Skip to content

Add Vendor to Vulnerability Scanners

What does this MR do?

Related to #210327 (closed) and gitlab-org/security-products/security-report-schemas!33 (merged)

This MR adds new field to Vulnerabilities::Scanner that reflects vendor/maintainer of the Scanner, by default it is GitLab (for now), however we expect that soon all scanners will update its security report and will have that property filled.

Migrations

== 20200622070620 AddLimitToVulnerabilityScannersVendor: reverting ============
-- execute("ALTER TABLE vulnerability_scanners\nDROP CONSTRAINT IF EXISTS check_37608c9db5\n")
   -> 0.0018s
== 20200622070620 AddLimitToVulnerabilityScannersVendor: reverted (0.0135s) ===
== 20200622070620 AddLimitToVulnerabilityScannersVendor: migrating ============
-- transaction_open?()
   -> 0.0000s
-- execute("ALTER TABLE vulnerability_scanners\nADD CONSTRAINT check_37608c9db5\nCHECK ( char_length(vendor) <= 255 )\nNOT VALID;\n")
   -> 0.0007s
== 20200622070620 AddLimitToVulnerabilityScannersVendor: migrated (0.0035s) ===
== 20200622070606 AddVendorToVulnerabilityScanners: reverting =================
-- remove_column(:vulnerability_scanners, :vendor)
   -> 0.0056s
== 20200622070606 AddVendorToVulnerabilityScanners: reverted (0.0107s) ========
== 20200622070606 AddVendorToVulnerabilityScanners: migrating =================
-- add_column(:vulnerability_scanners, :vendor, :text, {:default=>"GitLab", :null=>false})
   -> 0.0042s
== 20200622070606 AddVendorToVulnerabilityScanners: migrated (0.0083s) ========

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team
Edited by Alan (Maciej) Paruszewski

Merge request reports