Skip to content

Fix DAST security policy bug

Alexander Turinske requested to merge fix-dast-security-policy-bug into master

What does this MR do and why?

Fix DAST security policy bug

  • the projectDastProfileSelector gets its profiles from the dastProfileConfiguratorMixin
  • the mixin makes a graphql request to retrieve the profiles
  • the projectDastProfileSelector emits an error if the profile arrays do not contain the existing profile
  • thus, the projectDastProfileSelector component was emitting an error when the graphql requests hadn't even responded yet
  • move the check into a method and watch the appropriate properties and check to see if the graphql requests are loading
  • pass fullPath to child component that also uses mixin to prevent double request with fullPath null
  • simplify loading computed property
  • rename them to match file name
  • update project tests to match work

Changelog: fixed

EE: true

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Scenario Before After
New policy new_-_b new_-_a
Edit policy edit_-_b edit_-_a

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

  1. Upload a GitLab Ultimate license
  2. Create some DAST site/scanner profiles by navigating to a project => Secure => On-demand scans => etcetera
  3. Navigate to a project => Secure => Policies => New policy => Scan Execution Policy
  4. Select some profiles, navigate to yaml mode, change the profiles, navigate back, verify screen disabled
  5. Select some existing profiles and save the policy and merge the resulting MR
  6. Navigate back to the project => Secure => Policies => Select the new policy => Edit policy
  7. Verify the page is not disabled by default, perform the same tests as before

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Alexander Turinske

Merge request reports

Loading