Migrating from the DAST version 4 browser-based analyzer to DAST version 5

DAST version 5 replaces DAST version 4. This document serves as a guide to migrate from the DAST version 4 browser-based analyzer to DAST version 5.

Follow this migration guide if all the following conditions apply:

1. You use GitLab DAST to run a DAST scan in a CI/CD pipeline.
2. The DAST CI/CD job is configured by including either of the DAST templates DAST.gitlab-ci.yml or DAST.latest.gitlab-ci.yml.
3. The CI/CD variable DAST_VERSION is not set or is set to 4 or less.
4. The CI/CD variable DAST_BROWSER_SCAN is set to true.

Migrate to DAST version 5 by reading the following sections and making the recommended changes.

DAST analyzer versions

DAST comes in two major versions: 4 and 5. Effective from GitLab 17.0 the DAST templates DAST.gitlab-ci.yml and DAST.latest.gitlab-ci.yml use DAST version 5 by default. You can continue using DAST version 4, but you should do so only as an interim measure while migrating to DAST version 5. For details, see Continuing to use version 4.

Each DAST major version runs different analyzers:

• DAST version 4 can run either the proxy-based or browser-based analyzer, and uses the proxy-based analyzer by default.
• DAST version 5 runs only the browser-based analyzer.

DAST version 5 uses a set of new CI/CD variables. Aliases have been created for the DAST version 4 variables’ names.

Changes to make in GitLab 16.11 and earlier:

• To test DAST version 5, set the CI/CD variable DAST_VERSION to 5.
• To avoid job failures, do not remove or rename DAST_WEBSITE. The DAST.gitlab-ci.yml template versions 16.11 and earlier still use the DAST_WEBSITE variable.

Changes to make in GitLab 17.0 and later:

• After you upgrade to GitLab 17.0, rename DAST_WEBSITE to DAST_TARGET_URL.
• When you start using new templates that set DAST_VERSION to 5, make sure the CI/CD variable DAST_VERSION is not set.

Continuing to use version 4

You can use the DAST version 4 proxy-based analyzer until GitLab 18.0. Bugs and vulnerabilities in this legacy analyzer will not be fixed.

Changes to make:

• To continue using DAST version 4, set the CI/CD variable DAST_VERSION variable to 4.

Artifacts

GitLab 17.0 automatically publishes artifacts produced by DAST version 5 to the DAST CI job.

Changes to make:

• Remove artifacts from the CI job definition if you have overridden it to expose the file log, crawl graph, or authentication report.
• CI/CD variables DAST_BROWSER_FILE_LOG_PATH and DAST_FILE_LOG_PATH are no longer required.

Vulnerability check coverage

Browser-based DAST version 4 uses proxy-based analyzer checks for active checks not included in the browser-based analyzer. Browser-based DAST version 5 does not include the proxy-based analyzer, so there is a gap in check coverage when migrating to version 5.

There is one proxy-based active check that the browser-based analyzer does not cover. Migration of the remaining active check is proposed in epic 13411. If you prefer to remain on DAST version 4 until the last check is migrated, see Continuing to use version 4.

Remaining check:

• CWE-79: Cross-site Scripting (XSS)

Follow the progress of the remaining check in the epic Remaining active checks for BBD.

Changes to CI/CD variables

The following table outlines migration actions required for each browser-based analyzer DAST version 4 CI/CD variable. See configuration for more information on configuring the browser-based analyzer.