Add first 20 Scanned Resources and Scanned Resources count to "Security Details"
Description
The scanned resources count and scanned resources list is no longer show in the pipeline "Security Details" tabs and the MR security dropdown. They were removed in !61551 (merged) because the graphQL endpoint to download the details timed out if the security report was large.
The GraphQL query used to populate the "Security Details" box still offers the ability to query the first 20 scanned resources and a count of all the scanned resources, but is likely to timeout if used with its current implementation.
query{
project(fullPath:"gitlab-org/security-products/dast-benchmark"){
pipeline(iid:"69"){
securityReportSummary{
dast{
vulnerabilitiesCount
scannedResourcesCount
scannedResourcesCsvPath
scannedResources{
nodes{
requestMethod
url
}
}
}
}
}
}
}
vulnerabilitiesCount
is calculated using the vulnerabilities recorded in the database but to calculate the scanned resources, GitLab downloads the DAST artifacts associated with the pipeline and parses them, and returns the values. When there are multiple artifacts, downloading them can take a significant amount of time which causes the query to timeout.
A good example of a pipeline that times out is: https://gitlab.com/gitlab-org/security-products/dast-benchmark/-/pipelines/176880034/security
Proposal
When a pipeline completes, vulnerabilities are stored in the database and then removed when the artifacts expire.
One solution could be save and expire scanned_resources
in the same way, saving them to the DB when the pipeline completes and deleting them when the artifacts expire.