Merge branch 'add_scanner_profile_properties_to_on_demand_scan_254626' into 'master'

Honor all DAST Scanner Profile variables in on demand DAST Scan

See merge request gitlab-org/gitlab!44508

ee/app/graphql/mutations/dast_on_demand_scans/create.rb

@@ -44,7 +44,10 @@ module Mutations
           branch: project.default_branch,
           target_url: dast_site.url,
           spider_timeout: dast_scanner_profile&.spider_timeout,
-          target_timeout: dast_scanner_profile&.target_timeout
+          target_timeout: dast_scanner_profile&.target_timeout,
+          full_scan_enabled: dast_scanner_profile&.full_scan_enabled?,
+          use_ajax_spider: dast_scanner_profile&.use_ajax_spider,
+          show_debug_messages: dast_scanner_profile&.show_debug_messages
         )
 
         if result.success?

ee/app/models/dast_scanner_profile.rb

@@ -12,4 +12,8 @@ class DastScannerProfile < ApplicationRecord
     passive: 1,
     active: 2
   }
+
+  def full_scan_enabled?
+    scan_type == 'active'
+  end
 end

ee/app/services/ci/run_dast_scan_service.rb

@@ -5,7 +5,10 @@ module Ci
     ENV_MAPPING = {
       spider_timeout: 'DAST_SPIDER_MINS',
       target_timeout: 'DAST_TARGET_AVAILABILITY_TIMEOUT',
-      target_url: 'DAST_WEBSITE'
+      target_url: 'DAST_WEBSITE',
+      use_ajax_spider: 'DAST_USE_AJAX_SPIDER',
+      show_debug_messages: 'DAST_DEBUG',
+      full_scan_enabled: 'DAST_FULL_SCAN_ENABLED'
     }.freeze
 
     def self.ci_template_raw
@@ -40,9 +43,9 @@ module Ci
 
     def ci_yaml(args)
       variables = args.each_with_object({}) do |(key, val), hash|
-        next unless val && ENV_MAPPING[key]
+        next if val.nil? || !ENV_MAPPING[key]
 
-        hash[ENV_MAPPING[key]] = val
+        hash[ENV_MAPPING[key]] = !!val == val ? val.to_s : val
         hash
       end
 

ee/changelogs/unreleased/add_scanner_profile_properties_to_on_demand_scan_254626.yml

+---
+title: Honor all DAST Scanner Profile variables in on demand DAST Scan
+merge_request: 44508
+author:
+type: added

ee/spec/graphql/mutations/dast_on_demand_scans/create_spec.rb

@@ -103,7 +103,7 @@ RSpec.describe Mutations::DastOnDemandScans::Create do
         end
 
         context 'when dast_scanner_profile_id is provided' do
-          let(:dast_scanner_profile) { create(:dast_scanner_profile, project: project, target_timeout: 200, spider_timeout: 5000) }
+          let(:dast_scanner_profile) { create(:dast_scanner_profile, project: project, target_timeout: 200, spider_timeout: 5000, use_ajax_spider: true, show_debug_messages: true, scan_type: 'active') }
           let(:dast_scanner_profile_id) { dast_scanner_profile.to_global_id }
 
           subject do
@@ -123,7 +123,10 @@ RSpec.describe Mutations::DastOnDemandScans::Create do
           it 'passes additional arguments to the underlying service object' do
             args = hash_including(
               spider_timeout: dast_scanner_profile.spider_timeout,
-              target_timeout: dast_scanner_profile.target_timeout
+              target_timeout: dast_scanner_profile.target_timeout,
+              use_ajax_spider: dast_scanner_profile.use_ajax_spider,
+              show_debug_messages: dast_scanner_profile.show_debug_messages,
+              full_scan_enabled: dast_scanner_profile.full_scan_enabled?
             )
 
             expect_any_instance_of(::Ci::RunDastScanService).to receive(:execute).with(args).and_call_original

ee/spec/models/dast_scanner_profile_spec.rb

@@ -24,4 +24,18 @@ RSpec.describe DastScannerProfile, type: :model do
       end
     end
   end
+
+  describe 'full_scan_enabled?' do
+    describe 'when is active scan' do
+      subject { create(:dast_scanner_profile, scan_type: :active).full_scan_enabled? }
+
+      it { is_expected.to eq(true) }
+    end
+
+    describe 'when is passive scan' do
+      subject { create(:dast_scanner_profile, scan_type: :passive).full_scan_enabled? }
+
+      it { is_expected.to eq(false) }
+    end
+  end
 end

ee/spec/services/ci/run_dast_scan_service_spec.rb

@@ -7,6 +7,9 @@ RSpec.describe Ci::RunDastScanService do
   let(:project) { create(:project, :repository, creator: user) }
   let(:branch) { project.default_branch }
   let(:target_url) { generate(:url) }
+  let(:use_ajax_spider) { true }
+  let(:show_debug_messages) { false }
+  let(:full_scan_enabled) { true }
 
   before do
     stub_licensed_features(security_on_demand_scans: true)
@@ -27,7 +30,7 @@ RSpec.describe Ci::RunDastScanService do
   end
 
   describe '#execute' do
-    subject { described_class.new(project, user).execute(branch: branch, target_url: target_url, spider_timeout: 42, target_timeout: 21) }
+    subject { described_class.new(project, user).execute(branch: branch, target_url: target_url, spider_timeout: 42, target_timeout: 21, use_ajax_spider: use_ajax_spider, show_debug_messages: show_debug_messages, full_scan_enabled: full_scan_enabled) }
 
     let(:status) { subject.status }
     let(:pipeline) { subject.payload }
@@ -125,6 +128,18 @@ RSpec.describe Ci::RunDastScanService do
             'key' => 'DAST_TARGET_AVAILABILITY_TIMEOUT',
             'value' => '21',
             'public' => true
+          }, {
+            'key' => "DAST_USE_AJAX_SPIDER",
+            'public' => true,
+            'value' => 'true'
+          }, {
+            'key' => "DAST_DEBUG",
+            'public' => true,
+            'value' => 'false'
+          }, {
+            'key' => "DAST_FULL_SCAN_ENABLED",
+            'public' => true,
+            'value' => 'true'
           }, {
             'key' => 'GIT_STRATEGY',
             'value' => 'none',