Scan Execution Policy Scope misleading user interface

Summary

When setting up Security Policies, users can limit the scope of their policies to specific projects. The problem at the moment is if a policy is configured at the subgroup level, other projects inside the group can "appear" to be still included.

Steps to reproduce

  1. Go to a top level group.
  2. Create a subgroup Alpha.
  3. Create another subgroup under Alpha named Bravo.
  4. Create two dummy projects under Bravo group. Ideally you should have something like this.
Top level group
|- Alpha
  |- Bravo
    |- project_01
    |- project_02
  1. Create a Scan Execution Policy under group Alpha and limit the scope to project_01.
  2. Go to project_02 and observe that the Policy is still visible and mentions Scope: This project however it is not actually triggered.

Example Project

https://gitlab.com/kballon_ultimate_group/zd579407_policy_inheritance

What is the current bug behavior?

The Policy appears on the project not included in the scope.

What is the expected correct behavior?

The Policy should not appear on the project not included in the scope.

Relevant logs and/or screenshots

alpha

project_02

bravo

Output of checks

This bug happens on GitLab.com

Results of GitLab environment info

Expand for output related to GitLab environment info 

(For installations with omnibus-gitlab package run and paste the output of:
`sudo gitlab-rake gitlab:env:info`)

(For installations from source run and paste the output of:
`sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production`)

Results of GitLab application Check

Expand for output related to the GitLab application check 
(For installations with omnibus-gitlab package run and paste the output of:
sudo gitlab-rake gitlab:check SANITIZE=true)


(For installations from source run and paste the output of:
sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production SANITIZE=true)


(we will only investigate if the tests are passing)

Possible fixes

  • backend remove experimental setting from policies requests
  • frontend add includeUnscoped: false to policy requests
Edited by Alexander Turinske