Skip to content

Add vulneratiliby tracking tests to the GitLab rspecs

Create tests-cases to the GitLab test suite (rspecs) that simulate report ingestion starting from a report that originates from a SAST tool and includes TC tracking signatures. This test-case should ideally cover the following scenario:

  1. Addition of a single signature per algorithm. The expectation would be that only these signatures are used for the vulnerability fingerprint generation.
  2. "Upgrade" (coarsening) of existing signatures: for every algorithm with priority X, if there exist an signatures that was generated with an algorithm of prority > X, the fingerprint of the vulnerability should be recomputed using the new signatures.
  3. "Downgrade" (refinement) is currently not considered -- we should probably have some negative test-cases as a sanity-check.
Edited by Julian Thome