diff options
Diffstat (limited to 'spec/services/security/ci_configuration')
| -rw-r--r-- | spec/services/security/ci_configuration/sast_create_service_spec.rb | 69 | ||||
| -rw-r--r-- | spec/services/security/ci_configuration/sast_parser_service_spec.rb | 76 |
2 files changed, 145 insertions, 0 deletions
diff --git a/spec/services/security/ci_configuration/sast_create_service_spec.rb b/spec/services/security/ci_configuration/sast_create_service_spec.rb new file mode 100644 index 00000000000..ff7ab614e08 --- /dev/null +++ b/spec/services/security/ci_configuration/sast_create_service_spec.rb @@ -0,0 +1,69 @@ +# frozen_string_literal: true + +require 'spec_helper' + +RSpec.describe Security::CiConfiguration::SastCreateService, :snowplow do + describe '#execute' do + let_it_be(:project) { create(:project, :repository) } + let_it_be(:user) { create(:user) } + let(:params) { {} } + + subject(:result) { described_class.new(project, user, params).execute } + + context 'user does not belong to project' do + it 'returns an error status' do + expect(result[:status]).to eq(:error) + expect(result[:success_path]).to be_nil + end + + it 'does not track a snowplow event' do + subject + + expect_no_snowplow_event + end + end + + context 'user belongs to project' do + before do + project.add_developer(user) + end + + it 'does track the snowplow event' do + subject + + expect_snowplow_event( + category: 'Security::CiConfiguration::SastCreateService', + action: 'create', + label: 'false' + ) + end + + it 'raises exception if the user does not have permission to create a new branch' do + allow(project).to receive(:repository).and_raise(Gitlab::Git::PreReceiveError, "You are not allowed to create protected branches on this project.") + + expect { subject }.to raise_error(Gitlab::Git::PreReceiveError) + end + + context 'with no parameters' do + it 'returns the path to create a new merge request' do + expect(result[:status]).to eq(:success) + expect(result[:success_path]).to match(/#{Gitlab::Routing.url_helpers.project_new_merge_request_url(project, {})}(.*)description(.*)source_branch/) + end + end + + context 'with parameters' do + let(:params) do + { 'stage' => 'security', + 'SEARCH_MAX_DEPTH' => 1, + 'SECURE_ANALYZERS_PREFIX' => 'new_registry', + 'SAST_EXCLUDED_PATHS' => 'spec,docs' } + end + + it 'returns the path to create a new merge request' do + expect(result[:status]).to eq(:success) + expect(result[:success_path]).to match(/#{Gitlab::Routing.url_helpers.project_new_merge_request_url(project, {})}(.*)description(.*)source_branch/) + end + end + end + end +end diff --git a/spec/services/security/ci_configuration/sast_parser_service_spec.rb b/spec/services/security/ci_configuration/sast_parser_service_spec.rb new file mode 100644 index 00000000000..21490f993c7 --- /dev/null +++ b/spec/services/security/ci_configuration/sast_parser_service_spec.rb @@ -0,0 +1,76 @@ +# frozen_string_literal: true + +require 'spec_helper' + +RSpec.describe Security::CiConfiguration::SastParserService do + describe '#configuration' do + include_context 'read ci configuration for sast enabled project' + + let(:configuration) { described_class.new(project).configuration } + let(:secure_analyzers_prefix) { configuration['global'][0] } + let(:sast_excluded_paths) { configuration['global'][1] } + let(:sast_analyzer_image_tag) { configuration['global'][2] } + let(:sast_pipeline_stage) { configuration['pipeline'][0] } + let(:sast_search_max_depth) { configuration['pipeline'][1] } + let(:brakeman) { configuration['analyzers'][0] } + let(:bandit) { configuration['analyzers'][1] } + let(:sast_brakeman_level) { brakeman['variables'][0] } + + it 'parses the configuration for SAST' do + expect(secure_analyzers_prefix['default_value']).to eql('registry.gitlab.com/gitlab-org/security-products/analyzers') + expect(sast_excluded_paths['default_value']).to eql('spec, test, tests, tmp') + expect(sast_analyzer_image_tag['default_value']).to eql('2') + expect(sast_pipeline_stage['default_value']).to eql('test') + expect(sast_search_max_depth['default_value']).to eql('4') + expect(brakeman['enabled']).to be(true) + expect(sast_brakeman_level['default_value']).to eql('1') + end + + context 'while populating current values of the entities' do + context 'when .gitlab-ci.yml is present' do + it 'populates the current values from the file' do + allow(project.repository).to receive(:blob_data_at).and_return(gitlab_ci_yml_content) + expect(secure_analyzers_prefix['value']).to eql('registry.gitlab.com/gitlab-org/security-products/analyzers2') + expect(sast_excluded_paths['value']).to eql('spec, executables') + expect(sast_analyzer_image_tag['value']).to eql('2') + expect(sast_pipeline_stage['value']).to eql('our_custom_security_stage') + expect(sast_search_max_depth['value']).to eql('8') + expect(brakeman['enabled']).to be(false) + expect(bandit['enabled']).to be(true) + expect(sast_brakeman_level['value']).to eql('2') + end + + context 'SAST_DEFAULT_ANALYZERS is set' do + it 'enables analyzers correctly' do + allow(project.repository).to receive(:blob_data_at).and_return(gitlab_ci_yml_default_analyzers_content) + + expect(brakeman['enabled']).to be(false) + expect(bandit['enabled']).to be(true) + end + end + + context 'SAST_EXCLUDED_ANALYZERS is set' do + it 'enables analyzers correctly' do + allow(project.repository).to receive(:blob_data_at).and_return(gitlab_ci_yml_excluded_analyzers_content) + + expect(brakeman['enabled']).to be(false) + expect(bandit['enabled']).to be(true) + end + end + end + + context 'when .gitlab-ci.yml is absent' do + it 'populates the current values with the default values' do + allow(project.repository).to receive(:blob_data_at).and_return(nil) + expect(secure_analyzers_prefix['value']).to eql('registry.gitlab.com/gitlab-org/security-products/analyzers') + expect(sast_excluded_paths['value']).to eql('spec, test, tests, tmp') + expect(sast_analyzer_image_tag['value']).to eql('2') + expect(sast_pipeline_stage['value']).to eql('test') + expect(sast_search_max_depth['value']).to eql('4') + expect(brakeman['enabled']).to be(true) + expect(sast_brakeman_level['value']).to eql('1') + end + end + end + end +end |