SCM Type for self-managed GitLab

[sNiXx]

As far as I can tell from the current documentation on source code repositories, SCM type for GitLab should not have to be set, as it is the default. However, when clicking on the link of a finding, I get a 404, because the URL is incorrectly constructed. However, if I manually add scm-type/gitlab as a custom field, the link is constructed correctly.

We are using a self-managed instance of GitLab and I saw in this MR that SCM type indeed has to be set. However, settings this manually or having to parse the response is not convenient at all. In addition, the section of the documentation mentioned in the MR no longer exists (this points to the old docs). Nothing is mentioned in the current documentation on source code repositories.

What is the currently recommended approach to handling this? Having the possibility to set a default SCM type or to be able to use a field in the import-scan or reimport-scan methods would probably make sense?

Also, is it possible this is due to a recent change? In my earlier tests, I do not remember having any issues with the URLs...

[valentijnscholten]

Looking at the code you need to set scm-type to get the urls to work correctly. @paulOsinski Could you finetune the docs on this?

The field can be set via the API. The autocreate feature is already complex and not easy to understand, especially from the coding side.

A similar opinion was voiced by Cody in the MR linked above:

Hi dmarushkin thank you for your contribution! Though I like the approach you took, keeping the auto create context relevant to the necessities that the test and findings need is crucial in making this feature maintainable and easy to understand for newcomers.

If applicacble, mark the correct answer to help other users find the answer :-)

[sNiXx]

Thanks for the response, @valentijnscholten, but you are only giving indirect answers. If I understand the current situation correctly:

• The autocreate feature will not include setting the scm-type due to its already-high complexity
• The only ways to set the scm-type are
  • in the UI (manual step)
  • via the API endpoint /api/v2/metadata/, e.g.

    {
    "product": 123,
    "name": "scm-type",
    "value": "gitlab"
    }
    

What you haven't answered:

• What about the possibility of a "global" default setting? The above mentioned approaches feel like workarounds for something that is quite common (self-managed instances of an SCM)

And an additional question:

• What happens when I send the following request to /api/v2/metadata/? The product is nullable according to the API spec

  {
  "name": "scm-type",
  "value": "gitlab"
  }
  

[valentijnscholten]

Ah ok, your post sounded more like a request for explanation rather than a "please consider this suggestion".

What about the possibility of a "global" default setting? The above mentioned approaches feel like workarounds for something that is quite common (self-managed instances of an SCM)

Could you raise a feature request explaining in more detail how you see that "global default setting" working?

Currently there's some logic in place that deduces the scm-type from URLs. For example if the url contains https://github.com it will assume scm-type=github. Would that logic remain working even with a global default being set? There may be addition logic in the future, for example "if url contains https://gitlab.com, assum scm-type gitlab". Or (for self-hosted Gitlab) "if url contains "gitlab.", assume scm-type gitlab", etc.

If have:

• raised docs: source-code-repositories: clarify default scm type #11968 to make the docs more clear
• asked the Defect Dojo team about the status of this feature as the docs are currently marked as "archived"

What happens when I send the following request to /api/v2/metadata/? The product is nullable according to the API spec
{
"name": "scm-type",
"value": "gitlab"
}

Did you try it via the API? I expect an error as at least Product or Finding or Endpoint must be set.

[sNiXx]

Better late than never, I guess?

I was finally able to work on this a little bit more and have come up with the following (using curl in our pipeline):

1. I create the product in DefectDojo (with auto_create_context=true) via the /api/v2/reimport-scan endpoint
2. I then retrieve the product information via the /api/v2/products endpoint and extract the scm-type property from product_meta.
3. When scm-type is not set to gitlab, I set it via the /api/v2/metadata endpoint.

I still think it would be nice to be able to set this directly in the creation context or have a global setting (that can be overriden on a per-project basis). Extending existing functionality by checking for gitlab. in the URL also seems like a good compromise if the former two add to much complexity.

Please let me know if I you would like me to work on this - in that case some pointers would help :-)