gitlab-vulnerability

漏洞技能

使用 glab api 原始端点调用管理 GitLab 安全漏洞。

快速参考

操作	命令模式	风险
列出漏洞	glab api projects/:id/vulnerabilities	-
获取漏洞	glab api projects/:id/vulnerabilities/:vuln_id	-
确认漏洞	glab api projects/:id/vulnerabilities/:vuln_id/confirm -X POST	⚠️
忽略漏洞	glab api projects/:id/vulnerabilities/:vuln_id/dismiss -X POST -f ...	⚠️
解决漏洞	glab api projects/:id/vulnerabilities/:vuln_id/resolve -X POST	⚠️
恢复为已检测	glab api projects/:id/vulnerabilities/:vuln_id/revert -X POST	⚠️
列出发现项	glab api projects/:id/vulnerability_findings	-

风险说明：- 安全 | ⚠️ 注意 | ⚠️⚠️ 警告 | ⚠️⚠️⚠️ 危险

何时使用此技能

始终在以下情况使用：

• 用户提到“漏洞”“安全问题”或“CVE”
• 用户想查看安全扫描结果
• 用户提到“SAST”“DAST”“依赖项扫描”或“容器扫描”
• 用户想忽略或解决安全发现项
• 用户询问安全仪表板

以下情况切勿使用：

• 用户想运行安全扫描（使用 gitlab-ci）
• 用户想配置安全设置（使用项目设置）
• 用户想进行一般问题跟踪（使用 gitlab-issue）

API 前提条件

所需令牌范围： read_api 或 api

权限：

• 读取漏洞：Developer+
• 管理漏洞：Developer+

GitLab 版本层级： 完整的漏洞管理功能需要 Ultimate

漏洞状态

状态	说明
detected	新发现、尚未审核的漏洞
confirmed	已验证为真实漏洞
dismissed	标记为误报或决定不修复
resolved	已修复，不再存在

严重程度级别

严重程度	说明
critical	最高严重程度，需要立即采取行动
high	风险显著
medium	中等风险
low	风险较低
info	信息性发现项
unknown	尚未确定严重程度

可用命令

列出项目漏洞

# List all vulnerabilities
glab api projects/123/vulnerabilities --method GET

# Filter by state
glab api "projects/123/vulnerabilities?state=detected" --method GET

# Filter by severity
glab api "projects/123/vulnerabilities?severity=critical,high" --method GET

# Filter by multiple criteria
glab api "projects/123/vulnerabilities?state=detected&severity=critical,high" --method GET

# With pagination
glab api projects/123/vulnerabilities --paginate

# Using project path
glab api "projects/$(echo 'mygroup/myproject' | jq -Rr @uri)/vulnerabilities"

获取漏洞详情

# Get specific vulnerability
glab api projects/123/vulnerabilities/456 --method GET

确认漏洞

将已检测到的漏洞标记为已确认（真实安全问题）。

# Confirm vulnerability
glab api projects/123/vulnerabilities/456/confirm --method POST

忽略漏洞

将漏洞标记为已忽略（误报或已接受的风险）。

# Dismiss as false positive
glab api projects/123/vulnerabilities/456/dismiss --method POST \
  -f comment="False positive - this code path is not reachable"

# Dismiss as acceptable risk
glab api projects/123/vulnerabilities/456/dismiss --method POST \
  -f comment="Accepted risk - mitigated by network controls"

# Dismiss with dismissal reason (if available)
glab api projects/123/vulnerabilities/456/dismiss --method POST \
  -f comment="Not applicable to our use case" \
  -f dismissal_reason="used_in_tests"

解决漏洞

将漏洞标记为已解决（已修复）。

# Resolve vulnerability
glab api projects/123/vulnerabilities/456/resolve --method POST

恢复为已检测状态

将漏洞恢复为已检测状态。

# Revert to detected
glab api projects/123/vulnerabilities/456/revert --method POST

列出漏洞发现项

发现项是安全扫描器的原始结果。

# List all findings
glab api projects/123/vulnerability_findings --method GET

# Filter by severity
glab api "projects/123/vulnerability_findings?severity=critical,high" --method GET

# Filter by scanner
glab api "projects/123/vulnerability_findings?scanner=sast" --method GET

# Filter by pipeline
glab api "projects/123/vulnerability_findings?pipeline_id=789" --method GET

# With pagination
glab api projects/123/vulnerability_findings --paginate

安全仪表板（群组级别）

# Get security statistics for group
glab api groups/456/vulnerability_exports --method POST \
  -f export_format="csv"

# Get group vulnerability statistics
glab api "groups/456/vulnerability_statistics" --method GET

常见工作流

工作流 1：分类处理新漏洞

project_id=123

# Get all detected (new) vulnerabilities
glab api "projects/$project_id/vulnerabilities?state=detected" --paginate | \
  jq -r '.[] | "[\(.severity)] \(.title) - \(.id)"'

# Review critical/high first
glab api "projects/$project_id/vulnerabilities?state=detected&severity=critical,high" | \
  jq -r '.[] | "ID: \(.id)\nTitle: \(.title)\nSeverity: \(.severity)\nScanner: \(.scanner.name)\nLocation: \(.location | @json)\n---"'

工作流 2：生成安全报告

project_id=123

# Summary by severity
echo "=== Vulnerability Summary ==="
glab api "projects/$project_id/vulnerabilities" --paginate | \
  jq -r 'group_by(.severity) | map({severity: .[0].severity, count: length}) | .[] | "\(.severity): \(.count)"'

# Summary by state
echo ""
echo "=== By State ==="
glab api "projects/$project_id/vulnerabilities" --paginate | \
  jq -r 'group_by(.state) | map({state: .[0].state, count: length}) | .[] | "\(.state): \(.count)"'

# Summary by scanner
echo ""
echo "=== By Scanner ==="
glab api "projects/$project_id/vulnerabilities" --paginate | \
  jq -r 'group_by(.scanner.name) | map({scanner: .[0].scanner.name, count: length}) | .[] | "\(.scanner): \(.count)"'

工作流 3：批量忽略误报

project_id=123

# Dismiss all info-level findings from specific scanner
glab api "projects/$project_id/vulnerabilities?severity=info&state=detected" --paginate | \
  jq -r '.[].id' | while read vuln_id; do
    echo "Dismissing $vuln_id"
    glab api projects/$project_id/vulnerabilities/$vuln_id/dismiss --method POST \
      -f comment="Bulk dismissed - info level findings"
  done

工作流 4：跟踪严重漏洞

project_id=123

# List critical vulnerabilities with details
glab api "projects/$project_id/vulnerabilities?severity=critical" --paginate | \
  jq -r '.[] | {
    id: .id,
    title: .title,
    state: .state,
    detected_at: .detected_at,
    scanner: .scanner.name,
    identifiers: [.identifiers[]?.name] | join(", ")
  }'

工作流 5：检查 CVE

project_id=123
cve="CVE-2021-44228"

# Search for specific CVE
glab api "projects/$project_id/vulnerabilities" --paginate | \
  jq -r ".[] | select(.identifiers[]?.name == \"$cve\") | \"ID: \(.id), State: \(.state), Title: \(.title)\""

工作流 6：导出漏洞

project_id=123

# Export to JSON
glab api "projects/$project_id/vulnerabilities" --paginate > vulnerabilities.json

# Export to CSV format
glab api "projects/$project_id/vulnerabilities" --paginate | \
  jq -r '["id","title","severity","state","scanner","detected_at"],
         (.[] | [.id, .title, .severity, .state, .scanner.name, .detected_at]) | @csv' > vulnerabilities.csv

工作流 7：比较流水线结果

project_id=123

# Get findings from specific pipeline
pipeline_id=789
glab api "projects/$project_id/vulnerability_findings?pipeline_id=$pipeline_id" | \
  jq -r '.[] | "\(.severity): \(.name)"'

扫描器类型

扫描器	报告类型	说明
sast	SAST	静态应用安全测试
dast	DAST	动态应用安全测试
dependency_scanning	依赖项扫描	第三方依赖项漏洞
container_scanning	容器扫描	容器镜像漏洞
secret_detection	密钥检测	代码中的硬编码密钥
coverage_fuzzing	覆盖率模糊测试	模糊测试结果
api_fuzzing	API 模糊测试	API 模糊测试结果

故障排除

问题	原因	解决方案
403 Forbidden	需要 Ultimate 版本或没有访问权限	检查 GitLab 版本和权限
结果为空	尚未运行扫描	在 CI 中配置并运行安全扫描器
漏洞信息过时	没有近期流水线	运行包含安全作业的新流水线
无法忽略	已忽略或已解决	检查当前状态
缺少扫描器类型	未配置扫描器	将扫描器添加到 CI 配置中

最佳实践

1. 定期分类处理：经常检查新发现的漏洞
2. 记录忽略原因：始终添加说明原因的评论
3. 跟踪关键问题：密切监控严重和高危问题
4. 与议题集成：为已确认的漏洞创建议题
5. 尽可能自动化：使用 CI 在发现新的关键问题时使流水线失败

相关文档

• API 助手
• 安全防护措施
• 快速参考
• GitLab 漏洞 API
• GitLab 漏洞发现 API