Improve Vulnerability Tracking
This epic tracks work related to improving vulnerability/occurrence tracking
## Resources
* [Research Issue](https://gitlab.com/gitlab-org/gitlab/-/issues/233167)
## Summary
As outlined in the research issue above, several potential methods exist that could help improve vulnerability tracking throughout the lifecycle of a project. In other words, several imperfect methods exist to deduplicate vulnerabilities on the same and different versions of a project.
| Method | Breaks when | Requires |
|----------------|---------------------------|-------------------|
| `file+offset` | File line offset changes | |
| `scope+offset` | Scope line offset changes | Scope information |
| `ast+offset` | AST node position changes | Specific AST node |
| `diff` | Tracks outside of scope | Before/After text |
In order to objectively sift through these options, we needed to settle on a boundary where we absolutely consider a changed line of code to be a new vulnerability:
### {+VULN BOUNDARY: Scope changes equals a new vulnerability+}
<details>
<summary>Details of Different Methods</summary>
### File+Offset
### Scope+Offset
### AST-based
### Diff-based
</details>
## Plan
* MVC: `scope+scope_offset`
* imperfect, definite improvement over status quo
* Iteration 1:
* Preprocess code so that we can determine an exact AST node (guarantee one top-level AST node per line)
* Use an AST-based approach - TBD on exact mechanics (VET, microgrmr, ?)
<!-- start-discoto-summary -->
## Auto-Summary :robot:
<details>
<summary>Discoto Usage</summary>
---
> **Points**
>
> Discussion points are declared by headings, list items, and single
> lines that start with the text (case-insensitive) `point:`. For
> example, the following are all valid points:
>
> * `#### POINT: This is a point`
> * `* point: This is a point`
> * `+ Point: This is a point`
> * `- pOINT: This is a point`
> * `point: This is a **point**`
>
> Note that any markdown used in the point text will also be propagated
> into the topic summaries.
>
> **Topics**
>
> Topics can be stand-alone and contained within an issuable (epic,
> issue, MR), or can be inline.
>
> Inline topics are defined by creating a new thread (discussion)
> where the first line of the first comment is a heading that starts
> with (case-insensitive) `topic:`. For example, the following are all
> valid topics:
>
> * `# Topic: Inline discussion topic 1`
> * `## TOPIC: **{+A Green, bolded topic+}**`
> * `### tOpIc: Another topic`
>
> **Quick Actions**
>
> | Action | Description |
> |-------------------------------|---------------------------------------------------------|
> | `/discuss sub-topic TITLE` | Create an issue for a sub-topic. Does not work in epics |
> | `/discuss link ISSUABLE-LINK` | Link an issuable as a child of this discussion |
>
---
</details>
Last updated by [this job](https://gitlab.com/gitlab-org/secure/pocs/discoto-runner/-/jobs/1125622356)
* **TOPIC** Improve Vulnerability Occurrence Uniqueness/Tracking https://gitlab.com/gitlab-org/gitlab/-/issues/233167
* **TOPIC** Improve Vulnerability Tracking: MVP: Scope+Offset https://gitlab.com/groups/gitlab-org/-/epics/4690
* **TOPIC** Draft: Improve Vulnerability Tracking: proof of concept https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339
* **TOPIC** Simplicity and elegance https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339#note_443449912
* **TOPIC** Portability and/or modularity https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339#note_443449955
* **TOPIC** Supportability https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339#note_443450003
* **TOPIC** Maintainability https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339#note_443450055
* **TOPIC** Scalability https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339#note_443450085
* **TOPIC** Extensibility https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339#note_443450108
* **TOPIC** Reliability https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339#note_443450124
* **TOPIC** Security https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339#note_443450151
* **TOPIC** Cost https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339#note_443450264
* No cost changes https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339#note_448382135
* **TOPIC** Performance https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339#note_443450287
* `CompareSecurityReportsService` x1000 (None existing): BEFORE: TODO https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339#note_448368619
* `CompareSecurityReportsService` x1000 (None existing): _AFTER: TODO seconds (+-%) https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339#note_448368619
* `CompareSecurityReportsService` x1000 (x1000 existing): _AFTER: TODO seconds (+-%) https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339#note_448368752
* `CompareSecurityReportsService` x1000 (x1000 existing): BEFORE: TODO seconds https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339#note_448368752
* `StoreReportService` x1000 (None existing): _AFTER: TODO (+-%) https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339#note_448368966
* `StoreReportService` x1000 (None existing): BEFORE: TODO https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339#note_448368966
* `StoreReportService` x1000 (x1000 existing): BEFORE: TODO https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339#note_448369064
* `StoreReportService` x1000 (x1000 existing): _AFTER: TODO (+-%) https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339#note_448369064
* **TOPIC** Consistency https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339#note_443450329
* **TOPIC** Related Resources/Issues https://gitlab.com/gitlab-org/gitlab/-/merge_requests/45339#note_445286307
* **TOPIC** https://gitlab.com/gitlab-org/secure/vulnerability-research/pocs/ctags4ruby/-/merge_requests/2
* **TOPIC** https://gitlab.com/gitlab-org/secure/vulnerability-research/pocs/taggr/-/merge_requests/1
* **TOPIC** Improve Vulnerability Tracking: Security Report JSON format https://gitlab.com/gitlab-org/gitlab/-/issues/287672
* **TOPIC** https://gitlab.com/gitlab-org/secure/vulnerability-research/pocs/taggr4go/-/merge_requests/1
* **TOPIC** https://gitlab.com/gitlab-org/secure/vulnerability-research/pocs/taggr/-/issues/1
* **TOPIC** https://gitlab.com/gitlab-org/secure/vulnerability-research/pocs/post-analyzers/brakeman/-/merge_requests/1
* **TOPIC** https://gitlab.com/gitlab-org/secure/vulnerability-research/research/experiments/-/issues/1
* **TOPIC** Documentation https://gitlab.com/groups/gitlab-org/-/epics/4690#note_524685599
<!-- end-discoto-summary -->
<!-- start-discoto-topic-settings --><details>
<summary>Discoto Settings</summary>
<br/>
```yaml
---
summary:
max_items: -1
sort_by: created
sort_direction: ascending
```
See the [settings schema](https://gitlab.com/gitlab-org/secure/pocs/discussion-automation#settings-schema) for details.
</details>
<!-- end-discoto-topic-settings -->
epic