Skip to content

Switch to abstraction layer for "Explain this vulnerability" feature

Daniel Tian requested to merge 406633-add-explain-this-vulnerability into master

What does this MR do and why?

This MR switches the "Explain this vulnerability" feature from using the experimentation API (allows freeform prompt input, but is restricted to GitLab team members) to the explainVulnerability function on the aiAction GraphQL mutation (available to everyone, but no freeform input). This will allow everyone to use the "Explain this vulnerability" feature.

ksnip_20230418-232805

How to set up and validate locally

  1. Enable the openai_experimentation and explain_vulnerability feature flags.
  2. Clone this project: https://gitlab.com/gitlab-org/security-products/tests/webgoat.net
  3. Run a pipeline against the master branch.
  4. Go to Security and Compliance -> Vulnerability report.
  5. The list should only contain SAST vulnerabilities. Click on any one to get to the vulnerability details page.
  6. Click on the "Explain this vulnerability" button and wait around 15 seconds.
  7. Verify that an explanation is displayed in the drawer that opens to the right.

2023-04-18_23-32-00

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #406633 (closed)

Edited by Daniel Tian

Merge request reports