Skip to content

Add humanized summary in drawer for vulnerability management policy

What does this MR do and why?

Related #465757 (closed)

Add humanized summary in drawer for vulnerability management policy

This adds a human readable summary to the policy drawer for the vulnerability management policy type. Several util functions have been added that help humanize the rules into a human readable format.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Before After
Screenshot_2024-08-16_at_21.54.00 Screenshot_2024-08-16_at_21.53.26

How to set up and validate locally

Because the policy list cannot fetch vulnerability policy types and we can't persist those yet (backend work coming later), we need to mock a policy of the vulnerability management type.

Apply the following patch pbpaste | git apply to do so:

diff --git a/ee/app/assets/javascripts/security_orchestration/components/policies/list_component.vue b/ee/app/assets/javascripts/security_orchestration/components/policies/list_component.vue
index 30c694a090b4..e86a046f863b 100644
--- a/ee/app/assets/javascripts/security_orchestration/components/policies/list_component.vue
+++ b/ee/app/assets/javascripts/security_orchestration/components/policies/list_component.vue
@@ -120,6 +120,57 @@ export default {
         getPoliciesWithType(this.policiesByType[type], POLICY_TYPE_FILTER_OPTIONS[type].text),
       );
 
+      policies[1] = {
+        __typename: 'VulnerabilityManagementPolicy',
+        name: 'Resolve no longer detected',
+        yaml: '---\nname: Resolve no longer detected\ndescription: Auto-resolve all no longer detected vulnerabilities.\nenabled: true\nactions:\n- type: auto_resolve\nrules:\n- type: no_longer_detected\n  severity_levels: ["high", "medium"]\n  scanners: ["secret_detection", "dast"]\n- type: no_longer_detected\n  severity_levels: ["critical", "high", "medium"]\n  scanners: ["dependency_scanning", "container_scanning", "sast"]\n- type: no_longer_detected\n  severity_levels: ["info"]\n  scanners: []\n- type: no_longer_detected\n  severity_levels: []\n  scanners: ["sast"]',
+        editPath:
+          'https://gdk.test:3443/gitlab-org/security-reports/-/security/policies/scan+exec+1/edit?type=scan_execution_policy',
+        enabled: true,
+        policyScope: {
+          __typename: 'PolicyScope',
+          complianceFrameworks: {
+            __typename: 'ComplianceFrameworkConnection',
+            nodes: [],
+            pageInfo: {
+              __typename: 'PageInfo',
+              hasNextPage: false,
+              hasPreviousPage: false,
+              startCursor: null,
+              endCursor: null,
+            },
+          },
+          excludingProjects: {
+            __typename: 'ProjectConnection',
+            nodes: [],
+            pageInfo: {
+              __typename: 'PageInfo',
+              hasNextPage: false,
+              hasPreviousPage: false,
+              startCursor: null,
+              endCursor: null,
+            },
+          },
+          includingProjects: {
+            __typename: 'ProjectConnection',
+            nodes: [],
+            pageInfo: {
+              __typename: 'PageInfo',
+              hasNextPage: false,
+              hasPreviousPage: false,
+              startCursor: null,
+              endCursor: null,
+            },
+          },
+        },
+        source: {
+          __typename: 'ProjectSecurityPolicySource',
+          project: { __typename: 'Project', fullPath: 'gitlab-org/security-reports' },
+        },
+        updatedAt: '2024-07-03T12:50:07+00:00',
+        policyType: 'Vulnerability management',
+      };
+
       return policies.flat();
     },
     hasSelectedPolicy() {
  1. enable feature flag vulnerability_management_policy_type
  2. go to a project
  3. go to Secure > Policies
  4. click on the mocked vulnerability management policy
  5. validate that the drawer opens and shows the summary, name, description, scope, and status
  6. validate that in the lists the rules in a human readable format. It mentions the individual scanners and severity levels for each rule if not all are selected. If all are selected (or it's an empty array, which means the same), for the scanners the sentence mentions "All scanners", and for severity levels it mentions "all severity levels"
Edited by Lorenz van Herwaarden

Merge request reports

Loading