Skip to content

Limit Vulnerability Resolution to supported CWEs

Darby Frey requested to merge limit-vr-cwes into master

What does this MR do and why?

This MR adds the ability to limit access to the resolve vulnerability with AI feature to a list of supported CWEs as part of https://gitlab.com/gitlab-org/gitlab/-/issues/474047.

The CWE list was pulled from this issue https://gitlab.com/gitlab-org/gitlab/-/issues/472861+

Below is a chart of how the logic in this MR will flow into the frontend.

flowchart TD
    A[glAbilities.resolveVulnerabilityWithAi]
    A -->|false| B[hide button]
    A -->|true| C[initialVulnerability.aiResolutionAvailable]
    C -->|false| E[show the disabled button]
    C -->|true| F[show the enabled button]

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Before After

How to set up and validate locally

This MR doesn't make any frontend changes, but it can be validated locally by checking the props in Vue inspector in the browser.

  1. Using the webgoat.net seed project, load the vulnerability report for Use of cryptographically weak pseudo-random number generator (PRNG). In the Vue inspector, select VulnerabilityRoot, then in the props for the Vulnerability component you should see initialVulnerability.aiResolutionAvailable is true. See the screenshot below:

Screenshot_2024-07-31_at_9.49.20_AM

  1. Using the webgoat.net seed project, load the vulnerability report for Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). In the Vue inspector, select VulnerabilityRoot, then in the props for the Vulnerability component you should see initialVulnerability.aiResolutionAvailable is false. See the screenshot below:

Screenshot_2024-07-31_at_9.48.07_AM

Edited by Darby Frey

Merge request reports

Loading