Skip to content

Update placeholders for DAST Profile sensitive fields

Dheeraj Joshi requested to merge djadmin-update-placeholders-dast-profile into master

Related issue - #323449 (closed)

What does this MR do?

  • Updates placeholder for sensitive fields when updating a site profile

    • password field, a required field, to have asterisks
    • request headers, an optional field, to have [Redacted] placeholder when value is set previously
  • Update summary when selecting a site profile to create a new DAST Scan

    • show the placeholder for password when auth is enabled
    • disable summary field for optional fields (exclude urls, request headers)
  • Also, removes an extended query for site profile in favor of using @client directive

Screenshots (strongly suggested)

Editing site profile Profile summary
image image

How to test this

Site Profile Updation

  1. Create a DAST site profile, skip if you already have site profile created. To do so, visit the following path in your local GDK /:namespace/:project/-/security/configuration/dast_profiles/dast_site_profiles/new

  2. Enable the security_dast_site_profiles_additional_fields feature flag.

echo "Feature.enable(:security_dast_site_profiles_additional_fields)" | rails c
  1. Select and open the created site profile from /:namespace/:project/-/security/configuration/dast_profiles/#site-profiles

Site Profile Summary

  1. Enable the security_dast_site_profiles_additional_fields feature flag, if not done already

  2. (optional) Add the following diff to have multiple profiles

diff --git a/ee/app/assets/javascripts/on_demand_scans/components/on_demand_scans_form.vue b/ee/app/assets/javascripts/on_demand_scans/components/on_demand_scans_form.vue
index 02d7965b424..5772cfe2d09 100644
--- a/ee/app/assets/javascripts/on_demand_scans/components/on_demand_scans_form.vue
+++ b/ee/app/assets/javascripts/on_demand_scans/components/on_demand_scans_form.vue
@@ -31,6 +31,8 @@ import validation from '~/vue_shared/directives/validation';
 import glFeatureFlagsMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
 import dastProfileCreateMutation from '../graphql/dast_profile_create.mutation.graphql';
 import dastProfileUpdateMutation from '../graphql/dast_profile_update.mutation.graphql';
+import { siteProfiles } from 'ee_jest/on_demand_scans/mocks/mock_data';
+
 import {
   ERROR_RUN_SCAN,
   ERROR_FETCH_SCANNER_PROFILES,
@@ -59,7 +61,8 @@ const createProfilesApolloOptions = (name, field, { fetchQuery, fetchError }) =>
     if (edges.length === 1) {
       this[field] = edges[0].node.id;
     }
-    return edges.map(({ node }) => node);
+    // return edges.map(({ node }) => node);
+    return siteProfiles;
   },
   error(e) {
     Sentry.captureException(e);
  1. Visit on-demand scans form and select a site profile from the dropdown

/:namespace/:project/-/on_demand_scans /new

Does this MR meet the acceptance criteria?

Conformity

Edited by Dheeraj Joshi

Merge request reports