diff --git a/ee/app/helpers/ee/projects_helper.rb b/ee/app/helpers/ee/projects_helper.rb
index 9350669b53b69103ec362d6bfacdd8f9ea865f7a..74db411e0ba9e165cb7f022ada083d042d9766cb 100644
--- a/ee/app/helpers/ee/projects_helper.rb
+++ b/ee/app/helpers/ee/projects_helper.rb
@@ -198,7 +198,8 @@ def project_security_dashboard_config(project)
project_full_path: project.full_path,
security_configuration_path: project_security_configuration_path(@project),
can_admin_vulnerability: can?(current_user, :admin_vulnerability, project).to_s,
- new_vulnerability_path: new_project_security_vulnerability_path(@project)
+ new_vulnerability_path: new_project_security_vulnerability_path(@project),
+ dismissal_descriptions: dismissal_descriptions.to_json
}.merge!(security_dashboard_pipeline_data(project))
else
{
@@ -217,7 +218,8 @@ def project_security_dashboard_config(project)
can_admin_vulnerability: can?(current_user, :admin_vulnerability, project).to_s,
can_view_false_positive: can_view_false_positive?,
security_configuration_path: project_security_configuration_path(@project),
- new_vulnerability_path: new_project_security_vulnerability_path(@project)
+ new_vulnerability_path: new_project_security_vulnerability_path(@project),
+ dismissal_descriptions: dismissal_descriptions.to_json
}.merge!(security_dashboard_pipeline_data(project))
end
end
diff --git a/ee/app/helpers/groups/security_features_helper.rb b/ee/app/helpers/groups/security_features_helper.rb
index b5b58690bf928c5fd6a5638abceb914df54ae168..2125d817706b2349638d94fc74251a11f57295a1 100644
--- a/ee/app/helpers/groups/security_features_helper.rb
+++ b/ee/app/helpers/groups/security_features_helper.rb
@@ -26,7 +26,8 @@ def group_level_security_dashboard_data(group)
vulnerabilities_export_endpoint: expose_path(api_v4_security_groups_vulnerability_exports_path(id: group.id)),
can_admin_vulnerability: can?(current_user, :admin_vulnerability, group).to_s,
can_view_false_positive: group.licensed_feature_available?(:sast_fp_reduction).to_s,
- has_projects: Project.for_group_and_its_subgroups(group).any?.to_s
+ has_projects: Project.for_group_and_its_subgroups(group).any?.to_s,
+ dismissal_descriptions: dismissal_descriptions.to_json
}
end
diff --git a/ee/app/helpers/security_helper.rb b/ee/app/helpers/security_helper.rb
index 626db7802f8c572ad2215f3cd210ae62ea467ba7..785f57d7f24d4caab5e5741633330071294afdb7 100644
--- a/ee/app/helpers/security_helper.rb
+++ b/ee/app/helpers/security_helper.rb
@@ -13,7 +13,8 @@ def instance_security_dashboard_data
can_admin_vulnerability: can_admin_vulnerability?,
false_positive_doc_url: help_page_path('user/application_security/vulnerabilities/index'),
can_view_false_positive: can_view_false_positive?,
- has_projects: instance_security_dashboard.has_projects?.to_s
+ has_projects: instance_security_dashboard.has_projects?.to_s,
+ dismissal_descriptions: dismissal_descriptions.to_json
}
end
diff --git a/ee/spec/features/merge_request/user_sees_security_widget_spec.rb b/ee/spec/features/merge_request/user_sees_security_widget_spec.rb
index 17dca84e891dff26d71a2cebf7a10ee9776e9e2f..188f4c9676db409a34ea7ea7e001763eccbf59f6 100644
--- a/ee/spec/features/merge_request/user_sees_security_widget_spec.rb
+++ b/ee/spec/features/merge_request/user_sees_security_widget_spec.rb
@@ -95,19 +95,7 @@
describe 'dismissal descriptions' do
let(:dismissal_descriptions_json) do
- # Use dynamic translations via N_(...)
- {
- acceptable_risk: _("The vulnerability is known, and has not been remediated or mitigated, " \
- "but is considered to be an acceptable business risk."),
- false_positive: _("An error in reporting in which a test result incorrectly indicates " \
- "the presence of a vulnerability in a system when the vulnerability is not present."),
- mitigating_control: _("A management, operational, or technical control (that is, safeguard " \
- "or countermeasure) employed by an organization that provides equivalent " \
- "or comparable protection for an information system."),
- used_in_tests: _("The finding is not a vulnerability because it is part of a test or is test data."),
- not_applicable: _("The vulnerability is known, and has not been remediated or mitigated, but is " \
- "considered to be in a part of the application that will not be updated.")
- }.to_json
+ Gitlab::Json.parse(fixture_file('vulnerabilities/dismissal_descriptions.json', dir: 'ee')).to_json
end
it 'loads dismissal descriptions' do
diff --git a/ee/spec/fixtures/vulnerabilities/dismissal_descriptions.json b/ee/spec/fixtures/vulnerabilities/dismissal_descriptions.json
new file mode 100644
index 0000000000000000000000000000000000000000..5c6ef0ccfac52dfb6547e961bf6171f677759495
--- /dev/null
+++ b/ee/spec/fixtures/vulnerabilities/dismissal_descriptions.json
@@ -0,0 +1,7 @@
+{
+ "acceptable_risk": "The vulnerability is known, and has not been remediated or mitigated, but is considered to be an acceptable business risk.",
+ "false_positive": "An error in reporting in which a test result incorrectly indicates the presence of a vulnerability in a system when the vulnerability is not present.",
+ "mitigating_control": "A management, operational, or technical control (that is, safeguard or countermeasure) employed by an organization that provides equivalent or comparable protection for an information system.",
+ "used_in_tests": "The finding is not a vulnerability because it is part of a test or is test data.",
+ "not_applicable": "The vulnerability is known, and has not been remediated or mitigated, but is considered to be in a part of the application that will not be updated."
+}
diff --git a/ee/spec/helpers/groups/security_features_helper_spec.rb b/ee/spec/helpers/groups/security_features_helper_spec.rb
index dbbfe3034292276624ab85e225855ae85560c26b..47295e5e199aece8dc995edd77324f88fe2909cf 100644
--- a/ee/spec/helpers/groups/security_features_helper_spec.rb
+++ b/ee/spec/helpers/groups/security_features_helper_spec.rb
@@ -67,6 +67,10 @@
end
let(:has_projects) { 'false' }
+ let(:dismissal_descriptions_json) do
+ Gitlab::Json.parse(fixture_file('vulnerabilities/dismissal_descriptions.json', dir: 'ee')).to_json
+ end
+
let(:expected_data) do
{
projects_endpoint: "http://localhost/api/v4/groups/#{group.id}/projects",
@@ -77,7 +81,8 @@
vulnerabilities_export_endpoint: "/api/v4/security/groups/#{group.id}/vulnerability_exports",
can_admin_vulnerability: 'true',
can_view_false_positive: 'false',
- has_projects: has_projects
+ has_projects: has_projects,
+ dismissal_descriptions: dismissal_descriptions_json
}
end
diff --git a/ee/spec/helpers/projects_helper_spec.rb b/ee/spec/helpers/projects_helper_spec.rb
index e127ecae24858438c33bfc9e7f13a373402640c4..d525b462b3eb1ce82b3809175ed570aba7460712 100644
--- a/ee/spec/helpers/projects_helper_spec.rb
+++ b/ee/spec/helpers/projects_helper_spec.rb
@@ -262,6 +262,9 @@
let_it_be(:group) { create(:group) }
let_it_be(:project) { create(:project, :repository, group: group) }
let_it_be(:jira_integration) { create(:jira_integration, project: project, vulnerabilities_enabled: true, project_key: 'GV', vulnerabilities_issuetype: '10000') }
+ let_it_be(:dismissal_descriptions_json) do
+ Gitlab::Json.parse(fixture_file('vulnerabilities/dismissal_descriptions.json', dir: 'ee')).to_json
+ end
subject { helper.project_security_dashboard_config(project) }
@@ -284,7 +287,8 @@
no_vulnerabilities_svg_path: start_with('/assets/illustrations/empty-state/empty-search-md-'),
security_configuration_path: end_with('/configuration'),
can_admin_vulnerability: 'true',
- new_vulnerability_path: end_with('/security/vulnerabilities/new')
+ new_vulnerability_path: end_with('/security/vulnerabilities/new'),
+ dismissal_descriptions: dismissal_descriptions_json
}
end
@@ -309,7 +313,8 @@
can_admin_vulnerability: 'true',
can_view_false_positive: 'false',
security_configuration_path: kind_of(String),
- new_vulnerability_path: end_with('/security/vulnerabilities/new')
+ new_vulnerability_path: end_with('/security/vulnerabilities/new'),
+ dismissal_descriptions: dismissal_descriptions_json
}
end
diff --git a/ee/spec/helpers/security_helper_spec.rb b/ee/spec/helpers/security_helper_spec.rb
index b61702187e8acec1e98e3d342bf2fbbe852d2a21..b63acb7230aa9e138a7007f2e10fba0026866ea3 100644
--- a/ee/spec/helpers/security_helper_spec.rb
+++ b/ee/spec/helpers/security_helper_spec.rb
@@ -3,6 +3,8 @@
require 'spec_helper'
RSpec.describe SecurityHelper, feature_category: :vulnerability_management do
+ include VulnerabilitiesHelper
+
describe '#instance_security_dashboard_data' do
let_it_be(:group) { create(:group) }
let_it_be(:has_group) { true }
@@ -11,6 +13,10 @@
let_it_be(:current_user) { create(:user) }
let_it_be(:expected_can_admin_vulnerability) { 'true' }
+ let(:dismissal_descriptions_json) do
+ Gitlab::Json.parse(fixture_file('vulnerabilities/dismissal_descriptions.json', dir: 'ee')).to_json
+ end
+
before do
stub_licensed_features(security_dashboard: true)
project.namespace.add_maintainer(current_user) if has_group
@@ -31,7 +37,8 @@
can_admin_vulnerability: expected_can_admin_vulnerability,
false_positive_doc_url: help_page_path('user/application_security/vulnerabilities/index'),
can_view_false_positive: 'false',
- has_projects: 'true'
+ has_projects: 'true',
+ dismissal_descriptions: dismissal_descriptions_json
})
end