Skip to content

GitLab Next

  • Menu
Projects Groups Snippets
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • GitLab GitLab
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
    • Locked Files
  • Issues 43,122
    • Issues 43,122
    • List
    • Boards
    • Service Desk
    • Milestones
    • Iterations
    • Requirements
  • Merge requests 1,377
    • Merge requests 1,377
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
    • Test Cases
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages & Registries
    • Packages & Registries
    • Package Registry
    • Container Registry
    • Infrastructure Registry
  • Monitor
    • Monitor
    • Metrics
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Code review
    • Insights
    • Issue
    • Repository
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • GitLab.org
  • GitLabGitLab
  • Issues
  • #267509
Closed
Open
Created Oct 14, 2020 by Daniel Tian@dftian👶🏻Developer

Clickable file and line number links on Vulnerability Report

Release notes

Many of GitLab's security scanners output a file and line number where a potential vulnerability is detected. Users can see this information in the form of a clickable link when viewing a vulnerability's details. The link will take the user directly to the file and line number inside the repository for the default branch. This same information is also displayed on the Vulnerability Report. However, the file names were not clickable, requiring that you open a vulnerability's details page to access the link.

This enhancement brings the convenience of linked filenames to the Vulnerability Report. From a Project, Group, or Security Center Vulnerability Report, you can go directly to the affected file and line number from any vulnerability reported from a scanner which outputs this information. Because you no longer need to first open each vulnerability record, it is much faster to do things like open multiple referenced lines of code in separate tabs for speedy triage.

vulnerability_report_clickable_file_links

https://docs.gitlab.com/ee/user/application_security/vulnerability_report/

Further Details

On the security dashboard, the file path and line number of a vulnerability is shown as monospaced text:

ksnip_20201013-214020

However, this is just plain text. To actually view the file with the correct line number, the user needs to click on the vulnerability to view its details, then click on the link in the details view:

ksnip_20201013-214140

This is an extra step that's annoying when dealing with multiple vulnerabilities. We should make the following changes:

  1. Make the monospaced text on the vulnerability list a link as well.

  2. Change the file/path/file.ext (line: 83) text to file/path/file.ext:83 to match how it's shown in other places, i.e. the details view as shown in the second screenshot above.

Implementation Plan

backend #267521 (closed)

  1. GraphQL: Add blobPath (suggesting the name because maybe having it match the field on the vulnerability details page makes sense?) field to VulnerabilityLocation types

frontend (weight: 2)

  1. Within vulnerability.fragment.graphql
    • add blobPath to VulnerabilityLocation inline fragments
  2. Within vulnerability_list.vue
    • Remove class="monospace" from div that wraps the vulnerability path item
    • Wrap the gl-truncate instance that displays the item.location in a gl-link with the href set to the item.blobPath
    • Update createLocationString to display ${file}:${startLine}
  3. Update / add specs
Edited Mar 10, 2021 by Matt Wilson
Assignee
Assign to
Time tracking