Vulnerabilities with GraphQL

DevSecOps
1

Hello,

requesting vulnerabilities with graphql does not return vulnerabilities!

Problem to solve

I have activated SAST in my project.
It does find one vulnerabilitiy and it shows up in the Vulnerability Report.
However when querying with GraphQL the returned json is:

{
“data”: {
“project”: {
“vulnerabilities”: {
“nodes”: ,
“pageInfo”: {
“endCursor”: null,
“hasNextPage”: false
}
}
}
}
}

Steps to reproduce

Access token is set.
This is the request json, the query:

query VulnerabilityFindings {
project(fullPath: “beat9202016/bluerave-gateway”) {
vulnerabilities(state:[DETECTED,DISMISSED,CONFIRMED,RESOLVED],reportType:SAST) {
nodes {
detectedAt
title
severity
primaryIdentifier {
name
}
scanner {
reportTypeHumanized
}
}
pageInfo {
endCursor
hasNextPage
}
}
}
}

Does anyone have an idea what i am doing wrong?

Thx in advance! Cheers!

2

Looking at the documentation, it seems that Vulnerability Report features and functionality are only available in GitLab Ultimate: https://docs.gitlab.com/ee/user/application_security/vulnerability_report/

3

Yes I know, I am actually testing with ultimate, otherwise I would not see the vulnerability report at all!