From 71dc16a12c2b0aaeee3a8fa55aa1ca880f5699b4 Mon Sep 17 00:00:00 2001 From: GitLab Bot Date: Thu, 29 Apr 2021 18:10:23 +0000 Subject: Add latest changes from gitlab-org/gitlab@master --- doc/user/application_security/dast/index.md | 32 +++++++++++++++++++++++ doc/user/application_security/index.md | 39 ----------------------------- doc/user/gitlab_com/index.md | 1 + doc/user/project/integrations/webhooks.md | 1 + 4 files changed, 34 insertions(+), 39 deletions(-) (limited to 'doc') diff --git a/doc/user/application_security/dast/index.md b/doc/user/application_security/dast/index.md index 129e1a5925e..73a3d99253f 100644 --- a/doc/user/application_security/dast/index.md +++ b/doc/user/application_security/dast/index.md @@ -610,6 +610,38 @@ When using `DAST_PATHS` and `DAST_PATHS_FILE`, note the following: To perform a [full scan](#full-scan) on the listed paths, use the `DAST_FULL_SCAN_ENABLED` CI/CD variable. +### View details of a vulnerability detected by DAST + +> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/36332) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 13.1. + +Vulnerabilities detected by DAST occur in the live web application. Addressing these types of +vulnerabilities requires specific information. DAST provides the information required to +investigate and rectify the underlying cause. + +To view details of vulnerabilities detected by DAST: + +1. To see all vulnerabilities detected, either: + - Go to your project and select **Security & Compliance**. + - Go to the merge request and select the **Security** tab. + +1. Select a vulnerability's description. The following details are provided: + + | Field | Description | + |:-----------------|:------------------------------------------------------------------ | + | Description | Description of the vulnerability. | + | Project | Namespace and project in which the vulnerability was detected. | + | Method | HTTP method used to detect the vulnerability. | + | URL | URL at which the vulnerability was detected. | + | Request Headers | Headers of the request. | + | Response Status | Response status received from the application. | + | Response Headers | Headers of the response received from the application. | + | Evidence | Evidence of the data found that verified the vulnerability. Often a snippet of the request or response, this can be used to help verify that the finding is a vulnerability. | + | Identifiers | Identifiers of the vulnerability. | + | Severity | Severity of the vulnerability. | + | Scanner Type | Type of vulnerability report. | + | Links | Links to further details of the detected vulnerability. | + | Solution | Details of a recommended solution to the vulnerability (optional). | + ### Customizing the DAST settings WARNING: diff --git a/doc/user/application_security/index.md b/doc/user/application_security/index.md index 2e7c0bdaa15..45cc89c2208 100644 --- a/doc/user/application_security/index.md +++ b/doc/user/application_security/index.md @@ -119,45 +119,6 @@ reports are available to download. To download a report, click on the ![Security widget](img/security_widget_v13_7.png) -## View details of a DAST vulnerability - -> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/36332) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 13.1. - -Vulnerabilities detected by DAST occur in the live web application. Rectification of these types of -vulnerabilities requires specific information. DAST provides the information required to -investigate and rectify the underlying cause. - -To view details of DAST vulnerabilities: - -1. To see all vulnerabilities detected: - - In a project, go to the project's **{shield}** **Security & Compliance** page. - - Only in a merge request, go the merge request's **Security** tab. - -1. Select the vulnerability's description. The following details are provided: - -| Field | Description | -|:-----------------|:------------------------------------------------------------------ | -| Description | Description of the vulnerability. | -| Project | Namespace and project in which the vulnerability was detected. | -| Method | HTTP method used to detect the vulnerability. | -| URL | URL at which the vulnerability was detected. | -| Request Headers | Headers of the request. | -| Response Status | Response status received from the application. | -| Response Headers | Headers of the response received from the application. | -| Evidence | Evidence of the data found that verified the vulnerability. Often a snippet of the request or response, this can be used to help verify that the finding is a vulnerability. | -| Identifiers | Identifiers of the vulnerability. | -| Severity | Severity of the vulnerability. | -| Scanner Type | Type of vulnerability report. | -| Links | Links to further details of the detected vulnerability. | -| Solution | Details of a recommended solution to the vulnerability (optional). | - -### Hide sensitive information in headers - -HTTP request and response headers may contain sensitive information, including cookies and -authorization credentials. By default, content of specific headers are masked in DAST vulnerability -reports. You can specify the list of all headers to be masked. For details, see -[Hide sensitive information](dast/index.md#hide-sensitive-information). - ## Addressing vulnerabilities > Introduced in [GitLab Ultimate](https://about.gitlab.com/pricing/) 10.8. diff --git a/doc/user/gitlab_com/index.md b/doc/user/gitlab_com/index.md index 6e38534b044..8019e99a919 100644 --- a/doc/user/gitlab_com/index.md +++ b/doc/user/gitlab_com/index.md @@ -115,6 +115,7 @@ or over the repository size limit, you can [reduce your repository size with Git | ----------- | ----------- | ------------- | | [Repository size including LFS](../admin_area/settings/account_and_limit_settings.md#repository-size-limit) | 10 GB | Unlimited | | Maximum import size | 5 GB | Unlimited ([Modified](https://gitlab.com/gitlab-org/gitlab/-/issues/251106) from 50MB to unlimited in GitLab 13.8. | +| Maximum attachment size | 10 MB | 10 MB | NOTE: `git push` and GitLab project imports are limited to 5 GB per request through Cloudflare. Git LFS and imports other than a file upload are not affected by this limit. diff --git a/doc/user/project/integrations/webhooks.md b/doc/user/project/integrations/webhooks.md index 56a339e02d2..d74a2bec1f6 100644 --- a/doc/user/project/integrations/webhooks.md +++ b/doc/user/project/integrations/webhooks.md @@ -1368,6 +1368,7 @@ X-Gitlab-Event: Deployment Hook { "object_kind": "deployment", "status": "success", + "status_changed_at":"2021-04-28 21:50:00 +0200", "deployable_id": 796, "deployable_url": "http://10.126.0.2:3000/root/test-deployment-webhooks/-/jobs/796", "environment": "staging", -- cgit v1.2.3