GitLab Protect Stage, 26 May 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Create Merge Request / Download Patch from Vulnerability

Description

Issues:
- Create Merge Request from Vulnerability - https://gitlab.com/gitlab-org/gitlab/-/issues/216300
- Download Patch from Vulnerability - https://gitlab.com/gitlab-org/gitlab/-/issues/216300

A

Hello, this is alexander from the get lab defend team. I will be introducing the new functionality of having this button be extended to not only create an issue like you may have been used to in the past, but also to resolve with the merge request or to download a patched resolve, so uh the create issue. Functionality is what we've seen before, where, if you click this button it uh now in this drop down, you select it you'll, select the create issue, action that you, this button will work for.

A

You click the create issue and you are navigating to an issue that is created off this vulnerability and if I go back to the standalone vulnerability page, there is now the history of the issue created and is now linked to this vulnerability.

A

This leaves before this button would have been would have disappeared before, but now there are two more actions that you can take on this vulnerability. One is to download the patch results. So, what's going on here is the vulnerability exists and get gitlab has figured out a way to fix the vulnerability and they are suggesting it to you either through creating the mr itself or if you want download the patch resolve, you will get this box that basically downloads a patch file.

A

If you click ok to view we see here for me in text edit, we get the diff of what gitlab thinks should happen to your yarn, lock file. So it looks like it's removing certain packages and either removing them, because they're now obsolete or updating them with newer versions, um so there's a download patch functionality and then there's also the resolve with merge requests. So when you click on this button now it will create a merge request and we should be navigating to that page which we are here.

A

So it opens up a merge request for you and if we look at the changes it seems there is quite a few and it should and they're only our unlock file. They should be the same changes that we saw in the download patch file. So and of course, when you go back to the vulnerability.

A

um That functionality is no longer there, we can no longer create uh a um download or create a merge request. Just like we can no longer create an issue. Now we can only download the patch. There is not a history.

A

Box, like the create issue for creating an mr, but that is coming in the future. Thank you for watching uh look for more changes coming to the stand-alone vulnerability page in the future have a great day bye.