Skip to content

Remove sorting vulnerabilities by state

Thiago Figueiró requested to merge 360516-remove-vulnerability-sort-by-state into master

What does this MR do and why?

Remove the ability to sort Vulnerabilities by state_asc, state_desc.

Deprecation:

Screenshots or screen recordings

These are strongly recommended to assist reviewers and reduce the time to merge your change.

How to set up and validate locally

frontend

  1. Ensure your instance has an Ultimate license applied.
  2. Generate test vulnerabilities by using either:
    1. https://docs.gitlab.com/ee/user/application_security/generate_test_vulnerabilities/; OR
    2. Clone https://gitlab.com/gitlab-examples/security/security-reports/ into a local project and run a pipeline.
  3. Visit the vulnerability report page (i.e. <project_path>/-/security/vulnerability_report)
  4. Observe the order of the results in the report.
  5. Change the Status filter to "All statuses".
  6. Change the status of one vulnerability each to confirmed, resolved, dismissed.
  7. Click Status. The page won't reload, and the order won't change.

backend

  1. Do steps 1-2 above
  2. Run the GraphQL queries below:
    1. Should work and return 5 items: QUERY='{ project(fullPath:\"<project_path>\") { vulnerabilities(first: 5, sort: state_desc) { nodes { id state } pageInfo { endCursor } } } } '
    2. Should fail: QUERY='{ project(fullPath:\"<project_path>\") { vulnerabilities(first: 5) { nodes { id state } pageInfo { endCursor } } } } '
      1. Error message: "Argument 'sort' on Field 'vulnerabilities' has an invalid value (state_desc). Expected type 'VulnerabilitySort'.

Script

GRAPHQL_TOKEN=<personal access token with api access here>

#QUERY='query {currentUser {name}}'
#QUERY='{ project(fullPath:\"root/security-reports\") { vulnerabilities(first: 5, sort: state_desc) { nodes { id state } pageInfo { endCursor } } } } '
QUERY='{ project(fullPath:\"root/security-reports\") { vulnerabilities(first: 5) { nodes { id state } pageInfo { endCursor } } } } '

curl "http://localhost:3000/api/graphql" --header "Authorization: Bearer $GRAPHQL_TOKEN" \
     --header "Content-Type: application/json" --request POST \
     --data "{\"query\": \"$QUERY\"}"

Success

{
  "data": {
    "project": {
      "vulnerabilities": {
        "nodes": [
          {
            "id": "gid://gitlab/Vulnerability/248",
            "state": "CONFIRMED"
          },
          {
            "id": "gid://gitlab/Vulnerability/247",
            "state": "CONFIRMED"
          },
          {
            "id": "gid://gitlab/Vulnerability/246",
            "state": "RESOLVED"
          },
          {
            "id": "gid://gitlab/Vulnerability/243",
            "state": "RESOLVED"
          },
          {
            "id": "gid://gitlab/Vulnerability/239",
            "state": "DISMISSED"
          }
        ],
        "pageInfo": {
          "endCursor": "eyJzZXZlcml0eSI6ImNyaXRpY2FsIiwidnVsbmVyYWJpbGl0eV9pZCI6IjIzOSJ9"
        }
      }
    }
  }
}

Failure

{
  "errors": [
    {
      "message": "Argument 'sort' on Field 'vulnerabilities' has an invalid value (state_desc). Expected type 'VulnerabilitySort'.",
      "locations": [
        {
          "line": 1,
          "column": 47
        }
      ],
      "path": [
        "query",
        "project",
        "vulnerabilities",
        "sort"
      ],
      "extensions": {
        "code": "argumentLiteralsIncompatible",
        "typeName": "Field",
        "argumentName": "sort"
      }
    }
  ]
}

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #360516 (closed) /cc @matt_wilson

Edited by Thiago Figueiró

Merge request reports