chemlab 0.0.1

data/qa/ce/strategy.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module QA
+  module CE
+    module Strategy
+      extend self
+
+      def extend_autoloads!
+        # noop
+      end
+
+      def perform_before_hooks
+        # The login page could take some time to load the first time it is visited.
+        # We visit the login page and wait for it to properly load only once before the tests.
+        QA::Support::Retrier.retry_on_exception do
+          QA::Runtime::Browser.visit(:gitlab, QA::Page::Main::Login)
+        end
+      end
+    end
+  end
+end

data/qa/ee.rb

@@ -0,0 +1,234 @@
+# frozen_string_literal: true
+
+module QA
+  ##
+  # GitLab EE extensions
+  #
+  module EE
+    module Runtime
+      autoload :Env, 'qa/ee/runtime/env'
+      autoload :Geo, 'qa/ee/runtime/geo'
+      autoload :Saml, 'qa/ee/runtime/saml'
+    end
+
+    module Page
+      module Component
+        autoload :DesignManagement, 'qa/ee/page/component/design_management'
+        autoload :LicenseManagement, 'qa/ee/page/component/license_management'
+        autoload :SecureReport, 'qa/ee/page/component/secure_report'
+
+        module IssueBoard
+          autoload :Show, 'qa/ee/page/component/issue_board/show'
+        end
+
+        module WebIDE
+          autoload :WebTerminalPanel, 'qa/ee/page/component/web_ide/web_terminal_panel'
+        end
+      end
+
+      module Dashboard
+        autoload :Projects, 'qa/ee/page/dashboard/projects'
+      end
+
+      module Group
+        autoload :Menu, 'qa/ee/page/group/menu'
+        autoload :SamlSSOSignIn, 'qa/ee/page/group/saml_sso_sign_in'
+        autoload :SamlSSOSignUp, 'qa/ee/page/group/saml_sso_sign_up'
+        autoload :Members, 'qa/ee/page/group/members'
+        autoload :ContributionAnalytics, 'qa/ee/page/group/contribution_analytics'
+
+        module Settings
+          autoload :SamlSSO, 'qa/ee/page/group/settings/saml_sso'
+          autoload :LDAPSync, 'qa/ee/page/group/settings/ldap_sync'
+          autoload :General, 'qa/ee/page/group/settings/general'
+        end
+      end
+
+      module File
+        autoload :Show, 'qa/ee/page/file/show'
+      end
+
+      module Main
+        autoload :Banner, 'qa/ee/page/main/banner'
+      end
+
+      module Admin
+        autoload :Menu, 'qa/ee/page/admin/menu'
+        autoload :License, 'qa/ee/page/admin/license'
+
+        module Geo
+          module Nodes
+            autoload :Show, 'qa/ee/page/admin/geo/nodes/show'
+            autoload :New, 'qa/ee/page/admin/geo/nodes/new'
+          end
+        end
+
+        module Monitoring
+          autoload :AuditLog, 'qa/ee/page/admin/monitoring/audit_log.rb'
+        end
+
+        module Settings
+          autoload :Templates, 'qa/ee/page/admin/settings/templates'
+          autoload :Integration, 'qa/ee/page/admin/settings/integration'
+          autoload :Preferences, 'qa/ee/page/admin/settings/preferences'
+
+          module Component
+            autoload :Email, 'qa/ee/page/admin/settings/component/email'
+            autoload :Elasticsearch, 'qa/ee/page/admin/settings/component/elasticsearch'
+          end
+        end
+
+        module Overview
+          module Groups
+            autoload :Edit, 'qa/ee/page/admin/overview/groups/edit'
+          end
+        end
+      end
+
+      module Profile
+        autoload :Menu, 'qa/ee/page/profile/menu'
+      end
+
+      module Project
+        autoload :New, 'qa/ee/page/project/new'
+        autoload :Show, 'qa/ee/page/project/show'
+        autoload :Menu, 'qa/ee/page/project/menu'
+
+        module SubMenus
+          autoload :Packages, 'qa/ee/page/project/sub_menus/packages'
+          autoload :SecurityCompliance, 'qa/ee/page/project/sub_menus/security_compliance'
+          autoload :Repository, 'qa/ee/page/project/sub_menus/repository'
+          autoload :Settings, 'qa/ee/page/project/sub_menus/settings'
+          autoload :Project, 'qa/ee/page/project/sub_menus/project'
+        end
+
+        module Issue
+          autoload :Index, 'qa/ee/page/project/issue/index'
+          autoload :Show, 'qa/ee/page/project/issue/show'
+        end
+
+        module Wiki
+          autoload :Show, 'qa/ee/page/project/wiki/show'
+        end
+
+        module Milestone
+          autoload :Show, 'qa/ee/page/project/milestone/show'
+        end
+
+        module Settings
+          autoload :ProtectedBranches, 'qa/ee/page/project/settings/protected_branches'
+          autoload :MirroringRepositories, 'qa/ee/page/project/settings/mirroring_repositories'
+          autoload :MergeRequest, 'qa/ee/page/project/settings/merge_request'
+          autoload :Integrations, 'qa/ee/page/project/settings/integrations'
+          autoload :Repository, 'qa/ee/page/project/settings/repository'
+          autoload :PushRules, 'qa/ee/page/project/settings/push_rules'
+          autoload :CICD, 'qa/ee/page/project/settings/ci_cd.rb'
+          autoload :LicenseCompliance, 'qa/ee/page/project/settings/license_compliance.rb'
+
+          module Services
+            autoload :Jenkins, 'qa/ee/page/project/settings/services/jenkins'
+          end
+        end
+
+        module Operations
+          module Kubernetes
+            autoload :Show, 'qa/ee/page/project/operations/kubernetes/show'
+          end
+
+          module Metrics
+            autoload :Show, 'qa/ee/page/project/operations/metrics/show'
+          end
+        end
+
+        module Packages
+          autoload :Index, 'qa/ee/page/project/packages/index'
+          autoload :Show, 'qa/ee/page/project/packages/show'
+        end
+
+        module Pipeline
+          autoload :Show, 'qa/ee/page/project/pipeline/show'
+        end
+
+        module Secure
+          autoload :Show, 'qa/ee/page/project/secure/show'
+          autoload :DependencyList, 'qa/ee/page/project/secure/dependency_list'
+        end
+
+        module PathLocks
+          autoload :Index, 'qa/ee/page/project/path_locks/index'
+        end
+      end
+
+      module MergeRequest
+        autoload :New, 'qa/ee/page/merge_request/new'
+        autoload :Show, 'qa/ee/page/merge_request/show'
+      end
+
+      module Group
+        autoload :IssuesAnalytics, 'qa/ee/page/group/issues_analytics'
+        autoload :Roadmap, 'qa/ee/page/group/roadmap'
+
+        module Epic
+          autoload :Index, 'qa/ee/page/group/epic/index'
+          autoload :Show, 'qa/ee/page/group/epic/show'
+        end
+
+        module Secure
+          autoload :Show, 'qa/ee/page/group/secure/show'
+        end
+      end
+
+      module Insights
+        autoload :Show, 'qa/ee/page/insights/show'
+      end
+    end
+
+    module Resource
+      autoload :License, 'qa/ee/resource/license'
+      autoload :Epic, 'qa/ee/resource/epic'
+      autoload :ProjectMilestone, 'qa/ee/resource/project_milestone'
+      autoload :GroupLabel, 'qa/ee/resource/group_label.rb'
+
+      module Board
+        autoload :BaseBoard, 'qa/ee/resource/board/base_board'
+        autoload :GroupBoard, 'qa/ee/resource/board/group_board'
+        autoload :ProjectBoard, 'qa/ee/resource/board/project_board'
+
+        module BoardList
+          module Group
+            autoload :BoardList, 'qa/ee/resource/board/board_list/group/board_list'
+          end
+
+          module Project
+            autoload :BaseBoardList, 'qa/ee/resource/board/board_list/project/base_board_list'
+            autoload :AssigneeBoardList, 'qa/ee/resource/board/board_list/project/assignee_board_list'
+            autoload :LabelBoardList, 'qa/ee/resource/board/board_list/project/label_board_list'
+            autoload :MilestoneBoardList, 'qa/ee/resource/board/board_list/project/milestone_board_list'
+          end
+        end
+      end
+
+      module Geo
+        autoload :Node, 'qa/ee/resource/geo/node'
+      end
+
+      module Settings
+        autoload :Elasticsearch, 'qa/ee/resource/settings/elasticsearch'
+      end
+    end
+
+    module Scenario
+      module Test
+        autoload :Geo, 'qa/ee/scenario/test/geo'
+        module Integration
+          autoload :GroupSAML, 'qa/ee/scenario/test/integration/group_saml'
+          autoload :Elasticsearch, 'qa/ee/scenario/test/integration/elasticsearch'
+        end
+
+        module Sanity
+          autoload :Selectors, 'qa/ee/scenario/test/sanity/selectors'
+        end
+      end
+    end
+  end
+end

data/qa/ee/fixtures/secure_license_files/.gitlab-ci.yml

@@ -0,0 +1,12 @@
+include:
+  template: License-Management.gitlab-ci.yml
+
+license_management:
+  tags:
+    - qa
+    - test
+  script:
+    - echo "Skipped"
+  artifacts:
+    reports:
+      license_management: gl-license-management-report.json

data/qa/ee/fixtures/secure_license_files/gl-license-management-report.json

@@ -0,0 +1,24 @@
+{
+  "licenses": [
+    {
+      "count": 1,
+      "name": "WTFPL"
+    }
+  ],
+  "dependencies": [
+    {
+      "license": {
+          "name": "WTFPL",
+          "url": "http://www.wtfpl.net/"
+      },
+      "dependency": {
+          "name": "wtfpl_init",
+          "url": "https://rubygems.org/gems/wtfpl_init",
+          "description": "Download WTFPL license file and rename to LICENSE.md or something",
+          "paths": [
+              "."
+          ]
+      }
+    }
+  ]
+}

data/qa/ee/fixtures/secure_premade_reports/.gitlab-ci.yml

@@ -0,0 +1,61 @@
+include:
+  template: Dependency-Scanning.gitlab-ci.yml
+  template: Container-Scanning.gitlab-ci.yml
+  template: SAST.gitlab-ci.yml
+  template: DAST.gitlab-ci.yml
+  template: License-Management.gitlab-ci.yml
+
+dependency_scanning:
+  tags:
+    - qa
+    - test
+  script:
+    - echo "Skipped"
+  artifacts:
+    reports:
+      dependency_scanning: gl-dependency-scanning-report.json
+
+container_scanning:
+  tags:
+    - qa
+    - test
+  only: null # Template defaults to feature branches only
+  variables:
+    GIT_STRATEGY: fetch # Template defaults to none, which stops fetching the premade report
+  script:
+    - echo "Skipped"
+  artifacts:
+    reports:
+      container_scanning: gl-container-scanning-report.json
+
+sast:
+  tags:
+    - qa
+    - test
+  only: null # Template defaults to feature branches only
+  script:
+    - echo "Skipped"
+  artifacts:
+    reports:
+      sast: gl-sast-report.json
+
+dast:
+  tags:
+    - qa
+    - test
+  only: null # Template defaults to feature branches only
+  script:
+    - echo "Skipped"
+  artifacts:
+    reports:
+      dast: gl-dast-report.json
+
+license_management:
+  tags:
+    - qa
+    - test
+  script:
+    - echo "Skipped"
+  artifacts:
+    reports:
+      license_management: gl-license-management-report.json

data/qa/ee/fixtures/secure_premade_reports/gl-container-scanning-report.json

@@ -0,0 +1,105 @@
+{
+  "image": "registry.gitlab.com/groulot/container-scanning-test/master:5f21de6956aee99ddb68ae49498662d9872f50ff",
+  "unapproved": [
+    "CVE-2017-18269",
+    "CVE-2017-16997",
+    "CVE-2018-1000001",
+    "CVE-2016-10228",
+    "CVE-2018-18520",
+    "CVE-2010-4052",
+    "CVE-2018-16869",
+    "CVE-2018-18311"
+  ],
+  "vulnerabilities": [
+    {
+      "featurename": "glibc",
+      "featureversion": "2.24-11+deb9u3",
+      "vulnerability": "CVE-2017-18269",
+      "namespace": "debian:9",
+      "description": "SSE2-optimized memmove implementation problem.",
+      "link": "https://security-tracker.debian.org/tracker/CVE-2017-18269",
+      "severity": "Defcon1",
+      "fixedby": "2.24-11+deb9u4"
+    },
+    {
+      "featurename": "glibc",
+      "featureversion": "2.24-11+deb9u3",
+      "vulnerability": "CVE-2017-16997",
+      "namespace": "debian:9",
+      "description": "elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the \"./\" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.",
+      "link": "https://security-tracker.debian.org/tracker/CVE-2017-16997",
+      "severity": "Critical",
+      "fixedby": ""
+    },
+    {
+      "featurename": "glibc",
+      "featureversion": "2.24-11+deb9u3",
+      "vulnerability": "CVE-2018-1000001",
+      "namespace": "debian:9",
+      "description": "In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.",
+      "link": "https://security-tracker.debian.org/tracker/CVE-2018-1000001",
+      "severity": "High",
+      "fixedby": ""
+    },
+    {
+      "featurename": "glibc",
+      "featureversion": "2.24-11+deb9u3",
+      "vulnerability": "CVE-2016-10228",
+      "namespace": "debian:9",
+      "description": "The iconv program in the GNU C Library (aka glibc or libc6) 2.25 and earlier, when invoked with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.",
+      "link": "https://security-tracker.debian.org/tracker/CVE-2016-10228",
+      "severity": "Medium",
+      "fixedby": ""
+    },
+    {
+      "featurename": "elfutils",
+      "featureversion": "0.168-1",
+      "vulnerability": "CVE-2018-18520",
+      "namespace": "debian:9",
+      "description": "An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.",
+      "link": "https://security-tracker.debian.org/tracker/CVE-2018-18520",
+      "severity": "Low",
+      "fixedby": ""
+    },
+    {
+      "featurename": "glibc",
+      "featureversion": "2.24-11+deb9u3",
+      "vulnerability": "CVE-2010-4052",
+      "namespace": "debian:9",
+      "description": "Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.",
+      "link": "https://security-tracker.debian.org/tracker/CVE-2010-4052",
+      "severity": "Negligible",
+      "fixedby": ""
+    },
+    {
+      "featurename": "nettle",
+      "featureversion": "3.3-1",
+      "vulnerability": "CVE-2018-16869",
+      "namespace": "debian:9",
+      "description": "A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.",
+      "link": "https://security-tracker.debian.org/tracker/CVE-2018-16869",
+      "severity": "Unknown",
+      "fixedby": ""
+    },
+    {
+      "featurename": "perl",
+      "featureversion": "5.24.1-3+deb9u4",
+      "vulnerability": "CVE-2018-18311",
+      "namespace": "debian:9",
+      "description": "Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.",
+      "link": "https://security-tracker.debian.org/tracker/CVE-2018-18311",
+      "severity": "Unknown",
+      "fixedby": "5.24.1-3+deb9u5"
+    },
+    {
+      "featurename": "foo",
+      "featureversion": "1.3",
+      "vulnerability": "CVE-2018-666",
+      "namespace": "debian:9",
+      "description": "Foo has a vulnerability nobody cares about and whitelist.",
+      "link": "https://security-tracker.debian.org/tracker/CVE-2018-666",
+      "severity": "Unknown",
+      "fixedby": "1.4"
+    }
+  ]
+}