Skip to content

Add `VulnerabilityDetailNamedList` type to GraphQL schema

mo khan requested to merge 389923/mokhax/named-list into master

What does this MR do and why?

This change introduces a VulnerabilityDetailNamedListType to the GraphQL schema to be able to support a named-list for rendering data in the UI.

#389923 (closed)

Screenshots or screen recordings

image

How to set up and validate locally

Example below:

  • Clone https://gitlab.com/gitlab-examples/security/security-reports.git
  • Run a pipeline on the default branch.
  • Go to Secure -> Vulnerability Report and filter by Tool -> DAST
  • Note down the ID of the vulnerability title CWE-16 in
  • Determine the pipeline iid and finding uuid of the vulnerability in the rails console.
    v = Vulnerability.find($vuln_id)
    puts v.findings.first.uuid
    puts v.findings.first.security_findings.first.pipeline.iid
  • Open /-/graphql-explorer
  • Use the following query:
query getFinding($fullPath: ID!, $pipelineIid: ID!, $findingUuid: String!) {
   project(fullPath: $fullPath) {
     pipeline(iid: $pipelineIid) {
       securityReportFinding(uuid: $findingUuid) {
         uuid
         title
         details {
           __typename
           ... on VulnerabilityDetailNamedList {
             __typename
             name
             fieldName
             description
             items {
               __typename
               name
               fieldName
               description
               value {
                 __typename
                 ... on VulnerabilityDetailBoolean {
                   description
                   fieldName
                   name
                   value
                 }
                 ... on VulnerabilityDetailCode {
                   fieldName
                   lang
                   name
                   value
                 }
                 ... on VulnerabilityDetailCommit {
                   description
                   fieldName
                   name
                   value
                 }
                 ... on VulnerabilityDetailDiff {
                   after
                   before
                   description
                   fieldName
                   name
                 }
                 ... on VulnerabilityDetailFileLocation {
                   description
                   fieldName
                   fileName
                   lineEnd
                   lineStart
                   name
                 }
                 ... on VulnerabilityDetailInt {
                   description
                   fieldName
                   name
                   value
                 }
                 ... on VulnerabilityDetailMarkdown {
                   description
                   fieldName
                   name
                   value
                 }
                 ... on VulnerabilityDetailModuleLocation {
                   description
                   fieldName
                   moduleName
                   name
                   offset
                 }
                 ... on VulnerabilityDetailText {
                   description
                   fieldName
                   name
                   value
                 }
                 ... on VulnerabilityDetailUrl {
                   description
                   fieldName
                   href
                   name
                   text
                 }
               }
             }
           }
         }
       }
     }
   }
 }
  • Specify the appropriate GraphQL query variables:
     {
       "fullPath": "full/path/to/security-reports",
       "pipelineIid": "$pipeline_iid",
       "findingUuid": "$finding_uuid"
     }
  • Check the results for something that looks similar to:
     [
       {
         "details": [
           {
             "__typename": "VulnerabilityDetailNamedList",
             "name": "A Named List",
             "fieldName": "named_list",
             "description": null,
             "items": [
               {
                 "__typename": "VulnerabilityDetailNamedListItem",
                 "name": "Field 1",
                 "fieldName": "field1",
                 "description": "The description for field 1",
                 "value": {
                   "__typename": "VulnerabilityDetailText",
                   "description": "The description for field 1",
                   "fieldName": null,
                   "name": "Field 1",
                   "value": "Text"
                 }
               },
               {
                 "__typename": "VulnerabilityDetailNamedListItem",
                 "name": "Field 2",
                 "fieldName": "field2",
                 "description": "The description for field 2",
                 "value": {
                   "__typename": "VulnerabilityDetailText",
                   "description": "The description for field 2",
                   "fieldName": null,
                   "name": "Field 2",
                   "value": "Text"
                 }
               },
               {
                 "__typename": "VulnerabilityDetailNamedListItem",
                 "name": "Nested Ints",
                 "fieldName": "nested_ints",
                 "description": null,
                 "value": {
                   "__typename": "VulnerabilityDetailList"
                 }
               }
             ]
           }
         ]
       }
     ]
    

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by mo khan

Merge request reports

Loading