@@ -43,39 +43,21 @@ At this point, we've created two issues to address as security issues in our app
## Task B. Fixing Vulnerabilities
1. Navigate to **Plan > Work items**.
To resolve these vulnerabilities, we are going to use Duo Agent Platform (DAP). Duo Agent Platform is GitLab's AI solution that can help you build issues, review merge requests, fix broken pipelines, and in this case, remediate a vulnerability.
1.Select the issue titled **Investigate vulnerability: Active debug code**.
1.Navigate to your **Settings > General**, and click on **GitLab Duo**. Click the switches under **Turn on SAST false positive detection**, and **Turn on SAST vulnerability resolution workflow**. These options will help us handle vulnerability remediation, as well as check for potential false positives.
1. Select the code location: `main.py:14`.
1. Select **Save changes**.
1.Select **Edit > Open in Web IDE**.
1.Navigate to **Security > Vulnerability Report**. Select the *Improper neutralization of special elements used in an SQL Command ('SQL Injection')* vulnerability that was found on line 244.
1.Select the `main.py` file.
1.In the top right corner of the vulnerability, select **AI Vulnerability Management**, and then select **Explain with AI**. The DAP tool will analyse the vulnerability, and explain how the vulnerability can be used against you. The agent will also explain ways to be able to remediate the vulnerability.
1.Change the line of code to read:
1.Select **AI Vulnerability Management**, and then select **Explain with AI**. The AI will now analyse how your codebase is using the code that has the vulnerability, and check if it is a false positive or not. This will take a few minutes to run.
```python
app.run(debug=False)
```
1. Select **AI Vulnerability Management**, and then select **Resolve with AI**. This will create a merge request that will remediate the vulnerability. Once the AI has completed creating the vulnerability, it will take you directly to the Merge Request.
1. In the left sidebar, select the **Source Control** icon.
1. Type an appropriate commit message (e.g. 'Turned off debug mode'), and click **Create a new branch and commit**.
1. Press **Enter** to take the default branch name.
1. Select **Create MR** in the bottom right of the screen.
1. Select **Create merge request** at the bottom of the page.
1. Wait for the pipeline in the merge request to complete, and refresh the page. Click on **View all pipeline findings**.
1. Review the findings. You should no longer see the **Active debug code** vulnerability in the security list.
1. Return to the MR, and select **Merge** to merge the security updates.
1. Go to your **Vulnerability Report** once the pipeline on your main branch has finished. Remove all filters from your report by clicking on the X to the right of your filters. You will see that this vulnerability has automatically been marked as resolved.
1. Review the changes made by the Merge Request, and select **Merge** when satisfied.
