Name the owning group on scan profile badges

Miranda Fluhartyrequested to merge
624190-name-owning-group-on-scan-profile-badges into master

What does this MR do and why?

Name the owning group on scan profile badges

Show the name of the top-level group that owns a scan profile, in place
of the Custom badge. This covers the profile list, the profile detail
view and the Select scanners wizard dropdown.

Take the name from a new rootGroupName the page provides. The security
configuration page is reachable from a subgroup, but every profile
belongs to the root ancestor, so the existing groupName names the wrong
group.

Related to https://gitlab.com/gitlab-org/gitlab/-/issues/624190
Changelog: changed
EE: true

note: The drawer is feature-flagged, but the wizard is not, so this still gets a Changelog:

References

Screenshots or screen recordings

Before After
drawer 624190-before-drawer-badges-from-subgroup 624190-drawer-badges-from-subgroup
wizard dropdown 624190-before-wizard-dropdown-badges 624190-wizard-dropdown-badges

How to set up and validate locally

  1. git checkout 624190-name-owning-group-on-scan-profile-badges
echo "Feature.enable(:custom_scan_profiles_ui)" | gdk rails c
  2. have a GitLab Ultimate licence
  3. use a user with at least the Developer role on the root group, since the page checks read_security_scan_profiles against the root ancestor rather than against the group you are viewing
  4. there is no user interface yet for creating custom scan profiles, so create one by calling the securityScanProfileCreate mutation directly:
expand for example mutations

paste into https://gdk.test:3443/-/graphql-explorer, replace namespaceId: "gid://gitlab/Group/24" with your root group's id

mutation {
  securityScanProfileCreate(
    input: {
      namespaceId: "gid://gitlab/Group/24"
      scanType: SECRET_DETECTION
      name: "All settings at profile level"
      description: "Every setting shared across both configurable triggers"
      stripDefaults: false
      triggers: [
        {
          triggerType: MERGE_REQUEST_PIPELINE
          configuration: {
            secretDetection: {
              secureAnalyzersPrefix: "registry.example.com/security-products"
              imageSuffix: FIPS
              historicScan: true
              logOptions: "--all"
              excludedPaths: ["spec/fixtures/**", "tmp/**"]
              rulesetGitReference: "refs/tags/v1.2.0"
            }
          }
        }
        {
          triggerType: DEFAULT_BRANCH_PIPELINE
          configuration: {
            secretDetection: {
              secureAnalyzersPrefix: "registry.example.com/security-products"
              imageSuffix: FIPS
              historicScan: true
              logOptions: "--all"
              excludedPaths: ["spec/fixtures/**", "tmp/**"]
              rulesetGitReference: "refs/tags/v1.2.0"
            }
          }
        }
        { triggerType: GIT_PUSH_EVENT }
      ]
    }
  ) {
    scanProfile {
      id
      name
      triggerSettings {
        triggerType
        configuration {
          ... on SecretDetectionConfiguration {
            secureAnalyzersPrefix
            imageSuffix
            historicScan
            logOptions
            excludedPaths
            rulesetGitReference
          }
        }
      }
    }
    errors
  }
}
mutation {
  securityScanProfileCreate(
    input: {
      namespaceId: "gid://gitlab/Group/24"
      scanType: SECRET_DETECTION
      name: "Mixed profile and trigger settings"
      description: "Three settings shared across triggers, two that differ"
      stripDefaults: false
      triggers: [
        {
          triggerType: MERGE_REQUEST_PIPELINE
          configuration: {
            secretDetection: {
              secureAnalyzersPrefix: "registry.example.com/security-products"
              imageSuffix: FIPS
              excludedPaths: ["spec/fixtures/**", "tmp/**"]
              historicScan: false
              logOptions: "--all"
            }
          }
        }
        {
          triggerType: DEFAULT_BRANCH_PIPELINE
          configuration: {
            secretDetection: {
              secureAnalyzersPrefix: "registry.example.com/security-products"
              imageSuffix: FIPS
              excludedPaths: ["spec/fixtures/**", "tmp/**"]
              historicScan: true
            }
          }
        }
        { triggerType: GIT_PUSH_EVENT }
      ]
    }
  ) {
    scanProfile {
      id
      name
      gitlabRecommended
      triggerSettings {
        triggerType
        configuration {
          ... on SecretDetectionConfiguration {
            secureAnalyzersPrefix
            imageSuffix
            excludedPaths
            historicScan
            logOptions
            rulesetGitReference
          }
        }
      }
    }
    errors
  }
}
mutation {
  securityScanProfileCreate(
    input: {
      namespaceId: "gid://gitlab/Group/<root_group_id>"
      scanType: SECRET_DETECTION
      name: "XSS test <img src=x onerror=alert('profile-name')>"
      description: "\"><script>alert('description')</script> and a [markdown link](javascript:alert('md'))\nsecond line"
      stripDefaults: false
      triggers: [
        {
          triggerType: MERGE_REQUEST_PIPELINE
          configuration: {
            secretDetection: {
              historicScan: true
              imageSuffix: FIPS
              secureAnalyzersPrefix: "<img src=x onerror=alert('secureAnalyzersPrefix')>"
              excludedPaths: [
                "<script>alert('excludedPaths')</script>"
                "\"><img src=x onerror=alert('attr-breakout')>"
                "{{ constructor.constructor('alert(1)')() }}"
                "\\u003cimg src=x onerror=alert('double-decode')\\u003e"
                "<a href=\"javascript:alert('href')\">spec/**</a>"
              ]
              logOptions: "--all <svg onload=alert('logOptions-merge-request')>"
              rulesetGitReference: "javascript:alert('rulesetGitReference')"
            }
          }
        }
        {
          triggerType: DEFAULT_BRANCH_PIPELINE
          configuration: {
            secretDetection: {
              historicScan: true
              imageSuffix: FIPS
              secureAnalyzersPrefix: "<img src=x onerror=alert('secureAnalyzersPrefix')>"
              excludedPaths: [
                "<script>alert('excludedPaths')</script>"
                "\"><img src=x onerror=alert('attr-breakout')>"
                "{{ constructor.constructor('alert(1)')() }}"
                "\\u003cimg src=x onerror=alert('double-decode')\\u003e"
                "<a href=\"javascript:alert('href')\">spec/**</a>"
              ]
              logOptions: "--since=2020-01-01 <iframe srcdoc=\"<script>alert(1)</script>\"></iframe>"
              rulesetGitReference: "<style>body{display:none}</style>refs/tags/v1"
            }
          }
        }
        { triggerType: GIT_PUSH_EVENT }
      ]
    }
  ) {
    scanProfile {
      id
      name
    }
    errors
  }
}
  1. go to a subgroup => Secure => Security configuration
    • note: the profiles belong to the root ancestor, but the page is reachable from any subgroup within it
  2. open the drawer for the Secret Detection row (the only scanner with a drawer so far)
  3. check that the profile list down the side of the drawer:
    • shows GitLab for the GitLab-recommended default profile (unchanged)
    • shows the same top-level group name for every other (custom) profile
    • that name is the name of the root group, not the subgroup the page was opened from
  4. select a custom profile and check that the Managed by row in the detail panel:
    • shows that same root group name, matching the profile list
  5. go to Secure => Security configuration, open the Enable scanners wizard, and go to step 3, Select scanners
  6. select Secret detection and open its Configuration profile dropdown
  7. check that:
    • the GitLab-recommended options read GitLab
    • every custom profile option reads the same root group name as steps 5 and 6
  8. if the root group name is not fetchable for whatever reason, the badge falls back to Custom

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #624190 (closed)

Edited by Miranda Fluharty

Merge request reports