feat: add OWASP analysis fields to FindingAudit component#465
feat: add OWASP analysis fields to FindingAudit component#465fahedouch wants to merge 1 commit intoDependencyTrack:mainfrom
Conversation
Signed-off-by: Fahed Dorgaa <[email protected]>
There was a problem hiding this comment.
Pull request overview
Adds UI support in the Finding Audit view to display newly introduced OWASP Risk Rating analysis fields returned by the API, along with the analysis ownership source.
Changes:
- Render new read-only fields: OWASP RR Vector, OWASP RR Score, OWASP RR Severity, and Analysis Source.
- Extend FindingAudit component state to store these new values.
- Populate the new fields from the analysis payload in
updateAnalysisData(). - Align
package-lock.jsondependency spec for@codemirror/lang-jinjawithpackage.json.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| src/views/portfolio/projects/FindingAudit.vue | Adds UI + state plumbing for OWASP RR analysis fields and analysis source. |
| package-lock.json | Updates lockfile dependency entry for @codemirror/lang-jinja to 6.0.0. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| <b-form-group | ||
| v-if="owaspVector" | ||
| id="fieldset-owasp-vector" | ||
| label="OWASP RR Vector" | ||
| label-for="input-owasp-vector" | ||
| > | ||
| <b-form-input | ||
| id="input-owasp-vector" | ||
| :value="owaspVector" | ||
| class="form-control disabled" | ||
| readonly | ||
| trim | ||
| /> | ||
| </b-form-group> | ||
| <b-form-group | ||
| v-if="owaspScore" | ||
| id="fieldset-owasp-score" | ||
| label="OWASP RR Score" | ||
| label-for="input-owasp-score" | ||
| > | ||
| <b-form-input | ||
| id="input-owasp-score" | ||
| :value="owaspScore" | ||
| class="form-control disabled" | ||
| readonly | ||
| trim | ||
| /> | ||
| </b-form-group> | ||
| <b-form-group | ||
| v-if="owaspSeverity" | ||
| id="fieldset-owasp-severity" | ||
| label="OWASP RR Severity" | ||
| label-for="input-owasp-severity" | ||
| > | ||
| <b-form-input | ||
| id="input-owasp-severity" | ||
| :value="owaspSeverity" | ||
| class="form-control disabled" | ||
| readonly | ||
| trim | ||
| /> | ||
| </b-form-group> | ||
| <b-form-group | ||
| v-if="analysisSource" | ||
| id="fieldset-analysis-source" | ||
| label="Analysis Source" | ||
| label-for="input-analysis-source" | ||
| > |
There was a problem hiding this comment.
The new OWASP/analysis labels are hard-coded strings, while nearby fields use i18n via this.$t(...) (e.g., CVSS labels). This prevents localization and will be flagged by vue-i18n-extract. Please add i18n message keys for these labels and use :label="$t('...')" (or this.$t) consistently.
| <b-form-group | ||
| v-if="owaspScore" | ||
| id="fieldset-owasp-score" | ||
| label="OWASP RR Score" | ||
| label-for="input-owasp-score" | ||
| > | ||
| <b-form-input | ||
| id="input-owasp-score" | ||
| :value="owaspScore" | ||
| class="form-control disabled" | ||
| readonly | ||
| trim | ||
| /> | ||
| </b-form-group> |
There was a problem hiding this comment.
v-if="owaspScore" will hide the score when it is 0/0.0, even though that may be a valid OWASP RR score. Consider checking for null/undefined instead (e.g., owaspScore !== null && owaspScore !== undefined) so a zero score still renders.
| if (Object.prototype.hasOwnProperty.call(analysis, 'owaspVector')) { | ||
| this.owaspVector = analysis.owaspVector; | ||
| } | ||
| if (Object.prototype.hasOwnProperty.call(analysis, 'owaspScore')) { | ||
| this.owaspScore = analysis.owaspScore; | ||
| } | ||
| if (Object.prototype.hasOwnProperty.call(analysis, 'owaspSeverity')) { | ||
| this.owaspSeverity = analysis.owaspSeverity; | ||
| } | ||
| if (Object.prototype.hasOwnProperty.call(analysis, 'source')) { | ||
| this.analysisSource = analysis.source; | ||
| } |
There was a problem hiding this comment.
updateAnalysisData() sets the new OWASP/source fields only when the property exists, but never clears them when the backend omits the field. This can leave stale values visible after subsequent updates/refreshes where those properties are not present. Recommend explicitly resetting owaspVector/owaspScore/owaspSeverity/analysisSource to null when the property is missing (or initialize them all to null at the start of the method).
Description
Add display of new analysis fields (introduced in this PR) in the Finding Audit component:
owaspScore- OWASP Risk Rating scoreowaspSeverity- OWASP Risk Rating severity levelsource- Analysis ownership source (POLICY, VEX, MANUAL, NVD)Result:
Addressed Issue
Additional Details
Checklist