Skip to content

Update DastSiteProfile variables for graphql scans

Marcos Rocha requested to merge mc_rocha-fix-scan-file-path-validation-for-graphql-378692 into master

What does this MR do and why?

This MR updates the dast_site_profile configuration variables for GraphQL scans

The MR update the variable DAST_API_GRAPHQL to accept a file path. This change is necessary because the DAST API analyzer expects a file path for GraphQL scans not an URL.

And it also adds the DAST_API_TARGET_URL for GraphQL scans. The Analyzer won't work without variable when the scanMethod is GraphQL.

More context about this issue can be found here.

This Merge Request is related to issue #378692 (closed)

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

How to set up and validate locally

  1. Go to -/on_demand_scans/new

  2. Create a new site profile like:

Screenshot_2022-12-12_at_8.38.41_PM

  1. Click in Run
  2. Check the value of the variable [INF] DAST API: graphql: in the job log. It should match the GraphQL endpoint path.
  3. Check the value of the variable [INF] DAST API: target_url: in the job log. It should match the API endpoint URL.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Marcos Rocha

Merge request reports