Malicious sources scanning

Malicious sources scanning finds references to known-malicious external domains in your repository, such as the CDNs involved in the polyfill.io supply chain attack. Each reference is reported as a SAST vulnerability.

To help decide the future of this experiment, share your feedback in issue 634760.

Turn on malicious sources scanning

To turn on malicious sources scanning, add the malicious sources CI/CD component to your .gitlab-ci.yml file:

include:
  - component: gitlab.com/security-products/experiments/malicious-sources/malicious-sources@0.2.0

The component adds a malicious-sources-scan job to the test stage. Findings appear in the vulnerability report and in merge requests.

Detected domains

Malicious sources scanning detects references to these domains, with Critical severity:

• bootcdn.net
• bootcss.com and cdn.bootcss.com
• polyfill.com
• polyfill.io and cdn.polyfill.io
• staticfile.net and cdn.staticfile.net
• staticfile.org and cdn.staticfile.org
• unionadjs.com

The analyzer matches https://, http://, and protocol-relative (//) references case-insensitively.

Exclude paths

To skip files and directories, set SAST_EXCLUDED_PATHS to a comma-separated list of gitignore-style patterns. The .git directory is always excluded.

variables:
  SAST_EXCLUDED_PATHS: "node_modules, vendor, **/*.min.js"

Add custom rules

To detect other domains, set MALICIOUS_SOURCES_CUSTOM_RULES to a YAML list of rules. Custom rules are added to the built-in rules.

variables:
  MALICIOUS_SOURCES_CUSTOM_RULES: |
    - rule_id: malicious.example.test
      substring: //malicious.example.test
      severity: High
      title: "Malicious CDN: malicious.example.test"
      description: "Known malicious CDN observed in supply chain attacks."

To turn off a built-in rule, set disabled: true on its domain:

variables:
  MALICIOUS_SOURCES_CUSTOM_RULES: |
    - rule_id: cdn.polyfill.io
      disabled: true

If the YAML is not valid, the scan fails with an error.