Skip to content

WIP: Working with dotnet framework with mono

Florian requested to merge agixid/security-code-scan:mono-framework into master

What does this MR do?

Following !13 (closed) I tried to use mono instead of windows dotnet framework image so we can use security-code-scan on linux.

I successfully built and used security-code-scan for WebGoat.NET and a bunch of private project.

I don't think we can easily combine "classic" security-code-scan and "framework" security-code-scan as they don't use the same base docker images.

I pushed the mono image on dockerhub if you want a quick try.

From windows and with a docker on windows server :

git clone https://github.com/jerryhoff/WebGoat.NET
cd WebGoat.NET
docker run --interactive --tty --rm --volume $(pwd):/tmp/app --env CI_PROJECT_DIR=/tmp/app/WebGoat docker.io/agix/security-code-scan-framework-sln:mono_3.2.0

I used it directly from gitlab sast and it seems to work on most of the projects I tested.

Also analyzer shoul walk into project directories to add SecurityCodeScan package in all of them, not just the first csproj like current security-code-scan analyzer do.

What are the relevant issue numbers?

https://gitlab.com/gitlab-org/gitlab-ee/issues/6289

Does this MR meet the acceptance criteria?

Merge request reports