Skip to content

Include OWASP filter to vulnerabilitySeveritiesCount and vulnerabilities GraphQL API

Include OWASP filter to project.vulnerabilitySeveritiesCount and project.vulnerabilities GraphQL API after the backend work for storing OWASP details on vulnerability_reads table is completed in Store OWASP Top 10 in backend for vulnerability... (#419092 - closed)

The filter API should support both 2017 and 2021 OWASP identifiers as discussed in #419092 (comment 1633665621)

OWASP grouping

Update: For group level report, is disabled with FF #437253 (closed) and can be unblocked after closing #432715 (closed)

Verification steps:

  1. For the verification project we can use https://gitlab.com/bala.kumar/verify-owasp-top-10-grouping, fork or import the project and run the pipeline on main branch.
  2. To verify vulnerabilitySeveritiesCount, use the below GraphQL query:
query {
  project(fullPath: "bala.kumar/verify-owasp-top-10-grouping") {
    vulnerabilitySeveritiesCount(owaspTopTen: [A1_2021, A2_2021, A3_2021, A4_2021, A5_2021,
      A6_2021, A7_2021, A8_2021, A9_2021, A10_2021, A1_2017, A2_2017, A3_2017, A4_2017, A5_2017, A6_2017, A7_2017, A8_2017, A9_2017, A10_2017]) {
      critical
      high
      info
      low
      medium
      unknown
    }
  }
}
  1. To verify vulnerabilities GraphQL API, use the below GraphQL query:
query {
  project(fullPath: "bala.kumar/verify-owasp-top-10-grouping") {
    vulnerabilities(owaspTopTen: [A1_2021, A2_2021, A3_2021, A4_2021, A5_2021,
      A6_2021, A7_2021, A8_2021, A9_2021, A10_2021, A1_2017, A2_2017, A3_2017, A4_2017, A5_2017, A6_2017, A7_2017, A8_2017, A9_2017, A10_2017]) {
      nodes {
        id
        identifiers {
          externalId
          externalType
          name
          url
        }
      }
    }
  }
}
Edited by Bala Kumar