feat(issueVariant): allow for creation of issue variant with only a severity rating #362
Conversation
BlakePatterson
requested review from
drochow,
MR2011 and
dorneanu
as code owners
| @@ -150,6 +150,26 @@ type Cursor struct { | |||
| Limit int | |||
| } | |||
|
|
|||
| func NewSeverityFromRating(rating SeverityValues) Severity { | |||
There was a problem hiding this comment.
Please add a comment where this values come from. There might also be an adjustment depending on the CVSS version.
https://nvd.nist.gov/vuln-metrics/cvss
There was a problem hiding this comment.
I added a comment about the CVSS specification with links, but I'm not sure how I would handle doing adjustments based on which CVSS specification since there is no information being passed other than the rating. Should I just do something else here instead?
internal/e2e/evidence_query_test.go
Outdated
| "description": evidence.Description, | ||
| "severity": model.SeverityInput{ |
There was a problem hiding this comment.
Why is this needed in the evidence test?
There was a problem hiding this comment.
I removed this now as it's not needed and works without the severity input now.
| "secondaryName": issueVariant.SecondaryName, | ||
| "severity": model.SeverityInput{ | ||
| Rating: &model.AllSeverityValues[0], | ||
| Vector: &issueVariant.Severity.Cvss.Vector, |
There was a problem hiding this comment.
Do we check if rating and vector match?
There was a problem hiding this comment.
I added logic now to check if rating & vector don't match when they are both passed. If they match it works like normal, if not the issue variant creation errors out.
| return entity.Severity{} | ||
| } | ||
| if severity.Rating != nil && severity.Vector != nil { |
There was a problem hiding this comment.
I've updated it now so that it just uses the vector and ignores the rating when both are passed.
…rating and vector are passed
…ng vector if passed and added test
| logrus.WithError(err).WithField("request", req).Fatalln("Error while unmarshaling") | ||
| } | ||
|
|
||
| Expect(string(*respData.IssueVariant.Severity.Value)).To(Equal(issueVariant.Severity.Value)) |
There was a problem hiding this comment.
We should check if the vector is empty after updating the rating
MR2011
deleted the
BlakePatterson/issue-361/issue-variant-rating-creation
branch
…everity rating (#362) * feat(issueVariant): added optional rating field to severity input * feat(issueVariant): added comments and check for when rating doesn't match vector * fix(tests): removed severity input from tests where not needed * feat(issueVariant): changed iv creation to just use vector when both rating and vector are passed * feat(issueVariant): changed update handler for iv to overwrite existing vector if passed and added test * adding test --------- Co-authored-by: dustindemmerle <[email protected]> Co-authored-by: Michael Reimsbach <[email protected]>
Description
As part of the Openstack scanner development, we needed to be able to create issue variants with a severity that just has a rating and no cvss vector.
This PR adds a "rating" field to SeverityInput of type SeverityValues and also adds logic throughout the resolver implementation to handle the separate cases of whether a vector has been passed in SeverityInput or just a rating. There is also a new query in the queryCollection/issueVariant folder for the case of creating a query with only a severity rating and no vector.
What type of PR is this? (check all applicable)
Related Tickets & Documents
Added tests?
I created a new query for the case of creating an issue variant with only a severity rating and added a new e2e test case for it. I also updated any tests involving queries that contained SeverityInput wherever necessary.
All tests passed locally, and I also tested various queries in the playground to ensure issue variant creation worked.
Added to documentation?
Checklist