Signature normalization causes existing vulnerabilities to show up as new in MR widget

Summary

The update made by Normalize finding signature_hex generation (!233607 - merged) • Mehmet Emin INAC • 19.0 has introduced a bug that causes vulnerabilities that existed before the changes made by Normalize finding signature_hex generation (!233607 - merged) • Mehmet Emin INAC • 19.0 to show up as new in the Merge Request widget, but only for the first Merge Request made after Normalize finding signature_hex generation (!233607 - merged) • Mehmet Emin INAC • 19.0 was merged.

This bug will eventually work itself out, as each new Merge Request in a project overwrites the existing location_fingerprint values with the corrected values, however, this behaviour hasn't been documented and is confusing.

This behaviour change also impacts the RestoreIncorrectVulnerabilityStates code, which was relying on a stable format for the location_fingerprint in order to lookup duplicate vulnerabilities.

Steps to reproduce

1. Create a new project locally:

   Click to expand

   $ mkdir ~/tmp && cd ~/tmp
   
   export PROJECT_ID=<some-project-id>
   export GITLAB_PATH=/path/to/your/gdk/gitlab/
   
   curl --header "PRIVATE-TOKEN: $GITLAB_TOKEN" \
     --header "Content-Type: application/json" \
     --data "{
              \"path\": \"mr-widget-tester-$PROJECT_ID\", \"visibility\": \"public\"
            }" \
   "http://gdk.test:3000/api/v4/projects"   

2. Check out the contents of the files before the change made by Normalize finding signature_hex generation (!233607 - merged) • Mehmet Emin INAC • 19.0. This allows us to simulate what happens to vulnerabilities that existed before the change was made:

   $ cd $GITLAB_PATH
   
   git show 4b777f89557d7dfe033163489a02947fd914475f~:lib/gitlab/ci/reports/security/finding_signature.rb > lib/gitlab/ci/reports/security/finding_signature.rb
   git show 4b777f89557d7dfe033163489a02947fd914475f~:ee/app/models/vulnerabilities/finding_signature.rb > ee/app/models/vulnerabilities/finding_signature.rb

3. Restart your gdk instance:

   $ cd $GITLAB_PATH
   $ gdk restart

4. Clone the project and add some vulnerabilities containing tracking signatures from gl-sast-report-semgrep-6.6.2-multiple-vulnerabilities.json

   Click to expand

   git clone http://gdk.test:3000/root/mr-widget-tester-$PROJECT_ID.git && cd mr-widget-tester-$PROJECT_ID
   
   cp $GITLAB_PATH/ee/spec/fixtures/security_reports/master/gl-sast-report-semgrep-6.6.2-multiple-vulnerabilities.json ./
   
   cat > .gitlab-ci.yml << 'EOF'
   sast:
     script:
       - echo test
     artifacts:
       reports:
         sast: gl-sast-report-semgrep-6.6.2-multiple-vulnerabilities.json
   EOF
   
   git add .gitlab-ci.yml gl-sast-report-*
   git commit -m 'Add semgrep 6.6.2 vulnerabilities'
   git push

5. Stash the changes made to the lib/gitlab/ci/reports/security/finding_signature.rb and ee/app/models/vulnerabilities/finding_signature.rb made in step 2, so we can simulate what happens to existing vulnerabilities after the change:

   $ cd $GITLAB_PATH
   git stash

6. Restart your gdk instance:

   $ cd $GITLAB_PATH
   $ gdk restart

7. Create a new branch in the test project created in step 1, make some commits, and push the changes:

   Click to expand

   $ cd ~/tmp/mr-widget-tester-$PROJECT_ID
   
   git checkout -b make-some-change && \
     touch some-new-file && \
     git add some-new-file && \
     git commit -a -m 'add some new file' && \
     git push --set-upstream origin make-some-change

8. Create a new MR with the above changes by following the link output by the previous git push command, for example: http://gdk.test:3000/root/mr-widget-tester-181/-/merge_requests/new?merge_request%5Bsource_branch%5D=make-some-change

9. Notice that the MR widget shows that all the existing vulnerabilities are now new vulnerabilities:

   • 

   • 

   Sometimes it shows that the vulnerabilities have now been fixed, while at the same time, all the existing vulnerabilities are considered new:

   • 

What is the current bug behavior?

MR widget shows all vulnerabilities as new, when they actually already existed

What is the expected correct behavior?

MR widget should not show any vulnerabilities as new, since they already existed

Possible fixes

To be determined

/cc @minac