Remove FF `vulnerability_owasp_top_10_group`
What does this MR do and why?
-
Removes the OWASP group level FF as it is stable in production since we enabled it after fuzzy counts.
-
In this MR we are also enabling OWASP grouping for InstanceSecurityDashboard tracked in #480181 (closed). Frontend MR to query the additional argument in GraphQL is !164321 (merged)
Database
InstanceSecurityDashboard.vulnerabilitySeveritiesCount
:
https://console.postgres.ai/gitlab/gitlab-production-main/sessions/31070/commands/96495
Query.vulnerabilities
:
https://console.postgres.ai/gitlab/gitlab-production-main/sessions/31070/commands/96496
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Screenshots or screen recordings
Screenshots are required for UI changes, and strongly recommended for all other merge requests.
Before | After |
---|---|
How to set up and validate locally
Steps for verifying group level report:
- Import the project from https://gitlab.com/gitlab-org/govern/threat-insights-demos/verification-projects/verify-identifier-name-injestion into local setup under a group.
- Run pipeline on the imported project.
- Visit the group -> Secure -> Vulnerability Report. Group by drowndown should list OWASP top 10 2017. And the feature should show counts and vulnerabilities for each category.
Steps for verifying instance level report:
- After the above project import, add the project to the security center following step mentioned here.
- Once the project is added visit the home page and under the security section -> Select vulnerability report.
- Vulnerability report should have Group by OWASP top 10 2017 and the categories on expanding should fetch the corresponding vulnerabilities under that category.
Related to #437253 (closed)