diff options
author | Luke Bennett <lbennett@gitlab.com> | 2018-01-18 14:34:59 +0300 |
---|---|---|
committer | Luke Bennett <lbennett@gitlab.com> | 2018-01-18 14:34:59 +0300 |
commit | 99e71dec723e65b6d4f6e8ba6040d800a09ed0a1 (patch) | |
tree | 3e02a119b8d421be9c79bf88dc4d39fa06e0c460 /doc/ci/examples/dast.md | |
parent | 370a4654de51091ed671beb189e5b295f3b0a2ed (diff) | |
parent | 31c28f219ccd369803def2be819e862f2c65f103 (diff) |
Merge branch '10-4-stable-prepare-rc7' into '10-4-stable'
Prepare 10.4 RC7 release
See merge request gitlab-org/gitlab-ce!16519
Diffstat (limited to 'doc/ci/examples/dast.md')
-rw-r--r-- | doc/ci/examples/dast.md | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/doc/ci/examples/dast.md b/doc/ci/examples/dast.md new file mode 100644 index 00000000000..16ff8d5bb3e --- /dev/null +++ b/doc/ci/examples/dast.md @@ -0,0 +1,35 @@ +# Dynamic Application Security Testing with GitLab CI/CD + +This example shows how to run +[Dynamic Application Security Testing (DAST)](https://en.wikipedia.org/wiki/Dynamic_program_analysis) +on your project's source code by using GitLab CI/CD. + +DAST is using the popular open source tool +[OWASP ZAProxy](https://github.com/zaproxy/zaproxy) to perform an analysis. + +All you need is a GitLab Runner with the Docker executor (the shared Runners on +GitLab.com will work fine). You can then add a new job to `.gitlab-ci.yml`, +called `dast`: + +```yaml +dast: + image: owasp/zap2docker-stable + script: + - mkdir /zap/wrk/ + - /zap/zap-baseline.py -J gl-dast-report.json -t https://example.com || true + - cp /zap/wrk/gl-dast-report.json . + artifacts: + paths: [gl-dast-report.json] +``` + +The above example will create a `dast` job in your CI pipeline and will allow +you to download and analyze the report artifact in JSON format. + +TIP: **Tip:** +Starting with [GitLab Enterprise Edition Ultimate][ee] 10.4, this information will +be automatically extracted and shown right in the merge request widget. To do +so, the CI job must be named `dast` and the artifact path must be +`gl-dast-report.json`. +[Learn more on dynamic application security testing results shown in merge requests](https://docs.gitlab.com/ee/user/project/merge_requests/dast.html). + +[ee]: https://about.gitlab.com/gitlab-ee/ |