Skip to content

Version Check - Add support for critical severity

What does this MR do and why?

GitLab Frontend changes for #387719 (closed)
Implements GitLab support for: https://gitlab.com/gitlab-services/version-gitlab-com/-/issues/455
Removes Feature Flag: :critical_security_alert

This change adds support in GitLab for a new upgrade severity value of critical provided from the version.gitlab.com API. This critical value will inform the UI to show some invasive elements to Admin users that their instance is behind a critical security patch.

Initially this featured keyed off the danger severity value. However, danger is used for any level of security release ranging from low severity to critical and resulted in the invasive UI elements to appear way more often than they should have been.

Screenshots or screen recordings

UI
No updates available
Non-security update available
Non-critical security update available
Critical security update available ASAP

How to set up and validate locally

Important: You will need to provide "spoofs" to make your GDK think its behind a version. Below are patches to achieve each type of scenario.
Important: You need to reset any changes between adding different patches.

No updates available
diff --git a/app/helpers/version_check_helper.rb b/app/helpers/version_check_helper.rb
index 9f9cccf54a53..713cf2491315 100644
--- a/app/helpers/version_check_helper.rb
+++ b/app/helpers/version_check_helper.rb
@@ -13,7 +13,8 @@ def show_version_check?
   end
 
   def gitlab_version_check
-    VersionCheck.new.response
+    #VersionCheck.new.response
+    { "severity" => 'success' }
   end
   strong_memoize_attr :gitlab_version_check
 
Non-security update available
diff --git a/app/helpers/version_check_helper.rb b/app/helpers/version_check_helper.rb
index 9f9cccf54a53..adc310b600d3 100644
--- a/app/helpers/version_check_helper.rb
+++ b/app/helpers/version_check_helper.rb
@@ -13,7 +13,8 @@ def show_version_check?
   end
 
   def gitlab_version_check
-    VersionCheck.new.response
+    #VersionCheck.new.response
+    { "severity" => 'warning' }
   end
   strong_memoize_attr :gitlab_version_check
 
Non-critical security update available
diff --git a/app/helpers/version_check_helper.rb b/app/helpers/version_check_helper.rb
index 9f9cccf54a53..202101e5c900 100644
--- a/app/helpers/version_check_helper.rb
+++ b/app/helpers/version_check_helper.rb
@@ -13,7 +13,8 @@ def show_version_check?
   end
 
   def gitlab_version_check
-    VersionCheck.new.response
+    #VersionCheck.new.response
+    { "severity" => 'danger' }
   end
   strong_memoize_attr :gitlab_version_check
 
Critical security update available
diff --git a/app/helpers/version_check_helper.rb b/app/helpers/version_check_helper.rb
index 9f9cccf54a53..8f2b1ec6bab6 100644
--- a/app/helpers/version_check_helper.rb
+++ b/app/helpers/version_check_helper.rb
@@ -13,7 +13,8 @@ def show_version_check?
   end
 
   def gitlab_version_check
-    VersionCheck.new.response
+    #VersionCheck.new.response
+    { "severity" => SECURITY_ALERT_SEVERITY, "details" => 'There is a runner token vulnerability on this version. Please upgrade to prevent an attacker executing code on your instance', "latest_stable_versions" => ['15.9.2', '15.10.0', '16.0.0'] }
   end
   strong_memoize_attr :gitlab_version_check
 
  1. Login as an Admin (root is admin by default)
  2. Apply your selected patch
  3. Refresh any page
  4. Click Help Dropdown in the Top Right of nav (? icon)
  5. Ensure UI matches the Screenshot above

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #387719 (closed)

Edited by Zack Cuddy

Merge request reports