Limit Vulnerability Resolution to supported CWEs
What does this MR do and why?
This MR adds the ability to limit access to the resolve vulnerability with AI feature to a list of supported CWEs as part of https://gitlab.com/gitlab-org/gitlab/-/issues/474047.
The CWE list was pulled from this issue https://gitlab.com/gitlab-org/gitlab/-/issues/472861+
Below is a chart of how the logic in this MR will flow into the frontend.
flowchart TD
A[glAbilities.resolveVulnerabilityWithAi]
A -->|false| B[hide button]
A -->|true| C[initialVulnerability.aiResolutionAvailable]
C -->|false| E[show the disabled button]
C -->|true| F[show the enabled button]
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Screenshots or screen recordings
Screenshots are required for UI changes, and strongly recommended for all other merge requests.
Before | After |
---|---|
How to set up and validate locally
This MR doesn't make any frontend changes, but it can be validated locally by checking the props in Vue inspector in the browser.
- Using the
webgoat.net
seed project, load the vulnerability report forUse of cryptographically weak pseudo-random number generator (PRNG)
. In the Vue inspector, selectVulnerabilityRoot
, then in the props for theVulnerability
component you should seeinitialVulnerability.aiResolutionAvailable
is true. See the screenshot below:
- Using the
webgoat.net
seed project, load the vulnerability report forImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
. In the Vue inspector, selectVulnerabilityRoot
, then in the props for theVulnerability
component you should seeinitialVulnerability.aiResolutionAvailable
is false. See the screenshot below:
Edited by Darby Frey