Commit 0c8d2437 authored by Stan Hu's avatar Stan Hu

Merge branch 'philipcunningham-add-host-override-for-dast-ondemand-api-url-294060' into 'master'

Set DAST_API_HOST_OVERRIDE for on-demand API scans

See merge request gitlab-org/gitlab!60075
parents cb6c9c73 2bb794f7
......@@ -7,6 +7,7 @@ module Ci
target_timeout: 'DAST_TARGET_AVAILABILITY_TIMEOUT',
target_url: 'DAST_WEBSITE',
api_specification_url: 'DAST_API_SPECIFICATION',
api_host_override: 'DAST_API_HOST_OVERRIDE',
use_ajax_spider: 'DAST_USE_AJAX_SPIDER',
show_debug_messages: 'DAST_DEBUG',
full_scan_enabled: 'DAST_FULL_SCAN_ENABLED',
......
......@@ -45,7 +45,7 @@ module DastOnDemandScans
def dast_site
strong_memoize(:dast_site) do
dast_site_profile&.dast_site
dast_site_profile.dast_site
end
end
......@@ -66,12 +66,12 @@ module DastOnDemandScans
end
def target_config
url = dast_site&.url
url = dast_site.url
if dast_site_profile.target_type == 'website'
{ target_url: url }
else
{ api_specification_url: url }
{ api_specification_url: url, api_host_override: URI(url).host }
end
end
......
......@@ -13,6 +13,7 @@ RSpec.describe Ci::DastScanCiConfigurationService do
target_timeout: 100,
target_url: 'https://gitlab.local',
api_specification_url: 'https://gitlab.local/api.json',
api_host_override: 'gitlab.local',
use_ajax_spider: true,
show_debug_messages: true,
full_scan_enabled: true,
......@@ -36,6 +37,7 @@ RSpec.describe Ci::DastScanCiConfigurationService do
DAST_TARGET_AVAILABILITY_TIMEOUT: 100
DAST_WEBSITE: https://gitlab.local
DAST_API_SPECIFICATION: https://gitlab.local/api.json
DAST_API_HOST_OVERRIDE: gitlab.local
DAST_USE_AJAX_SPIDER: 'true'
DAST_DEBUG: 'true'
DAST_FULL_SCAN_ENABLED: 'true'
......
......@@ -7,6 +7,9 @@ RSpec.describe DastOnDemandScans::ParamsCreateService do
let_it_be(:dast_site_profile) { create(:dast_site_profile, project: project) }
let_it_be(:dast_scanner_profile) { create(:dast_scanner_profile, project: project) }
let(:excluded_urls) { dast_site_profile.excluded_urls.join(',') }
let(:target_url) { dast_site_profile.dast_site.url }
let(:params) { { dast_site_profile: dast_site_profile, dast_scanner_profile: dast_scanner_profile } }
subject { described_class.new(container: project, params: params).execute }
......@@ -45,8 +48,8 @@ RSpec.describe DastOnDemandScans::ParamsCreateService do
auth_url: dast_site_profile.auth_url,
branch: project.default_branch,
dast_profile: nil,
excluded_urls: dast_site_profile.excluded_urls.join(','),
target_url: dast_site_profile.dast_site.url
excluded_urls: excluded_urls,
target_url: target_url
)
end
end
......@@ -62,12 +65,12 @@ RSpec.describe DastOnDemandScans::ParamsCreateService do
auth_url: dast_site_profile.auth_url,
branch: project.default_branch,
dast_profile: nil,
excluded_urls: dast_site_profile.excluded_urls.join(','),
excluded_urls: excluded_urls,
full_scan_enabled: false,
show_debug_messages: false,
spider_timeout: nil,
target_timeout: nil,
target_url: dast_site_profile.dast_site.url,
target_url: target_url,
use_ajax_spider: false
)
end
......@@ -99,12 +102,12 @@ RSpec.describe DastOnDemandScans::ParamsCreateService do
expect(subject.payload).to eq(
branch: project.default_branch,
dast_profile: nil,
excluded_urls: dast_site_profile.excluded_urls.join(','),
excluded_urls: excluded_urls,
full_scan_enabled: false,
show_debug_messages: false,
spider_timeout: nil,
target_timeout: nil,
target_url: dast_site_profile.dast_site.url,
target_url: target_url,
use_ajax_spider: false
)
end
......@@ -113,9 +116,13 @@ RSpec.describe DastOnDemandScans::ParamsCreateService do
context 'when target_type=api' do
let_it_be(:dast_site_profile) { create(:dast_site_profile, project: project, target_type: :api) }
it 'returns params including the api_specification_url and omitting the target_url', :aggregate_failures do
expect(subject.payload[:api_specification_url]).to eq(dast_site_profile.dast_site.url)
expect(subject.payload[:target_url]).to be_nil
it 'returns params including the api_specification_url and omitting the target_url' do
expected_payload = hash_including(
api_specification_url: target_url,
api_host_override: URI(target_url).host
)
expect(subject.payload).to match(expected_payload).and exclude(:target_url)
end
end
end
......@@ -133,12 +140,12 @@ RSpec.describe DastOnDemandScans::ParamsCreateService do
branch: dast_profile.branch_name,
auth_url: dast_site_profile.auth_url,
dast_profile: dast_profile,
excluded_urls: dast_site_profile.excluded_urls.join(','),
excluded_urls: excluded_urls,
full_scan_enabled: false,
show_debug_messages: false,
spider_timeout: nil,
target_timeout: nil,
target_url: dast_site_profile.dast_site.url,
target_url: target_url,
use_ajax_spider: false
)
end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment