Gitlab:安全仪表板上未显示依赖项扫描程序报告

Question

我正在尝试创建我自己的安全扫描器，它将检查依赖关系。为了测试功能，我创建了一个“模拟扫描器”，它从webhook下载一个文件，并将其保存为应该上传到服务器的工件。

工件已成功上载，并且在CI输出中我可以看到201代码，但由于某种原因，它没有出现在安全仪表板中。

我做错了什么？

谢谢!

CI作业如下所示：

​

mysec_dependency_scanning:
  stage: test
  script: 
    - curl https://webhook.site/XXXX -o gl-dependency-scanning-report.json
    - sleep 3
  allow_failure: true
  artifacts:
    reports:
      dependency_scanning: gl-dependency-scanning-report.json

​

json文件的内容来自gitlab提供的示例，如下所示：

​

{
  "version": "2.0",
  "vulnerabilities": [
    {
      "id": "51e83874-0ff6-4677-a4c5-249060554eae",
      "category": "dependency_scanning",
      "name": "alik alik",
      "message": "Regular Expression Denial of Service in debug",
      "description": "alik to regular expression denial of service when untrusted user input is passed into the `o` formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.",
      "severity": "Unknown",
      "solution": "Upgrade to latest versions.",
      "scanner": {
        "id": "dadada",
        "name": "dadada"
      },
      "location": {
        "file": "yarn.lock",
        "dependency": {
          "package": {
            "name": "debug"
          },
          "version": "1.0.5"
        }
      },
      "identifiers": [
        {
          "type": "gemnasium",
          "name": "Gemnasium-37283ed4-0380-40d7-ada7-2d994afcc62a",
          "value": "37283ed4-0380-40d7-ada7-2d994afcc62a",
          "url": "https://deps.sec.gitlab.com/packages/npm/debug/versions/1.0.5/advisories"
        }
      ],
      "links": [
        {
          "url": "https://nodesecurity.io/advisories/534"
        },
        {
          "url": "https://github.com/visionmedia/debug/issues/501"
        },
        {
          "url": "https://github.com/visionmedia/debug/pull/504"
        }
      ]
    },
    {
      "id": "5d681b13-e8fa-4668-957e-8d88f932ddc7",
      "category": "dependency_scanning",
      "name": "Authentication bypass via incorrect DOM traversal and canonicalization",
      "message": "Authentication bypass via incorrect DOM traversal and canonicalization in saml2-js",
      "description": "Some XML DOM traversal and canonicalization APIs may be inconsistent in handling of comments within XML nodes. Incorrect use of these APIs by some SAML libraries results in incorrect parsing of the inner text of XML nodes such that any inner text after the comment is lost prior to cryptographically signing the SAML message. Text after the comment, therefore, has no impact on the signature on the SAML message.\r\n\r\nA remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic signature, which may allow attackers to bypass primary authentication for the affected SAML service provider.",
      "severity": "Unknown",
      "solution": "Upgrade to fixed version.\r\n",
      "scanner": {
        "id": "dadada",
        "name": "dadada"
      },
      "location": {
        "file": "yarn.lock",
        "dependency": {
          "package": {
            "name": "saml2-js"
          },
          "version": "1.5.0"
        }
      },
      "identifiers": [
        {
          "type": "gemnasium",
          "name": "Gemnasium-9952e574-7b5b-46fa-a270-aeb694198a98",
          "value": "9952e574-7b5b-46fa-a270-aeb694198a98",
          "url": "https://deps.sec.gitlab.com/packages/npm/saml2-js/versions/1.5.0/advisories"
        },
        {
          "type": "cve",
          "name": "CVE-2017-11429",
          "value": "CVE-2017-11429",
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11429"
        }
      ],
      "links": [
        {
          "url": "https://github.com/Clever/saml2/commit/3546cb61fd541f219abda364c5b919633609ef3d#diff-af730f9f738de1c9ad87596df3f6de84R279"
        },
        {
          "url": "https://github.com/Clever/saml2/issues/127"
        },
        {
          "url": "https://www.kb.cert.org/vuls/id/475445"
        }
      ]
    }
  ],
  "remediations": [
    {
      "fixes": [
        {
          "id": "5d681b13-e8fa-4668-957e-8d88f932ddc7",
        }
      ],
      "summary": "Upgrade saml2-js",
      "diff": "ZGlmZiAtLWdpdCBhL...OR0d1ZUc2THh3UT09Cg==" // some content is omitted for brevity
    }
  ]
}

​

Answer 1

我能够解决这个问题，这个问题是一个无效的json格式。我不得不做大量的试验和错误，但我能够为依赖项扫描报告创建一个工作模板。

​

{
  "version": "3.0.0",
  "vulnerabilities": [
    {
      "id": "dfa1f7f3d56db6e1c3451a232de42f153e0335611de6f0344443d84e448ee2cf",
      "category": "dddda",
      "name": "dddda",
      "message": "ddda",
      "description": "dddda lack of validation in `index.js`.",
      "cve": "dada",
      "severity": "Critical",
      "solution": "Upgrade to version 2.0.5 or above.",
      "scanner": {
        "id": "lalal",
        "name": "Code_Analyzer"
      },
      "location": {
        "file": "yarn.lock",
        "dependency": {
          "iid": 447,
          "package": {
            "name": "copy-props"
          },
          "version": "2.0.4"
        }
      },
      "identifiers": [
        {
          "type": "dada",
          "name": "dada-e9e12690-2e4d-4251-bef0-7357ddc05881",
          "value": "e9e57890-5e4d-4832-bef2-7337ddc05889",
          "url": "https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/blob/master/npm/copy-props/CVE-2219-28503.yml"
        },
        {
          "type": "cve",
          "name": "CVE-2237-28503",
          "value": "CVE-2237-28503",
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2237-28503"
        }
      ],
      "links": [
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2237-28503"
        }
      ]
    }
  ],
  "remediations": [],
  "dependency_files": [
    {
      "path": "yarn.lock",
      "package_manager": "yarn",
      "dependencies": [  
          {
            "iid": 447,
            "dependency_path": [
              {
                "iid": 708
              },
              {
                "iid": 707
              }
            ],
            "package": {
              "name": "copy-props"
            },
            "version": "2.0.4"
          }
        ]
    }
  ],
  "scan": {
  "scanner": {
    "id": "lalal",
    "name": "Code_Analyzer",
    "url": "https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium",
    "vendor": {
      "name": "lalal"
    },
    "version": "2.29.5"
  },
  "type": "dependency_scanning",
  "start_time": "2021-05-03T06:47:29",
  "end_time": "2021-05-03T06:47:30",
  "status": "success"
  }
}

​