Subashis Chakraborty (dcc76289) at 18 Mar 04:29

What does this MR do and why?

Add TopCwesFinder to identify and rank top CWEs from vulnerabilities

Implements a native Elasticsearch aggregation finder to:

• Identify the top 10 CWEs (Common Weakness Enumeration) in vulnerabilities
• Include severity breakdown for each CWE
• Support filtering by severity levels
• Follow existing finder patterns

Includes:

• TopCwesFinder implementation with execute, parse_aggregation, format_top_cwes methods
• by_top_cwes aggregation in VulnerabilityAggregations
• Integration with VulnerabilityQueryBuilder
• Comprehensive RSpec tests covering finder, aggregation, and query builder functionality

References

Screenshots or screen recordings

Before	After

How to set up and validate locally

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #592096

Subashis Chakraborty (3765ef03) at 18 Mar 00:36

Also, due dates should be able to be set retroactively.

Thanks @bwill for this 👍

Thanks Ugo for the heads up, I will wait until query plan is added here.

Thanks @uokeadu. @bwill Can you please do the maintainer review for this MR 🙏?

What does this MR do and why?

Add vulnerability_finding_due_dates to store remediation due dates for vulnerability findings.

Changes

• Create vulnerability_finding_due_dates table with:

  • vulnerability_occurrence_id (unique, FK -> vulnerability_occurrences, ON DELETE CASCADE)
  • project_id
  • due_date
  • timestamps

• Add indexes on vulnerability_occurrence_id and project_id

• Configure Loose Foreign Key cleanup for project_id → projects

• Add Vulnerabilities::FindingDueDate model and has_one :finding_due_date association on Vulnerabilities::Finding

• Add factory and model specs

• Include association in import/export configuration

References

Issue: https://gitlab.com/gitlab-org/gitlab/-/work_items/592222+

Screenshots or screen recordings

Before	After

How to set up and validate locally

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Thanks for the explanation 👍.

Ah, ok it would not be usual to see we are giving due dates in past. If we do not have any validation or constraint here, it means there is a possibility of that.

Thanks @uokeadu for updating this.

shall we let the backend pass this url as a field?

@lorenzvanherwaarden we can do that. As it will be passed as a new field. Hope that will not be an issue for version compatibility in frontend.

Shall we name it url or definitionUrl or something?

I would go for url. WDYT?

Thanks @sming-gitlab for working on this. LGTM.

What does this MR do and why?

This MR updates the actor for all mr_reports_tab FF reference to be project instead of current_user.

There is no UI/UX changes, everything continues to work expected:

mr_reports_tab true	mr_reports_tab false

mr_reports_tab true

• Has "Reports" tab
• Display "View reports"
• Widget is not expandable

mr_reports_tab false

• No "Reports" tab
• Widget is expandable

References

Screenshots or screen recordings

Before	After

How to set up and validate locally

1. Clone this repo and create a MR similar to this: gitlab-org/govern/threat-insights-demos/frontend/mr-reports-tab!1
2. Trigger a pipeline and it will create some findings

Enable and disable FF:

http://gdk.test:3000/rails/features/mr_reports_tab

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #592500

Subashis Chakraborty (8eefcfcc) at 16 Mar 22:33

... and 1 more commit

Subashis Chakraborty (3dd02c93) at 16 Mar 22:32

Extract common test patterns from security resolver specs

Create shared examples file for common test patterns used across VulnerabilitiesPerSeverityResolver, VulnerabilitiesOverTimeResolver, and RiskScoreResolver specs. This reduces duplication and improves maintainability by centralizing authorization and feature flag validation patterns.

Related to #559249

Subashis Chakraborty (3dd02c93) at 16 Mar 20:27

... and 601 more commits

If we have time in the milestone, we can research this further as stretch item perhaps.

I can look into this while I am doing the development.