chemlab 0.0.1 → 0.1.0

data/qa/specs/features/ee/browser_ui/secure/license_compliance_spec.rb

@@ -1,98 +0,0 @@
-# frozen_string_literal: true
-
-require 'pathname'
-
-module QA
-  context 'Secure', :docker, :runner do
-    let(:approved_license_name) { "MIT" }
-    let(:denied_license_name) { "WTFPL" }
-
-    describe 'License Compliance settings page' do
-      before do
-        Flow::Login.sign_in
-
-        @project = Resource::Project.fabricate_via_api! do |project|
-          project.name = Runtime::Env.auto_devops_project_name || 'project-with-secure'
-          project.description = 'Project with Secure'
-        end
-
-        @project.visit!
-        Page::Project::Menu.perform(&:go_to_ci_cd_settings)
-        Page::Project::Settings::CICD.perform(&:expand_license_compliance)
-      end
-
-      it 'can approve a license in the settings page' do
-        QA::EE::Page::Project::Settings::LicenseCompliance.perform do |license_compliance|
-          license_compliance.approve_license approved_license_name
-
-          expect(license_compliance).to have_approved_license approved_license_name
-        end
-      end
-
-      it 'can deny a license in the settings page' do
-        QA::EE::Page::Project::Settings::LicenseCompliance.perform do |license_compliance|
-          license_compliance.deny_license denied_license_name
-
-          expect(license_compliance).to have_denied_license denied_license_name
-        end
-      end
-    end
-
-    describe 'License Compliance pipeline reports' do
-      let(:number_of_licenses_in_fixture) { 2 }
-
-      after do
-        @runner.remove_via_api!
-      end
-
-      before do
-        @executor = "qa-runner-#{Time.now.to_i}"
-
-        Flow::Login.sign_in
-
-        @project = Resource::Project.fabricate_via_api! do |project|
-          project.name = Runtime::Env.auto_devops_project_name || 'project-with-secure'
-          project.description = 'Project with Secure'
-        end
-
-        @runner = Resource::Runner.fabricate! do |runner|
-          runner.project = @project
-          runner.name = @executor
-          runner.tags = %w[qa test]
-        end
-
-        # Push fixture to generate Secure reports
-        Resource::Repository::ProjectPush.fabricate! do |project_push|
-          project_push.project = @project
-          project_push.directory = Pathname
-            .new(__dir__)
-            .join('../../../../../ee/fixtures/secure_premade_reports')
-          project_push.commit_message = 'Create Secure compatible application to serve premade reports'
-        end.project.visit!
-
-        Page::Project::Menu.perform(&:go_to_ci_cd_settings)
-        Page::Project::Settings::CICD.perform(&:expand_license_compliance)
-        QA::EE::Page::Project::Settings::LicenseCompliance.perform do |license_compliance|
-          license_compliance.approve_license approved_license_name
-          license_compliance.deny_license denied_license_name
-        end
-
-        Page::Project::Menu.perform(&:click_ci_cd_pipelines)
-        Page::Project::Pipeline::Index.perform(&:wait_for_latest_pipeline_success)
-      end
-
-      it 'displays license approval status in the pipeline' do
-        Page::Project::Menu.perform(&:click_ci_cd_pipelines)
-        Page::Project::Pipeline::Index.perform(&:click_on_latest_pipeline)
-
-        Page::Project::Pipeline::Show.perform do |pipeline|
-          pipeline.click_on_licenses
-
-          expect(pipeline).to have_license_count_of number_of_licenses_in_fixture
-          expect(pipeline).to have_approved_license approved_license_name
-          expect(pipeline).to have_blacklisted_license denied_license_name
-        end
-      end
-    end
-  end
-end

data/qa/specs/features/ee/browser_ui/secure/merge_request_license_widget_spec.rb

@@ -1,134 +0,0 @@
-# frozen_string_literal: true
-
-require 'pathname'
-
-module QA
-  context 'Secure', :docker, :runner do
-    describe 'License merge request widget' do
-      let(:approved_license_name) { "MIT" }
-      let(:blacklisted_license_name) { "Zlib" }
-      let(:executor) {"qa-runner-#{Time.now.to_i}"}
-
-      after do
-        @runner.remove_via_api!
-      end
-
-      before do
-        Flow::Login.sign_in
-
-        @project = Resource::Project.fabricate_via_api! do |project|
-          project.name = 'license-widget-project'
-          project.description = 'License widget test'
-        end
-
-        @runner = Resource::Runner.fabricate! do |runner|
-          runner.project = @project
-          runner.name = executor
-          runner.tags = %w[qa test]
-        end
-
-        Resource::Repository::ProjectPush.fabricate! do |project_push|
-          project_push.project = @project
-          project_push.directory = Pathname
-            .new(__dir__)
-            .join('../../../../../ee/fixtures/secure_license_files')
-          project_push.commit_message = 'Create license file'
-        end
-
-        @project.visit!
-        Page::Project::Menu.perform(&:click_ci_cd_pipelines)
-        Page::Project::Pipeline::Index.perform(&:wait_for_latest_pipeline_success)
-
-        @merge_request = Resource::MergeRequest.fabricate_via_api! do |mr|
-          mr.project = @project
-          mr.source_branch = 'license-management-mr'
-          mr.target_branch = 'master'
-          mr.target = 'master'
-          mr.file_name = 'gl-license-management-report.json'
-          mr.file_content =
-            <<~FILE_UPDATE
-            {
-              "licenses": [
-                {
-                  "count": 1,
-                  "name": "WTFPL"
-                },
-                {
-                  "count": 1,
-                  "name": "MIT"
-                },
-                {
-                  "count": 1,
-                  "name": "Zlib"
-                }
-              ],
-              "dependencies": [
-                {
-                  "license": {
-                      "name": "MIT",
-                      "url": "http://opensource.org/licenses/mit-license"
-                  },
-                  "dependency": {
-                      "name": "actioncable",
-                      "url": "http://rubyonrails.org",
-                      "description": "WebSocket framework for Rails.",
-                      "paths": [
-                          "."
-                      ]
-                  }
-                },
-                {
-                  "license": {
-                      "name": "WTFPL",
-                      "url": "http://www.wtfpl.net/"
-                  },
-                  "dependency": {
-                      "name": "wtfpl_init",
-                      "url": "https://rubygems.org/gems/wtfpl_init",
-                      "description": "Download WTFPL license file and rename to LICENSE.md or something",
-                      "paths": [
-                          "."
-                      ]
-                  }
-                },
-                {
-                  "license": {
-                      "name": "Zlib",
-                      "url": "https://www.zlib.net/"
-                  },
-                  "dependency": {
-                      "name": "zlib",
-                      "url": "https://www.zlib.net/",
-                      "description": "Ruby interface for the zlib compression/decompression library",
-                      "paths": [
-                          "."
-                      ]
-                  }
-                }
-              ]
-            }
-            FILE_UPDATE
-          mr.target_new_branch = false
-        end
-
-        @project.visit!
-        Page::Project::Menu.perform(&:click_ci_cd_pipelines)
-        Page::Project::Pipeline::Index.perform(&:wait_for_latest_pipeline_success)
-      end
-
-      it 'manage licenses from the merge request' do
-        @merge_request.visit!
-
-        Page::MergeRequest::Show.perform do |show|
-          show.approve_license_with_mr(approved_license_name)
-          show.blacklist_license_with_mr(blacklisted_license_name)
-
-          show.wait_for_license_compliance_report
-
-          expect(show).to have_approved_license approved_license_name
-          expect(show).to have_blacklisted_license blacklisted_license_name
-        end
-      end
-    end
-  end
-end

data/qa/specs/features/ee/browser_ui/secure/security_reports_spec.rb

@@ -1,143 +0,0 @@
-# frozen_string_literal: true
-
-require 'pathname'
-
-module QA
-  context 'Secure', :docker, :runner, quarantine: { issue: 'https://gitlab.com/gitlab-org/gitlab/-/issues/213676', type: :investigating } do
-    let(:number_of_dependencies_in_fixture) { 7 }
-    let(:dependency_scan_example_vuln) { 'Prototype pollution attack in mixin-deep' }
-    let(:container_scan_example_vuln) { 'CVE-2017-18269 in glibc' }
-    let(:sast_scan_example_vuln) { 'Cipher with no integrity' }
-    let(:dast_scan_example_vuln) { 'Cookie Without SameSite Attribute' }
-
-    describe 'Security Reports' do
-      after(:all) do
-        @runner.remove_via_api!
-      end
-
-      before(:all) do
-        @executor = "qa-runner-#{Time.now.to_i}"
-
-        Flow::Login.sign_in
-
-        @project = Resource::Project.fabricate_via_api! do |p|
-          p.name = Runtime::Env.auto_devops_project_name || 'project-with-secure'
-          p.description = 'Project with Secure'
-        end
-
-        @runner = Resource::Runner.fabricate! do |runner|
-          runner.project = @project
-          runner.name = @executor
-          runner.tags = %w[qa test]
-        end
-
-        # Push fixture to generate Secure reports
-        Resource::Repository::ProjectPush.fabricate! do |push|
-          push.project = @project
-          push.directory = Pathname
-            .new(__dir__)
-            .join('../../../../../ee/fixtures/secure_premade_reports')
-          push.commit_message = 'Create Secure compatible application to serve premade reports'
-        end.project.visit!
-
-        Page::Project::Menu.perform(&:click_ci_cd_pipelines)
-        Page::Project::Pipeline::Index.perform(&:wait_for_latest_pipeline_success)
-      end
-
-      before do
-        Flow::Login.sign_in_unless_signed_in
-        @project.visit!
-      end
-
-      it 'displays security reports in the pipeline' do
-        Page::Project::Menu.perform(&:click_ci_cd_pipelines)
-        Page::Project::Pipeline::Index.perform(&:click_on_latest_pipeline)
-
-        Page::Project::Pipeline::Show.perform do |pipeline|
-          pipeline.click_on_security
-
-          filter_report_and_perform(pipeline, "Dependency Scanning") do
-            expect(pipeline).to have_vulnerability dependency_scan_example_vuln
-          end
-
-          filter_report_and_perform(pipeline, "Container Scanning") do
-            expect(pipeline).to have_vulnerability container_scan_example_vuln
-          end
-
-          filter_report_and_perform(pipeline, "SAST") do
-            expect(pipeline).to have_vulnerability sast_scan_example_vuln
-          end
-
-          filter_report_and_perform(pipeline, "DAST") do
-            expect(pipeline).to have_vulnerability dast_scan_example_vuln
-          end
-        end
-      end
-
-      it 'displays security reports in the project security dashboard' do
-        Page::Project::Menu.perform(&:click_project)
-        Page::Project::Menu.perform(&:click_on_security_dashboard)
-
-        EE::Page::Project::Secure::Show.perform do |dashboard|
-          filter_report_and_perform(dashboard, "Dependency Scanning") do
-            expect(dashboard).to have_vulnerability dependency_scan_example_vuln
-          end
-
-          filter_report_and_perform(dashboard, "Container Scanning") do
-            expect(dashboard).to have_vulnerability container_scan_example_vuln
-          end
-
-          filter_report_and_perform(dashboard, "SAST") do
-            expect(dashboard).to have_vulnerability sast_scan_example_vuln
-          end
-
-          filter_report_and_perform(dashboard, "DAST") do
-            expect(dashboard).to have_vulnerability dast_scan_example_vuln
-          end
-        end
-      end
-
-      it 'displays security reports in the group security dashboard' do
-        Page::Main::Menu.perform(&:go_to_groups)
-        Page::Dashboard::Groups.perform do |groups|
-          groups.click_group @project.group.path
-        end
-        Page::Group::Menu.perform(&:click_group_security_link)
-
-        EE::Page::Group::Secure::Show.perform do |dashboard|
-          dashboard.filter_project(@project.name)
-
-          filter_report_and_perform(dashboard, "Dependency Scanning") do
-            expect(dashboard).to have_vulnerability dependency_scan_example_vuln
-          end
-
-          filter_report_and_perform(dashboard, "Container Scanning") do
-            expect(dashboard).to have_vulnerability container_scan_example_vuln
-          end
-
-          filter_report_and_perform(dashboard, "SAST") do
-            expect(dashboard).to have_vulnerability sast_scan_example_vuln
-          end
-
-          filter_report_and_perform(dashboard, "DAST") do
-            expect(dashboard).to have_vulnerability dast_scan_example_vuln
-          end
-        end
-      end
-
-      it 'displays the Dependency List' do
-        Page::Project::Menu.perform(&:click_on_dependency_list)
-
-        EE::Page::Project::Secure::DependencyList.perform do |dependency_list|
-          expect(dependency_list).to have_dependency_count_of number_of_dependencies_in_fixture
-        end
-      end
-    end
-
-    def filter_report_and_perform(page, report)
-      page.filter_report_type report
-      yield
-      page.filter_report_type report # Disable filter to avoid combining
-    end
-  end
-end

data/qa/specs/features/ee/browser_ui/secure/vulnerability_management_spec.rb

@@ -1,101 +0,0 @@
-# frozen_string_literal: true
-
-require 'pathname'
-
-module QA
-  context 'Secure', :docker, :runner do
-    describe 'Security Reports in a Merge Request' do
-      let(:sast_vuln_count) { 5 }
-      let(:dependency_scan_vuln_count) { 4 }
-      let(:container_scan_vuln_count) { 8 }
-      let(:vuln_name) { "Regular Expression Denial of Service in debug" }
-      let(:remediable_vuln_name) { "Authentication bypass via incorrect DOM traversal and canonicalization in saml2-js" }
-
-      after(:all) do
-        @runner.remove_via_api!
-
-        Runtime::Feature.enable('job_log_json') if @job_log_json_flag_enabled
-      end
-
-      before(:all) do
-        @executor = "qa-runner-#{Time.now.to_i}"
-
-        Flow::Login.sign_in
-
-        @project = Resource::Project.fabricate_via_api! do |p|
-          p.name = Runtime::Env.auto_devops_project_name || 'project-with-secure'
-          p.description = 'Project with Secure'
-          p.auto_devops_enabled = false
-          p.initialize_with_readme = true
-        end
-
-        @runner = Resource::Runner.fabricate! do |runner|
-          runner.project = @project
-          runner.name = @executor
-          runner.tags = %w[qa test]
-        end
-
-        # Push fixture to generate Secure reports
-        @source = Resource::Repository::ProjectPush.fabricate! do |push|
-          push.project = @project
-          push.directory = Pathname
-            .new(__dir__)
-            .join('../../../../../ee/fixtures/secure_premade_reports')
-          push.commit_message = 'Create Secure compatible application to serve premade reports'
-          push.branch_name = 'secure-mr'
-        end
-
-        @merge_request = Resource::MergeRequest.fabricate_via_api! do |mr|
-          mr.project = @project
-          mr.source_branch = 'secure-mr'
-          mr.target_branch = 'master'
-          mr.source = @source
-          mr.target = 'master'
-          mr.target_new_branch = false
-        end
-
-        @project.visit!
-        Page::Project::Menu.perform(&:click_ci_cd_pipelines)
-        Page::Project::Pipeline::Index.perform(&:wait_for_latest_pipeline_success)
-      end
-
-      before do
-        Flow::Login.sign_in_unless_signed_in
-        @merge_request.visit!
-      end
-
-      it 'can dismiss a vulnerability with a reason' do
-        dismiss_reason = "Vulnerability not applicable"
-
-        Page::MergeRequest::Show.perform do |merge_request|
-          expect(merge_request).to have_vulnerability_report
-          merge_request.dismiss_vulnerability_with_reason(vuln_name, dismiss_reason)
-          merge_request.click_vulnerability(vuln_name)
-
-          expect(merge_request).to have_opened_dismissed_vulnerability(dismiss_reason)
-        end
-      end
-
-      it 'can create an issue from a vulnerability' do
-        Page::MergeRequest::Show.perform do |merge_request|
-          expect(merge_request).to have_vulnerability_report
-          merge_request.create_vulnerability_issue(vuln_name)
-        end
-
-        Page::Project::Issue::Show.perform do |issue|
-          expect(issue).to have_title("Investigate vulnerability: #{vuln_name}")
-        end
-      end
-
-      it 'can create an auto-remediation MR' do
-        Page::MergeRequest::Show.perform do |merge_request|
-          expect(merge_request).to have_vulnerability_report
-          merge_request.resolve_vulnerability_with_mr remediable_vuln_name
-
-          # Context changes as resolve method creates new MR
-          expect(merge_request).to have_title remediable_vuln_name
-        end
-      end
-    end
-  end
-end