Merge branch 'expose-vulnerability-evidence' into 'master'

Expose vulnerability occurrence evidence

Closes #37027

See merge request gitlab-org/gitlab!29224

ee/app/models/vulnerabilities/occurrence.rb

@@ -254,6 +254,10 @@ module Vulnerabilities
       metadata.dig('remediations')
     end
 
+    def evidence
+      metadata.dig('evidence', 'summary')
+    end
+
     alias_method :==, :eql? # eql? is necessary in some cases like array intersection
 
     def eql?(other)

ee/app/serializers/vulnerabilities/occurrence_entity.rb

@@ -29,6 +29,7 @@ class Vulnerabilities::OccurrenceEntity < Grape::Entity
     expose :location
     expose :remediations
     expose :solution
+    expose :evidence
   end
 
   expose :state

ee/spec/factories/vulnerabilities/occurrences.rb

@@ -54,7 +54,10 @@ FactoryBot.define do
             name: "Cipher does not check for integrity first?",
             url: "https://crypto.stackexchange.com/questions/31428/pbewithmd5anddes-cipher-does-not-check-for-integrity-first"
           }
-        ]
+        ],
+        evidence: {
+          summary: 'Credit card detected'
+        }
       }.to_json
     end
 

ee/spec/models/vulnerabilities/occurrence_spec.rb

@@ -568,4 +568,24 @@ describe Vulnerabilities::Occurrence do
       it { is_expected.to eq(vulnerabilities_occurrence.remediations.dig(0, 'summary')) }
     end
   end
+
+  describe '#evidence' do
+    it 'has an evidence summary when present' do
+      occurrence = create(:vulnerabilities_occurrence)
+
+      expect(occurrence.evidence).to eq(occurrence.metadata['evidence']['summary'])
+    end
+
+    it 'has no evidence summary when evidence is present, summary is not' do
+      occurrence = create(:vulnerabilities_occurrence, raw_metadata: { evidence: {} })
+
+      expect(occurrence.evidence).to be_nil
+    end
+
+    it 'has no evidence summary when evidence is not present' do
+      occurrence = create(:vulnerabilities_occurrence, raw_metadata: {})
+
+      expect(occurrence.evidence).to be_nil
+    end
+  end
 end

ee/spec/serializers/vulnerabilities/occurrence_entity_spec.rb

@@ -54,7 +54,7 @@ describe Vulnerabilities::OccurrenceEntity do
       expect(subject).to include(:name, :report_type, :severity, :confidence, :project_fingerprint)
       expect(subject).to include(:scanner, :project, :identifiers)
       expect(subject).to include(:dismissal_feedback, :issue_feedback)
-      expect(subject).to include(:description, :links, :location, :remediations, :solution)
+      expect(subject).to include(:description, :links, :location, :remediations, :solution, :evidence)
       expect(subject).to include(:blob_path)
     end