Include OWASP filter to vulnerabilitySeveritiesCount and vulnerabilities GraphQL API
Include OWASP filter to project.vulnerabilitySeveritiesCount
and project.vulnerabilities
GraphQL API after the backend work for storing OWASP details on vulnerability_reads
table is completed in Store OWASP Top 10 in backend for vulnerability... (#419092 - closed)
The filter API should support both 2017 and 2021 OWASP identifiers as discussed in #419092 (comment 1633665621)
Update: For group level report, is disabled with FF #437253 (closed) and can be unblocked after closing #432715 (closed)
Verification steps:
- For the verification project we can use https://gitlab.com/bala.kumar/verify-owasp-top-10-grouping, fork or import the project and run the pipeline on main branch.
- To verify vulnerabilitySeveritiesCount, use the below GraphQL query:
query {
project(fullPath: "bala.kumar/verify-owasp-top-10-grouping") {
vulnerabilitySeveritiesCount(owaspTopTen: [A1_2021, A2_2021, A3_2021, A4_2021, A5_2021,
A6_2021, A7_2021, A8_2021, A9_2021, A10_2021, A1_2017, A2_2017, A3_2017, A4_2017, A5_2017, A6_2017, A7_2017, A8_2017, A9_2017, A10_2017]) {
critical
high
info
low
medium
unknown
}
}
}
- To verify vulnerabilities GraphQL API, use the below GraphQL query:
query {
project(fullPath: "bala.kumar/verify-owasp-top-10-grouping") {
vulnerabilities(owaspTopTen: [A1_2021, A2_2021, A3_2021, A4_2021, A5_2021,
A6_2021, A7_2021, A8_2021, A9_2021, A10_2021, A1_2017, A2_2017, A3_2017, A4_2017, A5_2017, A6_2017, A7_2017, A8_2017, A9_2017, A10_2017]) {
nodes {
id
identifiers {
externalId
externalType
name
url
}
}
}
}
}
Edited by Bala Kumar