Skip to content

Add dismissal type reason to vulnerability status-comment

What does this MR do and why?

It is desired for the dismissal reason to be appropriately associated with a vulnerability upon dismissal and presented in the associated system note audit trail. This MR modifies all relevant locations of vulnerability state change to use the dismissal reason in the state transition record to provide better detail to the system note.

Screenshots or screen recordings

dismissal_reason_verification

Screenshot_2023-03-23_at_11.34.11

How to set up and validate locally

  1. Configure a project with functional vulnerability scanning pipelines and run them.
  2. Choose a vulnerability to test with.
  3. Run the following command in the console with Vulnerabilities::DismissService.new(User.first, Vulnerability.find(<chosen vuln id>), "yes", :acceptable_risk).execute
  4. Validate that your vulnerability has a system note similar to "@root changed vulnerability status to Dismissed: Acceptable Risk just now" according to your chosen parameters.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #392437 (closed)

Edited by Zamir Martins

Merge request reports