
- @starred_dashboards ||= begin
+ @starred_dashboards ||=
if project_for_dashboard.present?
::Metrics::UsersStarredDashboardsFinder
.new(user: current_user, project: project_for_dashboard)
@@ -89,7 +89,6 @@ module MetricsDashboard
else
Set.new
end
- end
end
# Project is not defined for group and admin level clusters.
diff --git a/app/helpers/ci/runners_helper.rb b/app/helpers/ci/runners_helper.rb
index 14ca189f795..7177ddd3f31 100644
--- a/app/helpers/ci/runners_helper.rb
+++ b/app/helpers/ci/runners_helper.rb
@@ -70,9 +70,7 @@ module Ci
new_runner_path: new_admin_runner_path,
registration_token: Gitlab::CurrentSettings.runners_registration_token,
online_contact_timeout_secs: ::Ci::Runner::ONLINE_CONTACT_TIMEOUT.to_i,
- stale_timeout_secs: ::Ci::Runner::STALE_TIMEOUT.to_i,
- empty_state_svg_path: image_path('illustrations/pipelines_empty.svg'),
- empty_state_filtered_svg_path: image_path('illustrations/magnifying-glass.svg')
+ stale_timeout_secs: ::Ci::Runner::STALE_TIMEOUT.to_i
}
end
@@ -95,9 +93,7 @@ module Ci
group_full_path: group.full_path,
runner_install_help_page: 'https://docs.gitlab.com/runner/install/',
online_contact_timeout_secs: ::Ci::Runner::ONLINE_CONTACT_TIMEOUT.to_i,
- stale_timeout_secs: ::Ci::Runner::STALE_TIMEOUT.to_i,
- empty_state_svg_path: image_path('illustrations/pipelines_empty.svg'),
- empty_state_filtered_svg_path: image_path('illustrations/magnifying-glass.svg')
+ stale_timeout_secs: ::Ci::Runner::STALE_TIMEOUT.to_i
}
end
diff --git a/app/views/admin/runners/show.html.haml b/app/views/admin/runners/show.html.haml
index f65b2f4915c..3942c427cc4 100644
--- a/app/views/admin/runners/show.html.haml
+++ b/app/views/admin/runners/show.html.haml
@@ -6,4 +6,4 @@
- page_title runner_name
- add_to_breadcrumbs _('Runners'), admin_runners_path
-#js-admin-runner-show{ data: {runner_id: @runner.id, runners_path: admin_runners_path, empty_state_image: image_path('illustrations/pipelines_empty.svg')} }
+#js-admin-runner-show{ data: {runner_id: @runner.id, runners_path: admin_runners_path} }
diff --git a/app/views/layouts/devise.html.haml b/app/views/layouts/devise.html.haml
index 36a9a284e91..bed3995cb35 100644
--- a/app/views/layouts/devise.html.haml
+++ b/app/views/layouts/devise.html.haml
@@ -7,8 +7,6 @@
= render "layouts/init_client_detection_flags"
- if Feature.enabled?(:restyle_login_page, @project)
.page-wrap.borderless
- .login-page-broadcast
- = render "layouts/broadcast"
.container.navless-container
.content
= render "layouts/flash"
@@ -29,8 +27,6 @@
- else
.page-wrap
= render "layouts/header/empty"
- .login-page-broadcast
- = render "layouts/broadcast"
.container.navless-container
.content
= render "layouts/flash"
diff --git a/app/views/layouts/minimal.html.haml b/app/views/layouts/minimal.html.haml
index e8da388da32..5531c0ab23a 100644
--- a/app/views/layouts/minimal.html.haml
+++ b/app/views/layouts/minimal.html.haml
@@ -10,8 +10,6 @@
= render "layouts/header/empty"
.layout-page
.content-wrapper.gl-pt-6{ class: 'gl-md-pt-11!' }
- .alert-wrapper.gl-force-block-formatting-context
- = render "layouts/broadcast"
%div{ class: container_class }
%main#content-body.content
= render "layouts/flash" unless @hide_flash
diff --git a/config/application.rb b/config/application.rb
index 9d8d285b6bc..e7bea556960 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -320,6 +320,7 @@ module Gitlab
config.assets.precompile << "page_bundles/prometheus.css"
config.assets.precompile << "page_bundles/promotions.css"
config.assets.precompile << "page_bundles/releases.css"
+ config.assets.precompile << "page_bundles/remote_development.css"
config.assets.precompile << "page_bundles/reports.css"
config.assets.precompile << "page_bundles/roadmap.css"
config.assets.precompile << "page_bundles/requirements.css"
diff --git a/config/circuitbox.rb b/config/circuitbox.rb
deleted file mode 100644
index edce0aefdb8..00000000000
--- a/config/circuitbox.rb
+++ /dev/null
@@ -1,6 +0,0 @@
-# frozen_string_literal: true
-
-Circuitbox.configure do |config|
- config.default_circuit_store = Circuitbox::MemoryStore.new
- config.default_notifier = GitLab::CircuitBreaker::Notifier.new
-end
diff --git a/config/feature_flags/development/draft_quick_action_non_toggle.yml b/config/feature_flags/development/draft_quick_action_non_toggle.yml
deleted file mode 100644
index 4d28b61f3bf..00000000000
--- a/config/feature_flags/development/draft_quick_action_non_toggle.yml
+++ /dev/null
@@ -1,8 +0,0 @@
----
-name: draft_quick_action_non_toggle
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/92654
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/368610
-milestone: '15.4'
-type: development
-group: group::code review
-default_enabled: false
diff --git a/config/initializers/circuitbox.rb b/config/initializers/circuitbox.rb
new file mode 100644
index 00000000000..966320265aa
--- /dev/null
+++ b/config/initializers/circuitbox.rb
@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+Gitlab.ee do
+ Circuitbox.configure do |config|
+ config.default_circuit_store = Gitlab::CircuitBreaker::Store.new
+ config.default_notifier = Gitlab::CircuitBreaker::Notifier.new
+ end
+end
diff --git a/config/metrics/counts_28d/20210216184559_ci_templates_total_unique_counts_monthly.yml b/config/metrics/counts_28d/20210216184559_ci_templates_total_unique_counts_monthly.yml
index cb112a9e078..aa50145225e 100755
--- a/config/metrics/counts_28d/20210216184559_ci_templates_total_unique_counts_monthly.yml
+++ b/config/metrics/counts_28d/20210216184559_ci_templates_total_unique_counts_monthly.yml
@@ -57,6 +57,7 @@ options:
- p_ci_templates_security_api_fuzzing
- p_ci_templates_security_dast
- p_ci_templates_security_api_discovery
+ - p_ci_templates_security_bas_latest
- p_ci_templates_ios_fastlane
- p_ci_templates_composer
- p_ci_templates_c
diff --git a/config/metrics/counts_28d/20230509140528_p_ci_templates_security_bas_latest_monthly.yml b/config/metrics/counts_28d/20230509140528_p_ci_templates_security_bas_latest_monthly.yml
new file mode 100644
index 00000000000..b1ebcac1427
--- /dev/null
+++ b/config/metrics/counts_28d/20230509140528_p_ci_templates_security_bas_latest_monthly.yml
@@ -0,0 +1,24 @@
+---
+key_path: redis_hll_counters.ci_templates.p_ci_templates_security_bas_latest_monthly
+description: Count of pipelines using the latest Breach and Attack Simulation template
+product_section: sec
+product_stage: secure
+product_group: dynamic_analysis
+value_type: number
+status: active
+milestone: "16.0"
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/119981
+time_frame: 28d
+data_source: redis_hll
+data_category: optional
+instrumentation_class: RedisHLLMetric
+distribution:
+- ce
+- ee
+tier:
+- free
+- premium
+- ultimate
+options:
+ events:
+ - p_ci_templates_security_bas_latest
diff --git a/config/metrics/counts_7d/20210216184557_ci_templates_total_unique_counts_weekly.yml b/config/metrics/counts_7d/20210216184557_ci_templates_total_unique_counts_weekly.yml
index f8c07beae1d..64ef9858a64 100755
--- a/config/metrics/counts_7d/20210216184557_ci_templates_total_unique_counts_weekly.yml
+++ b/config/metrics/counts_7d/20210216184557_ci_templates_total_unique_counts_weekly.yml
@@ -57,6 +57,7 @@ options:
- p_ci_templates_security_api_fuzzing
- p_ci_templates_security_dast
- p_ci_templates_security_api_discovery
+ - p_ci_templates_security_bas_latest
- p_ci_templates_ios_fastlane
- p_ci_templates_composer
- p_ci_templates_c
diff --git a/config/metrics/counts_7d/20230509140526_p_ci_templates_security_bas_latest_weekly.yml b/config/metrics/counts_7d/20230509140526_p_ci_templates_security_bas_latest_weekly.yml
new file mode 100644
index 00000000000..fe44c289e94
--- /dev/null
+++ b/config/metrics/counts_7d/20230509140526_p_ci_templates_security_bas_latest_weekly.yml
@@ -0,0 +1,24 @@
+---
+key_path: redis_hll_counters.ci_templates.p_ci_templates_security_bas_latest_weekly
+description: Count of pipelines using the latest Breach and Attack Simulation template
+product_section: sec
+product_stage: secure
+product_group: dynamic_analysis
+value_type: number
+status: active
+milestone: "16.0"
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/119981
+time_frame: 7d
+data_source: redis_hll
+data_category: optional
+instrumentation_class: RedisHLLMetric
+distribution:
+- ce
+- ee
+tier:
+- free
+- premium
+- ultimate
+options:
+ events:
+ - p_ci_templates_security_bas_latest
diff --git a/doc/administration/raketasks/github_import.md b/doc/administration/raketasks/github_import.md
index 5e96813103f..3c64e1fef8e 100644
--- a/doc/administration/raketasks/github_import.md
+++ b/doc/administration/raketasks/github_import.md
@@ -6,7 +6,8 @@ info: To determine the technical writer assigned to the Stage/Group associated w
# GitHub import Rake task **(FREE SELF)**
-> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/390690) in GitLab 15.9, Rake task no longer automatically creates namespaces or groups that don't exist.
+> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/390690) in GitLab 15.9, Rake task no longer automatically creates namespaces or groups that don't exist.
+> - Requirement for Maintainer role instead of Developer role introduced in GitLab 16.0 and backported to GitLab 15.11.1 and GitLab 15.10.5.
To retrieve and import GitHub repositories, you need a [GitHub personal access token](https://github.com/settings/tokens).
A username should be passed as the second argument to the Rake task,
diff --git a/doc/api/import.md b/doc/api/import.md
index 356977a1b9e..e762de4a0fa 100644
--- a/doc/api/import.md
+++ b/doc/api/import.md
@@ -8,22 +8,20 @@ info: To determine the technical writer assigned to the Stage/Group associated w
Use the Import API to import repositories from GitHub or Bitbucket Server.
-## Prerequisites
-
-For information on prerequisites for using the Import API, see:
-
-- [Prerequisites for GitHub importer](../user/project/import/github.md#prerequisites).
-- [Prerequisites for Bitbucket Server importer](../user/project/import/bitbucket_server.md#import-your-bitbucket-repositories).
-
## Import repository from GitHub
-> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/381902) in GitLab 15.8, GitLab no longer automatically creates namespaces or groups if the namespace or group name specified in `target_namespace` doesn't exist. GitLab also no longer falls back to using the user's personal namespace if the namespace or group name is taken or `target_namespace` is blank.
+> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/381902) in GitLab 15.8, GitLab no longer automatically creates namespaces or groups if the namespace or group name specified in `target_namespace` doesn't exist. GitLab also no longer falls back to using the user's personal namespace if the namespace or group name is taken or `target_namespace` is blank.
+> - Requirement for Maintainer role instead of Developer role introduced in GitLab 16.0 and backported to GitLab 15.11.1 and GitLab 15.10.5.
Import your projects from GitHub to GitLab using the API.
-The namespace set in `target_namespace` must exist. The namespace can be your user namespace or an existing group that
-you have at least the Maintainer role for. Using the Developer role for this purpose was
-[deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/387891) in GitLab 15.8 and will be removed in GitLab 16.0.
+Prerequisites:
+
+- [Prerequisites for GitHub importer](../user/project/import/github.md#prerequisites).
+- The namespace set in `target_namespace` must exist.
+- The namespace can be your user namespace or an existing group that you have at least the Maintainer role for. Using
+ the Developer role for this purpose was [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/387891) in GitLab
+ 15.8 and will be removed in GitLab 16.0.
```plaintext
POST /import/github
@@ -169,13 +167,16 @@ Returns the following status codes:
## Import repository from Bitbucket Server
-Import your projects from Bitbucket Server to GitLab via the API.
+Import your projects from Bitbucket Server to GitLab using the API.
-NOTE:
The Bitbucket Project Key is only used for finding the repository in Bitbucket.
You must specify a `target_namespace` if you want to import the repository to a GitLab group.
If you do not specify `target_namespace`, the project imports to your personal user namespace.
+Prerequisites:
+
+- For more information, see [prerequisites for Bitbucket Server importer](../user/project/import/bitbucket_server.md#import-your-bitbucket-repositories).
+
```plaintext
POST /import/bitbucket_server
```
diff --git a/doc/api/project_import_export.md b/doc/api/project_import_export.md
index 98f154c17d7..15f2e878570 100644
--- a/doc/api/project_import_export.md
+++ b/doc/api/project_import_export.md
@@ -138,6 +138,8 @@ ls *export.tar.gz
## Import a file
+> Requirement for Maintainer role instead of Developer role introduced in GitLab 16.0 and backported to GitLab 15.11.1 and GitLab 15.10.5.
+
```plaintext
POST /projects/import
```
diff --git a/doc/development/feature_flags/index.md b/doc/development/feature_flags/index.md
index 40a5d2a2abc..87d2da016d6 100644
--- a/doc/development/feature_flags/index.md
+++ b/doc/development/feature_flags/index.md
@@ -505,9 +505,12 @@ Feature.remove(:feature_flag_name)
## Changelog
+We want to avoid introducing a changelog when features are not accessible by an end-user either directly (example: ability to use the feature) or indirectly (examples: ability to take advantage of background jobs, performance improvements, or database migration updates).
+
+- Database migrations are always accessible by an end-user indirectly, as self-managed customers need to be aware of database changes before upgrading. For this reason, they **should** have a changelog entry.
- Any change behind a feature flag **disabled** by default **should not** have a changelog entry.
- - **Exception:** database migrations **should** have a changelog entry.
-- Any change related to a feature flag itself (flag removal, default-on setting) **should** have [a changelog entry](../changelog.md).
+- Any change behind a feature flag that is **enabled** by default **should** have a changelog entry.
+- Changing the feature flag itself (flag removal, default-on setting) **should** have [a changelog entry](../changelog.md).
Use the flowchart to determine the changelog entry type.
```mermaid
@@ -519,7 +522,6 @@ Feature.remove(:feature_flag_name)
A -->|no changelog| D
```
-- Any change behind a feature flag that is **enabled** by default **should** have a changelog entry.
- The changelog for a feature flag should describe the feature and not the
flag, unless a default on feature flag is removed keeping the new code (`other` in the flowchart above).
- A feature flag can also be used for rolling out a bug fix or a maintenance work. In this scenario, the changelog
diff --git a/doc/integration/cas.md b/doc/integration/cas.md
index bfeabde8a36..d2a29161a53 100644
--- a/doc/integration/cas.md
+++ b/doc/integration/cas.md
@@ -8,76 +8,6 @@ redirect_to: '../administration/auth/index.md'
# CAS OmniAuth provider (removed) **(FREE SELF)**
-WARNING:
-This feature was
-[deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/369127) in GitLab
-15.3 and [removed](https://gitlab.com/gitlab-org/gitlab/-/issues/369128) in 16.0.
-
-To enable the CAS OmniAuth provider you must register your application with your
-CAS instance. This requires the service URL GitLab supplies to CAS. It should be
-something like: `https://gitlab.example.com:443/users/auth/cas3/callback?url`.
-Handling for Single Logout (SLO) is enabled by default, so you only have to
-configure CAS for back-channel logout.
-
-1. On your GitLab server, open the configuration file.
-
- For Omnibus package:
-
- ```shell
- sudo editor /etc/gitlab/gitlab.rb
- ```
-
- For installations from source:
-
- ```shell
- cd /home/git/gitlab
-
- sudo -u git -H editor config/gitlab.yml
- ```
-
-1. Configure the [common settings](omniauth.md#configure-common-settings)
- to add `cas3` as a single sign-on provider. This enables Just-In-Time
- account provisioning for users who do not have an existing GitLab account.
-
-1. Add the provider configuration:
-
- For Omnibus package:
-
- ```ruby
- gitlab_rails['omniauth_providers'] = [
- {
- name: "cas3",
- label: "Provider name", # optional label for login button, defaults to "Cas3"
- args: {
- url: "CAS_SERVER",
- login_url: "/CAS_PATH/login",
- service_validate_url: "/CAS_PATH/p3/serviceValidate",
- logout_url: "/CAS_PATH/logout"
- }
- }
- ]
- ```
-
- For installations from source:
-
- ```yaml
- - { name: 'cas3',
- label: 'Provider name', # optional label for login button, defaults to "Cas3"
- args: {
- url: 'CAS_SERVER',
- login_url: '/CAS_PATH/login',
- service_validate_url: '/CAS_PATH/p3/serviceValidate',
- logout_url: '/CAS_PATH/logout' } }
- ```
-
-1. Change 'CAS_PATH' to the root of your CAS instance (such as `cas`).
-
-1. If your CAS instance does not use default TGC lifetimes, update the `cas3.session_duration` to at least the current TGC maximum lifetime. To explicitly disable SLO, regardless of CAS settings, set this to 0.
-
-1. Save the configuration file.
-
-1. For the changes to take effect:
- - If you installed via Omnibus, [reconfigure GitLab](../administration/restart_gitlab.md#omnibus-gitlab-reconfigure).
- - If you installed from source, [restart GitLab](../administration/restart_gitlab.md#installations-from-source).
-
-On the sign in page there should now be a CAS tab in the sign in form.
+This feature was [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/369127)
+in GitLab 15.3 and [removed](https://gitlab.com/gitlab-org/gitlab/-/issues/369128)
+in 16.0.
diff --git a/doc/update/index.md b/doc/update/index.md
index 9990a2e8ffe..74aec1bdf1e 100644
--- a/doc/update/index.md
+++ b/doc/update/index.md
@@ -270,12 +270,24 @@ and [Helm Chart deployments](https://docs.gitlab.com/charts/). They come with ap
every Sidekiq process also listens to those queues to ensure all jobs are processed across
all queues. This behavior does not apply if you have configured the [routing rules](../administration/sidekiq/processing_specific_job_classes.md#routing-rules).
+### 15.11.1
+
+- Many [project importers](../user/project/import/index.md) and [group importers](../user/group/import/index.md) now
+ require the Maintainer role instead of only requiring the Developer role. For more information, see the documentation
+ for any importers you use.
+
### 15.11.0
- Upgrades to GitLab 15.11 directly from GitLab versions 15.5.0 and earlier on self-managed installs will fail due to a missing migration until the fix for [issue 408304](https://gitlab.com/gitlab-org/gitlab/-/issues/408304) is released in an upcoming patch release. Affected users wanting to upgrade to 15.11.x can either:
- Perform an intermediate upgrade to any version between 15.5 and 15.10 before upgrading to 15.11, or
- Target the forthcoming patch release.
+### 15.10.5
+
+- Many [project importers](../user/project/import/index.md) and [group importers](../user/group/import/index.md) now
+ require the Maintainer role instead of only requiring the Developer role. For more information, see the documentation
+ for any importers you use.
+
### 15.10.0
- Gitaly configuration changes significantly in Omnibus GitLab 16.0. You can begin migrating to the new structure in Omnibus GitLab 15.10 while backwards compatibility is
diff --git a/doc/user/admin_area/settings/external_authorization.md b/doc/user/admin_area/settings/external_authorization.md
index ff0d6ae1e87..072873ba7f6 100644
--- a/doc/user/admin_area/settings/external_authorization.md
+++ b/doc/user/admin_area/settings/external_authorization.md
@@ -53,7 +53,8 @@ The external authorization service can be enabled by an administrator:
### Allow external authorization with deploy tokens and deploy keys
-> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/386656) in GitLab 15.9.
+> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/386656) in GitLab 15.9.
+> - Deploy tokens no longer being able to access container or package registries [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/387721) in GitLab 16.0.
You can set your instance to allow external authorization for Git operations with
[deploy tokens](../../project/deploy_tokens/index.md) or [deploy keys](../../project/deploy_keys/index.md).
@@ -71,6 +72,9 @@ To allow authorization with deploy tokens and keys:
- Select **Allow deploy tokens and deploy keys to be used with external authorization**.
1. Select **Save changes**.
+WARNING:
+If you enable external authorization, deploy tokens cannot access container or package registries. If you use deploy tokens to access these registries, this measure breaks this use of these tokens. Disable external authorization to use tokens with container or package registries.
+
## How it works
When GitLab requests access, it sends a JSON POST request to the external
diff --git a/doc/user/application_security/breach_and_attack_simulation/index.md b/doc/user/application_security/breach_and_attack_simulation/index.md
index 0d662f7d469..bb67150d4fa 100644
--- a/doc/user/application_security/breach_and_attack_simulation/index.md
+++ b/doc/user/application_security/breach_and_attack_simulation/index.md
@@ -7,10 +7,11 @@ type: reference, howto
# Breach and Attack Simulation **(ULTIMATE)**
-> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/402784) in GitLab 15.11.
+> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/402784) in GitLab 15.11 as an Incubating feature.
+> - [Included](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/119981) in the `Security/BAS.latest.gitlab-ci.yml` in GitLab 16.0.
DISCLAIMER:
-Breach and Attack Simulation is a set of experimental features being developed by the Incubation Engineering Department and is subject to significant changes over time.
+Breach and Attack Simulation is a set of incubating features being developed by the Incubation Engineering Department and is subject to significant changes over time.
Breach and Attack Simulation (BAS) uses additional security testing techniques to assess the risk of detected vulnerabilities and prioritize the remediation of exploitable vulnerabilities.
@@ -25,23 +26,116 @@ You can simulate attacks with [DAST](../dast/index.md) to detect vulnerabilities
By default, DAST active checks match an expected response, or determine by response
time whether a vulnerability was exploited.
-Enable the BAS feature flag in DAST to:
+To enable BAS extended DAST scanning for your application, use the `dast_with_bas` job defined
+in the GitLab BAS CI/CD template file. Updates to the template are provided with GitLab
+upgrades, allowing you to benefit from any improvements and additions.
-- Enable callback, match response, and timing attacks inside of active checks.
-- Perform Out-of-Band Application Security Testing (OAST) through callback attacks in active checks.
+1. Include the appropriate CI/CD template:
-To enable BAS:
+ - [`BAS.latest.gitlab-ci.yml`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Security/BAS.latest.gitlab-ci.yml):
+ Latest version of the BAS template. ([Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/119981)
+ in GitLab 16.0).
-1. Create a CI/CD job using the [DAST browser-based analyzer](../dast/browser_based.md#create-a-dast-cicd-job).
-1. Set the `DAST_FF_ENABLE_BAS` [CI/CD variable](../dast/browser_based.md#available-cicd-variables) to `true`.
+ WARNING:
+ The latest version of the template may include breaking changes. Use the
+ stable template unless you need a feature provided only in the latest template.
+
+ For more information about template versioning, see the [CI/CD documentation](../../../development/cicd/templates.md#latest-version).
+
+1. Choose one of the following options for running BAS extended DAST scans:
+
+ - [Enable a separate BAS extended DAST job](#enable-a-separate-bas-extended-dast-job)
+
+ - You're not using the latest DAST template yet.
+ - Continue using a stable version of the DAST security analyzer image for DAST scans.
+ - Create a duplicate `dast_with_bas` job which extends your existing DAST job configuration.
+
+ - [Extend an existing DAST job](#extend-an-existing-dast-job)
+ - You're already using the latest DAST template rather than the stable template.
+ - Extend your existing DAST job to include the latest DAST security analyzer image tag from the Breach and Attack Simulation SEG.
+
+1. Setup a callback server to [enable callback attacks](#enable-callback-attacks).
+
+### Enable a separate BAS extended DAST job
+
+To maintain a separate DAST job while testing the BAS extended DAST image:
+
+1. Add a `dast` stage to your GitLab CI/CD stages configuration.
+
+ ```yaml
+ stages:
+ - build
+ - test
+ - deploy
+ - dast
+ ```
+
+1. Set the `DAST_WEBSITE` [CI/CD variable](../../../ci/yaml/index.md#variables).
+
+ ```yaml
+ dast_with_bas:
+ variables:
+ DAST_WEBSITE: http://yourapp
+ ```
+
+### Extend an existing DAST job
+
+To enable Breach and Attack Simulation features inside of an existing DAST job:
-```yaml
-include:
- - template: DAST.gitlab-ci.yml
+1. Follow the steps in [Create a DAST CI/CD job](../dast/browser_based.md#create-a-dast-cicd-job).
-dast:
- variables:
- DAST_BROWSER_SCAN: "true"
- DAST_FF_ENABLE_BAS: "true"
- DAST_WEBSITE: "https://my.site.com"
-```
+1. Extend DAST to using the [extends](../../../ci/yaml/yaml_optimization.md#use-extends-to-reuse-configuration-sections) keyword to your DAST job's configuration:
+
+ ```yaml
+ dast:
+ extends: .dast_with_bas
+ ```
+
+1. Disable the `dast+job` job included in the BAS template by setting `DAST_BAS_DISABLED`:
+
+ ```yaml
+ variables:
+ DAST_BAS_DISABLED: "true"
+ ```
+
+### Enable callback attacks
+
+DISCLAIMER:
+This page contains information related to upcoming products, features, and functionality.
+It is important to note that the information presented is for informational purposes only.
+Please do not rely on this information for purchasing or planning purposes.
+As with all projects, the items mentioned on this page are subject to change or delay.
+The development, release, and timing of any products, features, or functionality remain at the
+sole discretion of GitLab Inc.
+
+Perform Out-of-Band Application Security Testing (OAST) for certain [active checks](../dast/checks/index.md#active-checks).
+
+1. Extend the `.dast_with_bas_using_services` job configuration using the [extends](../../../ci/yaml/yaml_optimization.md#use-extends-to-reuse-configuration-sections) keyword:
+
+ ```yaml
+ dast:
+ extends: .dast_with_bas_using_services
+
+ dast_with_bas:
+ extends:
+ # NOTE: extends overwrites rather than merges so dast must be included in this list.
+ - dast
+ - .dast_with_bas_using_services
+ ```
+
+1. Use a [!reference tag](../../../ci/yaml/yaml_optimization.md#reference-tags) to pull in the default `callback` service container in your `services`.
+
+ ```yaml
+ services:
+ # NOTE: services overwrites rather than merges so it must be referenced to merge.
+ - !reference [.dast_with_bas_using_services, services]
+ - name: $CI_REGISTRY_IMAGE
+ alias: yourapp
+ ```
+
+You can also manually enable callback attacks by making sure to:
+
+1. Set the `DAST_FF_ENABLE_BAS` [CI/CD variable](../dast/browser_based.md#available-cicd-variables) to `true`.
+1. Enable both the application being tested and callback service container using [services](../../../ci/services/index.md).
+1. Enable container-to-container networking [making the callback service accessible](../../../ci/services/index.md#connecting-services) in the job.
+1. Set `DAST_BROWSER_CALLBACK` to include `Address:$YOUR_CALLBACK_URL` key/value pair where the callback service is accessible to the Runner/DAST container.
diff --git a/doc/user/application_security/vulnerability_report/img/project_security_dashboard_status_change_v14_2.png b/doc/user/application_security/vulnerability_report/img/project_security_dashboard_status_change_v14_2.png
deleted file mode 100644
index a43340544ca..00000000000
--- a/doc/user/application_security/vulnerability_report/img/project_security_dashboard_status_change_v14_2.png
+++ /dev/null
Binary files differ
diff --git a/doc/user/application_security/vulnerability_report/img/project_security_dashboard_status_change_v16_0.png b/doc/user/application_security/vulnerability_report/img/project_security_dashboard_status_change_v16_0.png
new file mode 100644
index 00000000000..fd9626be2d9
--- /dev/null
+++ b/doc/user/application_security/vulnerability_report/img/project_security_dashboard_status_change_v16_0.png
Binary files differ
diff --git a/doc/user/application_security/vulnerability_report/index.md b/doc/user/application_security/vulnerability_report/index.md
index a4c4737f767..0826258de9e 100644
--- a/doc/user/application_security/vulnerability_report/index.md
+++ b/doc/user/application_security/vulnerability_report/index.md
@@ -161,7 +161,8 @@ If Jira issue support is enabled, the issue link found in the Activity entry lin
## Change status of vulnerabilities
-> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/292636) in GitLab 13.10, all statuses became selectable.
+> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/292636) in GitLab 13.10, all statuses became selectable.
+> - Providing a comment and dismissal reason [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/408366) in GitLab 16.0.
From the Vulnerability Report you can change the status of one or more vulnerabilities.
@@ -170,9 +171,11 @@ To change the status of vulnerabilities in the table:
1. Select the checkbox beside each vulnerability you want to update the status of. To select all,
select the checkbox in the table header.
1. In the **Set status** dropdown list, select the desired status.
+1. If the **Dismissed** status is chosen, select the desired reason in the **Set dismissal reason** dropdown list.
+1. In the **Add a comment** input, you can provide a comment. For the **Dismissed** status, a comment is required.
1. Select **Change status**.
-![Project Vulnerability Report](img/project_security_dashboard_status_change_v14_2.png)
+![Project Vulnerability Report](img/project_security_dashboard_status_change_v16_0.png)
## Sort vulnerabilities by date detected
diff --git a/doc/user/group/import/index.md b/doc/user/group/import/index.md
index 25467f3a6f8..1ff71d50e2d 100644
--- a/doc/user/group/import/index.md
+++ b/doc/user/group/import/index.md
@@ -91,6 +91,8 @@ make sure to have a similar setup on the destination instance, or to import into
### Prerequisites
+> Requirement for Maintainer role instead of Developer role introduced in GitLab 16.0 and backported to GitLab 15.11.1 and GitLab 15.10.5.
+
To migrate groups by direct transfer:
- The network connection between instances or GitLab.com must support HTTPS.
diff --git a/doc/user/profile/personal_access_tokens.md b/doc/user/profile/personal_access_tokens.md
index 0c733b8de30..68c9a5a4356 100644
--- a/doc/user/profile/personal_access_tokens.md
+++ b/doc/user/profile/personal_access_tokens.md
@@ -100,6 +100,8 @@ To view the last time a token was used:
## Personal access token scopes
+> Personal access tokens no longer being able to access container or package registries [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/387721) in GitLab 16.0.
+
A personal access token can perform actions based on the assigned scopes.
| Scope | Access |
@@ -114,6 +116,9 @@ A personal access token can perform actions based on the assigned scopes.
| `sudo` | Grants permission to perform API actions as any user in the system, when authenticated as an administrator. |
| `admin_mode` | Grants permission to perform API actions as an administrator, when Admin Mode is enabled. ([Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/107875) in GitLab 15.8.) |
+WARNING:
+If you enabled [external authorization](../admin_area/settings/external_authorization.md), personal access tokens cannot access container or package registries. If you use personal access tokens to access these registries, this measure breaks this use of these tokens. Disable external authorization to use personal access tokens with container or package registries.
+
## When personal access tokens expire
Personal access tokens expire on the date you define, at midnight UTC.
diff --git a/doc/user/project/import/bitbucket.md b/doc/user/project/import/bitbucket.md
index 4d84bc92c37..42eb690af64 100644
--- a/doc/user/project/import/bitbucket.md
+++ b/doc/user/project/import/bitbucket.md
@@ -32,6 +32,8 @@ When importing:
## Prerequisites
+> Requirement for Maintainer role instead of Developer role introduced in GitLab 16.0 and backported to GitLab 15.11.1 and GitLab 15.10.5.
+
- [Bitbucket Cloud integration](../../../integration/bitbucket.md) must be enabled. If that integration is not enabled, ask your GitLab administrator
to enable it. The Bitbucket Cloud integration is enabled by default on GitLab.com.
- [Bitbucket Cloud import source](../../admin_area/settings/visibility_and_access_controls.md#configure-allowed-import-sources) must be enabled. If not enabled, ask your
diff --git a/doc/user/project/import/bitbucket_server.md b/doc/user/project/import/bitbucket_server.md
index 22f81365755..451a15de92a 100644
--- a/doc/user/project/import/bitbucket_server.md
+++ b/doc/user/project/import/bitbucket_server.md
@@ -25,14 +25,20 @@ created as private in GitLab as well.
> Ability to re-import projects [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/23905) in GitLab 15.9.
-Prerequisites:
+You can import Bitbucket repositories to GitLab.
+
+### Prerequisites
+
+> Requirement for Maintainer role instead of Developer role introduced in GitLab 16.0 and backported to GitLab 15.11.1 and GitLab 15.10.5.
- [Bitbucket Server import source](../../admin_area/settings/visibility_and_access_controls.md#configure-allowed-import-sources)
-must be enabled. If not enabled, ask your GitLab administrator to enable it. The Bitbucket Server import source is enabled
-by default on GitLab.com.
+ must be enabled. If not enabled, ask your GitLab administrator to enable it. The Bitbucket Server import source is enabled
+ by default on GitLab.com.
- At least the Maintainer role on the destination group to import to. Using the Developer role for this purpose was
[deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/387891) in GitLab 15.8 and will be removed in GitLab 16.0.
+### Import repositories
+
To import your Bitbucket repositories:
1. Sign in to GitLab.
diff --git a/doc/user/project/import/fogbugz.md b/doc/user/project/import/fogbugz.md
index 6e378ccbb44..6f5e8e446d6 100644
--- a/doc/user/project/import/fogbugz.md
+++ b/doc/user/project/import/fogbugz.md
@@ -15,14 +15,18 @@ The importer imports all of your cases and comments with the original
case numbers and timestamps. You can also map FogBugz users to GitLab
users.
-Prerequisite:
+## Prerequisites
+
+> Requirement for Maintainer role instead of Developer role introduced in GitLab 16.0 and backported to GitLab 15.11.1 and GitLab 15.10.5.
- [FogBugz import source](../../admin_area/settings/visibility_and_access_controls.md#configure-allowed-import-sources)
-must be enabled. If not enabled, ask your GitLab administrator to enable it. The FogBugz import source is enabled
-by default on GitLab.com.
+ must be enabled. If not enabled, ask your GitLab administrator to enable it. The FogBugz import source is enabled
+ by default on GitLab.com.
- At least the Maintainer role on the destination group to import to. Using the Developer role for this purpose was
[deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/387891) in GitLab 15.8 and will be removed in GitLab 16.0.
+## Import project from FogBugz
+
To import your project from FogBugz:
1. Sign in to GitLab.
diff --git a/doc/user/project/import/gitea.md b/doc/user/project/import/gitea.md
index 2eb798fab0f..d600c26276a 100644
--- a/doc/user/project/import/gitea.md
+++ b/doc/user/project/import/gitea.md
@@ -8,18 +8,7 @@ info: To determine the technical writer assigned to the Stage/Group associated w
> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/381902) in GitLab 15.8, GitLab no longer automatically creates namespaces or groups that don't exist. GitLab also no longer falls back to using the user's personal namespace if the namespace or group name is taken.
-Import your projects from Gitea to GitLab with minimal effort.
-
-NOTE:
-This requires Gitea `v1.0.0` or later.
-
-Prerequisite:
-
-- [Gitea import source](../../admin_area/settings/visibility_and_access_controls.md#configure-allowed-import-sources)
-must be enabled. If not enabled, ask your GitLab administrator to enable it. The Gitea import source is enabled
-by default on GitLab.com.
-- At least the Maintainer role on the destination group to import to. Using the Developer role for this purpose was
- [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/387891) in GitLab 15.8 and will be removed in GitLab 16.0.
+Import your projects from Gitea to GitLab.
The Gitea importer can import:
@@ -33,13 +22,22 @@ The Gitea importer can import:
When importing, repository public access is retained. If a repository is private in Gitea, it's
created as private in GitLab as well.
-## How it works
-
Because Gitea isn't an OAuth provider, author/assignee can't be mapped to users
in your GitLab instance. This means the project creator (usually the user that
started the import process) is set as the author. A reference, however, is kept
on the issue about the original Gitea author.
+## Prerequisites
+
+> Requirement for Maintainer role instead of Developer role introduced in GitLab 16.0 and backported to GitLab 15.11.1 and GitLab 15.10.5.
+
+- Gitea version 1.0.0 or later.
+- [Gitea import source](../../admin_area/settings/visibility_and_access_controls.md#configure-allowed-import-sources)
+ must be enabled. If not enabled, ask your GitLab administrator to enable it. The Gitea import source is enabled
+ by default on GitLab.com.
+- At least the Maintainer role on the destination group to import to. Using the Developer role for this purpose was
+ [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/387891) in GitLab 15.8 and will be removed in GitLab 16.0.
+
## Import your Gitea repositories
The importer page is visible when you create a new project.
diff --git a/doc/user/project/import/github.md b/doc/user/project/import/github.md
index 4bbb8cee534..ad951994f69 100644
--- a/doc/user/project/import/github.md
+++ b/doc/user/project/import/github.md
@@ -36,6 +36,8 @@ For an overview of the import process, see [Migrating from GitHub to GitLab](htt
## Prerequisites
+> Requirement for Maintainer role instead of Developer role introduced in GitLab 16.0 and backported to GitLab 15.11.1 and GitLab 15.10.5.
+
To import projects from GitHub:
- [GitHub import source](../../admin_area/settings/visibility_and_access_controls.md#configure-allowed-import-sources)
diff --git a/doc/user/project/import/index.md b/doc/user/project/import/index.md
index b71ac240113..1265b8534d0 100644
--- a/doc/user/project/import/index.md
+++ b/doc/user/project/import/index.md
@@ -14,11 +14,6 @@ If you want to bring existing projects to GitLab or copy GitLab projects to a di
- Between a self-managed instance and GitLab.com in both directions.
- In the same GitLab instance.
-Prerequisite:
-
-- At least the Maintainer role on the destination group to import to. Using the Developer role for this purpose was
- [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/387891) in GitLab 15.8 and will be removed in GitLab 16.0.
-
For any type of source and target, you can migrate GitLab projects:
- When [migrating groups by direct transfer](../../group/import/index.md#migrate-groups-by-direct-transfer-recommended),
diff --git a/doc/user/project/import/jira.md b/doc/user/project/import/jira.md
index e9c016c5d2b..ede9eb244c6 100644
--- a/doc/user/project/import/jira.md
+++ b/doc/user/project/import/jira.md
@@ -37,16 +37,10 @@ iterations of the GitLab Jira importer.
## Prerequisites
-### Permissions
-
-To be able to import issues from a Jira project you must have read access on Jira
-issues and at least the Maintainer role in the GitLab project that you wish to import into.
-
-### Jira integration
-
-This feature uses the existing GitLab [Jira integration](../../../integration/jira/index.md).
-
-Make sure you have the integration set up before trying to import Jira issues.
+- To be able to import issues from a Jira project you must have read access on Jira
+ issues and at least the Maintainer role in the GitLab project that you wish to import into.
+- This feature uses the existing GitLab [Jira integration](../../../integration/jira/index.md).
+ Make sure you have the integration set up before trying to import Jira issues.
## Import Jira issues to GitLab
@@ -63,7 +57,7 @@ To import Jira issues to a GitLab project:
![Import issues from Jira button](img/jira/import_issues_from_jira_button_v12_10.png)
- The **Import from Jira** option is only visible if you have the [correct permissions](#permissions).
+ The **Import from Jira** option is only visible if you have the [correct permissions](#prerequisites).
The following form appears.
If you've previously set up the [Jira integration](../../../integration/jira/index.md), you can now see
diff --git a/doc/user/project/import/manifest.md b/doc/user/project/import/manifest.md
index 545fd7810dc..6a8c40ec601 100644
--- a/doc/user/project/import/manifest.md
+++ b/doc/user/project/import/manifest.md
@@ -15,11 +15,13 @@ based on a manifest file like the one used by the
Use the manifest to import a project with many
repositories like the Android Open Source Project (AOSP).
-## Requirements
+## Prerequisites
+
+> Requirement for Maintainer role instead of Developer role introduced in GitLab 16.0 and backported to GitLab 15.11.1 and GitLab 15.10.5.
- [Manifest import source](../../admin_area/settings/visibility_and_access_controls.md#configure-allowed-import-sources)
-must be enabled. If not enabled, ask your GitLab administrator to enable it. The Manifest import source is enabled
-by default on GitLab.com.
+ must be enabled. If not enabled, ask your GitLab administrator to enable it. The Manifest import source is enabled
+ by default on GitLab.com.
- GitLab must use PostgreSQL for its database, because [subgroups](../../group/subgroups/index.md) are needed for the manifest import
to work. Read more about the [database requirements](../../../install/requirements.md#database).
- At least the Maintainer role on the destination group to import to. Using the Developer role for this purpose was
diff --git a/doc/user/project/import/repo_by_url.md b/doc/user/project/import/repo_by_url.md
index 9f6d16cc04a..a4868fed94f 100644
--- a/doc/user/project/import/repo_by_url.md
+++ b/doc/user/project/import/repo_by_url.md
@@ -6,15 +6,19 @@ info: To determine the technical writer assigned to the Stage/Group associated w
# Import project from repository by URL **(FREE)**
-Prerequisite:
+You can import your existing repositories by providing the Git URL.
+
+## Prerequisites
+
+> Requirement for Maintainer role instead of Developer role introduced in GitLab 16.0 and backported to GitLab 15.11.1 and GitLab 15.10.5.
- [Repository by URL import source](../../admin_area/settings/visibility_and_access_controls.md#configure-allowed-import-sources)
-must be enabled. If not enabled, ask your GitLab administrator to enable it. The Repository by URL import source is enabled
-by default on GitLab.com.
+ must be enabled. If not enabled, ask your GitLab administrator to enable it. The Repository by URL import source is enabled
+ by default on GitLab.com.
- At least the Maintainer role on the destination group to import to. Using the Developer role for this purpose was
[deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/387891) in GitLab 15.8 and will be removed in GitLab 16.0.
-You can import your existing repositories by providing the Git URL:
+## Import project by URL
1. In GitLab, on the top bar, select **Main menu > Projects > View all projects**.
1. On the right of the page, select **New project**.
diff --git a/doc/user/project/merge_requests/drafts.md b/doc/user/project/merge_requests/drafts.md
index 839f3d17a43..88e5e4a6283 100644
--- a/doc/user/project/merge_requests/drafts.md
+++ b/doc/user/project/merge_requests/drafts.md
@@ -30,7 +30,7 @@ There are several ways to flag a merge request as a draft:
below the **Title** field.
- **Commenting in an existing merge request**: Add the `/draft`
[quick action](../quick_actions.md#issues-merge-requests-and-epics)
- in a comment. GitLab 15.4 [deprecated](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/92654) the toggle behavior of `/draft`. To mark a merge request as ready, use `/ready`.
+ in a comment. To mark a merge request as ready, use `/ready`.
- **Creating a commit**: Add `draft:`, `Draft:`, `fixup!`, or `Fixup!` to the
beginning of a commit message targeting the merge request's source branch. This
is not a toggle, and adding this text again in a later commit doesn't mark the
diff --git a/doc/user/project/quick_actions.md b/doc/user/project/quick_actions.md
index 777d7119ac6..5324606c1b8 100644
--- a/doc/user/project/quick_actions.md
+++ b/doc/user/project/quick_actions.md
@@ -71,7 +71,7 @@ threads. Some quick actions might not be available to all subscription tiers.
| `/copy_metadata <#issue>` | **{check-circle}** Yes | **{check-circle}** Yes | **{dotted-circle}** No | Copy labels and milestone from another issue in the project.
| `/create_merge_request <branch name>` | **{check-circle}** Yes | **{dotted-circle}** No | **{dotted-circle}** No | Create a new merge request starting from the current issue.
| `/done` | **{check-circle}** Yes | **{check-circle}** Yes | **{check-circle}** Yes | Mark to-do item as done.
-| `/draft` | **{dotted-circle}** No | **{check-circle}** Yes | **{dotted-circle}** No | Set the [draft status](merge_requests/drafts.md). Use for toggling the draft status ([deprecated](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/92654) in GitLab 15.4.) |
+| `/draft` | **{dotted-circle}** No | **{check-circle}** Yes | **{dotted-circle}** No | Set the [draft status](merge_requests/drafts.md). |
| `/due <date>` | **{check-circle}** Yes | **{dotted-circle}** No | **{dotted-circle}** No | Set due date. Examples of valid `<date>` include `in 2 days`, `this Friday` and `December 31st`. See [Chronic](https://gitlab.com/gitlab-org/ruby/gems/gitlab-chronic#examples) for more examples.
| `/duplicate <#issue>` | **{check-circle}** Yes | **{dotted-circle}** No | **{dotted-circle}** No | Close this issue. Mark as a duplicate of, and related to, issue `<#issue>`.
| `/epic <epic>` | **{check-circle}** Yes | **{dotted-circle}** No | **{dotted-circle}** No | Add to epic `<epic>`. The `<epic>` value should be in the format of `&epic`, `group&epic`, or a URL to an epic.
diff --git a/doc/user/project/settings/import_export.md b/doc/user/project/settings/import_export.md
index acafdb2dd7a..baa7470b309 100644
--- a/doc/user/project/settings/import_export.md
+++ b/doc/user/project/settings/import_export.md
@@ -189,11 +189,15 @@ Migrating projects with file exports uses the same export and import mechanisms
> Default maximum import file size [changed](https://gitlab.com/gitlab-org/gitlab/-/issues/251106) from 50 MB to unlimited in GitLab 13.8. Administrators of self-managed instances can [set maximum import file size](#set-maximum-import-file-size). On GitLab.com, the value is [set to 5 GB](../../gitlab_com/index.md#account-and-limit-settings).
+You can import a project and its data.
+
WARNING:
Only import projects from sources you trust. If you import a project from an untrusted source, it
may be possible for an attacker to steal your sensitive data.
-Prerequisites:
+### Prerequisites
+
+> Requirement for Maintainer role instead of Developer role introduced in GitLab 16.0 and backported to GitLab 15.11.1 and GitLab 15.10.5.
- You must have [exported the project and its data](#export-a-project-and-its-data).
- Compare GitLab versions and ensure you are importing to a GitLab version that is the same or later
@@ -202,6 +206,8 @@ Prerequisites:
- At least the Maintainer role on the destination group to migrate to. Using the Developer role for this purpose was
[deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/387891) in GitLab 15.8 and will be removed in GitLab 16.0.
+### Import a project
+
To import a project:
1. When [creating a new project](../index.md#create-a-project),
diff --git a/lib/gitlab/ci/parsers/security/validators/schema_validator.rb b/lib/gitlab/ci/parsers/security/validators/schema_validator.rb
index fee01b8a22a..4d609de10f6 100644
--- a/lib/gitlab/ci/parsers/security/validators/schema_validator.rb
+++ b/lib/gitlab/ci/parsers/security/validators/schema_validator.rb
@@ -7,27 +7,27 @@ module Gitlab
module Validators
class SchemaValidator
SUPPORTED_VERSIONS = {
- cluster_image_scanning: %w[14.0.4 14.0.5 14.0.6 14.1.0 14.1.1 14.1.2 14.1.3 15.0.0 15.0.1 15.0.2 15.0.4 15.0.6],
- container_scanning: %w[14.0.0 14.0.1 14.0.2 14.0.3 14.0.4 14.0.5 14.0.6 14.1.0 14.1.1 14.1.2 14.1.3 15.0.0 15.0.1 15.0.2 15.0.4 15.0.6],
- coverage_fuzzing: %w[14.0.0 14.0.1 14.0.2 14.0.3 14.0.4 14.0.5 14.0.6 14.1.0 14.1.1 14.1.2 14.1.3 15.0.0 15.0.1 15.0.2 15.0.4 15.0.6],
- dast: %w[14.0.0 14.0.1 14.0.2 14.0.3 14.0.4 14.0.5 14.0.6 14.1.0 14.1.1 14.1.2 14.1.3 15.0.0 15.0.1 15.0.2 15.0.4 15.0.6],
- api_fuzzing: %w[14.0.0 14.0.1 14.0.2 14.0.3 14.0.4 14.0.5 14.0.6 14.1.0 14.1.1 14.1.2 14.1.3 15.0.0 15.0.1 15.0.2 15.0.4 15.0.6],
- dependency_scanning: %w[14.0.0 14.0.1 14.0.2 14.0.3 14.0.4 14.0.5 14.0.6 14.1.0 14.1.1 14.1.2 14.1.3 15.0.0 15.0.1 15.0.2 15.0.4 15.0.6],
- sast: %w[14.0.0 14.0.1 14.0.2 14.0.3 14.0.4 14.0.5 14.0.6 14.1.0 14.1.1 14.1.2 14.1.3 15.0.0 15.0.1 15.0.2 15.0.4 15.0.6],
- secret_detection: %w[14.0.0 14.0.1 14.0.2 14.0.3 14.0.4 14.0.5 14.0.6 14.1.0 14.1.1 14.1.2 14.1.3 15.0.0 15.0.1 15.0.2 15.0.4 15.0.6]
+ cluster_image_scanning: %w[15.0.0 15.0.1 15.0.2 15.0.4 15.0.6],
+ container_scanning: %w[15.0.0 15.0.1 15.0.2 15.0.4 15.0.6],
+ coverage_fuzzing: %w[15.0.0 15.0.1 15.0.2 15.0.4 15.0.6],
+ dast: %w[15.0.0 15.0.1 15.0.2 15.0.4 15.0.6],
+ api_fuzzing: %w[15.0.0 15.0.1 15.0.2 15.0.4 15.0.6],
+ dependency_scanning: %w[15.0.0 15.0.1 15.0.2 15.0.4 15.0.6],
+ sast: %w[15.0.0 15.0.1 15.0.2 15.0.4 15.0.6],
+ secret_detection: %w[15.0.0 15.0.1 15.0.2 15.0.4 15.0.6]
}.freeze
- VERSIONS_TO_REMOVE_IN_16_0 = %w[14.0.0 14.0.1 14.0.2 14.0.3 14.0.4 14.0.5 14.0.6 14.1.0 14.1.1 14.1.2 14.1.3].freeze
+ VERSIONS_TO_REMOVE_IN_17_0 = %w[].freeze
DEPRECATED_VERSIONS = {
- cluster_image_scanning: VERSIONS_TO_REMOVE_IN_16_0,
- container_scanning: VERSIONS_TO_REMOVE_IN_16_0,
- coverage_fuzzing: VERSIONS_TO_REMOVE_IN_16_0,
- dast: VERSIONS_TO_REMOVE_IN_16_0,
- api_fuzzing: VERSIONS_TO_REMOVE_IN_16_0,
- dependency_scanning: VERSIONS_TO_REMOVE_IN_16_0,
- sast: VERSIONS_TO_REMOVE_IN_16_0,
- secret_detection: VERSIONS_TO_REMOVE_IN_16_0
+ cluster_image_scanning: VERSIONS_TO_REMOVE_IN_17_0,
+ container_scanning: VERSIONS_TO_REMOVE_IN_17_0,
+ coverage_fuzzing: VERSIONS_TO_REMOVE_IN_17_0,
+ dast: VERSIONS_TO_REMOVE_IN_17_0,
+ api_fuzzing: VERSIONS_TO_REMOVE_IN_17_0,
+ dependency_scanning: VERSIONS_TO_REMOVE_IN_17_0,
+ sast: VERSIONS_TO_REMOVE_IN_17_0,
+ secret_detection: VERSIONS_TO_REMOVE_IN_17_0
}.freeze
CURRENT_VERSIONS = SUPPORTED_VERSIONS.to_h { |k, v| [k, v - DEPRECATED_VERSIONS[k]] }
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/container-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/container-scanning-report-format.json
deleted file mode 100644
index 14eb376485f..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/container-scanning-report-format.json
+++ /dev/null
@@ -1,741 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Container Scanning",
- "description": "This schema provides the the report format for Container Scanning (https://docs.gitlab.com/ee/user/application_security/container_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.0"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "type": "object",
- "description": "The vendor/maintainer of the scanner.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "container_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "dependency",
- "operating_system",
- "image"
- ],
- "properties": {
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- },
- "operating_system": {
- "type": "string",
- "minLength": 1,
- "description": "The operating system that contains the vulnerable package."
- },
- "image": {
- "type": "string",
- "minLength": 1,
- "description": "The analyzed Docker image."
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/coverage-fuzzing-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/coverage-fuzzing-report-format.json
deleted file mode 100644
index 296a895c7cb..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/coverage-fuzzing-report-format.json
+++ /dev/null
@@ -1,711 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Fuzz Testing",
- "description": "This schema provides the report format for Coverage Guided Fuzz Testing (https://docs.gitlab.com/ee/user/application_security/coverage_fuzzing).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.0"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "type": "object",
- "description": "The vendor/maintainer of the scanner.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "coverage_fuzzing"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "location": {
- "description": "The location of the error",
- "type": "object",
- "properties": {
- "crash_address": {
- "type": "string",
- "description": "The relative address in memory were the crash occurred.",
- "examples": [
- "0xabababab"
- ]
- },
- "stacktrace_snippet": {
- "type": "string",
- "description": "The stack trace recorded during fuzzing resulting the crash.",
- "examples": [
- "func_a+0xabcd\nfunc_b+0xabcc"
- ]
- },
- "crash_state": {
- "type": "string",
- "description": "Minimised and normalized crash stack-trace (called crash_state).",
- "examples": [
- "func_a+0xa\nfunc_b+0xb\nfunc_c+0xc"
- ]
- },
- "crash_type": {
- "type": "string",
- "description": "Type of the crash.",
- "examples": [
- "Heap-Buffer-overflow",
- "Division-by-zero"
- ]
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/dast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/dast-report-format.json
deleted file mode 100644
index 4d3868be019..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/dast-report-format.json
+++ /dev/null
@@ -1,1128 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab DAST",
- "description": "This schema provides the the report format for Dynamic Application Security Testing (https://docs.gitlab.com/ee/user/application_security/dast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.0"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanned_resources",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "type": "object",
- "description": "The vendor/maintainer of the scanner.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dast",
- "api_fuzzing"
- ]
- },
- "scanned_resources": {
- "type": "array",
- "description": "The attack surface scanned by DAST.",
- "items": {
- "type": "object",
- "required": [
- "method",
- "url",
- "type"
- ],
- "properties": {
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method of the scanned resource.",
- "examples": [
- "GET",
- "POST",
- "HEAD"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the scanned resource.",
- "examples": [
- "http://my.site.com/a-page"
- ]
- },
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Type of the scanned resource, for DAST, this must be 'url'.",
- "examples": [
- "url"
- ]
- }
- }
- }
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "evidence": {
- "type": "object",
- "properties": {
- "source": {
- "type": "object",
- "description": "Source of evidence",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "Unique source identifier",
- "examples": [
- "assert:LogAnalysis",
- "assert:StatusCode"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Source display name",
- "examples": [
- "Log Analysis",
- "Status Code"
- ]
- },
- "url": {
- "type": "string",
- "description": "Link to additional information",
- "examples": [
- "https://docs.gitlab.com/ee/development/integrations/secure.html"
- ]
- }
- }
- },
- "summary": {
- "type": "string",
- "description": "Human readable string containing evidence of the vulnerability.",
- "examples": [
- "Credit card 4111111111111111 found",
- "Server leaked information nginx/1.17.6"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- },
- "supporting_messages": {
- "type": "array",
- "description": "Array of supporting http messages.",
- "items": {
- "type": "object",
- "description": "A supporting http message.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Message display name.",
- "examples": [
- "Unmodified",
- "Recorded"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- }
- }
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "hostname": {
- "type": "string",
- "description": "The protocol, domain, and port of the application where the vulnerability was found."
- },
- "method": {
- "type": "string",
- "description": "The HTTP method that was used to request the URL where the vulnerability was found."
- },
- "param": {
- "type": "string",
- "description": "A value provided by a vulnerability rule related to the found vulnerability. Examples include a header value, or a parameter used in a HTTP POST."
- },
- "path": {
- "type": "string",
- "description": "The path of the URL where the vulnerability was found. Typically, this would start with a forward slash."
- }
- }
- },
- "assets": {
- "type": "array",
- "description": "Array of build assets associated with vulnerability.",
- "items": {
- "type": "object",
- "description": "Describes an asset associated with vulnerability.",
- "required": [
- "type",
- "name",
- "url"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "The type of asset",
- "enum": [
- "http_session",
- "postman"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Display name for asset",
- "examples": [
- "HTTP Messages",
- "Postman Collection"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "Link to asset in build artifacts",
- "examples": [
- "https://gitlab.com/gitlab-org/security-products/dast/-/jobs/626397001/artifacts/file//output/zap_session.data"
- ]
- }
- }
- }
- },
- "discovered_at": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss.sss, representing when the vulnerability was discovered",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}\\.\\d{3}$",
- "examples": [
- "2020-01-28T03:26:02.956"
- ]
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/dependency-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/dependency-scanning-report-format.json
deleted file mode 100644
index f0c1a90adcc..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/dependency-scanning-report-format.json
+++ /dev/null
@@ -1,805 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Dependency Scanning",
- "description": "This schema provides the the report format for Dependency Scanning analyzers (https://docs.gitlab.com/ee/user/application_security/dependency_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.0"
- },
- "required": [
- "dependency_files",
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "type": "object",
- "description": "The vendor/maintainer of the scanner.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dependency_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "file",
- "dependency"
- ],
- "properties": {
- "file": {
- "type": "string",
- "minLength": 1,
- "description": "Path to the manifest or lock file where the dependency is declared (such as yarn.lock)."
- },
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- },
- "dependency_files": {
- "type": "array",
- "description": "List of dependency files identified in the project.",
- "items": {
- "type": "object",
- "required": [
- "path",
- "package_manager",
- "dependencies"
- ],
- "properties": {
- "path": {
- "type": "string",
- "minLength": 1
- },
- "package_manager": {
- "type": "string",
- "minLength": 1
- },
- "dependencies": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/sast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/sast-report-format.json
deleted file mode 100644
index a7159be0190..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/sast-report-format.json
+++ /dev/null
@@ -1,706 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab SAST",
- "description": "This schema provides the report format for Static Application Security Testing analyzers (https://docs.gitlab.com/ee/user/application_security/sast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.0"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "type": "object",
- "description": "The vendor/maintainer of the scanner.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "sast"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability."
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located."
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located."
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/secret-detection-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/secret-detection-report-format.json
deleted file mode 100644
index 462e23a151c..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.0/secret-detection-report-format.json
+++ /dev/null
@@ -1,729 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Secret Detection",
- "description": "This schema provides the the report format for the Secret Detection analyzer (https://docs.gitlab.com/ee/user/application_security/secret_detection)",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.0"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "type": "object",
- "description": "The vendor/maintainer of the scanner.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "secret_detection"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "location": {
- "required": [
- "commit"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located"
- },
- "commit": {
- "type": "object",
- "description": "Represents the commit in which the vulnerability was detected",
- "required": [
- "sha"
- ],
- "properties": {
- "author": {
- "type": "string"
- },
- "date": {
- "type": "string"
- },
- "message": {
- "type": "string"
- },
- "sha": {
- "type": "string",
- "minLength": 1
- }
- }
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability"
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability"
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located"
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located"
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/container-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/container-scanning-report-format.json
deleted file mode 100644
index d01e7818866..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/container-scanning-report-format.json
+++ /dev/null
@@ -1,809 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Container Scanning",
- "description": "This schema provides the the report format for Container Scanning (https://docs.gitlab.com/ee/user/application_security/container_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.1"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "type": "object",
- "description": "The vendor/maintainer of the scanner.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "container_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "dependency",
- "operating_system",
- "image"
- ],
- "properties": {
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- },
- "operating_system": {
- "type": "string",
- "minLength": 1,
- "description": "The operating system that contains the vulnerable package."
- },
- "image": {
- "type": "string",
- "minLength": 1,
- "description": "The analyzed Docker image."
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/coverage-fuzzing-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/coverage-fuzzing-report-format.json
deleted file mode 100644
index d496b62ee7f..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/coverage-fuzzing-report-format.json
+++ /dev/null
@@ -1,779 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Fuzz Testing",
- "description": "This schema provides the report format for Coverage Guided Fuzz Testing (https://docs.gitlab.com/ee/user/application_security/coverage_fuzzing).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.1"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "type": "object",
- "description": "The vendor/maintainer of the scanner.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "coverage_fuzzing"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "location": {
- "description": "The location of the error",
- "type": "object",
- "properties": {
- "crash_address": {
- "type": "string",
- "description": "The relative address in memory were the crash occurred.",
- "examples": [
- "0xabababab"
- ]
- },
- "stacktrace_snippet": {
- "type": "string",
- "description": "The stack trace recorded during fuzzing resulting the crash.",
- "examples": [
- "func_a+0xabcd\nfunc_b+0xabcc"
- ]
- },
- "crash_state": {
- "type": "string",
- "description": "Minimised and normalized crash stack-trace (called crash_state).",
- "examples": [
- "func_a+0xa\nfunc_b+0xb\nfunc_c+0xc"
- ]
- },
- "crash_type": {
- "type": "string",
- "description": "Type of the crash.",
- "examples": [
- "Heap-Buffer-overflow",
- "Division-by-zero"
- ]
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/dast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/dast-report-format.json
deleted file mode 100644
index a4d59f39a15..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/dast-report-format.json
+++ /dev/null
@@ -1,1196 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab DAST",
- "description": "This schema provides the the report format for Dynamic Application Security Testing (https://docs.gitlab.com/ee/user/application_security/dast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.1"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanned_resources",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "type": "object",
- "description": "The vendor/maintainer of the scanner.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dast",
- "api_fuzzing"
- ]
- },
- "scanned_resources": {
- "type": "array",
- "description": "The attack surface scanned by DAST.",
- "items": {
- "type": "object",
- "required": [
- "method",
- "url",
- "type"
- ],
- "properties": {
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method of the scanned resource.",
- "examples": [
- "GET",
- "POST",
- "HEAD"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the scanned resource.",
- "examples": [
- "http://my.site.com/a-page"
- ]
- },
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Type of the scanned resource, for DAST, this must be 'url'.",
- "examples": [
- "url"
- ]
- }
- }
- }
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "evidence": {
- "type": "object",
- "properties": {
- "source": {
- "type": "object",
- "description": "Source of evidence",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "Unique source identifier",
- "examples": [
- "assert:LogAnalysis",
- "assert:StatusCode"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Source display name",
- "examples": [
- "Log Analysis",
- "Status Code"
- ]
- },
- "url": {
- "type": "string",
- "description": "Link to additional information",
- "examples": [
- "https://docs.gitlab.com/ee/development/integrations/secure.html"
- ]
- }
- }
- },
- "summary": {
- "type": "string",
- "description": "Human readable string containing evidence of the vulnerability.",
- "examples": [
- "Credit card 4111111111111111 found",
- "Server leaked information nginx/1.17.6"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- },
- "supporting_messages": {
- "type": "array",
- "description": "Array of supporting http messages.",
- "items": {
- "type": "object",
- "description": "A supporting http message.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Message display name.",
- "examples": [
- "Unmodified",
- "Recorded"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- }
- }
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "hostname": {
- "type": "string",
- "description": "The protocol, domain, and port of the application where the vulnerability was found."
- },
- "method": {
- "type": "string",
- "description": "The HTTP method that was used to request the URL where the vulnerability was found."
- },
- "param": {
- "type": "string",
- "description": "A value provided by a vulnerability rule related to the found vulnerability. Examples include a header value, or a parameter used in a HTTP POST."
- },
- "path": {
- "type": "string",
- "description": "The path of the URL where the vulnerability was found. Typically, this would start with a forward slash."
- }
- }
- },
- "assets": {
- "type": "array",
- "description": "Array of build assets associated with vulnerability.",
- "items": {
- "type": "object",
- "description": "Describes an asset associated with vulnerability.",
- "required": [
- "type",
- "name",
- "url"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "The type of asset",
- "enum": [
- "http_session",
- "postman"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Display name for asset",
- "examples": [
- "HTTP Messages",
- "Postman Collection"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "Link to asset in build artifacts",
- "examples": [
- "https://gitlab.com/gitlab-org/security-products/dast/-/jobs/626397001/artifacts/file//output/zap_session.data"
- ]
- }
- }
- }
- },
- "discovered_at": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss.sss, representing when the vulnerability was discovered",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}\\.\\d{3}$",
- "examples": [
- "2020-01-28T03:26:02.956"
- ]
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/dependency-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/dependency-scanning-report-format.json
deleted file mode 100644
index c83d5195be4..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/dependency-scanning-report-format.json
+++ /dev/null
@@ -1,873 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Dependency Scanning",
- "description": "This schema provides the the report format for Dependency Scanning analyzers (https://docs.gitlab.com/ee/user/application_security/dependency_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.1"
- },
- "required": [
- "dependency_files",
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "type": "object",
- "description": "The vendor/maintainer of the scanner.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dependency_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "file",
- "dependency"
- ],
- "properties": {
- "file": {
- "type": "string",
- "minLength": 1,
- "description": "Path to the manifest or lock file where the dependency is declared (such as yarn.lock)."
- },
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- },
- "dependency_files": {
- "type": "array",
- "description": "List of dependency files identified in the project.",
- "items": {
- "type": "object",
- "required": [
- "path",
- "package_manager",
- "dependencies"
- ],
- "properties": {
- "path": {
- "type": "string",
- "minLength": 1
- },
- "package_manager": {
- "type": "string",
- "minLength": 1
- },
- "dependencies": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/sast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/sast-report-format.json
deleted file mode 100644
index 7c2cd2b78cf..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/sast-report-format.json
+++ /dev/null
@@ -1,774 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab SAST",
- "description": "This schema provides the report format for Static Application Security Testing analyzers (https://docs.gitlab.com/ee/user/application_security/sast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.1"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "type": "object",
- "description": "The vendor/maintainer of the scanner.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "sast"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability."
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located."
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located."
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/secret-detection-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/secret-detection-report-format.json
deleted file mode 100644
index b4449d0d59c..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.1/secret-detection-report-format.json
+++ /dev/null
@@ -1,797 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Secret Detection",
- "description": "This schema provides the the report format for the Secret Detection analyzer (https://docs.gitlab.com/ee/user/application_security/secret_detection)",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.1"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "type": "object",
- "description": "The vendor/maintainer of the scanner.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "secret_detection"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "location": {
- "required": [
- "commit"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located"
- },
- "commit": {
- "type": "object",
- "description": "Represents the commit in which the vulnerability was detected",
- "required": [
- "sha"
- ],
- "properties": {
- "author": {
- "type": "string"
- },
- "date": {
- "type": "string"
- },
- "message": {
- "type": "string"
- },
- "sha": {
- "type": "string",
- "minLength": 1
- }
- }
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability"
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability"
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located"
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located"
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/container-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/container-scanning-report-format.json
deleted file mode 100644
index 696fa214abd..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/container-scanning-report-format.json
+++ /dev/null
@@ -1,871 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Container Scanning",
- "description": "This schema provides the the report format for Container Scanning (https://docs.gitlab.com/ee/user/application_security/container_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.2"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "container_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "dependency",
- "operating_system",
- "image"
- ],
- "properties": {
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- },
- "operating_system": {
- "type": "string",
- "minLength": 1,
- "description": "The operating system that contains the vulnerable package."
- },
- "image": {
- "type": "string",
- "minLength": 1,
- "description": "The analyzed Docker image."
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/coverage-fuzzing-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/coverage-fuzzing-report-format.json
deleted file mode 100644
index 1312696d642..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/coverage-fuzzing-report-format.json
+++ /dev/null
@@ -1,841 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Fuzz Testing",
- "description": "This schema provides the report format for Coverage Guided Fuzz Testing (https://docs.gitlab.com/ee/user/application_security/coverage_fuzzing).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.2"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "coverage_fuzzing"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "location": {
- "description": "The location of the error",
- "type": "object",
- "properties": {
- "crash_address": {
- "type": "string",
- "description": "The relative address in memory were the crash occurred.",
- "examples": [
- "0xabababab"
- ]
- },
- "stacktrace_snippet": {
- "type": "string",
- "description": "The stack trace recorded during fuzzing resulting the crash.",
- "examples": [
- "func_a+0xabcd\nfunc_b+0xabcc"
- ]
- },
- "crash_state": {
- "type": "string",
- "description": "Minimised and normalized crash stack-trace (called crash_state).",
- "examples": [
- "func_a+0xa\nfunc_b+0xb\nfunc_c+0xc"
- ]
- },
- "crash_type": {
- "type": "string",
- "description": "Type of the crash.",
- "examples": [
- "Heap-Buffer-overflow",
- "Division-by-zero"
- ]
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/dast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/dast-report-format.json
deleted file mode 100644
index a7e9f83e557..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/dast-report-format.json
+++ /dev/null
@@ -1,1258 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab DAST",
- "description": "This schema provides the the report format for Dynamic Application Security Testing (https://docs.gitlab.com/ee/user/application_security/dast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.2"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanned_resources",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dast",
- "api_fuzzing"
- ]
- },
- "scanned_resources": {
- "type": "array",
- "description": "The attack surface scanned by DAST.",
- "items": {
- "type": "object",
- "required": [
- "method",
- "url",
- "type"
- ],
- "properties": {
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method of the scanned resource.",
- "examples": [
- "GET",
- "POST",
- "HEAD"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the scanned resource.",
- "examples": [
- "http://my.site.com/a-page"
- ]
- },
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Type of the scanned resource, for DAST, this must be 'url'.",
- "examples": [
- "url"
- ]
- }
- }
- }
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "evidence": {
- "type": "object",
- "properties": {
- "source": {
- "type": "object",
- "description": "Source of evidence",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "Unique source identifier",
- "examples": [
- "assert:LogAnalysis",
- "assert:StatusCode"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Source display name",
- "examples": [
- "Log Analysis",
- "Status Code"
- ]
- },
- "url": {
- "type": "string",
- "description": "Link to additional information",
- "examples": [
- "https://docs.gitlab.com/ee/development/integrations/secure.html"
- ]
- }
- }
- },
- "summary": {
- "type": "string",
- "description": "Human readable string containing evidence of the vulnerability.",
- "examples": [
- "Credit card 4111111111111111 found",
- "Server leaked information nginx/1.17.6"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- },
- "supporting_messages": {
- "type": "array",
- "description": "Array of supporting http messages.",
- "items": {
- "type": "object",
- "description": "A supporting http message.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Message display name.",
- "examples": [
- "Unmodified",
- "Recorded"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- }
- }
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "hostname": {
- "type": "string",
- "description": "The protocol, domain, and port of the application where the vulnerability was found."
- },
- "method": {
- "type": "string",
- "description": "The HTTP method that was used to request the URL where the vulnerability was found."
- },
- "param": {
- "type": "string",
- "description": "A value provided by a vulnerability rule related to the found vulnerability. Examples include a header value, or a parameter used in a HTTP POST."
- },
- "path": {
- "type": "string",
- "description": "The path of the URL where the vulnerability was found. Typically, this would start with a forward slash."
- }
- }
- },
- "assets": {
- "type": "array",
- "description": "Array of build assets associated with vulnerability.",
- "items": {
- "type": "object",
- "description": "Describes an asset associated with vulnerability.",
- "required": [
- "type",
- "name",
- "url"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "The type of asset",
- "enum": [
- "http_session",
- "postman"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Display name for asset",
- "examples": [
- "HTTP Messages",
- "Postman Collection"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "Link to asset in build artifacts",
- "examples": [
- "https://gitlab.com/gitlab-org/security-products/dast/-/jobs/626397001/artifacts/file//output/zap_session.data"
- ]
- }
- }
- }
- },
- "discovered_at": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss.sss, representing when the vulnerability was discovered",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}\\.\\d{3}$",
- "examples": [
- "2020-01-28T03:26:02.956"
- ]
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/dependency-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/dependency-scanning-report-format.json
deleted file mode 100644
index d6ff5248358..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/dependency-scanning-report-format.json
+++ /dev/null
@@ -1,935 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Dependency Scanning",
- "description": "This schema provides the the report format for Dependency Scanning analyzers (https://docs.gitlab.com/ee/user/application_security/dependency_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.2"
- },
- "required": [
- "dependency_files",
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dependency_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "file",
- "dependency"
- ],
- "properties": {
- "file": {
- "type": "string",
- "minLength": 1,
- "description": "Path to the manifest or lock file where the dependency is declared (such as yarn.lock)."
- },
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- },
- "dependency_files": {
- "type": "array",
- "description": "List of dependency files identified in the project.",
- "items": {
- "type": "object",
- "required": [
- "path",
- "package_manager",
- "dependencies"
- ],
- "properties": {
- "path": {
- "type": "string",
- "minLength": 1
- },
- "package_manager": {
- "type": "string",
- "minLength": 1
- },
- "dependencies": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/sast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/sast-report-format.json
deleted file mode 100644
index 2be6801d2f6..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/sast-report-format.json
+++ /dev/null
@@ -1,836 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab SAST",
- "description": "This schema provides the report format for Static Application Security Testing analyzers (https://docs.gitlab.com/ee/user/application_security/sast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.2"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "sast"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability."
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located."
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located."
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/secret-detection-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/secret-detection-report-format.json
deleted file mode 100644
index c44554489ce..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.2/secret-detection-report-format.json
+++ /dev/null
@@ -1,859 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Secret Detection",
- "description": "This schema provides the the report format for the Secret Detection analyzer (https://docs.gitlab.com/ee/user/application_security/secret_detection)",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.2"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "secret_detection"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "location": {
- "required": [
- "commit"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located"
- },
- "commit": {
- "type": "object",
- "description": "Represents the commit in which the vulnerability was detected",
- "required": [
- "sha"
- ],
- "properties": {
- "author": {
- "type": "string"
- },
- "date": {
- "type": "string"
- },
- "message": {
- "type": "string"
- },
- "sha": {
- "type": "string",
- "minLength": 1
- }
- }
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability"
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability"
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located"
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located"
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/container-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/container-scanning-report-format.json
deleted file mode 100644
index 959b7b8f6f2..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/container-scanning-report-format.json
+++ /dev/null
@@ -1,904 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Container Scanning",
- "description": "This schema provides the the report format for Container Scanning (https://docs.gitlab.com/ee/user/application_security/container_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.3"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "container_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "dependency",
- "operating_system",
- "image"
- ],
- "properties": {
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- },
- "operating_system": {
- "type": "string",
- "minLength": 1,
- "description": "The operating system that contains the vulnerable package."
- },
- "image": {
- "type": "string",
- "minLength": 1,
- "description": "The analyzed Docker image."
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/coverage-fuzzing-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/coverage-fuzzing-report-format.json
deleted file mode 100644
index 20038dcb21c..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/coverage-fuzzing-report-format.json
+++ /dev/null
@@ -1,874 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Fuzz Testing",
- "description": "This schema provides the report format for Coverage Guided Fuzz Testing (https://docs.gitlab.com/ee/user/application_security/coverage_fuzzing).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.3"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "coverage_fuzzing"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "description": "The location of the error",
- "type": "object",
- "properties": {
- "crash_address": {
- "type": "string",
- "description": "The relative address in memory were the crash occurred.",
- "examples": [
- "0xabababab"
- ]
- },
- "stacktrace_snippet": {
- "type": "string",
- "description": "The stack trace recorded during fuzzing resulting the crash.",
- "examples": [
- "func_a+0xabcd\nfunc_b+0xabcc"
- ]
- },
- "crash_state": {
- "type": "string",
- "description": "Minimised and normalized crash stack-trace (called crash_state).",
- "examples": [
- "func_a+0xa\nfunc_b+0xb\nfunc_c+0xc"
- ]
- },
- "crash_type": {
- "type": "string",
- "description": "Type of the crash.",
- "examples": [
- "Heap-Buffer-overflow",
- "Division-by-zero"
- ]
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/dast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/dast-report-format.json
deleted file mode 100644
index 37b98a73233..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/dast-report-format.json
+++ /dev/null
@@ -1,1291 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab DAST",
- "description": "This schema provides the the report format for Dynamic Application Security Testing (https://docs.gitlab.com/ee/user/application_security/dast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.3"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanned_resources",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dast",
- "api_fuzzing"
- ]
- },
- "scanned_resources": {
- "type": "array",
- "description": "The attack surface scanned by DAST.",
- "items": {
- "type": "object",
- "required": [
- "method",
- "url",
- "type"
- ],
- "properties": {
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method of the scanned resource.",
- "examples": [
- "GET",
- "POST",
- "HEAD"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the scanned resource.",
- "examples": [
- "http://my.site.com/a-page"
- ]
- },
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Type of the scanned resource, for DAST, this must be 'url'.",
- "examples": [
- "url"
- ]
- }
- }
- }
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "evidence": {
- "type": "object",
- "properties": {
- "source": {
- "type": "object",
- "description": "Source of evidence",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "Unique source identifier",
- "examples": [
- "assert:LogAnalysis",
- "assert:StatusCode"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Source display name",
- "examples": [
- "Log Analysis",
- "Status Code"
- ]
- },
- "url": {
- "type": "string",
- "description": "Link to additional information",
- "examples": [
- "https://docs.gitlab.com/ee/development/integrations/secure.html"
- ]
- }
- }
- },
- "summary": {
- "type": "string",
- "description": "Human readable string containing evidence of the vulnerability.",
- "examples": [
- "Credit card 4111111111111111 found",
- "Server leaked information nginx/1.17.6"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- },
- "supporting_messages": {
- "type": "array",
- "description": "Array of supporting http messages.",
- "items": {
- "type": "object",
- "description": "A supporting http message.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Message display name.",
- "examples": [
- "Unmodified",
- "Recorded"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- }
- }
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "hostname": {
- "type": "string",
- "description": "The protocol, domain, and port of the application where the vulnerability was found."
- },
- "method": {
- "type": "string",
- "description": "The HTTP method that was used to request the URL where the vulnerability was found."
- },
- "param": {
- "type": "string",
- "description": "A value provided by a vulnerability rule related to the found vulnerability. Examples include a header value, or a parameter used in a HTTP POST."
- },
- "path": {
- "type": "string",
- "description": "The path of the URL where the vulnerability was found. Typically, this would start with a forward slash."
- }
- }
- },
- "assets": {
- "type": "array",
- "description": "Array of build assets associated with vulnerability.",
- "items": {
- "type": "object",
- "description": "Describes an asset associated with vulnerability.",
- "required": [
- "type",
- "name",
- "url"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "The type of asset",
- "enum": [
- "http_session",
- "postman"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Display name for asset",
- "examples": [
- "HTTP Messages",
- "Postman Collection"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "Link to asset in build artifacts",
- "examples": [
- "https://gitlab.com/gitlab-org/security-products/dast/-/jobs/626397001/artifacts/file//output/zap_session.data"
- ]
- }
- }
- }
- },
- "discovered_at": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss.sss, representing when the vulnerability was discovered",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}\\.\\d{3}$",
- "examples": [
- "2020-01-28T03:26:02.956"
- ]
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/dependency-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/dependency-scanning-report-format.json
deleted file mode 100644
index 5e9bbeec1a9..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/dependency-scanning-report-format.json
+++ /dev/null
@@ -1,968 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Dependency Scanning",
- "description": "This schema provides the the report format for Dependency Scanning analyzers (https://docs.gitlab.com/ee/user/application_security/dependency_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.3"
- },
- "required": [
- "dependency_files",
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dependency_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "file",
- "dependency"
- ],
- "properties": {
- "file": {
- "type": "string",
- "minLength": 1,
- "description": "Path to the manifest or lock file where the dependency is declared (such as yarn.lock)."
- },
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- },
- "dependency_files": {
- "type": "array",
- "description": "List of dependency files identified in the project.",
- "items": {
- "type": "object",
- "required": [
- "path",
- "package_manager",
- "dependencies"
- ],
- "properties": {
- "path": {
- "type": "string",
- "minLength": 1
- },
- "package_manager": {
- "type": "string",
- "minLength": 1
- },
- "dependencies": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/sast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/sast-report-format.json
deleted file mode 100644
index 8aa98646818..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/sast-report-format.json
+++ /dev/null
@@ -1,869 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab SAST",
- "description": "This schema provides the report format for Static Application Security Testing analyzers (https://docs.gitlab.com/ee/user/application_security/sast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.3"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "sast"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability."
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located."
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located."
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/secret-detection-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/secret-detection-report-format.json
deleted file mode 100644
index 5a315e39385..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.3/secret-detection-report-format.json
+++ /dev/null
@@ -1,892 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Secret Detection",
- "description": "This schema provides the the report format for the Secret Detection analyzer (https://docs.gitlab.com/ee/user/application_security/secret_detection)",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.3"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "secret_detection"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "required": [
- "commit"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located"
- },
- "commit": {
- "type": "object",
- "description": "Represents the commit in which the vulnerability was detected",
- "required": [
- "sha"
- ],
- "properties": {
- "author": {
- "type": "string"
- },
- "date": {
- "type": "string"
- },
- "message": {
- "type": "string"
- },
- "sha": {
- "type": "string",
- "minLength": 1
- }
- }
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability"
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability"
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located"
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located"
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/cluster-image-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/cluster-image-scanning-report-format.json
deleted file mode 100644
index 3736eac0ba0..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/cluster-image-scanning-report-format.json
+++ /dev/null
@@ -1,977 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Cluster Image Scanning",
- "description": "This schema provides the the report format for Cluster Image Scanning (https://docs.gitlab.com/ee/user/application_security/cluster_image_scanning/).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.4"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "cluster_image_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "dependency",
- "image",
- "kubernetes_resource"
- ],
- "properties": {
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- },
- "operating_system": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The operating system that contains the vulnerable package."
- },
- "image": {
- "type": "string",
- "minLength": 1,
- "description": "The analyzed Docker image.",
- "examples": [
- "index.docker.io/library/nginx:1.21"
- ]
- },
- "kubernetes_resource": {
- "type": "object",
- "description": "The specific Kubernetes resource that was scanned.",
- "required": [
- "namespace",
- "kind",
- "name",
- "container_name"
- ],
- "properties": {
- "namespace": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The Kubernetes namespace the resource that had its image scanned.",
- "examples": [
- "default",
- "staging",
- "production"
- ]
- },
- "kind": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The Kubernetes kind the resource that had its image scanned.",
- "examples": [
- "Deployment",
- "DaemonSet"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The name of the resource that had its image scanned.",
- "examples": [
- "nginx-ingress"
- ]
- },
- "container_name": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The name of the container that had its image scanned.",
- "examples": [
- "nginx"
- ]
- },
- "agent_id": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The GitLab ID of the Kubernetes Agent which performed the scan.",
- "examples": [
- "1234"
- ]
- },
- "cluster_id": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The GitLab ID of the Kubernetes cluster when using cluster integration.",
- "examples": [
- "1234"
- ]
- }
- }
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/container-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/container-scanning-report-format.json
deleted file mode 100644
index e324201b04b..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/container-scanning-report-format.json
+++ /dev/null
@@ -1,904 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Container Scanning",
- "description": "This schema provides the the report format for Container Scanning (https://docs.gitlab.com/ee/user/application_security/container_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.4"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "container_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "dependency",
- "operating_system",
- "image"
- ],
- "properties": {
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- },
- "operating_system": {
- "type": "string",
- "minLength": 1,
- "description": "The operating system that contains the vulnerable package."
- },
- "image": {
- "type": "string",
- "minLength": 1,
- "description": "The analyzed Docker image."
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/coverage-fuzzing-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/coverage-fuzzing-report-format.json
deleted file mode 100644
index 7ac5d2b7783..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/coverage-fuzzing-report-format.json
+++ /dev/null
@@ -1,874 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Fuzz Testing",
- "description": "This schema provides the report format for Coverage Guided Fuzz Testing (https://docs.gitlab.com/ee/user/application_security/coverage_fuzzing).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.4"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "coverage_fuzzing"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "description": "The location of the error",
- "type": "object",
- "properties": {
- "crash_address": {
- "type": "string",
- "description": "The relative address in memory were the crash occurred.",
- "examples": [
- "0xabababab"
- ]
- },
- "stacktrace_snippet": {
- "type": "string",
- "description": "The stack trace recorded during fuzzing resulting the crash.",
- "examples": [
- "func_a+0xabcd\nfunc_b+0xabcc"
- ]
- },
- "crash_state": {
- "type": "string",
- "description": "Minimised and normalized crash stack-trace (called crash_state).",
- "examples": [
- "func_a+0xa\nfunc_b+0xb\nfunc_c+0xc"
- ]
- },
- "crash_type": {
- "type": "string",
- "description": "Type of the crash.",
- "examples": [
- "Heap-Buffer-overflow",
- "Division-by-zero"
- ]
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/dast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/dast-report-format.json
deleted file mode 100644
index b3ce7609aea..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/dast-report-format.json
+++ /dev/null
@@ -1,1291 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab DAST",
- "description": "This schema provides the the report format for Dynamic Application Security Testing (https://docs.gitlab.com/ee/user/application_security/dast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.4"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanned_resources",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dast",
- "api_fuzzing"
- ]
- },
- "scanned_resources": {
- "type": "array",
- "description": "The attack surface scanned by DAST.",
- "items": {
- "type": "object",
- "required": [
- "method",
- "url",
- "type"
- ],
- "properties": {
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method of the scanned resource.",
- "examples": [
- "GET",
- "POST",
- "HEAD"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the scanned resource.",
- "examples": [
- "http://my.site.com/a-page"
- ]
- },
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Type of the scanned resource, for DAST, this must be 'url'.",
- "examples": [
- "url"
- ]
- }
- }
- }
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "evidence": {
- "type": "object",
- "properties": {
- "source": {
- "type": "object",
- "description": "Source of evidence",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "Unique source identifier",
- "examples": [
- "assert:LogAnalysis",
- "assert:StatusCode"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Source display name",
- "examples": [
- "Log Analysis",
- "Status Code"
- ]
- },
- "url": {
- "type": "string",
- "description": "Link to additional information",
- "examples": [
- "https://docs.gitlab.com/ee/development/integrations/secure.html"
- ]
- }
- }
- },
- "summary": {
- "type": "string",
- "description": "Human readable string containing evidence of the vulnerability.",
- "examples": [
- "Credit card 4111111111111111 found",
- "Server leaked information nginx/1.17.6"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- },
- "supporting_messages": {
- "type": "array",
- "description": "Array of supporting http messages.",
- "items": {
- "type": "object",
- "description": "A supporting http message.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Message display name.",
- "examples": [
- "Unmodified",
- "Recorded"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- }
- }
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "hostname": {
- "type": "string",
- "description": "The protocol, domain, and port of the application where the vulnerability was found."
- },
- "method": {
- "type": "string",
- "description": "The HTTP method that was used to request the URL where the vulnerability was found."
- },
- "param": {
- "type": "string",
- "description": "A value provided by a vulnerability rule related to the found vulnerability. Examples include a header value, or a parameter used in a HTTP POST."
- },
- "path": {
- "type": "string",
- "description": "The path of the URL where the vulnerability was found. Typically, this would start with a forward slash."
- }
- }
- },
- "assets": {
- "type": "array",
- "description": "Array of build assets associated with vulnerability.",
- "items": {
- "type": "object",
- "description": "Describes an asset associated with vulnerability.",
- "required": [
- "type",
- "name",
- "url"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "The type of asset",
- "enum": [
- "http_session",
- "postman"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Display name for asset",
- "examples": [
- "HTTP Messages",
- "Postman Collection"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "Link to asset in build artifacts",
- "examples": [
- "https://gitlab.com/gitlab-org/security-products/dast/-/jobs/626397001/artifacts/file//output/zap_session.data"
- ]
- }
- }
- }
- },
- "discovered_at": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss.sss, representing when the vulnerability was discovered",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}\\.\\d{3}$",
- "examples": [
- "2020-01-28T03:26:02.956"
- ]
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/dependency-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/dependency-scanning-report-format.json
deleted file mode 100644
index 605d379e497..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/dependency-scanning-report-format.json
+++ /dev/null
@@ -1,968 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Dependency Scanning",
- "description": "This schema provides the the report format for Dependency Scanning analyzers (https://docs.gitlab.com/ee/user/application_security/dependency_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.4"
- },
- "required": [
- "dependency_files",
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dependency_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "file",
- "dependency"
- ],
- "properties": {
- "file": {
- "type": "string",
- "minLength": 1,
- "description": "Path to the manifest or lock file where the dependency is declared (such as yarn.lock)."
- },
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- },
- "dependency_files": {
- "type": "array",
- "description": "List of dependency files identified in the project.",
- "items": {
- "type": "object",
- "required": [
- "path",
- "package_manager",
- "dependencies"
- ],
- "properties": {
- "path": {
- "type": "string",
- "minLength": 1
- },
- "package_manager": {
- "type": "string",
- "minLength": 1
- },
- "dependencies": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/sast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/sast-report-format.json
deleted file mode 100644
index 2d9e1af6663..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/sast-report-format.json
+++ /dev/null
@@ -1,869 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab SAST",
- "description": "This schema provides the report format for Static Application Security Testing analyzers (https://docs.gitlab.com/ee/user/application_security/sast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.4"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "sast"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability."
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located."
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located."
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/secret-detection-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/secret-detection-report-format.json
deleted file mode 100644
index 70f22b243c6..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4/secret-detection-report-format.json
+++ /dev/null
@@ -1,892 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Secret Detection",
- "description": "This schema provides the the report format for the Secret Detection analyzer (https://docs.gitlab.com/ee/user/application_security/secret_detection)",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.4"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "secret_detection"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "required": [
- "commit"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located"
- },
- "commit": {
- "type": "object",
- "description": "Represents the commit in which the vulnerability was detected",
- "required": [
- "sha"
- ],
- "properties": {
- "author": {
- "type": "string"
- },
- "date": {
- "type": "string"
- },
- "message": {
- "type": "string"
- },
- "sha": {
- "type": "string",
- "minLength": 1
- }
- }
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability"
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability"
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located"
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located"
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/cluster-image-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/cluster-image-scanning-report-format.json
deleted file mode 100644
index 882a21e430a..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/cluster-image-scanning-report-format.json
+++ /dev/null
@@ -1,977 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Cluster Image Scanning",
- "description": "This schema provides the the report format for Cluster Image Scanning (https://docs.gitlab.com/ee/user/application_security/cluster_image_scanning/).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.5"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "cluster_image_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "dependency",
- "image",
- "kubernetes_resource"
- ],
- "properties": {
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- },
- "operating_system": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The operating system that contains the vulnerable package."
- },
- "image": {
- "type": "string",
- "minLength": 1,
- "description": "The analyzed Docker image.",
- "examples": [
- "index.docker.io/library/nginx:1.21"
- ]
- },
- "kubernetes_resource": {
- "type": "object",
- "description": "The specific Kubernetes resource that was scanned.",
- "required": [
- "namespace",
- "kind",
- "name",
- "container_name"
- ],
- "properties": {
- "namespace": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The Kubernetes namespace the resource that had its image scanned.",
- "examples": [
- "default",
- "staging",
- "production"
- ]
- },
- "kind": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The Kubernetes kind the resource that had its image scanned.",
- "examples": [
- "Deployment",
- "DaemonSet"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The name of the resource that had its image scanned.",
- "examples": [
- "nginx-ingress"
- ]
- },
- "container_name": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The name of the container that had its image scanned.",
- "examples": [
- "nginx"
- ]
- },
- "agent_id": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The GitLab ID of the Kubernetes Agent which performed the scan.",
- "examples": [
- "1234"
- ]
- },
- "cluster_id": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The GitLab ID of the Kubernetes cluster when using cluster integration.",
- "examples": [
- "1234"
- ]
- }
- }
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/container-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/container-scanning-report-format.json
deleted file mode 100644
index 08f38650340..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/container-scanning-report-format.json
+++ /dev/null
@@ -1,910 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Container Scanning",
- "description": "This schema provides the the report format for Container Scanning (https://docs.gitlab.com/ee/user/application_security/container_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.5"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "container_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "dependency",
- "operating_system",
- "image"
- ],
- "properties": {
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- },
- "operating_system": {
- "type": "string",
- "minLength": 1,
- "description": "The operating system that contains the vulnerable package."
- },
- "image": {
- "type": "string",
- "minLength": 1,
- "description": "The analyzed Docker image."
- },
- "default_branch_image": {
- "type": "string",
- "maxLength": 255,
- "pattern": "^[a-zA-Z0-9/_.-]+:[a-zA-Z0-9_.-]+$",
- "description": "The name of the image on the default branch."
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/coverage-fuzzing-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/coverage-fuzzing-report-format.json
deleted file mode 100644
index a442d38c134..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/coverage-fuzzing-report-format.json
+++ /dev/null
@@ -1,874 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Fuzz Testing",
- "description": "This schema provides the report format for Coverage Guided Fuzz Testing (https://docs.gitlab.com/ee/user/application_security/coverage_fuzzing).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.5"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "coverage_fuzzing"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "description": "The location of the error",
- "type": "object",
- "properties": {
- "crash_address": {
- "type": "string",
- "description": "The relative address in memory were the crash occurred.",
- "examples": [
- "0xabababab"
- ]
- },
- "stacktrace_snippet": {
- "type": "string",
- "description": "The stack trace recorded during fuzzing resulting the crash.",
- "examples": [
- "func_a+0xabcd\nfunc_b+0xabcc"
- ]
- },
- "crash_state": {
- "type": "string",
- "description": "Minimised and normalized crash stack-trace (called crash_state).",
- "examples": [
- "func_a+0xa\nfunc_b+0xb\nfunc_c+0xc"
- ]
- },
- "crash_type": {
- "type": "string",
- "description": "Type of the crash.",
- "examples": [
- "Heap-Buffer-overflow",
- "Division-by-zero"
- ]
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/dast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/dast-report-format.json
deleted file mode 100644
index 9a4d1515bc2..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/dast-report-format.json
+++ /dev/null
@@ -1,1291 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab DAST",
- "description": "This schema provides the the report format for Dynamic Application Security Testing (https://docs.gitlab.com/ee/user/application_security/dast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.5"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanned_resources",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dast",
- "api_fuzzing"
- ]
- },
- "scanned_resources": {
- "type": "array",
- "description": "The attack surface scanned by DAST.",
- "items": {
- "type": "object",
- "required": [
- "method",
- "url",
- "type"
- ],
- "properties": {
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method of the scanned resource.",
- "examples": [
- "GET",
- "POST",
- "HEAD"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the scanned resource.",
- "examples": [
- "http://my.site.com/a-page"
- ]
- },
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Type of the scanned resource, for DAST, this must be 'url'.",
- "examples": [
- "url"
- ]
- }
- }
- }
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "evidence": {
- "type": "object",
- "properties": {
- "source": {
- "type": "object",
- "description": "Source of evidence",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "Unique source identifier",
- "examples": [
- "assert:LogAnalysis",
- "assert:StatusCode"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Source display name",
- "examples": [
- "Log Analysis",
- "Status Code"
- ]
- },
- "url": {
- "type": "string",
- "description": "Link to additional information",
- "examples": [
- "https://docs.gitlab.com/ee/development/integrations/secure.html"
- ]
- }
- }
- },
- "summary": {
- "type": "string",
- "description": "Human readable string containing evidence of the vulnerability.",
- "examples": [
- "Credit card 4111111111111111 found",
- "Server leaked information nginx/1.17.6"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- },
- "supporting_messages": {
- "type": "array",
- "description": "Array of supporting http messages.",
- "items": {
- "type": "object",
- "description": "A supporting http message.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Message display name.",
- "examples": [
- "Unmodified",
- "Recorded"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- }
- }
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "hostname": {
- "type": "string",
- "description": "The protocol, domain, and port of the application where the vulnerability was found."
- },
- "method": {
- "type": "string",
- "description": "The HTTP method that was used to request the URL where the vulnerability was found."
- },
- "param": {
- "type": "string",
- "description": "A value provided by a vulnerability rule related to the found vulnerability. Examples include a header value, or a parameter used in a HTTP POST."
- },
- "path": {
- "type": "string",
- "description": "The path of the URL where the vulnerability was found. Typically, this would start with a forward slash."
- }
- }
- },
- "assets": {
- "type": "array",
- "description": "Array of build assets associated with vulnerability.",
- "items": {
- "type": "object",
- "description": "Describes an asset associated with vulnerability.",
- "required": [
- "type",
- "name",
- "url"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "The type of asset",
- "enum": [
- "http_session",
- "postman"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Display name for asset",
- "examples": [
- "HTTP Messages",
- "Postman Collection"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "Link to asset in build artifacts",
- "examples": [
- "https://gitlab.com/gitlab-org/security-products/dast/-/jobs/626397001/artifacts/file//output/zap_session.data"
- ]
- }
- }
- }
- },
- "discovered_at": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss.sss, representing when the vulnerability was discovered",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}\\.\\d{3}$",
- "examples": [
- "2020-01-28T03:26:02.956"
- ]
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/dependency-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/dependency-scanning-report-format.json
deleted file mode 100644
index e84dd9c87d8..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/dependency-scanning-report-format.json
+++ /dev/null
@@ -1,968 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Dependency Scanning",
- "description": "This schema provides the the report format for Dependency Scanning analyzers (https://docs.gitlab.com/ee/user/application_security/dependency_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.5"
- },
- "required": [
- "dependency_files",
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dependency_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "file",
- "dependency"
- ],
- "properties": {
- "file": {
- "type": "string",
- "minLength": 1,
- "description": "Path to the manifest or lock file where the dependency is declared (such as yarn.lock)."
- },
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- },
- "dependency_files": {
- "type": "array",
- "description": "List of dependency files identified in the project.",
- "items": {
- "type": "object",
- "required": [
- "path",
- "package_manager",
- "dependencies"
- ],
- "properties": {
- "path": {
- "type": "string",
- "minLength": 1
- },
- "package_manager": {
- "type": "string",
- "minLength": 1
- },
- "dependencies": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/sast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/sast-report-format.json
deleted file mode 100644
index b10b199a97c..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/sast-report-format.json
+++ /dev/null
@@ -1,869 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab SAST",
- "description": "This schema provides the report format for Static Application Security Testing analyzers (https://docs.gitlab.com/ee/user/application_security/sast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.5"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "sast"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability."
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located."
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located."
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/secret-detection-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/secret-detection-report-format.json
deleted file mode 100644
index 5bd945c8ab5..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5/secret-detection-report-format.json
+++ /dev/null
@@ -1,892 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Secret Detection",
- "description": "This schema provides the the report format for the Secret Detection analyzer (https://docs.gitlab.com/ee/user/application_security/secret_detection)",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.5"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "secret_detection"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability.",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "required": [
- "commit"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located"
- },
- "commit": {
- "type": "object",
- "description": "Represents the commit in which the vulnerability was detected",
- "required": [
- "sha"
- ],
- "properties": {
- "author": {
- "type": "string"
- },
- "date": {
- "type": "string"
- },
- "message": {
- "type": "string"
- },
- "sha": {
- "type": "string",
- "minLength": 1
- }
- }
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability"
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability"
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located"
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located"
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/cluster-image-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/cluster-image-scanning-report-format.json
deleted file mode 100644
index 951b0fea013..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/cluster-image-scanning-report-format.json
+++ /dev/null
@@ -1,977 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Cluster Image Scanning",
- "description": "This schema provides the the report format for Cluster Image Scanning (https://docs.gitlab.com/ee/user/application_security/cluster_image_scanning/).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.6"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "cluster_image_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "dependency",
- "image",
- "kubernetes_resource"
- ],
- "properties": {
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- },
- "operating_system": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The operating system that contains the vulnerable package."
- },
- "image": {
- "type": "string",
- "minLength": 1,
- "description": "The analyzed Docker image.",
- "examples": [
- "index.docker.io/library/nginx:1.21"
- ]
- },
- "kubernetes_resource": {
- "type": "object",
- "description": "The specific Kubernetes resource that was scanned.",
- "required": [
- "namespace",
- "kind",
- "name",
- "container_name"
- ],
- "properties": {
- "namespace": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The Kubernetes namespace the resource that had its image scanned.",
- "examples": [
- "default",
- "staging",
- "production"
- ]
- },
- "kind": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The Kubernetes kind the resource that had its image scanned.",
- "examples": [
- "Deployment",
- "DaemonSet"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The name of the resource that had its image scanned.",
- "examples": [
- "nginx-ingress"
- ]
- },
- "container_name": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The name of the container that had its image scanned.",
- "examples": [
- "nginx"
- ]
- },
- "agent_id": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The GitLab ID of the Kubernetes Agent which performed the scan.",
- "examples": [
- "1234"
- ]
- },
- "cluster_id": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The GitLab ID of the Kubernetes cluster when using cluster integration.",
- "examples": [
- "1234"
- ]
- }
- }
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/container-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/container-scanning-report-format.json
deleted file mode 100644
index fb412af44e3..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/container-scanning-report-format.json
+++ /dev/null
@@ -1,910 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Container Scanning",
- "description": "This schema provides the the report format for Container Scanning (https://docs.gitlab.com/ee/user/application_security/container_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.6"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "container_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "dependency",
- "operating_system",
- "image"
- ],
- "properties": {
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- },
- "operating_system": {
- "type": "string",
- "minLength": 1,
- "description": "The operating system that contains the vulnerable package."
- },
- "image": {
- "type": "string",
- "minLength": 1,
- "description": "The analyzed Docker image."
- },
- "default_branch_image": {
- "type": "string",
- "maxLength": 255,
- "pattern": "^[a-zA-Z0-9/_.-]+:[a-zA-Z0-9_.-]+$",
- "description": "The name of the image on the default branch."
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/coverage-fuzzing-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/coverage-fuzzing-report-format.json
deleted file mode 100644
index de79d4b52ab..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/coverage-fuzzing-report-format.json
+++ /dev/null
@@ -1,874 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Fuzz Testing",
- "description": "This schema provides the report format for Coverage Guided Fuzz Testing (https://docs.gitlab.com/ee/user/application_security/coverage_fuzzing).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.6"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "coverage_fuzzing"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "description": "The location of the error",
- "type": "object",
- "properties": {
- "crash_address": {
- "type": "string",
- "description": "The relative address in memory were the crash occurred.",
- "examples": [
- "0xabababab"
- ]
- },
- "stacktrace_snippet": {
- "type": "string",
- "description": "The stack trace recorded during fuzzing resulting the crash.",
- "examples": [
- "func_a+0xabcd\nfunc_b+0xabcc"
- ]
- },
- "crash_state": {
- "type": "string",
- "description": "Minimised and normalized crash stack-trace (called crash_state).",
- "examples": [
- "func_a+0xa\nfunc_b+0xb\nfunc_c+0xc"
- ]
- },
- "crash_type": {
- "type": "string",
- "description": "Type of the crash.",
- "examples": [
- "Heap-Buffer-overflow",
- "Division-by-zero"
- ]
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/dast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/dast-report-format.json
deleted file mode 100644
index 598f162aad2..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/dast-report-format.json
+++ /dev/null
@@ -1,1291 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab DAST",
- "description": "This schema provides the the report format for Dynamic Application Security Testing (https://docs.gitlab.com/ee/user/application_security/dast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.6"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanned_resources",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dast",
- "api_fuzzing"
- ]
- },
- "scanned_resources": {
- "type": "array",
- "description": "The attack surface scanned by DAST.",
- "items": {
- "type": "object",
- "required": [
- "method",
- "url",
- "type"
- ],
- "properties": {
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method of the scanned resource.",
- "examples": [
- "GET",
- "POST",
- "HEAD"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the scanned resource.",
- "examples": [
- "http://my.site.com/a-page"
- ]
- },
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Type of the scanned resource, for DAST, this must be 'url'.",
- "examples": [
- "url"
- ]
- }
- }
- }
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "evidence": {
- "type": "object",
- "properties": {
- "source": {
- "type": "object",
- "description": "Source of evidence",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "Unique source identifier",
- "examples": [
- "assert:LogAnalysis",
- "assert:StatusCode"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Source display name",
- "examples": [
- "Log Analysis",
- "Status Code"
- ]
- },
- "url": {
- "type": "string",
- "description": "Link to additional information",
- "examples": [
- "https://docs.gitlab.com/ee/development/integrations/secure.html"
- ]
- }
- }
- },
- "summary": {
- "type": "string",
- "description": "Human readable string containing evidence of the vulnerability.",
- "examples": [
- "Credit card 4111111111111111 found",
- "Server leaked information nginx/1.17.6"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- },
- "supporting_messages": {
- "type": "array",
- "description": "Array of supporting http messages.",
- "items": {
- "type": "object",
- "description": "A supporting http message.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Message display name.",
- "examples": [
- "Unmodified",
- "Recorded"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- }
- }
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "hostname": {
- "type": "string",
- "description": "The protocol, domain, and port of the application where the vulnerability was found."
- },
- "method": {
- "type": "string",
- "description": "The HTTP method that was used to request the URL where the vulnerability was found."
- },
- "param": {
- "type": "string",
- "description": "A value provided by a vulnerability rule related to the found vulnerability. Examples include a header value, or a parameter used in a HTTP POST."
- },
- "path": {
- "type": "string",
- "description": "The path of the URL where the vulnerability was found. Typically, this would start with a forward slash."
- }
- }
- },
- "assets": {
- "type": "array",
- "description": "Array of build assets associated with vulnerability.",
- "items": {
- "type": "object",
- "description": "Describes an asset associated with vulnerability.",
- "required": [
- "type",
- "name",
- "url"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "The type of asset",
- "enum": [
- "http_session",
- "postman"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Display name for asset",
- "examples": [
- "HTTP Messages",
- "Postman Collection"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "Link to asset in build artifacts",
- "examples": [
- "https://gitlab.com/gitlab-org/security-products/dast/-/jobs/626397001/artifacts/file//output/zap_session.data"
- ]
- }
- }
- }
- },
- "discovered_at": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss.sss, representing when the vulnerability was discovered",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}\\.\\d{3}$",
- "examples": [
- "2020-01-28T03:26:02.956"
- ]
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/dependency-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/dependency-scanning-report-format.json
deleted file mode 100644
index 80d6fc9c7d2..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/dependency-scanning-report-format.json
+++ /dev/null
@@ -1,968 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Dependency Scanning",
- "description": "This schema provides the the report format for Dependency Scanning analyzers (https://docs.gitlab.com/ee/user/application_security/dependency_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.6"
- },
- "required": [
- "dependency_files",
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dependency_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "file",
- "dependency"
- ],
- "properties": {
- "file": {
- "type": "string",
- "minLength": 1,
- "description": "Path to the manifest or lock file where the dependency is declared (such as yarn.lock)."
- },
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- },
- "dependency_files": {
- "type": "array",
- "description": "List of dependency files identified in the project.",
- "items": {
- "type": "object",
- "required": [
- "path",
- "package_manager",
- "dependencies"
- ],
- "properties": {
- "path": {
- "type": "string",
- "minLength": 1
- },
- "package_manager": {
- "type": "string",
- "minLength": 1
- },
- "dependencies": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/sast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/sast-report-format.json
deleted file mode 100644
index b87182bb237..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/sast-report-format.json
+++ /dev/null
@@ -1,869 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab SAST",
- "description": "This schema provides the report format for Static Application Security Testing analyzers (https://docs.gitlab.com/ee/user/application_security/sast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.6"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "sast"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability."
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located."
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located."
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/secret-detection-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/secret-detection-report-format.json
deleted file mode 100644
index 191d94aad5f..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6/secret-detection-report-format.json
+++ /dev/null
@@ -1,892 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Secret Detection",
- "description": "This schema provides the the report format for the Secret Detection analyzer (https://docs.gitlab.com/ee/user/application_security/secret_detection)",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.0.6"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "secret_detection"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "required": [
- "commit"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located"
- },
- "commit": {
- "type": "object",
- "description": "Represents the commit in which the vulnerability was detected",
- "required": [
- "sha"
- ],
- "properties": {
- "author": {
- "type": "string"
- },
- "date": {
- "type": "string"
- },
- "message": {
- "type": "string"
- },
- "sha": {
- "type": "string",
- "minLength": 1
- }
- }
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability"
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability"
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located"
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located"
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/cluster-image-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/cluster-image-scanning-report-format.json
deleted file mode 100644
index 3f78ff0354f..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/cluster-image-scanning-report-format.json
+++ /dev/null
@@ -1,977 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Cluster Image Scanning",
- "description": "This schema provides the the report format for Cluster Image Scanning (https://docs.gitlab.com/ee/user/application_security/cluster_image_scanning/).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.0"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "cluster_image_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "dependency",
- "image",
- "kubernetes_resource"
- ],
- "properties": {
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- },
- "operating_system": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The operating system that contains the vulnerable package."
- },
- "image": {
- "type": "string",
- "minLength": 1,
- "description": "The analyzed Docker image.",
- "examples": [
- "index.docker.io/library/nginx:1.21"
- ]
- },
- "kubernetes_resource": {
- "type": "object",
- "description": "The specific Kubernetes resource that was scanned.",
- "required": [
- "namespace",
- "kind",
- "name",
- "container_name"
- ],
- "properties": {
- "namespace": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The Kubernetes namespace the resource that had its image scanned.",
- "examples": [
- "default",
- "staging",
- "production"
- ]
- },
- "kind": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The Kubernetes kind the resource that had its image scanned.",
- "examples": [
- "Deployment",
- "DaemonSet"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The name of the resource that had its image scanned.",
- "examples": [
- "nginx-ingress"
- ]
- },
- "container_name": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The name of the container that had its image scanned.",
- "examples": [
- "nginx"
- ]
- },
- "agent_id": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The GitLab ID of the Kubernetes Agent which performed the scan.",
- "examples": [
- "1234"
- ]
- },
- "cluster_id": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The GitLab ID of the Kubernetes cluster when using cluster integration.",
- "examples": [
- "1234"
- ]
- }
- }
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/container-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/container-scanning-report-format.json
deleted file mode 100644
index 6e8a1c54fb4..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/container-scanning-report-format.json
+++ /dev/null
@@ -1,911 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Container Scanning",
- "description": "This schema provides the the report format for Container Scanning (https://docs.gitlab.com/ee/user/application_security/container_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.0"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "container_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "dependency",
- "operating_system",
- "image"
- ],
- "properties": {
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- },
- "operating_system": {
- "type": "string",
- "minLength": 1,
- "description": "The operating system that contains the vulnerable package."
- },
- "image": {
- "type": "string",
- "minLength": 1,
- "pattern": "^[^:]+(:\\d+[^:]*)?:[^:]+$",
- "description": "The analyzed Docker image."
- },
- "default_branch_image": {
- "type": "string",
- "maxLength": 255,
- "pattern": "^[a-zA-Z0-9/_.-]+(:\\d+[a-zA-Z0-9/_.-]*)?:[a-zA-Z0-9_.-]+$",
- "description": "The name of the image on the default branch."
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/coverage-fuzzing-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/coverage-fuzzing-report-format.json
deleted file mode 100644
index f63ebfa2cc2..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/coverage-fuzzing-report-format.json
+++ /dev/null
@@ -1,874 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Fuzz Testing",
- "description": "This schema provides the report format for Coverage Guided Fuzz Testing (https://docs.gitlab.com/ee/user/application_security/coverage_fuzzing).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.0"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "coverage_fuzzing"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "description": "The location of the error",
- "type": "object",
- "properties": {
- "crash_address": {
- "type": "string",
- "description": "The relative address in memory were the crash occurred.",
- "examples": [
- "0xabababab"
- ]
- },
- "stacktrace_snippet": {
- "type": "string",
- "description": "The stack trace recorded during fuzzing resulting the crash.",
- "examples": [
- "func_a+0xabcd\nfunc_b+0xabcc"
- ]
- },
- "crash_state": {
- "type": "string",
- "description": "Minimised and normalized crash stack-trace (called crash_state).",
- "examples": [
- "func_a+0xa\nfunc_b+0xb\nfunc_c+0xc"
- ]
- },
- "crash_type": {
- "type": "string",
- "description": "Type of the crash.",
- "examples": [
- "Heap-Buffer-overflow",
- "Division-by-zero"
- ]
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/dast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/dast-report-format.json
deleted file mode 100644
index 73c03082d32..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/dast-report-format.json
+++ /dev/null
@@ -1,1291 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab DAST",
- "description": "This schema provides the the report format for Dynamic Application Security Testing (https://docs.gitlab.com/ee/user/application_security/dast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.0"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanned_resources",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dast",
- "api_fuzzing"
- ]
- },
- "scanned_resources": {
- "type": "array",
- "description": "The attack surface scanned by DAST.",
- "items": {
- "type": "object",
- "required": [
- "method",
- "url",
- "type"
- ],
- "properties": {
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method of the scanned resource.",
- "examples": [
- "GET",
- "POST",
- "HEAD"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the scanned resource.",
- "examples": [
- "http://my.site.com/a-page"
- ]
- },
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Type of the scanned resource, for DAST, this must be 'url'.",
- "examples": [
- "url"
- ]
- }
- }
- }
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "evidence": {
- "type": "object",
- "properties": {
- "source": {
- "type": "object",
- "description": "Source of evidence",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "Unique source identifier",
- "examples": [
- "assert:LogAnalysis",
- "assert:StatusCode"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Source display name",
- "examples": [
- "Log Analysis",
- "Status Code"
- ]
- },
- "url": {
- "type": "string",
- "description": "Link to additional information",
- "examples": [
- "https://docs.gitlab.com/ee/development/integrations/secure.html"
- ]
- }
- }
- },
- "summary": {
- "type": "string",
- "description": "Human readable string containing evidence of the vulnerability.",
- "examples": [
- "Credit card 4111111111111111 found",
- "Server leaked information nginx/1.17.6"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- },
- "supporting_messages": {
- "type": "array",
- "description": "Array of supporting http messages.",
- "items": {
- "type": "object",
- "description": "A supporting http message.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Message display name.",
- "examples": [
- "Unmodified",
- "Recorded"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- }
- }
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "hostname": {
- "type": "string",
- "description": "The protocol, domain, and port of the application where the vulnerability was found."
- },
- "method": {
- "type": "string",
- "description": "The HTTP method that was used to request the URL where the vulnerability was found."
- },
- "param": {
- "type": "string",
- "description": "A value provided by a vulnerability rule related to the found vulnerability. Examples include a header value, or a parameter used in a HTTP POST."
- },
- "path": {
- "type": "string",
- "description": "The path of the URL where the vulnerability was found. Typically, this would start with a forward slash."
- }
- }
- },
- "assets": {
- "type": "array",
- "description": "Array of build assets associated with vulnerability.",
- "items": {
- "type": "object",
- "description": "Describes an asset associated with vulnerability.",
- "required": [
- "type",
- "name",
- "url"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "The type of asset",
- "enum": [
- "http_session",
- "postman"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Display name for asset",
- "examples": [
- "HTTP Messages",
- "Postman Collection"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "Link to asset in build artifacts",
- "examples": [
- "https://gitlab.com/gitlab-org/security-products/dast/-/jobs/626397001/artifacts/file//output/zap_session.data"
- ]
- }
- }
- }
- },
- "discovered_at": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss.sss, representing when the vulnerability was discovered",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}\\.\\d{3}$",
- "examples": [
- "2020-01-28T03:26:02.956"
- ]
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/dependency-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/dependency-scanning-report-format.json
deleted file mode 100644
index 6f2c3740b09..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/dependency-scanning-report-format.json
+++ /dev/null
@@ -1,968 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Dependency Scanning",
- "description": "This schema provides the the report format for Dependency Scanning analyzers (https://docs.gitlab.com/ee/user/application_security/dependency_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.0"
- },
- "required": [
- "dependency_files",
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dependency_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "file",
- "dependency"
- ],
- "properties": {
- "file": {
- "type": "string",
- "minLength": 1,
- "description": "Path to the manifest or lock file where the dependency is declared (such as yarn.lock)."
- },
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- },
- "dependency_files": {
- "type": "array",
- "description": "List of dependency files identified in the project.",
- "items": {
- "type": "object",
- "required": [
- "path",
- "package_manager",
- "dependencies"
- ],
- "properties": {
- "path": {
- "type": "string",
- "minLength": 1
- },
- "package_manager": {
- "type": "string",
- "minLength": 1
- },
- "dependencies": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/sast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/sast-report-format.json
deleted file mode 100644
index 5c7f636e169..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/sast-report-format.json
+++ /dev/null
@@ -1,869 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab SAST",
- "description": "This schema provides the report format for Static Application Security Testing analyzers (https://docs.gitlab.com/ee/user/application_security/sast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.0"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "sast"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability."
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located."
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located."
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/secret-detection-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/secret-detection-report-format.json
deleted file mode 100644
index a87388c45e7..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0/secret-detection-report-format.json
+++ /dev/null
@@ -1,892 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Secret Detection",
- "description": "This schema provides the the report format for the Secret Detection analyzer (https://docs.gitlab.com/ee/user/application_security/secret_detection)",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.0"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "secret_detection"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "required": [
- "commit"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located"
- },
- "commit": {
- "type": "object",
- "description": "Represents the commit in which the vulnerability was detected",
- "required": [
- "sha"
- ],
- "properties": {
- "author": {
- "type": "string"
- },
- "date": {
- "type": "string"
- },
- "message": {
- "type": "string"
- },
- "sha": {
- "type": "string",
- "minLength": 1
- }
- }
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability"
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability"
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located"
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located"
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/cluster-image-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/cluster-image-scanning-report-format.json
deleted file mode 100644
index 7bcb2d5867f..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/cluster-image-scanning-report-format.json
+++ /dev/null
@@ -1,977 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Cluster Image Scanning",
- "description": "This schema provides the the report format for Cluster Image Scanning (https://docs.gitlab.com/ee/user/application_security/cluster_image_scanning/).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.1"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "cluster_image_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "dependency",
- "image",
- "kubernetes_resource"
- ],
- "properties": {
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- },
- "operating_system": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The operating system that contains the vulnerable package."
- },
- "image": {
- "type": "string",
- "minLength": 1,
- "description": "The analyzed Docker image.",
- "examples": [
- "index.docker.io/library/nginx:1.21"
- ]
- },
- "kubernetes_resource": {
- "type": "object",
- "description": "The specific Kubernetes resource that was scanned.",
- "required": [
- "namespace",
- "kind",
- "name",
- "container_name"
- ],
- "properties": {
- "namespace": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The Kubernetes namespace the resource that had its image scanned.",
- "examples": [
- "default",
- "staging",
- "production"
- ]
- },
- "kind": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The Kubernetes kind the resource that had its image scanned.",
- "examples": [
- "Deployment",
- "DaemonSet"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The name of the resource that had its image scanned.",
- "examples": [
- "nginx-ingress"
- ]
- },
- "container_name": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The name of the container that had its image scanned.",
- "examples": [
- "nginx"
- ]
- },
- "agent_id": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The GitLab ID of the Kubernetes Agent which performed the scan.",
- "examples": [
- "1234"
- ]
- },
- "cluster_id": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The GitLab ID of the Kubernetes cluster when using cluster integration.",
- "examples": [
- "1234"
- ]
- }
- }
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/container-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/container-scanning-report-format.json
deleted file mode 100644
index a13e0418499..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/container-scanning-report-format.json
+++ /dev/null
@@ -1,911 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Container Scanning",
- "description": "This schema provides the the report format for Container Scanning (https://docs.gitlab.com/ee/user/application_security/container_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.1"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "container_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "dependency",
- "operating_system",
- "image"
- ],
- "properties": {
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- },
- "operating_system": {
- "type": "string",
- "minLength": 1,
- "description": "The operating system that contains the vulnerable package."
- },
- "image": {
- "type": "string",
- "minLength": 1,
- "pattern": "^[^:]+(:\\d+[^:]*)?:[^:]+$",
- "description": "The analyzed Docker image."
- },
- "default_branch_image": {
- "type": "string",
- "maxLength": 255,
- "pattern": "^[a-zA-Z0-9/_.-]+(:\\d+[a-zA-Z0-9/_.-]*)?:[a-zA-Z0-9_.-]+$",
- "description": "The name of the image on the default branch."
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/coverage-fuzzing-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/coverage-fuzzing-report-format.json
deleted file mode 100644
index 050c34669b3..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/coverage-fuzzing-report-format.json
+++ /dev/null
@@ -1,874 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Fuzz Testing",
- "description": "This schema provides the report format for Coverage Guided Fuzz Testing (https://docs.gitlab.com/ee/user/application_security/coverage_fuzzing).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.1"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "coverage_fuzzing"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "description": "The location of the error",
- "type": "object",
- "properties": {
- "crash_address": {
- "type": "string",
- "description": "The relative address in memory were the crash occurred.",
- "examples": [
- "0xabababab"
- ]
- },
- "stacktrace_snippet": {
- "type": "string",
- "description": "The stack trace recorded during fuzzing resulting the crash.",
- "examples": [
- "func_a+0xabcd\nfunc_b+0xabcc"
- ]
- },
- "crash_state": {
- "type": "string",
- "description": "Minimised and normalized crash stack-trace (called crash_state).",
- "examples": [
- "func_a+0xa\nfunc_b+0xb\nfunc_c+0xc"
- ]
- },
- "crash_type": {
- "type": "string",
- "description": "Type of the crash.",
- "examples": [
- "Heap-Buffer-overflow",
- "Division-by-zero"
- ]
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/dast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/dast-report-format.json
deleted file mode 100644
index 62ed293ad44..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/dast-report-format.json
+++ /dev/null
@@ -1,1291 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab DAST",
- "description": "This schema provides the the report format for Dynamic Application Security Testing (https://docs.gitlab.com/ee/user/application_security/dast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.1"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanned_resources",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dast",
- "api_fuzzing"
- ]
- },
- "scanned_resources": {
- "type": "array",
- "description": "The attack surface scanned by DAST.",
- "items": {
- "type": "object",
- "required": [
- "method",
- "url",
- "type"
- ],
- "properties": {
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method of the scanned resource.",
- "examples": [
- "GET",
- "POST",
- "HEAD"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the scanned resource.",
- "examples": [
- "http://my.site.com/a-page"
- ]
- },
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Type of the scanned resource, for DAST, this must be 'url'.",
- "examples": [
- "url"
- ]
- }
- }
- }
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "evidence": {
- "type": "object",
- "properties": {
- "source": {
- "type": "object",
- "description": "Source of evidence",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "Unique source identifier",
- "examples": [
- "assert:LogAnalysis",
- "assert:StatusCode"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Source display name",
- "examples": [
- "Log Analysis",
- "Status Code"
- ]
- },
- "url": {
- "type": "string",
- "description": "Link to additional information",
- "examples": [
- "https://docs.gitlab.com/ee/development/integrations/secure.html"
- ]
- }
- }
- },
- "summary": {
- "type": "string",
- "description": "Human readable string containing evidence of the vulnerability.",
- "examples": [
- "Credit card 4111111111111111 found",
- "Server leaked information nginx/1.17.6"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- },
- "supporting_messages": {
- "type": "array",
- "description": "Array of supporting http messages.",
- "items": {
- "type": "object",
- "description": "A supporting http message.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Message display name.",
- "examples": [
- "Unmodified",
- "Recorded"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "minLength": 1,
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- }
- }
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "hostname": {
- "type": "string",
- "description": "The protocol, domain, and port of the application where the vulnerability was found."
- },
- "method": {
- "type": "string",
- "description": "The HTTP method that was used to request the URL where the vulnerability was found."
- },
- "param": {
- "type": "string",
- "description": "A value provided by a vulnerability rule related to the found vulnerability. Examples include a header value, or a parameter used in a HTTP POST."
- },
- "path": {
- "type": "string",
- "description": "The path of the URL where the vulnerability was found. Typically, this would start with a forward slash."
- }
- }
- },
- "assets": {
- "type": "array",
- "description": "Array of build assets associated with vulnerability.",
- "items": {
- "type": "object",
- "description": "Describes an asset associated with vulnerability.",
- "required": [
- "type",
- "name",
- "url"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "The type of asset",
- "enum": [
- "http_session",
- "postman"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Display name for asset",
- "examples": [
- "HTTP Messages",
- "Postman Collection"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "Link to asset in build artifacts",
- "examples": [
- "https://gitlab.com/gitlab-org/security-products/dast/-/jobs/626397001/artifacts/file//output/zap_session.data"
- ]
- }
- }
- }
- },
- "discovered_at": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss.sss, representing when the vulnerability was discovered",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}\\.\\d{3}$",
- "examples": [
- "2020-01-28T03:26:02.956"
- ]
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/dependency-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/dependency-scanning-report-format.json
deleted file mode 100644
index 1e3f4188845..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/dependency-scanning-report-format.json
+++ /dev/null
@@ -1,968 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Dependency Scanning",
- "description": "This schema provides the the report format for Dependency Scanning analyzers (https://docs.gitlab.com/ee/user/application_security/dependency_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.1"
- },
- "required": [
- "dependency_files",
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dependency_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "file",
- "dependency"
- ],
- "properties": {
- "file": {
- "type": "string",
- "minLength": 1,
- "description": "Path to the manifest or lock file where the dependency is declared (such as yarn.lock)."
- },
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- },
- "dependency_files": {
- "type": "array",
- "description": "List of dependency files identified in the project.",
- "items": {
- "type": "object",
- "required": [
- "path",
- "package_manager",
- "dependencies"
- ],
- "properties": {
- "path": {
- "type": "string",
- "minLength": 1
- },
- "package_manager": {
- "type": "string",
- "minLength": 1
- },
- "dependencies": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/sast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/sast-report-format.json
deleted file mode 100644
index 4c57d20dbaa..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/sast-report-format.json
+++ /dev/null
@@ -1,869 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab SAST",
- "description": "This schema provides the report format for Static Application Security Testing analyzers (https://docs.gitlab.com/ee/user/application_security/sast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.1"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "sast"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability."
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located."
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located."
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/secret-detection-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/secret-detection-report-format.json
deleted file mode 100644
index b1337954e97..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.1/secret-detection-report-format.json
+++ /dev/null
@@ -1,892 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Secret Detection",
- "description": "This schema provides the the report format for the Secret Detection analyzer (https://docs.gitlab.com/ee/user/application_security/secret_detection)",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.1"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "secret_detection"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "required": [
- "commit"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located"
- },
- "commit": {
- "type": "object",
- "description": "Represents the commit in which the vulnerability was detected",
- "required": [
- "sha"
- ],
- "properties": {
- "author": {
- "type": "string"
- },
- "date": {
- "type": "string"
- },
- "message": {
- "type": "string"
- },
- "sha": {
- "type": "string",
- "minLength": 1
- }
- }
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability"
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability"
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located"
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located"
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/cluster-image-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/cluster-image-scanning-report-format.json
deleted file mode 100644
index 31840a7e914..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/cluster-image-scanning-report-format.json
+++ /dev/null
@@ -1,977 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Cluster Image Scanning",
- "description": "This schema provides the the report format for Cluster Image Scanning (https://docs.gitlab.com/ee/user/application_security/cluster_image_scanning/).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.2"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "cluster_image_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "dependency",
- "image",
- "kubernetes_resource"
- ],
- "properties": {
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- },
- "operating_system": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The operating system that contains the vulnerable package."
- },
- "image": {
- "type": "string",
- "minLength": 1,
- "description": "The analyzed Docker image.",
- "examples": [
- "index.docker.io/library/nginx:1.21"
- ]
- },
- "kubernetes_resource": {
- "type": "object",
- "description": "The specific Kubernetes resource that was scanned.",
- "required": [
- "namespace",
- "kind",
- "name",
- "container_name"
- ],
- "properties": {
- "namespace": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The Kubernetes namespace the resource that had its image scanned.",
- "examples": [
- "default",
- "staging",
- "production"
- ]
- },
- "kind": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The Kubernetes kind the resource that had its image scanned.",
- "examples": [
- "Deployment",
- "DaemonSet"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The name of the resource that had its image scanned.",
- "examples": [
- "nginx-ingress"
- ]
- },
- "container_name": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The name of the container that had its image scanned.",
- "examples": [
- "nginx"
- ]
- },
- "agent_id": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The GitLab ID of the Kubernetes Agent which performed the scan.",
- "examples": [
- "1234"
- ]
- },
- "cluster_id": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The GitLab ID of the Kubernetes cluster when using cluster integration.",
- "examples": [
- "1234"
- ]
- }
- }
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/container-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/container-scanning-report-format.json
deleted file mode 100644
index c70628a0949..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/container-scanning-report-format.json
+++ /dev/null
@@ -1,911 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Container Scanning",
- "description": "This schema provides the the report format for Container Scanning (https://docs.gitlab.com/ee/user/application_security/container_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.2"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "container_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "dependency",
- "operating_system",
- "image"
- ],
- "properties": {
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- },
- "operating_system": {
- "type": "string",
- "minLength": 1,
- "description": "The operating system that contains the vulnerable package."
- },
- "image": {
- "type": "string",
- "minLength": 1,
- "pattern": "^[^:]+(:\\d+[^:]*)?:[^:]+$",
- "description": "The analyzed Docker image."
- },
- "default_branch_image": {
- "type": "string",
- "maxLength": 255,
- "pattern": "^[a-zA-Z0-9/_.-]+(:\\d+[a-zA-Z0-9/_.-]*)?:[a-zA-Z0-9_.-]+$",
- "description": "The name of the image on the default branch."
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/coverage-fuzzing-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/coverage-fuzzing-report-format.json
deleted file mode 100644
index fbc7b4ea733..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/coverage-fuzzing-report-format.json
+++ /dev/null
@@ -1,874 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Fuzz Testing",
- "description": "This schema provides the report format for Coverage Guided Fuzz Testing (https://docs.gitlab.com/ee/user/application_security/coverage_fuzzing).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.2"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "coverage_fuzzing"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "description": "The location of the error",
- "type": "object",
- "properties": {
- "crash_address": {
- "type": "string",
- "description": "The relative address in memory were the crash occurred.",
- "examples": [
- "0xabababab"
- ]
- },
- "stacktrace_snippet": {
- "type": "string",
- "description": "The stack trace recorded during fuzzing resulting the crash.",
- "examples": [
- "func_a+0xabcd\nfunc_b+0xabcc"
- ]
- },
- "crash_state": {
- "type": "string",
- "description": "Minimised and normalized crash stack-trace (called crash_state).",
- "examples": [
- "func_a+0xa\nfunc_b+0xb\nfunc_c+0xc"
- ]
- },
- "crash_type": {
- "type": "string",
- "description": "Type of the crash.",
- "examples": [
- "Heap-Buffer-overflow",
- "Division-by-zero"
- ]
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/dast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/dast-report-format.json
deleted file mode 100644
index 3c9db0546b1..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/dast-report-format.json
+++ /dev/null
@@ -1,1287 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab DAST",
- "description": "This schema provides the the report format for Dynamic Application Security Testing (https://docs.gitlab.com/ee/user/application_security/dast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.2"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanned_resources",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dast",
- "api_fuzzing"
- ]
- },
- "scanned_resources": {
- "type": "array",
- "description": "The attack surface scanned by DAST.",
- "items": {
- "type": "object",
- "required": [
- "method",
- "url",
- "type"
- ],
- "properties": {
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method of the scanned resource.",
- "examples": [
- "GET",
- "POST",
- "HEAD"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the scanned resource.",
- "examples": [
- "http://my.site.com/a-page"
- ]
- },
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Type of the scanned resource, for DAST, this must be 'url'.",
- "examples": [
- "url"
- ]
- }
- }
- }
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "evidence": {
- "type": "object",
- "properties": {
- "source": {
- "type": "object",
- "description": "Source of evidence",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "Unique source identifier",
- "examples": [
- "assert:LogAnalysis",
- "assert:StatusCode"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Source display name",
- "examples": [
- "Log Analysis",
- "Status Code"
- ]
- },
- "url": {
- "type": "string",
- "description": "Link to additional information",
- "examples": [
- "https://docs.gitlab.com/ee/development/integrations/secure.html"
- ]
- }
- }
- },
- "summary": {
- "type": "string",
- "description": "Human readable string containing evidence of the vulnerability.",
- "examples": [
- "Credit card 4111111111111111 found",
- "Server leaked information nginx/1.17.6"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- },
- "supporting_messages": {
- "type": "array",
- "description": "Array of supporting http messages.",
- "items": {
- "type": "object",
- "description": "A supporting http message.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Message display name.",
- "examples": [
- "Unmodified",
- "Recorded"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- }
- }
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "hostname": {
- "type": "string",
- "description": "The protocol, domain, and port of the application where the vulnerability was found."
- },
- "method": {
- "type": "string",
- "description": "The HTTP method that was used to request the URL where the vulnerability was found."
- },
- "param": {
- "type": "string",
- "description": "A value provided by a vulnerability rule related to the found vulnerability. Examples include a header value, or a parameter used in a HTTP POST."
- },
- "path": {
- "type": "string",
- "description": "The path of the URL where the vulnerability was found. Typically, this would start with a forward slash."
- }
- }
- },
- "assets": {
- "type": "array",
- "description": "Array of build assets associated with vulnerability.",
- "items": {
- "type": "object",
- "description": "Describes an asset associated with vulnerability.",
- "required": [
- "type",
- "name",
- "url"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "The type of asset",
- "enum": [
- "http_session",
- "postman"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Display name for asset",
- "examples": [
- "HTTP Messages",
- "Postman Collection"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "Link to asset in build artifacts",
- "examples": [
- "https://gitlab.com/gitlab-org/security-products/dast/-/jobs/626397001/artifacts/file//output/zap_session.data"
- ]
- }
- }
- }
- },
- "discovered_at": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss.sss, representing when the vulnerability was discovered",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}\\.\\d{3}$",
- "examples": [
- "2020-01-28T03:26:02.956"
- ]
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/dependency-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/dependency-scanning-report-format.json
deleted file mode 100644
index c7459216faf..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/dependency-scanning-report-format.json
+++ /dev/null
@@ -1,968 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Dependency Scanning",
- "description": "This schema provides the the report format for Dependency Scanning analyzers (https://docs.gitlab.com/ee/user/application_security/dependency_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.2"
- },
- "required": [
- "dependency_files",
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dependency_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "file",
- "dependency"
- ],
- "properties": {
- "file": {
- "type": "string",
- "minLength": 1,
- "description": "Path to the manifest or lock file where the dependency is declared (such as yarn.lock)."
- },
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- },
- "dependency_files": {
- "type": "array",
- "description": "List of dependency files identified in the project.",
- "items": {
- "type": "object",
- "required": [
- "path",
- "package_manager",
- "dependencies"
- ],
- "properties": {
- "path": {
- "type": "string",
- "minLength": 1
- },
- "package_manager": {
- "type": "string",
- "minLength": 1
- },
- "dependencies": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/sast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/sast-report-format.json
deleted file mode 100644
index 20818792652..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/sast-report-format.json
+++ /dev/null
@@ -1,869 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab SAST",
- "description": "This schema provides the report format for Static Application Security Testing analyzers (https://docs.gitlab.com/ee/user/application_security/sast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.2"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "sast"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability."
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located."
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located."
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/secret-detection-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/secret-detection-report-format.json
deleted file mode 100644
index 12386d2c1d4..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.2/secret-detection-report-format.json
+++ /dev/null
@@ -1,892 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Secret Detection",
- "description": "This schema provides the the report format for the Secret Detection analyzer (https://docs.gitlab.com/ee/user/application_security/secret_detection)",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.2"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "secret_detection"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "required": [
- "commit"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located"
- },
- "commit": {
- "type": "object",
- "description": "Represents the commit in which the vulnerability was detected",
- "required": [
- "sha"
- ],
- "properties": {
- "author": {
- "type": "string"
- },
- "date": {
- "type": "string"
- },
- "message": {
- "type": "string"
- },
- "sha": {
- "type": "string",
- "minLength": 1
- }
- }
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability"
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability"
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located"
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located"
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/cluster-image-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/cluster-image-scanning-report-format.json
deleted file mode 100644
index db4c7ab1425..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/cluster-image-scanning-report-format.json
+++ /dev/null
@@ -1,977 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Cluster Image Scanning",
- "description": "This schema provides the the report format for Cluster Image Scanning (https://docs.gitlab.com/ee/user/application_security/cluster_image_scanning/).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.3"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "cluster_image_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "dependency",
- "image",
- "kubernetes_resource"
- ],
- "properties": {
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- },
- "operating_system": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The operating system that contains the vulnerable package."
- },
- "image": {
- "type": "string",
- "minLength": 1,
- "description": "The analyzed Docker image.",
- "examples": [
- "index.docker.io/library/nginx:1.21"
- ]
- },
- "kubernetes_resource": {
- "type": "object",
- "description": "The specific Kubernetes resource that was scanned.",
- "required": [
- "namespace",
- "kind",
- "name",
- "container_name"
- ],
- "properties": {
- "namespace": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The Kubernetes namespace the resource that had its image scanned.",
- "examples": [
- "default",
- "staging",
- "production"
- ]
- },
- "kind": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The Kubernetes kind the resource that had its image scanned.",
- "examples": [
- "Deployment",
- "DaemonSet"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The name of the resource that had its image scanned.",
- "examples": [
- "nginx-ingress"
- ]
- },
- "container_name": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The name of the container that had its image scanned.",
- "examples": [
- "nginx"
- ]
- },
- "agent_id": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The GitLab ID of the Kubernetes Agent which performed the scan.",
- "examples": [
- "1234"
- ]
- },
- "cluster_id": {
- "type": "string",
- "minLength": 1,
- "maxLength": 255,
- "description": "The GitLab ID of the Kubernetes cluster when using cluster integration.",
- "examples": [
- "1234"
- ]
- }
- }
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/container-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/container-scanning-report-format.json
deleted file mode 100644
index 641cfc82e48..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/container-scanning-report-format.json
+++ /dev/null
@@ -1,911 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Container Scanning",
- "description": "This schema provides the the report format for Container Scanning (https://docs.gitlab.com/ee/user/application_security/container_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.3"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "container_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "dependency",
- "operating_system",
- "image"
- ],
- "properties": {
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- },
- "operating_system": {
- "type": "string",
- "minLength": 1,
- "description": "The operating system that contains the vulnerable package."
- },
- "image": {
- "type": "string",
- "minLength": 1,
- "pattern": "^[^:]+(:\\d+[^:]*)?:[^:]+(:[^:]+)?$",
- "description": "The analyzed Docker image."
- },
- "default_branch_image": {
- "type": "string",
- "maxLength": 255,
- "pattern": "^[a-zA-Z0-9/_.-]+(:\\d+[a-zA-Z0-9/_.-]*)?:[a-zA-Z0-9_.-]+$",
- "description": "The name of the image on the default branch."
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/coverage-fuzzing-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/coverage-fuzzing-report-format.json
deleted file mode 100644
index 59aa172444d..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/coverage-fuzzing-report-format.json
+++ /dev/null
@@ -1,874 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Fuzz Testing",
- "description": "This schema provides the report format for Coverage Guided Fuzz Testing (https://docs.gitlab.com/ee/user/application_security/coverage_fuzzing).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.3"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "coverage_fuzzing"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "description": "The location of the error",
- "type": "object",
- "properties": {
- "crash_address": {
- "type": "string",
- "description": "The relative address in memory were the crash occurred.",
- "examples": [
- "0xabababab"
- ]
- },
- "stacktrace_snippet": {
- "type": "string",
- "description": "The stack trace recorded during fuzzing resulting the crash.",
- "examples": [
- "func_a+0xabcd\nfunc_b+0xabcc"
- ]
- },
- "crash_state": {
- "type": "string",
- "description": "Minimised and normalized crash stack-trace (called crash_state).",
- "examples": [
- "func_a+0xa\nfunc_b+0xb\nfunc_c+0xc"
- ]
- },
- "crash_type": {
- "type": "string",
- "description": "Type of the crash.",
- "examples": [
- "Heap-Buffer-overflow",
- "Division-by-zero"
- ]
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/dast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/dast-report-format.json
deleted file mode 100644
index 0e4c866794a..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/dast-report-format.json
+++ /dev/null
@@ -1,1287 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab DAST",
- "description": "This schema provides the the report format for Dynamic Application Security Testing (https://docs.gitlab.com/ee/user/application_security/dast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.3"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanned_resources",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dast",
- "api_fuzzing"
- ]
- },
- "scanned_resources": {
- "type": "array",
- "description": "The attack surface scanned by DAST.",
- "items": {
- "type": "object",
- "required": [
- "method",
- "url",
- "type"
- ],
- "properties": {
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method of the scanned resource.",
- "examples": [
- "GET",
- "POST",
- "HEAD"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the scanned resource.",
- "examples": [
- "http://my.site.com/a-page"
- ]
- },
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Type of the scanned resource, for DAST, this must be 'url'.",
- "examples": [
- "url"
- ]
- }
- }
- }
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "evidence": {
- "type": "object",
- "properties": {
- "source": {
- "type": "object",
- "description": "Source of evidence",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "Unique source identifier",
- "examples": [
- "assert:LogAnalysis",
- "assert:StatusCode"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Source display name",
- "examples": [
- "Log Analysis",
- "Status Code"
- ]
- },
- "url": {
- "type": "string",
- "description": "Link to additional information",
- "examples": [
- "https://docs.gitlab.com/ee/development/integrations/secure.html"
- ]
- }
- }
- },
- "summary": {
- "type": "string",
- "description": "Human readable string containing evidence of the vulnerability.",
- "examples": [
- "Credit card 4111111111111111 found",
- "Server leaked information nginx/1.17.6"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- },
- "supporting_messages": {
- "type": "array",
- "description": "Array of supporting http messages.",
- "items": {
- "type": "object",
- "description": "A supporting http message.",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Message display name.",
- "examples": [
- "Unmodified",
- "Recorded"
- ]
- },
- "request": {
- "type": "object",
- "description": "An HTTP request.",
- "required": [
- "headers",
- "method",
- "url"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "method": {
- "type": "string",
- "minLength": 1,
- "description": "HTTP method used in the request.",
- "examples": [
- "GET",
- "POST"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "URL of the request.",
- "examples": [
- "http://my.site.com/vulnerable-endpoint?show-credit-card"
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the request for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "user=jsmith&first=%27&last=smith"
- ]
- }
- }
- },
- "response": {
- "type": "object",
- "description": "An HTTP response.",
- "required": [
- "headers",
- "reason_phrase",
- "status_code"
- ],
- "properties": {
- "headers": {
- "type": "array",
- "description": "HTTP headers present on the request.",
- "items": {
- "type": "object",
- "required": [
- "name",
- "value"
- ],
- "properties": {
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Name of the HTTP header.",
- "examples": [
- "Accept",
- "Content-Length",
- "Content-Type"
- ]
- },
- "value": {
- "type": "string",
- "description": "Value of the HTTP header.",
- "examples": [
- "*/*",
- "560",
- "application/json; charset=utf-8"
- ]
- }
- }
- }
- },
- "reason_phrase": {
- "type": "string",
- "description": "HTTP reason phrase of the response.",
- "examples": [
- "OK",
- "Internal Server Error"
- ]
- },
- "status_code": {
- "type": "integer",
- "description": "HTTP status code of the response.",
- "examples": [
- 200,
- 500
- ]
- },
- "body": {
- "type": "string",
- "description": "Body of the response for display purposes. Body must be suitable for display (not binary), and truncated to a reasonable size.",
- "examples": [
- "{\"user_id\": 2}"
- ]
- }
- }
- }
- }
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "hostname": {
- "type": "string",
- "description": "The protocol, domain, and port of the application where the vulnerability was found."
- },
- "method": {
- "type": "string",
- "description": "The HTTP method that was used to request the URL where the vulnerability was found."
- },
- "param": {
- "type": "string",
- "description": "A value provided by a vulnerability rule related to the found vulnerability. Examples include a header value, or a parameter used in a HTTP POST."
- },
- "path": {
- "type": "string",
- "description": "The path of the URL where the vulnerability was found. Typically, this would start with a forward slash."
- }
- }
- },
- "assets": {
- "type": "array",
- "description": "Array of build assets associated with vulnerability.",
- "items": {
- "type": "object",
- "description": "Describes an asset associated with vulnerability.",
- "required": [
- "type",
- "name",
- "url"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "The type of asset",
- "enum": [
- "http_session",
- "postman"
- ]
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Display name for asset",
- "examples": [
- "HTTP Messages",
- "Postman Collection"
- ]
- },
- "url": {
- "type": "string",
- "minLength": 1,
- "description": "Link to asset in build artifacts",
- "examples": [
- "https://gitlab.com/gitlab-org/security-products/dast/-/jobs/626397001/artifacts/file//output/zap_session.data"
- ]
- }
- }
- }
- },
- "discovered_at": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss.sss, representing when the vulnerability was discovered",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}\\.\\d{3}$",
- "examples": [
- "2020-01-28T03:26:02.956"
- ]
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/dependency-scanning-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/dependency-scanning-report-format.json
deleted file mode 100644
index 652c2f48fe4..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/dependency-scanning-report-format.json
+++ /dev/null
@@ -1,968 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Dependency Scanning",
- "description": "This schema provides the the report format for Dependency Scanning analyzers (https://docs.gitlab.com/ee/user/application_security/dependency_scanning).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.3"
- },
- "required": [
- "dependency_files",
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "dependency_scanning"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "required": [
- "file",
- "dependency"
- ],
- "properties": {
- "file": {
- "type": "string",
- "minLength": 1,
- "description": "Path to the manifest or lock file where the dependency is declared (such as yarn.lock)."
- },
- "dependency": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- },
- "dependency_files": {
- "type": "array",
- "description": "List of dependency files identified in the project.",
- "items": {
- "type": "object",
- "required": [
- "path",
- "package_manager",
- "dependencies"
- ],
- "properties": {
- "path": {
- "type": "string",
- "minLength": 1
- },
- "package_manager": {
- "type": "string",
- "minLength": 1
- },
- "dependencies": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Describes the dependency of a project where the vulnerability is located.",
- "properties": {
- "package": {
- "type": "object",
- "description": "Provides information on the package where the vulnerability is located.",
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the package where the vulnerability is located."
- }
- }
- },
- "version": {
- "type": "string",
- "description": "Version of the vulnerable package."
- },
- "iid": {
- "description": "ID that identifies the dependency in the scope of a dependency file.",
- "type": "number"
- },
- "direct": {
- "type": "boolean",
- "description": "Tells whether this is a direct, top-level dependency of the scanned project."
- },
- "dependency_path": {
- "type": "array",
- "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
- "items": {
- "type": "object",
- "required": [
- "iid"
- ],
- "properties": {
- "iid": {
- "type": "number",
- "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/sast-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/sast-report-format.json
deleted file mode 100644
index 40d4d9f5287..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/sast-report-format.json
+++ /dev/null
@@ -1,869 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab SAST",
- "description": "This schema provides the report format for Static Application Security Testing analyzers (https://docs.gitlab.com/ee/user/application_security/sast).",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.3"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "sast"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "type": "object",
- "description": "Identifies the vulnerability's location.",
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability."
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located."
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located."
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/secret-detection-report-format.json b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/secret-detection-report-format.json
deleted file mode 100644
index cfde126dd7b..00000000000
--- a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.3/secret-detection-report-format.json
+++ /dev/null
@@ -1,892 +0,0 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Report format for GitLab Secret Detection",
- "description": "This schema provides the the report format for the Secret Detection analyzer (https://docs.gitlab.com/ee/user/application_security/secret_detection)",
- "definitions": {
- "detail_type": {
- "oneOf": [
- {
- "$ref": "#/definitions/named_list"
- },
- {
- "$ref": "#/definitions/list"
- },
- {
- "$ref": "#/definitions/table"
- },
- {
- "$ref": "#/definitions/text"
- },
- {
- "$ref": "#/definitions/url"
- },
- {
- "$ref": "#/definitions/code"
- },
- {
- "$ref": "#/definitions/value"
- },
- {
- "$ref": "#/definitions/diff"
- },
- {
- "$ref": "#/definitions/markdown"
- },
- {
- "$ref": "#/definitions/commit"
- },
- {
- "$ref": "#/definitions/file_location"
- },
- {
- "$ref": "#/definitions/module_location"
- }
- ]
- },
- "text_value": {
- "type": "string"
- },
- "named_field": {
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "$ref": "#/definitions/text_value",
- "minLength": 1
- },
- "description": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "named_list": {
- "type": "object",
- "description": "An object with named and typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "named-list"
- },
- "items": {
- "type": "object",
- "patternProperties": {
- "^.*$": {
- "allOf": [
- {
- "$ref": "#/definitions/named_field"
- },
- {
- "$ref": "#/definitions/detail_type"
- }
- ]
- }
- }
- }
- }
- },
- "list": {
- "type": "object",
- "description": "A list of typed fields",
- "required": [
- "type",
- "items"
- ],
- "properties": {
- "type": {
- "const": "list"
- },
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- },
- "table": {
- "type": "object",
- "description": "A table of typed fields",
- "required": [
- "type",
- "rows"
- ],
- "properties": {
- "type": {
- "const": "table"
- },
- "header": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- },
- "rows": {
- "type": "array",
- "items": {
- "type": "array",
- "items": {
- "$ref": "#/definitions/detail_type"
- }
- }
- }
- }
- },
- "text": {
- "type": "object",
- "description": "Raw text",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "text"
- },
- "value": {
- "$ref": "#/definitions/text_value"
- }
- }
- },
- "url": {
- "type": "object",
- "description": "A single URL",
- "required": [
- "type",
- "href"
- ],
- "properties": {
- "type": {
- "const": "url"
- },
- "text": {
- "$ref": "#/definitions/text_value"
- },
- "href": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "http://mysite.com"
- ]
- }
- }
- },
- "code": {
- "type": "object",
- "description": "A codeblock",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "code"
- },
- "value": {
- "type": "string"
- },
- "lang": {
- "type": "string",
- "description": "A programming language"
- }
- }
- },
- "value": {
- "type": "object",
- "description": "A field that can store a range of types of value",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "value"
- },
- "value": {
- "type": [
- "number",
- "string",
- "boolean"
- ]
- }
- }
- },
- "diff": {
- "type": "object",
- "description": "A diff",
- "required": [
- "type",
- "before",
- "after"
- ],
- "properties": {
- "type": {
- "const": "diff"
- },
- "before": {
- "type": "string"
- },
- "after": {
- "type": "string"
- }
- }
- },
- "markdown": {
- "type": "object",
- "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "markdown"
- },
- "value": {
- "$ref": "#/definitions/text_value",
- "examples": [
- "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
- ]
- }
- }
- },
- "commit": {
- "type": "object",
- "description": "A commit/tag/branch within the GitLab project",
- "required": [
- "type",
- "value"
- ],
- "properties": {
- "type": {
- "const": "commit"
- },
- "value": {
- "type": "string",
- "description": "The commit SHA",
- "minLength": 1
- }
- }
- },
- "file_location": {
- "type": "object",
- "description": "A location within a file in the project",
- "required": [
- "type",
- "file_name",
- "line_start"
- ],
- "properties": {
- "type": {
- "const": "file-location"
- },
- "file_name": {
- "type": "string",
- "minLength": 1
- },
- "line_start": {
- "type": "integer"
- },
- "line_end": {
- "type": "integer"
- }
- }
- },
- "module_location": {
- "type": "object",
- "description": "A location within a binary module of the form module+relative_offset",
- "required": [
- "type",
- "module_name",
- "offset"
- ],
- "properties": {
- "type": {
- "const": "module-location"
- },
- "module_name": {
- "type": "string",
- "minLength": 1,
- "examples": [
- "compiled_binary"
- ]
- },
- "offset": {
- "type": "integer",
- "examples": [
- 100
- ]
- }
- }
- }
- },
- "self": {
- "version": "14.1.3"
- },
- "required": [
- "version",
- "vulnerabilities"
- ],
- "additionalProperties": true,
- "properties": {
- "scan": {
- "type": "object",
- "required": [
- "end_time",
- "scanner",
- "start_time",
- "status",
- "type"
- ],
- "properties": {
- "end_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-01-28T03:26:02"
- ]
- },
- "messages": {
- "type": "array",
- "items": {
- "type": "object",
- "description": "Communication intended for the initiator of a scan.",
- "required": [
- "level",
- "value"
- ],
- "properties": {
- "level": {
- "type": "string",
- "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
- "enum": [
- "info",
- "warn",
- "fatal"
- ],
- "examples": [
- "info"
- ]
- },
- "value": {
- "type": "string",
- "description": "The message to communicate.",
- "minLength": 1,
- "examples": [
- "Permission denied, scanning aborted"
- ]
- }
- }
- }
- },
- "analyzer": {
- "type": "object",
- "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the analyzer.",
- "minLength": 1,
- "examples": [
- "gitlab-dast"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the analyzer, not required to be unique.",
- "minLength": 1,
- "examples": [
- "GitLab DAST"
- ]
- },
- "url": {
- "type": "string",
- "format": "uri",
- "pattern": "^https?://.+",
- "description": "A link to more information about the analyzer.",
- "examples": [
- "https://docs.gitlab.com/ee/user/application_security/dast"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the analyzer.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- },
- "version": {
- "type": "string",
- "description": "The version of the analyzer.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- }
- }
- },
- "scanner": {
- "type": "object",
- "description": "Object defining the scanner used to perform the scan.",
- "required": [
- "id",
- "name",
- "version",
- "vendor"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique id that identifies the scanner.",
- "minLength": 1,
- "examples": [
- "my-sast-scanner"
- ]
- },
- "name": {
- "type": "string",
- "description": "A human readable value that identifies the scanner, not required to be unique.",
- "minLength": 1,
- "examples": [
- "My SAST Scanner"
- ]
- },
- "url": {
- "type": "string",
- "description": "A link to more information about the scanner.",
- "examples": [
- "https://scanner.url"
- ]
- },
- "version": {
- "type": "string",
- "description": "The version of the scanner.",
- "minLength": 1,
- "examples": [
- "1.0.2"
- ]
- },
- "vendor": {
- "description": "The vendor/maintainer of the scanner.",
- "type": "object",
- "required": [
- "name"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "The name of the vendor.",
- "minLength": 1,
- "examples": [
- "GitLab"
- ]
- }
- }
- }
- }
- },
- "start_time": {
- "type": "string",
- "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}\\:\\d{2}\\:\\d{2}$",
- "examples": [
- "2020-02-14T16:01:59"
- ]
- },
- "status": {
- "type": "string",
- "description": "Result of the scan.",
- "enum": [
- "success",
- "failure"
- ]
- },
- "type": {
- "type": "string",
- "description": "Type of the scan.",
- "enum": [
- "secret_detection"
- ]
- }
- }
- },
- "schema": {
- "type": "string",
- "description": "URI pointing to the validating security report schema.",
- "format": "uri"
- },
- "version": {
- "type": "string",
- "description": "The version of the schema to which the JSON report conforms.",
- "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
- },
- "vulnerabilities": {
- "type": "array",
- "description": "Array of vulnerability objects.",
- "items": {
- "type": "object",
- "description": "Describes the vulnerability using GitLab Flavored Markdown",
- "required": [
- "category",
- "cve",
- "identifiers",
- "location",
- "scanner"
- ],
- "properties": {
- "id": {
- "type": "string",
- "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
- "examples": [
- "642735a5-1425-428d-8d4e-3c854885a3c9"
- ]
- },
- "category": {
- "type": "string",
- "minLength": 1,
- "description": "Describes where this vulnerability belongs (for example, SAST, Dependency Scanning, and so on)."
- },
- "name": {
- "type": "string",
- "description": "The name of the vulnerability. This must not include the finding's specific information."
- },
- "message": {
- "type": "string",
- "description": "A short text section that describes the vulnerability. This may include the finding's specific information."
- },
- "description": {
- "type": "string",
- "description": "A long text section describing the vulnerability more fully."
- },
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- },
- "severity": {
- "type": "string",
- "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Info",
- "Unknown",
- "Low",
- "Medium",
- "High",
- "Critical"
- ]
- },
- "confidence": {
- "type": "string",
- "description": "How reliable the vulnerability's assessment is. Possible values are Ignore, Unknown, Experimental, Low, Medium, High, and Confirmed. Note that some analyzers may not report all these possible values.",
- "enum": [
- "Ignore",
- "Unknown",
- "Experimental",
- "Low",
- "Medium",
- "High",
- "Confirmed"
- ]
- },
- "solution": {
- "type": "string",
- "description": "Explanation of how to fix the vulnerability."
- },
- "scanner": {
- "description": "Describes the scanner used to find this vulnerability.",
- "type": "object",
- "required": [
- "id",
- "name"
- ],
- "properties": {
- "id": {
- "type": "string",
- "minLength": 1,
- "description": "The scanner's ID, as a snake_case string."
- },
- "name": {
- "type": "string",
- "minLength": 1,
- "description": "Human-readable name of the scanner."
- }
- }
- },
- "identifiers": {
- "type": "array",
- "minItems": 1,
- "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
- "items": {
- "type": "object",
- "required": [
- "type",
- "name",
- "value"
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
- "minLength": 1
- },
- "name": {
- "type": "string",
- "description": "Human-readable name of the identifier.",
- "minLength": 1
- },
- "url": {
- "type": "string",
- "description": "URL of the identifier's documentation.",
- "format": "uri"
- },
- "value": {
- "type": "string",
- "description": "Value of the identifier, for matching purpose.",
- "minLength": 1
- }
- }
- }
- },
- "links": {
- "type": "array",
- "description": "An array of references to external documentation or articles that describe the vulnerability.",
- "items": {
- "type": "object",
- "required": [
- "url"
- ],
- "properties": {
- "name": {
- "type": "string",
- "description": "Name of the vulnerability details link."
- },
- "url": {
- "type": "string",
- "description": "URL of the vulnerability details document.",
- "format": "uri"
- }
- }
- }
- },
- "details": {
- "$ref": "#/definitions/named_list/properties/items"
- },
- "tracking": {
- "description": "Describes how this vulnerability should be tracked as the project changes.",
- "oneOf": [
- {
- "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
- "required": [
- "items"
- ],
- "properties": {
- "type": {
- "const": "source"
- },
- "items": {
- "type": "array",
- "items": {
- "description": "An item that should be tracked using source-specific tracking methods.",
- "type": "object",
- "required": [
- "signatures"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located."
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the file that includes the vulnerability."
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the file that includes the vulnerability."
- },
- "signatures": {
- "type": "array",
- "description": "An array of calculated tracking signatures for this tracking item.",
- "minItems": 1,
- "items": {
- "description": "A calculated tracking signature value and metadata.",
- "required": [
- "algorithm",
- "value"
- ],
- "properties": {
- "algorithm": {
- "type": "string",
- "description": "The algorithm used to generate the signature."
- },
- "value": {
- "type": "string",
- "description": "The result of this signature algorithm."
- }
- }
- }
- }
- }
- }
- }
- }
- }
- ],
- "properties": {
- "type": {
- "type": "string",
- "description": "Each tracking type must declare its own type."
- }
- }
- },
- "flags": {
- "description": "Flags that can be attached to vulnerabilities.",
- "type": "array",
- "items": {
- "type": "object",
- "description": "Informational flags identified and assigned to a vulnerability.",
- "required": [
- "type",
- "origin",
- "description"
- ],
- "properties": {
- "type": {
- "type": "string",
- "minLength": 1,
- "description": "Result of the scan.",
- "enum": [
- "flagged-as-likely-false-positive"
- ]
- },
- "origin": {
- "minLength": 1,
- "description": "Tool that issued the flag.",
- "type": "string"
- },
- "description": {
- "minLength": 1,
- "description": "What the flag is about.",
- "type": "string"
- }
- }
- }
- },
- "location": {
- "required": [
- "commit"
- ],
- "properties": {
- "file": {
- "type": "string",
- "description": "Path to the file where the vulnerability is located"
- },
- "commit": {
- "type": "object",
- "description": "Represents the commit in which the vulnerability was detected",
- "required": [
- "sha"
- ],
- "properties": {
- "author": {
- "type": "string"
- },
- "date": {
- "type": "string"
- },
- "message": {
- "type": "string"
- },
- "sha": {
- "type": "string",
- "minLength": 1
- }
- }
- },
- "start_line": {
- "type": "number",
- "description": "The first line of the code affected by the vulnerability"
- },
- "end_line": {
- "type": "number",
- "description": "The last line of the code affected by the vulnerability"
- },
- "class": {
- "type": "string",
- "description": "Provides the name of the class where the vulnerability is located"
- },
- "method": {
- "type": "string",
- "description": "Provides the name of the method where the vulnerability is located"
- }
- }
- },
- "raw_source_code_extract": {
- "type": "string",
- "description": "Provides an unsanitized excerpt of the affected source code."
- }
- }
- }
- },
- "remediations": {
- "type": "array",
- "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
- "items": {
- "type": "object",
- "required": [
- "fixes",
- "summary",
- "diff"
- ],
- "properties": {
- "fixes": {
- "type": "array",
- "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
- "items": {
- "type": "object",
- "required": [
- "cve"
- ],
- "properties": {
- "cve": {
- "type": "string",
- "description": "(Deprecated - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete finding. This is used to determine whether two findings are same, which may not be 100% accurate. Note that this is NOT a CVE as described by https://cve.mitre.org/."
- }
- }
- }
- },
- "summary": {
- "type": "string",
- "minLength": 1,
- "description": "An overview of how the vulnerabilities were fixed."
- },
- "diff": {
- "type": "string",
- "minLength": 1,
- "description": "A base64-encoded remediation code diff, compatible with git apply."
- }
- }
- }
- }
- }
-}
diff --git a/lib/gitlab/ci/templates/Security/BAS.latest.gitlab-ci.yml b/lib/gitlab/ci/templates/Security/BAS.latest.gitlab-ci.yml
new file mode 100644
index 00000000000..b626a7ca770
--- /dev/null
+++ b/lib/gitlab/ci/templates/Security/BAS.latest.gitlab-ci.yml
@@ -0,0 +1,65 @@
+# To contribute improvements to CI/CD templates, please follow the Development guide at:
+# https://docs.gitlab.com/ee/development/cicd/templates.html
+# This specific template is located at:
+# https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Security/BAS.latest.gitlab-ci.yml
+
+# To use this template, add the following to your .gitlab-ci.yml file:
+#
+# include:
+# template: BAS.latest.gitlab-ci.yml
+#
+# You also need to add a `dast` stage to your `stages:` configuration. A sample configuration for DAST:
+#
+# stages:
+# - build
+# - test
+# - deploy
+# - dast
+#
+# Read more about this feature here: https://docs.gitlab.com/ee/user/application_security/breach_and_attack_simulation/index.html#extend-dynamic-application-security-testing-dast
+
+# Include the DAST.latest template if $DAST_VERSION is null because this means a DAST template has not been included already.
+include:
+ - template: Security/DAST.latest.gitlab-ci.yml
+ rules:
+ - if: $DAST_VERSION == null
+
+variables:
+ BAS_CALLBACK_IMAGE_TAG: "latest"
+ BAS_DAST_IMAGE_TAG: "latest"
+ # Setting this variable will affect all Security templates
+ # (SAST, Dependency Scanning, ...)
+ SECURE_ANALYZERS_PREFIX: "$CI_TEMPLATE_REGISTRY_HOST/security-products"
+
+dast_with_bas:
+ extends:
+ - dast
+ - .dast_with_bas
+ rules:
+ # Don't add if the DAST+BAS job is disabled.
+ - if: $DAST_BAS_DISABLED == 'true' || $DAST_BAS_DISABLED == '1'
+ when: never
+ # Add the job to merge request pipelines if there's an open merge request.
+ - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+ # Don't add it to a *branch* pipeline if it's already in a merge request pipeline.
+ - if: $CI_OPEN_MERGE_REQUESTS
+ when: never
+ # If there's no open merge request, add it to a *branch* pipeline instead.
+ - if: $CI_COMMIT_BRANCH
+
+.dast_with_bas:
+ image:
+ name: "$SECURE_ANALYZERS_PREFIX/dast/breach-and-attack-simulation:$BAS_DAST_IMAGE_TAG"
+ variables:
+ DAST_BROWSER_SCAN: "true"
+ DAST_FF_ENABLE_BAS: "true"
+ DAST_FULL_SCAN_ENABLED: "true"
+
+.dast_with_bas_using_services:
+ extends: .dast_with_bas
+ services:
+ - name: "$SECURE_ANALYZERS_PREFIX/callback:$BAS_CALLBACK_IMAGE_TAG"
+ alias: callback
+ variables:
+ DAST_BROWSER_CALLBACK: "Address:http://callback"
+ FF_NETWORK_PER_BUILD: "true"
diff --git a/lib/gitlab/quick_actions/merge_request_actions.rb b/lib/gitlab/quick_actions/merge_request_actions.rb
index f0ad6653c5e..c374593bf01 100644
--- a/lib/gitlab/quick_actions/merge_request_actions.rb
+++ b/lib/gitlab/quick_actions/merge_request_actions.rb
@@ -102,7 +102,7 @@ module Gitlab
(quick_action_target.new_record? || current_user.can?(:"update_#{quick_action_target.to_ability_name}", quick_action_target))
end
command :draft do
- @updates[:wip_event] = draft_action_command
+ @updates[:wip_event] = 'draft'
end
desc { _('Set the Ready status') }
@@ -309,21 +309,11 @@ module Gitlab
noun = quick_action_target.to_ability_name.humanize(capitalize: false)
if !quick_action_target.draft?
_("%{verb} this %{noun} as a draft.")
- elsif Feature.disabled?(:draft_quick_action_non_toggle, quick_action_target.project)
- _("%{verb} this %{noun} as ready.")
else
_("No change to this %{noun}'s draft status.")
end % { verb: verb, noun: noun }
end
- def draft_action_command
- if Feature.disabled?(:draft_quick_action_non_toggle, quick_action_target.project)
- quick_action_target.draft? ? 'ready' : 'draft'
- else
- 'draft'
- end
- end
-
def merge_orchestration_service
@merge_orchestration_service ||= ::MergeRequests::MergeOrchestrationService.new(project, current_user)
end
diff --git a/lib/gitlab/usage_data_counters/known_events/ci_templates.yml b/lib/gitlab/usage_data_counters/known_events/ci_templates.yml
index 82c023e6e38..f685f0d65d9 100644
--- a/lib/gitlab/usage_data_counters/known_events/ci_templates.yml
+++ b/lib/gitlab/usage_data_counters/known_events/ci_templates.yml
@@ -85,6 +85,8 @@
aggregation: weekly
- name: p_ci_templates_security_sast_iac_latest
aggregation: weekly
+- name: p_ci_templates_security_bas_latest
+ aggregation: weekly
- name: p_ci_templates_qualys_iac_security
aggregation: weekly
- name: p_ci_templates_ios_fastlane
diff --git a/lib/sidebars/admin/panel.rb b/lib/sidebars/admin/panel.rb
index 95a5c183e96..4f14c4ffb49 100644
--- a/lib/sidebars/admin/panel.rb
+++ b/lib/sidebars/admin/panel.rb
@@ -22,7 +22,8 @@ module Sidebars
override :super_sidebar_context_header
def super_sidebar_context_header
@super_sidebar_context_header ||= {
- title: aria_label
+ title: aria_label,
+ icon: 'admin'
}
end
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index da217acab98..ab435049daa 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -1274,9 +1274,6 @@ msgstr ""
msgid "%{verb} this %{noun} as a draft."
msgstr ""
-msgid "%{verb} this %{noun} as ready."
-msgstr ""
-
msgid "%{webhooks_link_start}%{webhook_type}%{link_end} enable you to send notifications to web applications in response to events in a group or project."
msgstr ""
@@ -6956,6 +6953,9 @@ msgstr ""
msgid "Below you will find all the groups that are public."
msgstr ""
+msgid "Beta"
+msgstr ""
+
msgid "Bi-weekly code coverage"
msgstr ""
@@ -40691,6 +40691,12 @@ msgstr ""
msgid "SecurityReports|Activity"
msgstr ""
+msgid "SecurityReports|Add a comment"
+msgstr ""
+
+msgid "SecurityReports|Add a comment (required)"
+msgstr ""
+
msgid "SecurityReports|Add a comment or reason for dismissal"
msgstr ""
@@ -40931,6 +40937,9 @@ msgstr ""
msgid "SecurityReports|Select a project to add by using the project search field above."
msgstr ""
+msgid "SecurityReports|Set dismissal reason"
+msgstr ""
+
msgid "SecurityReports|Set status"
msgstr ""
@@ -50976,9 +50985,6 @@ msgstr ""
msgid "Workspaces|GitLab Workspaces is a powerful collaborative platform that provides a comprehensive set of tools for software development teams to manage their entire development lifecycle."
msgstr ""
-msgid "Workspaces|Hours before automatic termination"
-msgstr ""
-
msgid "Workspaces|New workspace"
msgstr ""
@@ -51024,7 +51030,10 @@ msgstr ""
msgid "Workspaces|Terminating"
msgstr ""
-msgid "Workspaces|To create a workspace for this project, an administrator must configure an agent for the project's group."
+msgid "Workspaces|Time before automatic termination"
+msgstr ""
+
+msgid "Workspaces|To create a workspace for this project, an administrator must %{linkStart}configure a cluster agent%{linkEnd} for the project's group."
msgstr ""
msgid "Workspaces|To create a workspace, add a devfile to this project. A devfile is a configuration file for your workspace."
diff --git a/package.json b/package.json
index 6ab6e397808..f605019d248 100644
--- a/package.json
+++ b/package.json
@@ -57,7 +57,7 @@
"@gitlab/favicon-overlay": "2.0.0",
"@gitlab/fonts": "^1.2.0",
"@gitlab/svgs": "3.46.0",
- "@gitlab/ui": "62.9.1",
+ "@gitlab/ui": "62.9.2",
"@gitlab/visual-review-tools": "1.7.3",
"@gitlab/web-ide": "0.0.1-dev-20230508202052",
"@mattiasbuelens/web-streams-adapter": "^0.1.0",
diff --git a/spec/features/broadcast_messages_spec.rb b/spec/features/broadcast_messages_spec.rb
index 3e4289347e3..2fad15c8a1f 100644
--- a/spec/features/broadcast_messages_spec.rb
+++ b/spec/features/broadcast_messages_spec.rb
@@ -7,7 +7,7 @@ RSpec.describe 'Broadcast Messages', feature_category: :onboarding do
shared_examples 'a Broadcast Messages' do |type|
it 'shows broadcast message' do
- visit root_path
+ visit explore_projects_path
expect(page).to have_content 'SampleMessage'
end
@@ -15,17 +15,17 @@ RSpec.describe 'Broadcast Messages', feature_category: :onboarding do
it 'renders styled links' do
create(:broadcast_message, type, message: "<a href='gitlab.com' style='color: purple'>click me</a>")
- visit root_path
+ visit explore_projects_path
expected_html = "<p><a href=\"gitlab.com\" style=\"color: purple\">click me</a></p>"
expect(page.body).to include(expected_html)
end
end
- shared_examples 'a dismissable Broadcast Messages' do
+ shared_examples 'a dismissible Broadcast Messages' do
it 'hides broadcast message after dismiss', :js,
quarantine: 'https://gitlab.com/gitlab-org/gitlab/-/issues/390900' do
- visit root_path
+ visit explore_projects_path
find('.js-dismiss-current-broadcast-notification').click
@@ -34,25 +34,25 @@ RSpec.describe 'Broadcast Messages', feature_category: :onboarding do
it 'broadcast message is still hidden after refresh', :js,
quarantine: 'https://gitlab.com/gitlab-org/gitlab/-/issues/391406' do
- visit root_path
+ visit explore_projects_path
find('.js-dismiss-current-broadcast-notification').click
wait_for_cookie_set("hide_broadcast_message_#{broadcast_message.id}")
- visit root_path
+ visit explore_projects_path
expect(page).not_to have_content 'SampleMessage'
end
end
describe 'banner type' do
- let!(:broadcast_message) { create(:broadcast_message, message: 'SampleMessage') }
+ let_it_be(:broadcast_message) { create(:broadcast_message, message: 'SampleMessage') }
it_behaves_like 'a Broadcast Messages'
- it 'is not dismissable' do
- visit root_path
+ it 'is not dismissible' do
+ visit explore_projects_path
expect(page).not_to have_selector('.js-dismiss-current-broadcast-notification')
end
@@ -62,33 +62,33 @@ RSpec.describe 'Broadcast Messages', feature_category: :onboarding do
sign_in(user)
- visit root_path
+ visit explore_projects_path
expect(page).to have_content 'Hi {{name}}'
end
end
- describe 'dismissable banner type' do
- let!(:broadcast_message) { create(:broadcast_message, dismissable: true, message: 'SampleMessage') }
+ describe 'dismissible banner type' do
+ let_it_be(:broadcast_message) { create(:broadcast_message, dismissable: true, message: 'SampleMessage') }
it_behaves_like 'a Broadcast Messages'
- it_behaves_like 'a dismissable Broadcast Messages'
+ it_behaves_like 'a dismissible Broadcast Messages'
end
describe 'notification type' do
- let!(:broadcast_message) { create(:broadcast_message, :notification, message: 'SampleMessage') }
+ let_it_be(:broadcast_message) { create(:broadcast_message, :notification, message: 'SampleMessage') }
it_behaves_like 'a Broadcast Messages', :notification
- it_behaves_like 'a dismissable Broadcast Messages'
+ it_behaves_like 'a dismissible Broadcast Messages'
it 'replaces placeholders' do
create(:broadcast_message, :notification, message: 'Hi {{name}}')
sign_in(user)
- visit root_path
+ visit explore_projects_path
expect(page).to have_content "Hi #{user.name}"
end
diff --git a/spec/frontend/boards/components/board_content_spec.js b/spec/frontend/boards/components/board_content_spec.js
index b109c2a3ab1..e14f661a8bd 100644
--- a/spec/frontend/boards/components/board_content_spec.js
+++ b/spec/frontend/boards/components/board_content_spec.js
@@ -1,9 +1,8 @@
import { GlAlert } from '@gitlab/ui';
import { shallowMount } from '@vue/test-utils';
-import Vue, { nextTick } from 'vue';
+import Vue from 'vue';
import Draggable from 'vuedraggable';
import Vuex from 'vuex';
-
import eventHub from '~/boards/eventhub';
import { stubComponent } from 'helpers/stub_component';
import waitForPromises from 'helpers/wait_for_promises';
@@ -77,29 +76,6 @@ describe('BoardContent', () => {
});
};
- beforeAll(() => {
- global.ResizeObserver = class MockResizeObserver {
- constructor(callback) {
- this.callback = callback;
-
- this.entries = [];
- }
-
- observe(entry) {
- this.entries.push(entry);
- }
-
- disconnect() {
- this.entries = [];
- this.callback = null;
- }
-
- trigger() {
- this.callback(this.entries);
- }
- };
- });
-
describe('default', () => {
beforeEach(() => {
createComponent();
@@ -118,34 +94,6 @@ describe('BoardContent', () => {
expect(wrapper.findComponent(GlAlert).exists()).toBe(false);
});
- it('on small screens, sets board container height to full height', async () => {
- window.innerHeight = 1000;
- window.innerWidth = 767;
- jest.spyOn(Element.prototype, 'getBoundingClientRect').mockReturnValue({ top: 100 });
-
- wrapper.vm.resizeObserver.trigger();
-
- await nextTick();
-
- const style = wrapper.findComponent({ ref: 'list' }).attributes('style');
-
- expect(style).toBe('height: 1000px;');
- });
-
- it('on large screens, sets board container height fill area below filters', async () => {
- window.innerHeight = 1000;
- window.innerWidth = 768;
- jest.spyOn(Element.prototype, 'getBoundingClientRect').mockReturnValue({ top: 100 });
-
- wrapper.vm.resizeObserver.trigger();
-
- await nextTick();
-
- const style = wrapper.findComponent({ ref: 'list' }).attributes('style');
-
- expect(style).toBe('height: 900px;');
- });
-
it('sets delay and delayOnTouchOnly attributes on board list', () => {
const listEl = wrapper.findComponent({ ref: 'list' });
diff --git a/spec/frontend/ci/runner/admin_runners/admin_runners_app_spec.js b/spec/frontend/ci/runner/admin_runners/admin_runners_app_spec.js
index 6fc6c0b6085..c3d33c88422 100644
--- a/spec/frontend/ci/runner/admin_runners/admin_runners_app_spec.js
+++ b/spec/frontend/ci/runner/admin_runners/admin_runners_app_spec.js
@@ -60,8 +60,6 @@ import {
mockRegistrationToken,
newRunnerPath,
emptyPageInfo,
- emptyStateSvgPath,
- emptyStateFilteredSvgPath,
} from '../mock_data';
const mockRunners = allRunnersData.data.runners.nodes;
@@ -122,8 +120,6 @@ describe('AdminRunnersApp', () => {
localMutations,
onlineContactTimeoutSecs,
staleTimeoutSecs,
- emptyStateSvgPath,
- emptyStateFilteredSvgPath,
...provide,
},
...options,
@@ -448,9 +444,7 @@ describe('AdminRunnersApp', () => {
expect(findRunnerListEmptyState().props()).toEqual({
newRunnerPath,
isSearchFiltered: false,
- filteredSvgPath: emptyStateFilteredSvgPath,
registrationToken: mockRegistrationToken,
- svgPath: emptyStateSvgPath,
});
});
diff --git a/spec/frontend/ci/runner/components/runner_jobs_empty_state_spec.js b/spec/frontend/ci/runner/components/runner_jobs_empty_state_spec.js
index e64308f49d1..59c9383cb31 100644
--- a/spec/frontend/ci/runner/components/runner_jobs_empty_state_spec.js
+++ b/spec/frontend/ci/runner/components/runner_jobs_empty_state_spec.js
@@ -1,3 +1,5 @@
+import EMPTY_STATE_SVG_URL from '@gitlab/svgs/dist/illustrations/pipelines_empty.svg?url';
+
import { shallowMount } from '@vue/test-utils';
import { GlEmptyState } from '@gitlab/ui';
import RunnerJobsEmptyState from '~/ci/runner/components/runner_jobs_empty_state.vue';
@@ -12,11 +14,7 @@ describe('RunnerJobsEmptyStateComponent', () => {
let wrapper;
const mountComponent = () => {
- wrapper = shallowMount(RunnerJobsEmptyState, {
- provide: {
- emptyStateImage: 'emptyStateImage',
- },
- });
+ wrapper = shallowMount(RunnerJobsEmptyState);
};
const findEmptyState = () => wrapper.findComponent(GlEmptyState);
@@ -29,7 +27,7 @@ describe('RunnerJobsEmptyStateComponent', () => {
it('should show an empty state if it is empty', () => {
const emptyState = findEmptyState();
- expect(emptyState.props('svgPath')).toBe('emptyStateImage');
+ expect(emptyState.props('svgPath')).toBe(EMPTY_STATE_SVG_URL);
expect(emptyState.props('title')).toBe(DEFAULT_PROPS.emptyTitle);
expect(emptyState.text()).toContain(DEFAULT_PROPS.emptyDescription);
});
diff --git a/spec/frontend/ci/runner/components/runner_list_empty_state_spec.js b/spec/frontend/ci/runner/components/runner_list_empty_state_spec.js
index f4e93e83ce8..0de2759ea8a 100644
--- a/spec/frontend/ci/runner/components/runner_list_empty_state_spec.js
+++ b/spec/frontend/ci/runner/components/runner_list_empty_state_spec.js
@@ -1,15 +1,12 @@
+import EMPTY_STATE_SVG_URL from '@gitlab/svgs/dist/illustrations/pipelines_empty.svg?url';
+import FILTERED_SVG_URL from '@gitlab/svgs/dist/illustrations/magnifying-glass.svg?url';
import { GlEmptyState, GlLink, GlSprintf } from '@gitlab/ui';
import { s__ } from '~/locale';
import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
import { createMockDirective, getBinding } from 'helpers/vue_mock_directive';
import RunnerInstructionsModal from '~/vue_shared/components/runner_instructions/runner_instructions_modal.vue';
-import {
- mockRegistrationToken,
- newRunnerPath,
- emptyStateSvgPath,
- emptyStateFilteredSvgPath,
-} from 'jest/ci/runner/mock_data';
+import { mockRegistrationToken, newRunnerPath } from 'jest/ci/runner/mock_data';
import RunnerListEmptyState from '~/ci/runner/components/runner_list_empty_state.vue';
@@ -23,8 +20,6 @@ describe('RunnerListEmptyState', () => {
const createComponent = ({ props, mountFn = shallowMountExtended, ...options } = {}) => {
wrapper = mountFn(RunnerListEmptyState, {
propsData: {
- svgPath: emptyStateSvgPath,
- filteredSvgPath: emptyStateFilteredSvgPath,
registrationToken: mockRegistrationToken,
newRunnerPath,
...props,
@@ -50,7 +45,7 @@ describe('RunnerListEmptyState', () => {
});
it('renders an illustration', () => {
- expect(findEmptyState().props('svgPath')).toBe(emptyStateSvgPath);
+ expect(findEmptyState().props('svgPath')).toBe(EMPTY_STATE_SVG_URL);
});
it('displays "no results" text with instructions', () => {
@@ -125,7 +120,7 @@ describe('RunnerListEmptyState', () => {
});
it('renders an illustration', () => {
- expect(findEmptyState().props('svgPath')).toBe(emptyStateSvgPath);
+ expect(findEmptyState().props('svgPath')).toBe(EMPTY_STATE_SVG_URL);
});
it('displays "no results" text', () => {
@@ -148,7 +143,7 @@ describe('RunnerListEmptyState', () => {
});
it('renders a "filtered search" illustration', () => {
- expect(findEmptyState().props('svgPath')).toBe(emptyStateFilteredSvgPath);
+ expect(findEmptyState().props('svgPath')).toBe(FILTERED_SVG_URL);
});
it('displays "no filtered results" text', () => {
diff --git a/spec/frontend/ci/runner/group_runners/group_runners_app_spec.js b/spec/frontend/ci/runner/group_runners/group_runners_app_spec.js
index e750327294c..41be72b1645 100644
--- a/spec/frontend/ci/runner/group_runners/group_runners_app_spec.js
+++ b/spec/frontend/ci/runner/group_runners/group_runners_app_spec.js
@@ -61,8 +61,6 @@ import {
mockRegistrationToken,
newRunnerPath,
emptyPageInfo,
- emptyStateSvgPath,
- emptyStateFilteredSvgPath,
} from '../mock_data';
Vue.use(VueApollo);
@@ -123,8 +121,6 @@ describe('GroupRunnersApp', () => {
localMutations,
onlineContactTimeoutSecs,
staleTimeoutSecs,
- emptyStateSvgPath,
- emptyStateFilteredSvgPath,
...provide,
},
...options,
@@ -424,8 +420,6 @@ describe('GroupRunnersApp', () => {
isSearchFiltered: false,
newRunnerPath,
registrationToken: mockRegistrationToken,
- svgPath: 'emptyStateSvgPath.svg',
- filteredSvgPath: 'emptyStateFilteredSvgPath.svg',
});
});
});
diff --git a/spec/frontend/ci/runner/mock_data.js b/spec/frontend/ci/runner/mock_data.js
index d47a95f5c07..223a156795c 100644
--- a/spec/frontend/ci/runner/mock_data.js
+++ b/spec/frontend/ci/runner/mock_data.js
@@ -322,8 +322,6 @@ export const mockRegistrationToken = 'MOCK_REGISTRATION_TOKEN';
export const mockAuthenticationToken = 'MOCK_AUTHENTICATION_TOKEN';
export const newRunnerPath = '/runners/new';
-export const emptyStateSvgPath = 'emptyStateSvgPath.svg';
-export const emptyStateFilteredSvgPath = 'emptyStateFilteredSvgPath.svg';
export {
allRunnersData,
diff --git a/spec/frontend/content_editor/components/bubble_menus/bubble_menu_spec.js b/spec/frontend/content_editor/components/bubble_menus/bubble_menu_spec.js
index 271e63abf21..97716ce848c 100644
--- a/spec/frontend/content_editor/components/bubble_menus/bubble_menu_spec.js
+++ b/spec/frontend/content_editor/components/bubble_menus/bubble_menu_spec.js
@@ -64,10 +64,12 @@ describe('content_editor/components/bubble_menus/bubble_menu', () => {
tippyOptions: expect.objectContaining({
onHidden: expect.any(Function),
onShow: expect.any(Function),
+ appendTo: expect.any(Function),
...tippyOptions,
}),
});
+ expect(BubbleMenuPlugin.mock.calls[0][0].tippyOptions.appendTo()).toBe(document.body);
expect(tiptapEditor.registerPlugin).toHaveBeenCalledWith(pluginInitializationResult);
});
diff --git a/spec/helpers/ci/runners_helper_spec.rb b/spec/helpers/ci/runners_helper_spec.rb
index ab3f0b193ac..c170d7fae67 100644
--- a/spec/helpers/ci/runners_helper_spec.rb
+++ b/spec/helpers/ci/runners_helper_spec.rb
@@ -96,9 +96,7 @@ RSpec.describe Ci::RunnersHelper, feature_category: :runner_fleet do
runner_install_help_page: 'https://docs.gitlab.com/runner/install/',
registration_token: Gitlab::CurrentSettings.runners_registration_token,
online_contact_timeout_secs: 7200,
- stale_timeout_secs: 7889238,
- empty_state_svg_path: start_with('/assets/illustrations/pipelines_empty'),
- empty_state_filtered_svg_path: start_with('/assets/illustrations/magnifying-glass')
+ stale_timeout_secs: 7889238
)
end
end
@@ -168,9 +166,7 @@ RSpec.describe Ci::RunnersHelper, feature_category: :runner_fleet do
group_full_path: group.full_path,
runner_install_help_page: 'https://docs.gitlab.com/runner/install/',
online_contact_timeout_secs: 7200,
- stale_timeout_secs: 7889238,
- empty_state_svg_path: start_with('/assets/illustrations/pipelines_empty'),
- empty_state_filtered_svg_path: start_with('/assets/illustrations/magnifying-glass')
+ stale_timeout_secs: 7889238
)
end
end
diff --git a/spec/initializers/circuitbox_spec.rb b/spec/initializers/circuitbox_spec.rb
new file mode 100644
index 00000000000..64e384e4d22
--- /dev/null
+++ b/spec/initializers/circuitbox_spec.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'circuitbox', feature_category: :shared do
+ it 'does not configure Circuitbox', unless: Gitlab.ee? do
+ expect(Circuitbox.default_circuit_store).to be_a(Circuitbox::MemoryStore)
+ expect(Circuitbox.default_notifier).to be_a(Circuitbox::Notifier::ActiveSupport)
+ end
+
+ it 'configures Circuitbox', if: Gitlab.ee? do
+ expect(Circuitbox.default_circuit_store).to be_a(Gitlab::CircuitBreaker::Store)
+ expect(Circuitbox.default_notifier).to be_a(Gitlab::CircuitBreaker::Notifier)
+ end
+end
diff --git a/spec/lib/gitlab/ci/parsers/security/validators/schema_validator_spec.rb b/spec/lib/gitlab/ci/parsers/security/validators/schema_validator_spec.rb
index 5fbaae58a73..18ac8a7b42b 100644
--- a/spec/lib/gitlab/ci/parsers/security/validators/schema_validator_spec.rb
+++ b/spec/lib/gitlab/ci/parsers/security/validators/schema_validator_spec.rb
@@ -5,20 +5,7 @@ require 'spec_helper'
RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, feature_category: :vulnerability_management do
let_it_be(:project) { create(:project) }
- let(:current_dast_versions) { described_class::CURRENT_VERSIONS[:dast].join(', ') }
let(:supported_dast_versions) { described_class::SUPPORTED_VERSIONS[:dast].join(', ') }
- let(:deprecated_schema_version_message) {}
- let(:missing_schema_version_message) do
- "Report version not provided, dast report type supports versions: #{supported_dast_versions}"
- end
-
- let(:scanner) do
- {
- 'id' => 'gemnasium',
- 'name' => 'Gemnasium',
- 'version' => '2.1.0'
- }
- end
let(:analyzer_vendor) do
{ 'name' => 'A DAST analyzer' }
@@ -28,7 +15,18 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
{ 'name' => 'A DAST scanner' }
end
- let(:report_data) do
+ let(:scanner) do
+ {
+ 'id' => 'my-dast-scanner',
+ 'name' => 'My DAST scanner',
+ 'version' => '0.2.0',
+ 'vendor' => scanner_vendor
+ }
+ end
+
+ let(:report_type) { :dast }
+
+ let(:valid_data) do
{
'scan' => {
'analyzer' => {
@@ -39,21 +37,18 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
},
'end_time' => '2020-01-28T03:26:02',
'scanned_resources' => [],
- 'scanner' => {
- 'id' => 'my-dast-scanner',
- 'name' => 'My DAST scanner',
- 'version' => '0.2.0',
- 'vendor' => scanner_vendor
- },
+ 'scanner' => scanner,
'start_time' => '2020-01-28T03:26:01',
'status' => 'success',
- 'type' => 'dast'
+ 'type' => report_type.to_s
},
'version' => report_version,
'vulnerabilities' => []
}
end
+ let(:report_data) { valid_data }
+
let(:validator) { described_class.new(report_type, report_data, report_version, project: project, scanner: scanner) }
shared_examples 'report is valid' do
@@ -70,8 +65,8 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
security_report_version: report_version,
project_id: project.id,
security_report_failure: security_report_failure,
- security_report_scanner_id: 'gemnasium',
- security_report_scanner_version: '2.1.0'
+ security_report_scanner_id: scanner['id'],
+ security_report_scanner_version: scanner['version']
)
subject
@@ -142,7 +137,6 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
subject { validator.valid? }
context 'when given a supported MAJOR.MINOR schema version' do
- let(:report_type) { :dast }
let(:report_version) do
latest_vendored_version = described_class::SUPPORTED_VERSIONS[report_type].last.split(".")
(latest_vendored_version[0...2] << "34").join(".")
@@ -153,7 +147,6 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
end
context 'when given a supported schema version' do
- let(:report_type) { :dast }
let(:report_version) { described_class::SUPPORTED_VERSIONS[report_type].last }
it_behaves_like 'report is valid'
@@ -161,7 +154,6 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
end
context 'when given a deprecated schema version' do
- let(:report_type) { :dast }
let(:deprecations_hash) do
{
dast: %w[10.0.0]
@@ -175,13 +167,6 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
end
context 'and the report passes schema validation' do
- let(:report_data) do
- {
- 'version' => '10.0.0',
- 'vulnerabilities' => []
- }
- end
-
let(:security_report_failure) { 'using_deprecated_schema_version' }
it { is_expected.to be_truthy }
@@ -191,9 +176,8 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
context 'and the report does not pass schema validation' do
let(:report_data) do
- {
- 'version' => 'V2.7.0'
- }
+ valid_data.delete('vulnerabilities')
+ valid_data
end
it { is_expected.to be_falsey }
@@ -201,17 +185,9 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
end
context 'when given an unsupported schema version' do
- let(:report_type) { :dast }
let(:report_version) { "12.37.0" }
context 'and the report is valid' do
- let(:report_data) do
- {
- 'version' => report_version,
- 'vulnerabilities' => []
- }
- end
-
let(:security_report_failure) { 'using_unsupported_schema_version' }
it { is_expected.to be_falsey }
@@ -259,8 +235,8 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
end
context 'when not given a schema version' do
- let(:report_type) { :dast }
let(:report_version) { nil }
+
let(:report_data) do
{
'vulnerabilities' => []
@@ -285,21 +261,19 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
subject { validator.errors }
context 'when given a supported schema version' do
- let(:report_type) { :dast }
let(:report_version) { described_class::SUPPORTED_VERSIONS[report_type].last }
it_behaves_like 'report is valid with no error'
context 'and the report is invalid' do
let(:report_data) do
- {
- 'version' => report_version
- }
+ valid_data.delete('vulnerabilities')
+ valid_data
end
let(:expected_errors) do
[
- 'root is missing required keys: scan, vulnerabilities'
+ 'root is missing required keys: vulnerabilities'
]
end
@@ -308,7 +282,6 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
end
context 'when given a deprecated schema version' do
- let(:report_type) { :dast }
let(:deprecations_hash) do
{
dast: %w[10.0.0]
@@ -325,9 +298,9 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
context 'and the report does not pass schema validation' do
let(:report_data) do
- {
- 'version' => 'V2.7.0'
- }
+ valid_data['version'] = "V2.7.0"
+ valid_data.delete('vulnerabilities')
+ valid_data
end
let(:expected_errors) do
@@ -342,7 +315,6 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
end
context 'when given an unsupported schema version' do
- let(:report_type) { :dast }
let(:report_version) { "12.37.0" }
let(:expected_unsupported_message) do
"Version #{report_version} for report type #{report_type} is unsupported, supported versions for this report type are: "\
@@ -351,13 +323,6 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
end
context 'and the report is valid' do
- let(:report_data) do
- {
- 'version' => report_version,
- 'vulnerabilities' => []
- }
- end
-
let(:expected_errors) do
[
expected_unsupported_message
@@ -369,9 +334,8 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
context 'and the report is invalid' do
let(:report_data) do
- {
- 'version' => report_version
- }
+ valid_data.delete('vulnerabilities')
+ valid_data
end
let(:expected_errors) do
@@ -386,7 +350,6 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
end
context 'when not given a schema version' do
- let(:report_type) { :dast }
let(:report_version) { nil }
let(:expected_missing_version_message) do
"Report version not provided, #{report_type} report type supports versions: #{supported_dast_versions}. GitLab "\
@@ -395,9 +358,8 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
end
let(:report_data) do
- {
- 'vulnerabilities' => []
- }
+ valid_data.delete('version')
+ valid_data
end
let(:expected_errors) do
@@ -413,13 +375,6 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
shared_examples 'report is valid with no warning' do
context 'and the report is valid' do
- let(:report_data) do
- {
- 'version' => report_version,
- 'vulnerabilities' => []
- }
- end
-
it { is_expected.to be_empty }
end
end
@@ -432,25 +387,16 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
subject { validator.deprecation_warnings }
context 'when given a supported schema version' do
- let(:report_type) { :dast }
let(:report_version) { described_class::SUPPORTED_VERSIONS[report_type].last }
context 'and the report is valid' do
- let(:report_data) do
- {
- 'version' => report_version,
- 'vulnerabilities' => []
- }
- end
-
it { is_expected.to be_empty }
end
context 'and the report is invalid' do
let(:report_data) do
- {
- 'version' => report_version
- }
+ valid_data.delete('vulnerabilities')
+ valid_data
end
it { is_expected.to be_empty }
@@ -458,7 +404,6 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
end
context 'when given a deprecated schema version' do
- let(:report_type) { :dast }
let(:deprecations_hash) do
{
dast: %w[V2.7.0]
@@ -466,6 +411,7 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
end
let(:report_version) { described_class::DEPRECATED_VERSIONS[report_type].last }
+ let(:current_dast_versions) { described_class::CURRENT_VERSIONS[:dast].join(', ') }
let(:expected_deprecation_message) do
"version #{report_version} for report type #{report_type} is deprecated. "\
"However, GitLab will still attempt to parse and ingest this report. "\
@@ -483,21 +429,14 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
end
context 'and the report passes schema validation' do
- let(:report_data) do
- {
- 'version' => report_version,
- 'vulnerabilities' => []
- }
- end
-
it_behaves_like 'report with expected warnings'
end
context 'and the report does not pass schema validation' do
let(:report_data) do
- {
- 'version' => 'V2.7.0'
- }
+ valid_data['version'] = "V2.7.0"
+ valid_data.delete('vulnerabilities')
+ valid_data
end
it_behaves_like 'report with expected warnings'
@@ -521,15 +460,8 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
end
context 'when given an unsupported schema version' do
- let(:report_type) { :dast }
let(:report_version) { "21.37.0" }
let(:expected_deprecation_warnings) { [] }
- let(:report_data) do
- {
- 'version' => report_version,
- 'vulnerabilities' => []
- }
- end
it_behaves_like 'report with expected warnings'
end
@@ -539,7 +471,6 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
subject { validator.warnings }
context 'when given a supported MAJOR.MINOR schema version' do
- let(:report_type) { :dast }
let(:report_version) do
latest_vendored_version = described_class::SUPPORTED_VERSIONS[report_type].last.split(".")
(latest_vendored_version[0...2] << "34").join(".")
@@ -559,13 +490,6 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
end
context 'and the report is valid' do
- let(:report_data) do
- {
- 'version' => report_version,
- 'vulnerabilities' => []
- }
- end
-
it { is_expected.to match_array([message]) }
context 'without license', unless: Gitlab.ee? do
@@ -607,7 +531,6 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
end
context 'when given a supported schema version' do
- let(:report_type) { :dast }
let(:report_version) { described_class::SUPPORTED_VERSIONS[report_type].last }
it_behaves_like 'report is valid with no warning'
@@ -624,34 +547,26 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
end
context 'when given a deprecated schema version' do
- let(:report_type) { :dast }
+ let(:deprecated_version) { '14.1.3' }
+ let(:report_version) { deprecated_version }
let(:deprecations_hash) do
{
- dast: %w[V2.7.0]
+ dast: %w[deprecated_version]
}
end
- let(:report_version) { described_class::DEPRECATED_VERSIONS[report_type].last }
-
before do
stub_const("#{described_class}::DEPRECATED_VERSIONS", deprecations_hash)
end
context 'and the report passes schema validation' do
- let(:report_data) do
- {
- 'vulnerabilities' => []
- }
- end
-
it { is_expected.to be_empty }
end
context 'and the report does not pass schema validation' do
let(:report_data) do
- {
- 'version' => 'V2.7.0'
- }
+ valid_data.delete('vulnerabilities')
+ valid_data
end
it { is_expected.to be_empty }
@@ -659,7 +574,6 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
end
context 'when given an unsupported schema version' do
- let(:report_type) { :dast }
let(:report_version) { "12.37.0" }
it_behaves_like 'report is valid with no warning'
@@ -676,13 +590,7 @@ RSpec.describe Gitlab::Ci::Parsers::Security::Validators::SchemaValidator, featu
end
context 'when not given a schema version' do
- let(:report_type) { :dast }
let(:report_version) { nil }
- let(:report_data) do
- {
- 'vulnerabilities' => []
- }
- end
it { is_expected.to be_empty }
end
diff --git a/spec/lib/sidebars/admin/panel_spec.rb b/spec/lib/sidebars/admin/panel_spec.rb
index 12bd83a4b88..9c362f527f5 100644
--- a/spec/lib/sidebars/admin/panel_spec.rb
+++ b/spec/lib/sidebars/admin/panel_spec.rb
@@ -6,11 +6,25 @@ RSpec.describe Sidebars::Admin::Panel, feature_category: :navigation do
let_it_be(:user) { build(:admin) }
let(:context) { Sidebars::Context.new(current_user: user, container: nil) }
+ let(:panel) { described_class.new(context) }
subject { described_class.new(context) }
- it 'implements #super_sidebar_context_header' do
- expect(subject.super_sidebar_context_header).to eq({ title: 'Admin Area' })
+ describe '#aria_label' do
+ it 'returns the correct aria label' do
+ expect(panel.aria_label).to eq(_('Admin Area'))
+ end
+ end
+
+ describe '#super_sidebar_context_header' do
+ it 'returns a hash with the correct title and icon' do
+ expected_header = {
+ title: panel.aria_label,
+ icon: 'admin'
+ }
+
+ expect(panel.super_sidebar_context_header).to eq(expected_header)
+ end
end
it_behaves_like 'a panel with uniquely identifiable menu items'
diff --git a/spec/services/quick_actions/interpret_service_spec.rb b/spec/services/quick_actions/interpret_service_spec.rb
index 30cfb92ba06..8a0c8f519b0 100644
--- a/spec/services/quick_actions/interpret_service_spec.rb
+++ b/spec/services/quick_actions/interpret_service_spec.rb
@@ -1399,34 +1399,11 @@ RSpec.describe QuickActions::InterpretService, feature_category: :team_planning
let(:issuable) { issue }
end
- # /draft is a toggle (ff disabled)
- it_behaves_like 'draft command' do
- let(:content) { '/draft' }
- let(:issuable) { merge_request }
-
- before do
- stub_feature_flags(draft_quick_action_non_toggle: false)
- end
- end
-
- # /draft is a toggle (ff disabled)
- it_behaves_like 'ready command' do
- let(:content) { '/draft' }
- let(:issuable) { merge_request }
-
- before do
- stub_feature_flags(draft_quick_action_non_toggle: false)
- issuable.update!(title: issuable.draft_title)
- end
- end
-
- # /draft is one way (ff enabled)
it_behaves_like 'draft command' do
let(:content) { '/draft' }
let(:issuable) { merge_request }
end
- # /draft is one way (ff enabled)
it_behaves_like 'draft/ready command no action' do
let(:content) { '/draft' }
let(:issuable) { merge_request }
@@ -2754,27 +2731,6 @@ RSpec.describe QuickActions::InterpretService, feature_category: :team_planning
end
end
- describe 'draft command toggle (deprecated)' do
- let(:content) { '/draft' }
-
- before do
- stub_feature_flags(draft_quick_action_non_toggle: false)
- end
-
- it 'includes the new status' do
- _, explanations = service.explain(content, merge_request)
-
- expect(explanations).to match_array(['Marks this merge request as a draft.'])
- end
-
- it 'sets the ready status on a draft' do
- merge_request.update!(title: merge_request.draft_title)
- _, explanations = service.explain(content, merge_request)
-
- expect(explanations).to match_array(["Marks this merge request as ready."])
- end
- end
-
describe 'draft command set' do
let(:content) { '/draft' }
diff --git a/spec/views/layouts/devise.html.haml_spec.rb b/spec/views/layouts/devise.html.haml_spec.rb
index b37bdeceb7e..a9215730370 100644
--- a/spec/views/layouts/devise.html.haml_spec.rb
+++ b/spec/views/layouts/devise.html.haml_spec.rb
@@ -2,7 +2,7 @@
require 'spec_helper'
-RSpec.describe 'layouts/devise' do
+RSpec.describe 'layouts/devise', feature_category: :user_management do
it_behaves_like 'a layout which reflects the application theme setting'
describe 'logo' do
@@ -22,4 +22,12 @@ RSpec.describe 'layouts/devise' do
end
end
end
+
+ context 'without broadcast messaging' do
+ it 'does not render the broadcast layout' do
+ render
+
+ expect(rendered).not_to render_template('layouts/_broadcast')
+ end
+ end
end
diff --git a/spec/views/layouts/minimal.html.haml_spec.rb b/spec/views/layouts/minimal.html.haml_spec.rb
new file mode 100644
index 00000000000..97cd699d32f
--- /dev/null
+++ b/spec/views/layouts/minimal.html.haml_spec.rb
@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'layouts/minimal', feature_category: :onboarding do
+ context 'without broadcast messaging' do
+ it 'does not render the broadcast layout' do
+ render
+
+ expect(rendered).not_to render_template('layouts/_broadcast')
+ end
+ end
+end
diff --git a/yarn.lock b/yarn.lock
index f47606d2fed..55e29c0dcac 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1115,10 +1115,10 @@
resolved "https://registry.yarnpkg.com/@gitlab/svgs/-/svgs-3.46.0.tgz#741fea428ce9cac9fd8ccdb65a7b863ab5f7773d"
integrity sha512-+NEdjNTBCTnJIjQKomf6yasT3ezg8UNBGJVUDf+ZgXgENKbwOjV9ngcVeHQMZM4hDaQSaJx08fagyadCcTw0Ow==
-"@gitlab/ui@62.9.1":
- version "62.9.1"
- resolved "https://registry.yarnpkg.com/@gitlab/ui/-/ui-62.9.1.tgz#0660d8c6d159e3d11690a73ad5c2833306bb5a15"
- integrity sha512-6SqEAcFLqk4V1S/8rlvTG1Wj6uAPiX+GNuQaWXJ++5SlP+2XlzBJBr+udymtgn8ZAsCc9vKTzVo5PW2XZ6UjAA==
+"@gitlab/ui@62.9.2":
+ version "62.9.2"
+ resolved "https://registry.yarnpkg.com/@gitlab/ui/-/ui-62.9.2.tgz#5b519b403000ab06621fa0a0f0b0d3ae0b3aca8c"
+ integrity sha512-GU69cxqfMa7jSU/ra9OHh38eLuy1tFNl5QZWRZIVU5IjRBZe1CaYVPTzeXQxd5kDOAj0MwtvC0z1XlDz54UMYA==
dependencies:
"@popperjs/core" "^2.11.2"
bootstrap-vue "2.23.1"