Skip to content

Update vulnerability_reads.owasp_top_10 for multiple identifiers

What does this MR do and why?

When a vulnerabilities is having many identifiers, vulnerability_reads.owasp_top_10 column was not populated as the ingestion logic was only using the first identifier.

For already created records, it should not be a problem as we have a backfill migration !139544 (diffs)

Screenshots or screen recordings

Without fix, the vulnerability should have owasp_top_10 as nil.

Before After
Screenshot_2023-12-19_at_3.07.00_AM Screenshot_2023-12-19_at_3.07.51_AM

How to set up and validate locally

  1. Import project with multiple vulnerability identifiers. Example: https://gitlab.com/bala.kumar/verify-multiple-identifiers
  2. Run pipeline for the main branch.
  3. In Rails console for the imported project say 45, we should observe Project.find(45).vulnerability_reads.pluck(:owasp_top_10) having values like the screenshot above.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #419092 (closed)

Edited by Bala Kumar

Merge request reports