Tutorial: Set up a scan result policy (ULTIMATE)

This tutorial shows you how to create and configure a scan result policy. These policies can be set to take action based on scan results. For example, in this tutorial, you'll set up a policy that requires approval from two specified users if a vulnerability is detected in a merge request.

Prerequisites:

The namespace used for this tutorial must:

Contain a minimum of three users, including your own. If you don't have two other users, you must first create them. For details, see Creating users.

To set up a scan result policy:

Create a test project.
Add a scan result policy.
Test the scan result policy.

Create a test project

On the top bar, select Main menu > Projects.
Select New project.
Select Create blank project.
Complete the fields.
- Project name: sast-scan-result-policy.
- Select the Enable Static Application Security Testing (SAST) checkbox.
Select Create project.

Add a scan result policy

Next, you'll add a scan result policy to your test project:

On the top bar, select Main menu > Projects and find the sast-scan-result-policy project.
On the left sidebar, go to Security and Compliance > Policies.
Select New policy.
In Scan result policy, select Select policy.
Complete the fields.
- Name: sast-scan-result-policy
- Policy status: Enabled

Add the following rule:

IF |Security Scan| from |SAST| find(s) more than |0| |All severity levels| |All vulnerability states| vulnerabilities in an open merge request targeting |All protected branches|

Set Actions to the following:

THEN Require approval from | 2 | of the following approvers:

Select two users.
Select Configure with a merge request.

The application creates a new project to store the policies linked to it, and creates a merge request to define the policy.
Select Merge.
On the top bar, select Main menu > Projects and select the sast-scan-result-policy project.
On the left sidebar, select Security and Compliance > Policies.

You can see the list of policies added in the previous steps.

Test the scan result policy

Nice work, you've created a scan result policy. To test it, create some vulnerabilities and check the result:

On the top bar, select Main menu > Projects and select the sast-scan-result-policy project.
On the left sidebar, select Repository > Files.
From the Add ({plus}) dropdown list, select New file.
In the Filename field enter main.ts.

In the file's content, copy the following:

// Non-literal require - tsr-detect-non-literal-require
var lib: String = 'fs'
require(lib)

// Eval with variable - tsr-detect-eval-with-expression
var myeval: String = 'console.log("Hello.");';
eval(myeval);

// Unsafe Regexp - tsr-detect-unsafe-regexp
const regex: RegExp = /(x+x+)+y/;

// Non-literal Regexp - tsr-detect-non-literal-regexp
var myregexpText: String = "/(x+x+)+y/";
var myregexp: RegExp = new RegExp(myregexpText);
myregexp.test("(x+x+)+y");

// Markup escaping disabled - tsr-detect-disable-mustache-escape
var template: Object = new Object;
template.escapeMarkup = false;

// Detects HTML injections - tsr-detect-html-injection
var element: Element =  document.getElementById("mydiv");
var content: String = "mycontent"
Element.innerHTML = content;

// Timing attack - tsr-detect-possible-timing-attacks
var userInput: String = "Jane";
var auth: String = "Jane";
if (userInput == auth) {
  console.log(userInput);
}

In the Commit message field, enter Add vulnerable file.
In the Target Branch field, enter test-branch.
Select Commit changes. The New merge request form opens.
Select Create merge request.
In the new merge request, select Create merge request.

Wait for the pipeline to complete. This could be a few minutes.

The merge request security widget confirms that security scanning detected one potential vulnerability. As defined in the scan result policy, the merge request is blocked and waiting for approval.

You now know how to set up and use scan result policies to catch vulnerabilities!