Package: secscanner2junit
SecScanner2JUnitGitLab offerssecurity scanning and visualizationdirectly via and on their platform.One nice feature is direct insights on merge requests. However, this feature is only available with the Ultimate tier. To also use this feature on the free tier, one can build around it by taking the security tool output, converting it to the JUnit format, and uploading it as JUnit report.To summarize, this tool is for you if:You use GitLab's free tierYou use Gitlabssecurity templatesYou want to easily access security tool output in merge requestsIf you are on the GitLabs Ultimate tier, just use their tooling! No need to mess up your.gitlab-ci.ymlfile. :smile:Which scanning types are supported?All scanning types available under the free tier:Secret ScanningStatic Application Security Testing (SAST)Container ScanningInfrastructure as Code ScanningHow to use?Procedure:Overwrite the existing job so that the report can be used by future jobs.Convert reportUpload converted report as junit reportExample for Secret ScanningThis example can be used as is.stages:-test-convert-include:-template:Security/Secret-Detection.gitlab-ci.ymlsecret_detection:artifacts:paths:-gl-secret-detection-report.jsonwhen:alwayssecret_convert:stage:convertdependencies:-secret_detectionscript:-pip3 install SecScanner2JUnit-ss2ju secrets gl-secret-detection-report.json gl-secret-detection-report.xmlartifacts:reports:junit:gl-secret-detection-report.xmlExample for SASTSince GitLab decides dynamically which scanners to use depending on project languages, it makes sense to first perform a testrun only including the template. This way one can see which jobs are executed and then overwrite them.stages:-test-convert-include:-template:Security/SAST.gitlab-ci.ymlsemgrep-sast:after_script:-cp gl-sast-report.json gl-sast-semgrep-report.jsonartifacts:paths:-gl-sast-semgrep-report.jsonwhen:alwaysbrakeman-sast:after_script:-cp gl-sast-report.json gl-sast-brakeman-report.jsonartifacts:paths:-gl-sast-brakeman-report.jsonwhen:alwayssemgrep-sast-convert:stage:convertdependencies:-semgrep-sastscript:-pip3 install SecScanner2JUnit-ss2ju sast gl-sast-semgrep-report.json gl-sast-semgrep-report.xmlartifacts:reports:junit:gl-sast-semgrep-report.xmlbrakeman-sast-convert:stage:convertdependencies:-brakeman-sastscript:-pip3 install SecScanner2JUnit-ss2ju sast gl-sast-brakeman-report.json gl-sast-brakeman-report.xmlartifacts:reports:junit:gl-sast-brakeman-report.xmlExample for Container Scanning-include:-template:Jobs/Build.gitlab-ci.yml#Build and push the container image-template:Security/Container-Scanning.gitlab-ci.yml#Scan the built imagecontainer_scanning:artifacts:paths:-gl-container-scanning-report-format.jsonwhen:alwayscontainer_scanning-convert:stage:convertdependencies:-container_scanningscript:-pip3 install SecScanner2JUnit-ss2ju container_scanning gl-container-scanning-report.json gl-container-scanning-report.xmlartifacts:reports:junit:gl-container-scanning-report.xmlSuppressionYou can provide a file with suppression which will allow to ignore some vulnerabilities.You have to create a filess2ju-config.ymlf.e. in.gitlabdirectory which includes:sast:
  suppressions:
    - type: "cwe"
      value: "2555"
    - type: "find_sec_bugs_type"
      value: "SPRING_ENDPOINT"And now you can modify execution commands as follows:-ss2jusastgl-sast-semgrep-report.jsongl-sast-semgrep-report.xml.gitlab/ss2ju-config.ymlUsage with dockerFor easier usage in CI,Secscanner2JUnitis also shipped in a docker container:https://hub.docker.com/r/angrymeir/secscanner2junitIts' usage is similar to the ways described above:...secret_convert:stage:convertimage:name:angrymeir/secscanner2junit:latestentrypoint:[""]dependencies:-secret_detectionscript:-ss2ju secrets gl-secret-detection-report.json gl-secret-detection-report.xmlartifacts:reports:junit:gl-secret-detection-report.xml