Update files that require AppSec reviews
What does this MR do and why?
Related to https://gitlab.com/gitlab-com/gl-security/appsec/appsec-team/-/issues/263
Following https://gitlab.com/gitlab-com/gl-security/security-operations/sirt/operations/-/issues/2167 we introduced !84141 (merged) which added required approval by ~"group::authentication and authorization" for our Auth-related code.
In the same vein, this requires AppSec reviews for changes on the files that are central to our security and protect us from large classes of vulnerabilities.
At this time this is a very limited list:
- The main CSP configuration which limits cross-site scripting (XSS) exploitation
-
Gitlab::UrlBlocker
which protects us against server-side request forgery (SSRF) - The DOMPurify configuration which is important for our XSS defense
Screenshots or screen recordings
N/A
How to set up and validate locally
N/A
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
-
I have evaluated the MR acceptance checklist for this MR.
Edited by Dominic Couture