Replace VulnerabilitiesFinder with VulnerabilityReadsFinder

Arpit Gogiarequested to merge
499694-resolve-cross-join-vuln-scope-part-1 into master

What does this MR do and why?

Replace ::Security::VulnerabilitiesFinder with ::Security::VulnerabilityReadsFinder . Part 1 of the split of !171725 (closed).

Relevant discussion: !171725 (comment 2222215770)

  • Relevant discussion (comments starting from !171725 (comment 2222215770))
  • This was needed because it has the denormalized archive attribute and namespace traversal IDs to more easily query vulnerabilities.
  • The ::Security::VulnerabilitiesFinder has no more use and will be deleted.

References

Please include cross links to any resources that are relevant to this MR. This will give reviewers and future readers helpful context to give an efficient review of the changes introduced.

Query Analysis

Query plans for the new methods/scopes in this MR, the queries are obtained from calling the new methods through the Rails console. Data used was in accordance with: https://docs.gitlab.com/ee/development/database_review.html#query-plans

We skipped the vulns/projects/license selects as those are pretty straightforward constant time and were already existing, standard behaviour for the finders.

LIMIT 1 Cursor start for projects iteration: https://console.postgres.ai/gitlab/gitlab-production-main/sessions/34959/commands/108264

LIMIT 10 OFFSET 10 for second batch of projects: https://postgres.ai/console/gitlab/gitlab-production-main/sessions/35103/commands/108817

Worst Case (No Hits):

Best Case (5 Hits Found on first batch):

Project batch size is set to 10 to reduce risk of statement timeout. We expect faster execution time in production, so this should be largely stable, but if there are problems, we have considered implementing a timelimit as well.

For more context on this analysis, view the conversation here.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #499694 (closed)

Edited by Gregory Havenga

Merge request reports