From 2ccc9aaf48ad5badb839991a00c98cb7dee28ec1 Mon Sep 17 00:00:00 2001 From: GitLab Bot Date: Fri, 19 Jun 2020 06:08:36 +0000 Subject: Add latest changes from gitlab-org/gitlab@master --- .gitlab/ci/rules.gitlab-ci.yml | 2 +- Gemfile | 2 +- Gemfile.lock | 4 +-- doc/development/integrations/secure.md | 28 ++++++++++++++++ .../container_scanning/index.md | 1 + .../dependency_scanning/index.md | 1 + doc/user/application_security/sast/index.md | 12 +++++++ .../application_security/secret_detection/index.md | 12 +++++++ .../group_security_dashboard_export_csv_v13_1.png | Bin 536756 -> 105028 bytes .../img/standalone_vulnerability_page_v13_1.png | Bin 0 -> 79341 bytes .../img/vulnerability_list_table_v13_1.png | Bin 0 -> 74381 bytes .../security_dashboard/index.md | 13 ++++++++ doc/user/clusters/applications.md | 37 +++++++++++++++++++++ spec/routing/project_routing_spec.rb | 6 ++++ 14 files changed, 114 insertions(+), 4 deletions(-) create mode 100644 doc/user/application_security/security_dashboard/img/standalone_vulnerability_page_v13_1.png create mode 100644 doc/user/application_security/security_dashboard/img/vulnerability_list_table_v13_1.png diff --git a/.gitlab/ci/rules.gitlab-ci.yml b/.gitlab/ci/rules.gitlab-ci.yml index a03b81f9ce9..2caa57141e5 100644 --- a/.gitlab/ci/rules.gitlab-ci.yml +++ b/.gitlab/ci/rules.gitlab-ci.yml @@ -242,7 +242,7 @@ - <<: *if-not-canonical-namespace when: never - changes: *ci-build-images-patterns - - changes: *code-backstage-qa-patterns + - changes: *code-qa-patterns #################### # Cache repo rules # diff --git a/Gemfile b/Gemfile index 5477ee3d181..33d4ebb7f22 100644 --- a/Gemfile +++ b/Gemfile @@ -416,7 +416,7 @@ end gem 'octokit', '~> 4.15' # https://gitlab.com/gitlab-org/gitlab/issues/207207 -gem 'gitlab-mail_room', '~> 0.0.4', require: 'mail_room' +gem 'gitlab-mail_room', '~> 0.0.6', require: 'mail_room' gem 'email_reply_trimmer', '~> 0.1' gem 'html2text' diff --git a/Gemfile.lock b/Gemfile.lock index 319c4df3f9d..2e3537e223f 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -390,7 +390,7 @@ GEM opentracing (~> 0.4) redis (> 3.0.0, < 5.0.0) gitlab-license (1.0.0) - gitlab-mail_room (0.0.4) + gitlab-mail_room (0.0.6) gitlab-markup (1.7.1) gitlab-net-dns (0.9.1) gitlab-puma (4.3.3.gitlab.2) @@ -1241,7 +1241,7 @@ DEPENDENCIES gitlab-chronic (~> 0.10.5) gitlab-labkit (= 0.12.0) gitlab-license (~> 1.0) - gitlab-mail_room (~> 0.0.4) + gitlab-mail_room (~> 0.0.6) gitlab-markup (~> 1.7.1) gitlab-net-dns (~> 0.9.1) gitlab-puma (~> 4.3.3.gitlab.2) diff --git a/doc/development/integrations/secure.md b/doc/development/integrations/secure.md index 1737daae0e0..c1e4cc538bd 100644 --- a/doc/development/integrations/secure.md +++ b/doc/development/integrations/secure.md @@ -232,6 +232,34 @@ to colorize the messages they write to the Unix standard output and standard err We recommend using red to report errors, yellow for warnings, and green for notices. Also, we recommend prefixing error messages with `[ERRO]`, warnings with `[WARN]`, and notices with `[INFO]`. +#### Logging level + +The scanner should filter out a log message if its log level is lower than the +one set in the `SECURE_LOG_LEVEL` variable. For instance, `info` and `warn` +messages should be skipped when `SECURE_LOG_LEVEL` is set to `error`. Accepted +values are as follows, listed from highest to lowest: + +- `panic` +- `fatal` +- `error` +- `warn` +- `info` +- `debug` +- `trace` + +It is recommended to use the `debug` and `trace` levels for verbose logging +that could be useful when debugging. The default value for `SECURE_LOG_LEVEL` +should be set to `info`. + +#### common logutil package + +If you are using [go](https://golang.org/) and +[common](https://gitlab.com/gitlab-org/security-products/analyzers/common), +then it is suggested that you use [logrus](https://github.com/Sirupsen/logrus) +and [common's logutil package](https://gitlab.com/gitlab-org/security-products/analyzers/common/-/tree/master/logutil) +to configure the formatter for [logrus](https://github.com/Sirupsen/logrus). +See the [logutil README.md](https://gitlab.com/gitlab-org/security-products/analyzers/common/-/tree/master/logutil/README.md) + ## Report The report is a JSON document that combines vulnerabilities with possible remediations. diff --git a/doc/user/application_security/container_scanning/index.md b/doc/user/application_security/container_scanning/index.md index 0ffe83cdfc9..4bf1c6ae1c6 100644 --- a/doc/user/application_security/container_scanning/index.md +++ b/doc/user/application_security/container_scanning/index.md @@ -174,6 +174,7 @@ using environment variables. | `CLAIR_DB_IMAGE_TAG` | (**DEPRECATED - use `CLAIR_DB_IMAGE` instead**) The Docker image tag for the [PostgreSQL server hosting the vulnerabilities definitions](https://hub.docker.com/r/arminc/clair-db). It can be useful to override this value with a specific version, for example, to provide a consistent set of vulnerabilities for integration testing purposes. | `latest` | | `DOCKERFILE_PATH` | The path to the `Dockerfile` to be used for generating remediations. By default, the scanner will look for a file named `Dockerfile` in the root directory of the project, so this variable should only be configured if your `Dockerfile` is in a non-standard location, such as a subdirectory. See [Solutions for vulnerabilities](#solutions-for-vulnerabilities-auto-remediation) for more details. | `Dockerfile` | | `ADDITIONAL_CA_CERT_BUNDLE` | Bundle of CA certs that you want to trust. | "" | +| `SECURE_LOG_LEVEL` | The log levels available are: `panic`, `fatal`, `error`, `warn`, `info`, `debug`, `trace` | `info` | ### Overriding the Container Scanning template diff --git a/doc/user/application_security/dependency_scanning/index.md b/doc/user/application_security/dependency_scanning/index.md index ed34d5e02fb..65aa145da60 100644 --- a/doc/user/application_security/dependency_scanning/index.md +++ b/doc/user/application_security/dependency_scanning/index.md @@ -155,6 +155,7 @@ The following variables allow configuration of global dependency scanning settin | `DS_DISABLE_DIND` | Disable Docker-in-Docker and run analyzers [individually](#enabling-docker-in-docker). This variable is `true` by default. | | `ADDITIONAL_CA_CERT_BUNDLE` | Bundle of CA certs to trust. | | `DS_EXCLUDED_PATHS` | Exclude vulnerabilities from output based on the paths. A comma-separated list of patterns. Patterns can be globs, or file or folder paths (for example, `doc,spec`). Parent directories also match patterns. Default: `"spec, test, tests, tmp"` | +| `SECURE_LOG_LEVEL` | Default log level is `info`, you can set it to any of the following strings: `panic`, `fatal`, `error`, `warn`, `info`, `debug`, `trace`. | #### Configuring Docker-in-Docker orchestrator diff --git a/doc/user/application_security/sast/index.md b/doc/user/application_security/sast/index.md index e6e7eb9c162..90cb3594d23 100644 --- a/doc/user/application_security/sast/index.md +++ b/doc/user/application_security/sast/index.md @@ -285,6 +285,18 @@ See [Analyzer settings](#analyzer-settings) for the complete list of available o SAST can be [configured](#customizing-the-sast-settings) using environment variables. +#### Logging Level + +You can control the verbosity of logs by setting the `SECURE_LOG_LEVEL` env var. It's default is set to `info`, you can set it to any of the following levels: + +- `panic` +- `fatal` +- `error` +- `warn` +- `info` +- `debug` +- `trace` + #### Custom Certificate Authority To trust a custom Certificate Authority, set the `ADDITIONAL_CA_CERT_BUNDLE` variable to the bundle diff --git a/doc/user/application_security/secret_detection/index.md b/doc/user/application_security/secret_detection/index.md index c9a3741faa3..e0cbaeda24c 100644 --- a/doc/user/application_security/secret_detection/index.md +++ b/doc/user/application_security/secret_detection/index.md @@ -146,6 +146,18 @@ Secret Detection can be customized by defining available variables: | `SECRET_DETECTION_COMMIT_TO` | - | The commit a Gitleaks scan ends at. | | `SECRET_DETECTION_HISTORIC_SCAN` | false | Flag to enable a historic Gitleaks scan. | +### Logging Level + +You can control the verbosity of logs by setting the `SECURE_LOG_LEVEL` env var. It's default is set to `info`, you can set it to any of the following levels: + +- `panic` +- `fatal` +- `error` +- `warn` +- `info` +- `debug` +- `trace` + ## Full History Secret Scan GitLab 12.11 introduced support for scanning the full history of a repository. This new functionality diff --git a/doc/user/application_security/security_dashboard/img/group_security_dashboard_export_csv_v13_1.png b/doc/user/application_security/security_dashboard/img/group_security_dashboard_export_csv_v13_1.png index 0dfe7b637cd..d98fb71ae37 100644 Binary files a/doc/user/application_security/security_dashboard/img/group_security_dashboard_export_csv_v13_1.png and b/doc/user/application_security/security_dashboard/img/group_security_dashboard_export_csv_v13_1.png differ diff --git a/doc/user/application_security/security_dashboard/img/standalone_vulnerability_page_v13_1.png b/doc/user/application_security/security_dashboard/img/standalone_vulnerability_page_v13_1.png new file mode 100644 index 00000000000..9cf95b197fe Binary files /dev/null and b/doc/user/application_security/security_dashboard/img/standalone_vulnerability_page_v13_1.png differ diff --git a/doc/user/application_security/security_dashboard/img/vulnerability_list_table_v13_1.png b/doc/user/application_security/security_dashboard/img/vulnerability_list_table_v13_1.png new file mode 100644 index 00000000000..2b792727a99 Binary files /dev/null and b/doc/user/application_security/security_dashboard/img/vulnerability_list_table_v13_1.png differ diff --git a/doc/user/application_security/security_dashboard/index.md b/doc/user/application_security/security_dashboard/index.md index 60798b9c921..b0574bfc917 100644 --- a/doc/user/application_security/security_dashboard/index.md +++ b/doc/user/application_security/security_dashboard/index.md @@ -200,6 +200,19 @@ When using [Auto DevOps](../../../topics/autodevops/index.md), use [special environment variables](../../../topics/autodevops/customize.md#environment-variables) to configure daily security scans. +## Vulnerability list + +Each dashboard's vulnerability list contains new vulnerabilities discovered in the latest scans. +Click any vulnerability in the table to see more information on that vulnerability. To create an +issue associated with the vulnerability, click the **Create Issue** button. + +![Create an issue for the vulnerability](img/standalone_vulnerability_page_v13_1.png) + +Once you create the issue, the vulnerability list contains a link to the issue and an icon whose +color indicates the issue's status (green for open issues, blue for closed issues). + +![Display attached issues](img/vulnerability_list_table_v13_1.png) +