Commit 1656a6c6 authored by Mehmet Emin INAC's avatar Mehmet Emin INAC

Disable creating `security_findings` by default

Create entries in `security_findings` table if the feature is enabled.
parent 8a75797e
......@@ -19,6 +19,8 @@ module Security
end
def execute
return security_scan unless Feature.enabled?(:store_security_findings, project)
StoreFindingsMetadataService.execute(security_scan, security_report)
deduplicate_findings? ? update_deduplicated_findings : register_finding_keys
......
---
name: store_security_findings
introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/44312
rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/276011
milestone: '13.6'
type: development
group: group::threat insights
default_enabled: false
......@@ -41,89 +41,121 @@ RSpec.describe Security::StoreScanService do
known_keys.add(finding_key)
end
it 'calls the `Security::StoreFindingsMetadataService` to store findings' do
store_scan
context 'when the `store_security_findings` feature is not enabled' do
before do
stub_feature_flags(store_security_findings: false)
end
expect(Security::StoreFindingsMetadataService).to have_received(:execute)
end
it 'does not call the `Security::StoreFindingsMetadataService`' do
store_scan
context 'when the security scan already exists for the artifact' do
let_it_be(:security_scan) { create(:security_scan, build: artifact.job, scan_type: :sast) }
let_it_be(:unique_security_finding) do
create(:security_finding,
scan: security_scan,
position: 0)
expect(Security::StoreFindingsMetadataService).not_to have_received(:execute)
end
let_it_be(:duplicated_security_finding) do
create(:security_finding,
scan: security_scan,
position: 5)
end
context 'when the security scan already exists for the artifact' do
let_it_be(:security_scan) { create(:security_scan, build: artifact.job, scan_type: :sast) }
it 'does not create a new security scan' do
expect { store_scan }.not_to change { artifact.job.security_scans.count }
it 'does not create a new security scan' do
expect { store_scan }.not_to change { artifact.job.security_scans.count }
end
end
context 'when the `deduplicate` param is set as false' do
it 'does not change the deduplicated flag of duplicated finding' do
expect { store_scan }.not_to change { duplicated_security_finding.reload.deduplicated }.from(false)
context 'when the security scan does not exist for the artifact' do
it 'creates a new security scan' do
expect { store_scan }.to change { artifact.job.security_scans.sast.count }.by(1)
end
end
end
it 'does not change the deduplicated flag of unique finding' do
expect { store_scan }.not_to change { unique_security_finding.reload.deduplicated }.from(false)
end
context 'when the `store_security_findings` feature is enabled' do
before do
stub_feature_flags(store_security_findings: true)
end
context 'when the `deduplicate` param is set as true' do
let(:deduplicate) { true }
it 'calls the `Security::StoreFindingsMetadataService` to store findings' do
store_scan
expect(Security::StoreFindingsMetadataService).to have_received(:execute)
end
it 'does not change the deduplicated flag of duplicated finding false' do
expect { store_scan }.not_to change { duplicated_security_finding.reload.deduplicated }.from(false)
context 'when the security scan already exists for the artifact' do
let_it_be(:security_scan) { create(:security_scan, build: artifact.job, scan_type: :sast) }
let_it_be(:unique_security_finding) do
create(:security_finding,
scan: security_scan,
position: 0)
end
it 'sets the deduplicated flag of unique finding as true' do
expect { store_scan }.to change { unique_security_finding.reload.deduplicated }.to(true)
let_it_be(:duplicated_security_finding) do
create(:security_finding,
scan: security_scan,
position: 5)
end
end
end
context 'when the security scan does not exist for the artifact' do
let(:unique_finding_attribute) do
-> { Security::Finding.by_position(0).first&.deduplicated }
end
it 'does not create a new security scan' do
expect { store_scan }.not_to change { artifact.job.security_scans.count }
end
let(:duplicated_finding_attribute) do
-> { Security::Finding.by_position(5).first&.deduplicated }
end
context 'when the `deduplicate` param is set as false' do
it 'does not change the deduplicated flag of duplicated finding' do
expect { store_scan }.not_to change { duplicated_security_finding.reload.deduplicated }.from(false)
end
before do
allow(Security::StoreFindingsMetadataService).to receive(:execute).and_call_original
end
it 'does not change the deduplicated flag of unique finding' do
expect { store_scan }.not_to change { unique_security_finding.reload.deduplicated }.from(false)
end
end
it 'creates a new security scan' do
expect { store_scan }.to change { artifact.job.security_scans.sast.count }.by(1)
context 'when the `deduplicate` param is set as true' do
let(:deduplicate) { true }
it 'does not change the deduplicated flag of duplicated finding false' do
expect { store_scan }.not_to change { duplicated_security_finding.reload.deduplicated }.from(false)
end
it 'sets the deduplicated flag of unique finding as true' do
expect { store_scan }.to change { unique_security_finding.reload.deduplicated }.to(true)
end
end
end
context 'when the `deduplicate` param is set as false' do
it 'sets the deduplicated flag of duplicated finding as false' do
expect { store_scan }.to change { duplicated_finding_attribute.call }.to(false)
context 'when the security scan does not exist for the artifact' do
let(:unique_finding_attribute) do
-> { Security::Finding.by_position(0).first&.deduplicated }
end
it 'sets the deduplicated flag of unique finding as true' do
expect { store_scan }.to change { unique_finding_attribute.call }.to(true)
let(:duplicated_finding_attribute) do
-> { Security::Finding.by_position(5).first&.deduplicated }
end
end
context 'when the `deduplicate` param is set as true' do
let(:deduplicate) { true }
before do
allow(Security::StoreFindingsMetadataService).to receive(:execute).and_call_original
end
it 'sets the deduplicated flag of duplicated finding false' do
expect { store_scan }.to change { duplicated_finding_attribute.call }.to(false)
it 'creates a new security scan' do
expect { store_scan }.to change { artifact.job.security_scans.sast.count }.by(1)
end
it 'sets the deduplicated flag of unique finding as true' do
expect { store_scan }.to change { unique_finding_attribute.call }.to(true)
context 'when the `deduplicate` param is set as false' do
it 'sets the deduplicated flag of duplicated finding as false' do
expect { store_scan }.to change { duplicated_finding_attribute.call }.to(false)
end
it 'sets the deduplicated flag of unique finding as true' do
expect { store_scan }.to change { unique_finding_attribute.call }.to(true)
end
end
context 'when the `deduplicate` param is set as true' do
let(:deduplicate) { true }
it 'sets the deduplicated flag of duplicated finding false' do
expect { store_scan }.to change { duplicated_finding_attribute.call }.to(false)
end
it 'sets the deduplicated flag of unique finding as true' do
expect { store_scan }.to change { unique_finding_attribute.call }.to(true)
end
end
end
end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment