diff options
| author | GitLab Bot <gitlab-bot@gitlab.com> | 2021-05-10 06:10:06 +0300 |
|---|---|---|
| committer | GitLab Bot <gitlab-bot@gitlab.com> | 2021-05-10 06:10:06 +0300 |
| commit | 35ee286f94ee7c706713fbf0b8f16468bb4e4381 (patch) | |
| tree | 1bf78f684eed5eeb3546f1319f5b414d47ae52f6 /doc/user | |
| parent | 06d5641a544be4c5605ef2b7dcad43d841386ede (diff) | |
Add latest changes from gitlab-org/gitlab@master
Diffstat (limited to 'doc/user')
| -rw-r--r-- | doc/user/application_security/dast/index.md | 3 | ||||
| -rw-r--r-- | doc/user/application_security/sast/index.md | 1 |
2 files changed, 4 insertions, 0 deletions
diff --git a/doc/user/application_security/dast/index.md b/doc/user/application_security/dast/index.md index 354e92b1cc5..413326dd5ce 100644 --- a/doc/user/application_security/dast/index.md +++ b/doc/user/application_security/dast/index.md @@ -978,6 +978,7 @@ required for an on-demand DAST scan. A site profile contains the following: - **Profile name**: A name you assign to the site to be scanned. +- **Site type**: The type of target to be scanned, either website or API scan. - **Target URL**: The URL that DAST runs against. - **Excluded URLs**: A comma-separated list of URLs to exclude from the scan. - **Request headers**: A comma-separated list of HTTP request headers, including names and values. These headers are added to every request made by DAST. @@ -988,6 +989,8 @@ A site profile contains the following: - **Username form field**: The name of username field at the sign-in HTML form. - **Password form field**: The name of password field at the sign-in HTML form. +When an API site type is selected, a [host override](#host-override) is used to ensure the API being scanned is on the same host as the target. This is done to reduce the risk of running an active scan against the wrong API. + #### Site profile validation > [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/233020) in GitLab 13.8. diff --git a/doc/user/application_security/sast/index.md b/doc/user/application_security/sast/index.md index fe5a85cf0b0..b0e5877ae84 100644 --- a/doc/user/application_security/sast/index.md +++ b/doc/user/application_security/sast/index.md @@ -518,6 +518,7 @@ Experimental features available are: - Enable scanning of iOS and Android apps using the [MobSF analyzer](https://gitlab.com/gitlab-org/security-products/analyzers/mobsf/). - Enable the [semgrep analyzer](https://gitlab.com/gitlab-org/security-products/analyzers/semgrep/). + - Semgrep may be inconsistent when reporting vulnerabilities found in minified JavaScript files. #### Enable experimental features |