GitLab Secure Stage, 20 Apr 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Threat Insights Weekly Group Discussion

Description

Weekly meeting for the Secure:Threat Insights group.

Includes milestone kick-off for 13.12.

A

Welcome to the weekly threat insights group conversation, we're gonna jump right into our agenda. I added the top item, so we have talked in recent retrospectives around wanting to have more insight into what everybody's working on going into the milestone.

A

So in the last couple of milestones we have experimented with, but I wouldn't say successfully timed a retrospective discussion during these group meetings, so we're going to go through the front end and back end issues that are currently slated for 1312 and I am going to ask individuals from those teams to go down the list for us. There is a link in the agenda to take you to a board. That's pretty easy to view we're going to look at the ready for development and blocked issues and summarize to to your best degree.

A

I know that might be hard, so I already know who's doing it for the front end team and I'm pretty sure I picked on jonathan to do this last time for back in so sebastian. Do you mind doing this for the back end team today.

B

Sure I can go, would.

A

You like to share, or um should we just do this.

B

A

Yeah, I think it.

B

Would be easier.

A

If you share the board as you're doing it, try to put you on the spot and thank you.

B

No, that's, okay. uh I think I'm sharing the right screen yeah this one right. Can you see, can you see my screen.

C

Yes, that's good.

B

Okay, so I think I'm uh going through this, the ready for development.

A

Yes, and if you see patterns- or you know like all, four of these issues are in one epic, you don't necessarily need to talk about all of them and I don't think you need to click into them and like go into great detail either. This is more of a high level hey. This is what we're working on.

B

Okay, so it seems like we are working on, add ability to search instance, security, dashboard projects, graphql query, um so we are at a blocker for a.

A

Front-End issue just to call out try to interrupt you sebastian.

B

Yeah sure, please edge.

A

Daniel's been working on some updates for our project filter and we identified some need for updates to the graphql query that this was. I mean yeah.

B

Should I go for the next one? Ignore the unnecessary columns from the security findings table seems like um an easy one like and perform audit identity and address underperforming. Sql queries, um some sql queries, that's needs some attention, I don't know, is the it's refined right. So maybe we had all the sql queries. We just need to audit them.

B

Please add if, if you want to add some other information, clean up vulnerabilities with missing findings, okay, I think there are some missing findings that has vulnerabilities entry. We need to clean those up. I think.

D

um Just just the question here um the vulnerabilities are uh so there is a one one to one relationship with the with the findings right. um So how come that we generate vulnerabilities? If there are no findings, do we know this?

D

C

um We shouldn't um that. That's uh that's why we have to clean them up, uh because we should not be um creating vulnerabilities with the missing finding.

D

But yeah that's the question. So if um maybe does this uh issue also tackle with with the root cause of this, because we shouldn't have vulnerabilities if we don't have findings so clearly somewhere in the code, we have something that generates vulnerabilities that have no findings right.

C

um uh Oh okay, so yeah so this is this is a follow-on from um a bug that we had fixed.

B

A couple weeks.

C

Back, uh where yeah, where it was.

C

He was looking for. Let's see, he was trying to find findings.

B

And fix the bug, um I think it's it was for csv, not loading because of the missing vulnerability as missing findings or something you fixed that jonathan.

C

Well, it was, it was looking for. It was trying to pull data for findings that weren't there and it was throwing an error. um I think what was creating the vulnerabilities without the findings has also been uh fixed.

C

E

A

Just curious, yeah add a comment to the issue. If you want to confirm savash, uh sorry lindsey, you should feel free to add a comment to the issue asking that question. If you'd like to confirm yeah.

C

We and we can and yeah we should. We should confirm and that's a good point. We should confirm that and everything is we are not still creating vulnerabilities without findings. Yeah.

B

I agree we need some constraint there.

F

So question, though, what's going to happen when we do or finish the manual vulnerability creation where you can create a record directly against a project, it won't have a finding because, by definition, you're just entering in manual data.

C

It's going to have to have a finding vulnerability is pretty much required to have a finding. Vulnerability is required to have a finding for it to be a valid vulnerability.

F

So then, that'll that'll, just like be behind the scenes directly against. I guess the default branch for that project.

E

Right: okay, cool.

C

Okay, and and along those same lines, I think I mentioned before, is like we're: gonna have to figure out like because a finding has to have a pipeline, and so we're gonna have to figure out how to the vulnerability has to have a finding a binding has to have a pipeline. But if it's manually created, it's not gonna have a pipeline, so we're gonna have to deal with that. A little idiosyncrasy.

E

As well, probably in the ux we should like and then the vulnerability.

D

Creation page, we should just specify that first, you need to run a pipeline and the pipeline.

B

D

Find findings, and only then you can create manual, vulnerable keys, well,.

C

That's the thing is that we want to be able to create vulnerabilities without having to run a pipeline that they can just put in there. So we need to be able to. We pretty much need to be able to create a vulnerability. A manual vulnerability without a pipeline run.

D

Which, today is not possible right because you need to have it right.

C

Right today, yeah today, it's it's not possible, um so we have to work that out.

A

And that epic is still in planning breakdown with the back end to probably work out some of these details right now,.

C

E

A

Let's keep moving.

B

Okay, uh the next one is uh restrict vulnerability pages for reporter and below. I think there is some leaking going on. The vulnerability pages are shown to um not expected users or something so we need to restrict um then and.

A

Just to call us that's a security issue, that's passed our sla, so I would you know I'll talk to thiago, but I'd love to see that pulled up in priority. We shouldn't let security issues go two months past their due date.

A

Sure, okay, sorry.

B

No, no thanks uh created issue. Feedback does not show on pipeline security. Tab created issue feedback, yep, okay,.

B

Discover project security link is not visible in sidebar uh discover project security. I have I don't it's not. I think it's.

D

B

On the sidewalk link.

D

Yeah, the sidebar- I think it uh needs to contain a discover uh project security link, which is not visible right now. um I had hard time to to show it. I remember that I used to work on something related.

B

Okay, no method, error, undefined method configured to create issue from vulnerabilities for nil class must be something that's missing. We need to check or something.

B

Last updated on the security dashboard does not seem to link to a successful pipeline all the time.

B

A

Which is a new feature that we'd added and a bug that came out of that? That only happens sporadically.

B

Okay, last updated on the security dashboard populate a new issue from vulnerability finding do we. We have that right right now,.

C

uh These, no um that one is actually that one it was block. I had that one in my backlog or in my in my list of issues for a while, while we were trying to get some other issues that was blocking that um that one finally came unblocked, but I was also in the middle of doing some other things. So that's why it's back in the list.

B

Thanks thanks introduce uh present on default branch boolean to vulnerability model. I think it came from the discussions. That's to get rid of the feedback model or something.

B

Remove always uh now kills from vulnerabilities okay.

B

um What? What does it mean? Remove always knowledge from vulnerabilities? It's is it the entry of the fields, yeah.

C

There's certain fields and vulnerabilities that we're always going to be know that we never populate with anything they were put in there. Thinking hey we're going to do something with this later, but we never did, and so we just need to yank those fields out.

B

Okay, so it's unused kids, okay, right, use, vulnerability, external issuing, create mutation for creating a jira on vulnerability, details page. It's pretty slightly explained.

D

um Sorry, regarding the one above are we going to remove those fields from the from the database? Yes, yes, okay, so this may also have uh front-end changes if we're pulling those fields in graphql.

B

Or it sounds like we are not using those right. Yes, I don't know that details.

D

Okay, so there's a list here: okay, okay, I can check. I can check.

B

Later so, it seems like we need to create a mutation for jira issue for vandalism, details page.

B

Enable migration create table with foreign.

B

Weights right, I'm just curious like what.

B

So, are we talking about uh um adding a robocop room for migration or something.

B

Another migration creator- okay, we can check later um include additional information in binary report. Export date detected and location. Two more fields seems like straightforward and enable jira for vulnerabilities feature flag activity activity, filter on vulnerability report, close error in group level, dashboard.

B

And benchmark current db calls for which pages.

C

So that one, that one is um specifically to figure out where our major slowdowns are coming from the vulnerability finder. Well, it's in the vulnerability thing then I listed all the ones to check the the queries. The scopes.

C

B

So it's like these are the issues for ready for development and.

A

B

A

One right there that uh that you just had the go up a little bit. Sorry, the jira one is actually a mislabeled front, end issue, so someone on node- uh oh you already.

A

It was the use, vulnerability, external issue, link creation mutation for creating issue on vulnerability, details page the really catchy titled one was is a front-end issue that was created. The the graphql endpoint already exists and we're just not using it yet on the details page, and so it looks like yannick from neil's team has already picked it up. It was a list identified of work that if they had bandwidth, they could grab and work on in the next couple milestones. So I'm correcting that right now.

A

So anyone on the back end team, who is curious about that one, ignore it it's going to move to a front-end issue right now,.

B

Okay, thanks thanks are we also discussing uh blocked issues as well.

A

I think it's good to just call them out, so we know what they're blocked on.

B

Okay uh findings evidence details.

B

Adds extra fees to the evidence, fields of the security report schema it's blocked by new borders for findings, evidence, okay and create mutation, to support vulnerability, feedback creation.

C

As a node, I am working on that new model for the findings. Evidence right now, so that's in progress, and it should be hopefully done early next week, nice.

B

Thank you thanks jonathan, so the next issue is blocked is create mutation, to support vulnerability, feedback creation, okay,.

A

I'll call out to thiago that this is blocked on an issue. That's in a future milestone, so that'll make it hard to address this milestone. We can correct that async, though.

B

Okay, yeah it's for 14 months.

A

A

In the future, we should probably make sure either we don't have a lot of items waiting and refinement when we do this conversation or that we have time, I I don't think we have time to go through the refinement issues right now, if we're gonna talk about the front-end issues and there's one other item on the agenda, but if everyone can make sure that if you have something assigned to you in refinement, 4 13 12 that you prioritize that and try and get it completed in the next couple of days, that would be helpful.

G

A

Can you do the same for us for the front end, hey mihal or should I say, mr president,.

D

um Is it this one? It's yes, exactly! um Okay, so here are the front-end issues. um Basically they we just been. We just went through these with uh linsei, so I know that they're grouped the first ones, for instance, are grouped by the pipeline, so this is uh regarding migrating. The pipeline security to graphql, so this use graphql enables this for pipeline security tab and then use vulnerable details component for pipeline security, tab vulnerabilities model.

D

um So basically this one is just using the vulnerability details page inside the the model that appears in the pipeline, and there is yeah. We need to enable the feature flag here on top um and then we have use onvolume with the details. Page uh change fetching a vulnerability to graphql um fetching your phone, oh yeah, right now. This is this- is injected to dom. uh We need to change that to graphql um and then, as part of the cleanup, since we will be uh removing the so we will be migrating to graphql.

D

We can remove the view x uh version of the vulnerability list. As a cleanup, then we have the feature flag, uh removing the we're just enabling the feature flag for every user. uh I guess.

A

It's already up there and defaulted to on it's just a matter of removing the code around it. Now that we're confident with that integration.

F

D

um So it's regarding that one and then we, the couple of uh we have a few issues regarding the gener generic report schema. um All of these are uh basically creating new components. So, for instance, this one is creating a table uh component for the generic report schema. This one is creating the value type so which which will display a string in integer or boolean, um and then we have the markdown.

A

D

To add the rest.

A

Of those components we broke them down, one issue for each uh data type, the rest are in refinement and they're all very small. So the hope is that they'll all still fit in 1312 once the refinement is done.

D

um And then we have a couple of bugs, so this one is basically um error when loading results showing in the my files scanning is in progress, but displays correctly when pipeline completes. The title is, I think, it's pretty uh explanatory, and then we have. This can't dismiss vulnerability from mr widget.

A

Which may go away? You know that bottom one once we do the work around converting the pipeline modal to use all of the shared endpoints and components that final bug might just be fixed by the time we get to it. Here's how that's true.

D

And then we have uh what three of them of these issues are blocked, um but they're all blocked, because the the the back end counterparts are. uh They still need to be implemented. So as soon as the back-end is implemented, we should be able to um work on these features.

D

C

D

This one is blocked because yeah first, we need to implement the migration.

A

I don't think we're very consistent about our blocked, workflow state versus blocked. uh You know if something's blocked by an issue there, you know just call that out, but thank you savage. I don't. uh I hope that that was helpful for everyone to understand what we're working on coming into 1312.

A

we're going to do this also for container security, and our goal is to have this conversation once at the beginning of each milestone, hopefully over time, it'll get a little more natural and quicker and won't take up the whole meeting. But we appreciate you guys going through that.

C

Real quick, so you say so: there's the so I'm trying to so there's the work. There's the blocked flag and the blocked workflow state right.

A

C

Of those need to be turned set to on or or which one's the important one it's.

A

A good question- and I think we should decide that as a group and I'm not sure what the correct answer is. So I don't know what you I think it might be both to be honest with you. If you just put something in the blocked column, and you don't say what it's blocked by that's not very helpful.

A

If you put a blocker on the issue like say, this is blocked by issue one two, three at least the person will see that, but they have to click into it and probably grab it before they see that they might miss it. So I I kind of want to say both. It feels a little redundant and like extra work. But what do you guys think.

C

I mean I mean we have to have the issue in there. We have to have, I think, putting in the workflow keeps things tracked. I don't know what the blocked flag does like that, the red flag, it says, blocked off. That's just.

A

When you, when you associate an issue as blocked by and the.

C

Problem would be even once.

A

That issue is closed. It still shows that little circle, so you say I'm blocked on issue one two: three: it's gonna immediately show that you know indicator on the issue board, but then, when issue one two three gets closed. That indicator still shows there. There's no visual indicator that that blocking issue is now resolved either. So it would be a nice product enhancement.

C

So I mean: does that mean that we need to move them from like manually, move them from blocked to linked issue.

A

C

Haven't done that on occasion.

A

Just when I was.

C

A

That it wouldn't be clear to the person that was looking at it. So that's a good question and I don't know if we should make that part of our process or just assume that, once if we did both once it's blocked right, if we both put the workflow state on and the blocker, we would eventually just start to ignore that visual indicator of something being blocked once it's in the ready for dev column, because you wouldn't move it back to ready for dev until the blocked issue was resolved. The manual.

B

A

Of this is kind of a pain, but honestly it should be, for you know I don't know so far.

C

A

And I have been doing it, but we should. We should find a better way to improve the instruction around that process so that everybody knows what to do when they see that happen.

C

I've tried to move them from block to link just so it gets rid of that blocked like so that there's it doesn't show it's blocked by something, because it's no longer blocked. You know and it'd be nice if it automatically went and the workflow as well as soon as that issue's closed, then it you know, moves out of the block by column or the little icon removes.

A

Yeah one of the two I mean it almost feels like either would work um I'm going to take a minute this morning and see if I can find an issue that exists around that jonathan, because I feel like this is something we've talked about quite a bit.

C

I'll put it in the retrospective too: oh.

A

Good idea, thank you. Yes, yes,.

C

I got okay got my contribution, I'm done with the retro.

A

All right, the last item is on the agenda, is from savage savage. Do you want to talk about your needs and back and help.

D

Yeah um so since we still have a couple of minutes, I think I can uh share my screen and then describe the problem that I was going through today. um So basically, I'm working on this, um not this one, but this one, this one. So I'm implementing. Okay, I'm just gonna- hold on move this zoom bar somewhere else. So I can see um so I'm just adding the the dismissal reason to the vulnerability uh details page I did that it works um and, as you can see here, the vulnerability object receives the dismissal feedback.

D

It took me a while to figure out the backend data structure, but I thanks to john, I was able to figure out that the dismissive reason is inside the dismissal feedback object um and it just shows pops here, but the problem is with with graphql. So when, when I change this um the status and then I change it back to dismissive reason, we're here we're using graphql to fetch the new version, and I was not able to populate that field using graphql.

D

So this is one part where I need help with the backend and the second one is when I dismiss it. um The dismissal reason doesn't seem to populate it's always nil. I had to go to the database and then manually change the field in order to get this false positive here. So this is, I think this could be a bug, or um maybe I don't know how to populate that using the ui.

C

um This is the second part, so we don't have feedback for confirm.

C

We were talking about getting.

B

C

The feedback and and replacing it.

G

Okay, just to quickly reiterate on what we have agreed upon. Okay, actually, we only have feedback feedback for like false positive.

G

If you dismiss, then you should get an ui option, at least that's what we wanted to implement at some point, when you dismiss, you should be able to set a reason for this missile and we have uh pre-made dismissal reasons and you should be able to set them, but I am not aware myself like where should they show up in the user interface, because I I'm currently working with translations for uh dismissal reasons and when you're actually dismissing a vulnerability, you're creating a feedback using graphql?

G

So if you're creating a dismissal feedback like like you're creating right now, it's not going to populate any dismissal reason. So it's going to be empty.

D

Okay, so that's why I was not able- because I thought so somewhere here uh in the graphql- I see that we send um the comment. Okay, this is this one is yeah, so we we send the comment, but I assume this comment um is not the value that the beckham expects or.

D

G

Let me check it.

B

For dismissal reason, it's like uh pre-populated five uh dismissal descriptions that we are sending. I think we are exposing in the this page, which is not uh confined with um I. I don't think it's within the dismissal feedback. It's outside of yeah, these five reasons, yeah exactly.

D

So I I would need to send this these values uh when we dismiss actually uh right. I remember that we have an issue for the for this and then um in the front end to have a sub drop down here, which you can choose uh the the okay. So that's why it's not appearing right now: okay,.

A

I just shared the design issue for that savash, so that is work that we uh have upcoming.

G

The common field itself, uh I think it's getting populated, but we don't like expose it. So what you're.

B

Essentially, sending us here is just.

G

Yeah, that's a different thing. The dismissal reason itself should be populated once you send something in the uh dismissal reason argument to the graphql mutation.

B

I think we are also exposing comment. uh I think it's a it's a part of common details or something the details I can see. We are exposing a comment.

G

Okay, I see that that mutation itself also accepts comment.

B

D

I wasn't actually exposing one.

G

Yeah yeah, okay,.

D

It's this one, okay, because I remember that we had the comment uh payload uh beforehand, but then we added this piece of reason and I just remember some conversation around uh having both of them, which basically uh is doing the same thing so kind of uh a backward comp compatibility.

D

I think, uh but maybe I was wrong, okay, so now it's it's all clear, um but I still need help uh from a backender to generate this field in graphql.

D

So if someone is willing to help me out afterwards I'll be happy.

G

uh Which field are you talking about because, like I lost track of it at some point, uh the dismissal reason this one dismissal reason will get populated once you send something as a dismissal reason.

D

As an imitation.

G

Yep, the mutation to dismiss the vulnerability accepts an argument called dismissal reason. Once you pass.

G

D

I need to fetch it afterwards.

D

We're using the get query, um but maybe we can continue this yeah.

G

We can continue yeah. I might be not clear on something here.

D

Okay, that was it thanks for the help.

A

How productive, what a great meeting you guys! Thank you very much we're at the end of our time, I'll share the recording for those who couldn't attend and I'll talk to you all soon. Thank.

C