Vulnerability Findings API · Gitlab 中文文檔

# Vulnerability Findings API > 原文：[https://docs.gitlab.com/ee/api/vulnerability_findings.html](https://docs.gitlab.com/ee/api/vulnerability_findings.html) * [Vulnerability findings pagination](#vulnerability-findings-pagination) * [List project vulnerability findings](#list-project-vulnerability-findings) # Vulnerability Findings API[](#vulnerability-findings-api-ultimate "Permalink") 在 GitLab Ultimate 12.5 中[引入](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/19029) . **注意：**此 API 資源已從"漏洞"重命名為"漏洞發現"，因為這些漏洞是為服務即將到來的[獨立漏洞對象](https://gitlab.com/gitlab-org/gitlab/-/issues/13561)而保留的. 要修復與以前的 Vulnerabilities API 的任何損壞的集成，請將`vulnerabilities` URL 部分更改為`vulnerabilities` _ `vulnerability_findings` . 每個對漏洞發現的 API 調用都必須經過[身份驗證](README.html#authentication) . 漏洞發現是項目約束的實體. 如果用戶不是項目成員，并且該項目是私有項目，則對該項目的請求將產生`404`狀態代碼. 如果用戶能夠訪問該項目但無權[使用 Project Security 儀表板](../user/permissions.html#project-members-permissions) ，則任何對此項目的漏洞發現的請求都將生成`403`狀態代碼. **警告：**此 API 處于 alpha 階段，被認為是不穩定的. 響應有效載荷可能會在 GitLab 版本之間發生更改或損壞. ## Vulnerability findings pagination[](#vulnerability-findings-pagination "Permalink") 默認情況下，因為 API 結果是分頁的，所以`GET`請求一次返回 20 個結果. 閱讀有關[分頁的](README.html#pagination)更多信息. ## List project vulnerability findings[](#list-project-vulnerability-findings "Permalink") 列出項目的所有漏洞發現. ``` GET /projects/:id/vulnerability_findings GET /projects/:id/vulnerability_findings?report_type=sast GET /projects/:id/vulnerability_findings?report_type=container_scanning GET /projects/:id/vulnerability_findings?report_type=sast,dast GET /projects/:id/vulnerability_findings?scope=all GET /projects/:id/vulnerability_findings?scope=dismissed GET /projects/:id/vulnerability_findings?severity=high GET /projects/:id/vulnerability_findings?confidence=unknown,experimental GET /projects/:id/vulnerability_findings?scanner=bandit,find_sec_bugs GET /projects/:id/vulnerability_findings?pipeline_id=42 ``` **棄用：**從 GitLab 12.9 開始，不再報告`undefined`嚴重性和可信度級別. | Attribute | Type | Required | Description | | --- | --- | --- | --- | | `id` | integer/string | yes | 經過身份驗證的用戶[所屬的項目](README.html#namespaced-path-encoding)的 ID 或[URL 編碼路徑](README.html#namespaced-path-encoding) . | | `report_type` | 字符串數組 | no | 返回屬于指定報告類型的漏洞發現. 有效值： `sast` ， `dast` ， `dependency_scanning`或`container_scanning` . 默認為全部. | | `scope` | string | no | 返回給定范圍內的漏洞發現結果： `all`或已`dismissed` . 默認為`dismissed` . | | `severity` | 字符串數組 | no | 返回屬于指定嚴重性級別的漏洞發現： `info` ， `unknown` ， `low` ， `medium` ， `high`或`critical` . 默認為全部. | | `confidence` | 字符串數組 | no | 返回屬于指定置信度的漏洞發現： `ignore` ， `unknown` ， `experimental` ， `low` ， `medium` ， `high`或`confirmed` . 默認為全部. | | `scanner` | 字符串數組 | no | 返回指定掃描程序檢測到的漏洞發現. | | `pipeline_id` | integer/string | no | 返回屬于指定管道的漏洞發現. | ``` curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/4/vulnerability_findings" ``` Example response: ``` [ { "id": null, "report_type": "dependency_scanning", "name": "Authentication bypass via incorrect DOM traversal and canonicalization in saml2-js", "severity": "unknown", "confidence": "undefined", "scanner": { "external_id": "gemnasium", "name": "Gemnasium" }, "identifiers": [ { "external_type": "gemnasium", "external_id": "9952e574-7b5b-46fa-a270-aeb694198a98", "name": "Gemnasium-9952e574-7b5b-46fa-a270-aeb694198a98", "url": "https://deps.sec.gitlab.com/packages/npm/saml2-js/versions/1.5.0/advisories" }, { "external_type": "cve", "external_id": "CVE-2017-11429", "name": "CVE-2017-11429", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11429" } ], "project_fingerprint": "fa6f5b6c5d240b834ac5e901dc69f9484cef89ec", "create_vulnerability_feedback_issue_path": "/tests/yarn-remediation-test/vulnerability_feedback", "create_vulnerability_feedback_merge_request_path": "/tests/yarn-remediation-test/vulnerability_feedback", "create_vulnerability_feedback_dismissal_path": "/tests/yarn-remediation-test/vulnerability_feedback", "project": { "id": 31, "name": "yarn-remediation-test", "full_path": "/tests/yarn-remediation-test", "full_name": "tests / yarn-remediation-test" }, "dismissal_feedback": null, "issue_feedback": null, "merge_request_feedback": null, "description": "Some XML DOM traversal and canonicalization APIs may be inconsistent in handling of comments within XML nodes. Incorrect use of these APIs by some SAML libraries results in incorrect parsing of the inner text of XML nodes such that any inner text after the comment is lost prior to cryptographically signing the SAML message. Text after the comment therefore has no impact on the signature on the SAML message.\r\n\r\nA remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic signature, which may allow attackers to bypass primary authentication for the affected SAML service provider.", "links": [ { "url": "https://github.com/Clever/saml2/commit/3546cb61fd541f219abda364c5b919633609ef3d#diff-af730f9f738de1c9ad87596df3f6de84R279" }, { "url": "https://www.kb.cert.org/vuls/id/475445" }, { "url": "https://github.com/Clever/saml2/issues/127" } ], "location": { "file": "yarn.lock", "dependency": { "package": { "name": "saml2-js" }, "version": "1.5.0" } }, "solution": "Upgrade to fixed version.\r\n", "blob_path": "/tests/yarn-remediation-test/blob/cc6c4a0778460455ae5d16ca7025ca9ca1ca75ac/yarn.lock" } ] ```