Skip to content

fix(parsers): use unsaved_tags instead of tags= in Finding constructor #14626

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
valentijnscholten wants to merge 3 commits into
base: bugfix
Choose a base branch
from
Open

fix(parsers): use unsaved_tags instead of tags= in Finding constructor #14626

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6266610
fix(parsers): use unsaved_tags instead of tags= in Finding constructo…
valentijnscholten Apr 1, 2026
0f7c99a
fix: resolve ruff D203 and COM812 lint errors from formatter conflict
valentijnscholten Apr 1, 2026
ca68a95
fix: update tests to check unsaved_tags instead of tags
valentijnscholten Apr 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 19 additions & 34 deletions dojo/tools/anchore_grype/parser.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,8 @@ def get_findings(self, file, test):
rel_epss = related_vulnerability.get("epss")
rel_vuln_id = related_vulnerability.get("id")
vulnerability_ids = self.get_vulnerability_ids(
vuln_id, related_vulnerabilities,
vuln_id,
related_vulnerabilities,
)

matches = item["matchDetails"]
Expand All @@ -77,37 +78,25 @@ def get_findings(self, file, test):
artifact_purl = artifact.get("purl")
artifact_location = artifact.get("locations")
file_path = None
if (
artifact_location
and len(artifact_location) > 0
and artifact_location[0].get("path")
):
if artifact_location and len(artifact_location) > 0 and artifact_location[0].get("path"):
file_path = artifact_location[0].get("path")

finding_title = f"{vuln_id} in {artifact_name}:{artifact_version}"

finding_tags = None
finding_description = ""
if vuln_namespace:
finding_description += (
f"**Vulnerability Namespace:** {vuln_namespace}"
)
finding_description += f"**Vulnerability Namespace:** {vuln_namespace}"
if vuln_description:
finding_description += (
f"\n**Vulnerability Description:** {vuln_description}"
)
finding_description += f"\n**Vulnerability Description:** {vuln_description}"
if rel_description and rel_description != vuln_description:
finding_description += f"\n**Related Vulnerability Description:** {rel_description}"
if matches:
if isinstance(item["matchDetails"], dict):
finding_description += (
f"\n**Matcher:** {matches['matcher']}"
)
finding_description += f"\n**Matcher:** {matches['matcher']}"
finding_tags = [matches["matcher"].replace("-matcher", "")]
elif len(matches) == 1:
finding_description += (
f"\n**Matcher:** {matches[0]['matcher']}"
)
finding_description += f"\n**Matcher:** {matches[0]['matcher']}"
finding_tags = [
matches[0]["matcher"].replace("-matcher", ""),
]
Expand Down Expand Up @@ -138,30 +127,22 @@ def get_findings(self, file, test):

finding_references = ""
if vuln_datasource:
finding_references += (
f"**Vulnerability Datasource:** {vuln_datasource}\n"
)
finding_references += f"**Vulnerability Datasource:** {vuln_datasource}\n"
if vuln_urls:
if len(vuln_urls) == 1:
if vuln_urls[0] != vuln_datasource:
finding_references += (
f"**Vulnerability URL:** {vuln_urls[0]}\n"
)
finding_references += f"**Vulnerability URL:** {vuln_urls[0]}\n"
else:
finding_references += "**Vulnerability URLs:**\n"
for url in vuln_urls:
if url != vuln_datasource:
finding_references += f"- {url}\n"
if rel_datasource:
finding_references += (
f"**Related Vulnerability Datasource:** {rel_datasource}\n"
)
finding_references += f"**Related Vulnerability Datasource:** {rel_datasource}\n"
if rel_urls:
if len(rel_urls) == 1:
if rel_urls[0] != vuln_datasource:
finding_references += (
f"**Related Vulnerability URL:** {rel_urls[0]}\n"
)
finding_references += f"**Related Vulnerability URL:** {rel_urls[0]}\n"
else:
finding_references += "**Related Vulnerability URLs:**\n"
for url in rel_urls:
Expand Down Expand Up @@ -202,14 +183,14 @@ def get_findings(self, file, test):
component_name=artifact_name,
component_version=artifact_version.replace("\x00", ""),
vuln_id_from_tool=vuln_id,
tags=finding_tags,
static_finding=True,
dynamic_finding=False,
nb_occurences=1,
file_path=file_path,
fix_available=fix_available,
fix_version=fix_version,
)
dupes[dupe_key].unsaved_tags = finding_tags
dupes[dupe_key].unsaved_vulnerability_ids = vulnerability_ids
if settings.V3_FEATURE_LOCATIONS and artifact_purl:
dupes[dupe_key].unsaved_locations.append(
Expand All @@ -229,7 +210,8 @@ def get_cvss(self, cvss):
vector = cvss_item["vector"]
cvss_objects = cvss_parser.parse_cvss_from_text(vector)
if len(cvss_objects) > 0 and isinstance(
cvss_objects[0], CVSS3,
cvss_objects[0],
CVSS3,
):
return vector
return None
Expand Down Expand Up @@ -259,8 +241,11 @@ def get_vulnerability_ids(self, vuln_id, related_vulnerabilities):
if vuln_id:
vulnerability_ids.append(vuln_id)
if related_vulnerabilities:
vulnerability_ids.extend(related_vulnerability_id for related_vulnerability in related_vulnerabilities
if (related_vulnerability_id := related_vulnerability.get("id")))
vulnerability_ids.extend(
related_vulnerability_id
for related_vulnerability in related_vulnerabilities
if (related_vulnerability_id := related_vulnerability.get("id"))
)
if vulnerability_ids:
return vulnerability_ids
return None
21 changes: 5 additions & 16 deletions dojo/tools/cargo_audit/parser.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,24 +80,13 @@ def get_findings(self, filename, test):
vuln_id = advisory.get("id")
vulnerability_ids = [advisory.get("id")]
categories = f"**Categories:** {', '.join(advisory['categories'])}" if "categories" in advisory else ""
description = (
categories
+ f"\n**Description:** `{advisory.get('description')}`"
)
description = categories + f"\n**Description:** `{advisory.get('description')}`"

if (
item["affected"] is not None
and "functions" in item["affected"]
):
if item["affected"] is not None and "functions" in item["affected"]:
affected_func = [
f'{func}: {", ".join(versions)}'
for func, versions in item["affected"][
"functions"
].items()
f"{func}: {', '.join(versions)}" for func, versions in item["affected"]["functions"].items()
]
description += (
f"\n**Affected functions**: {', '.join(affected_func)}"
)
description += f"\n**Affected functions**: {', '.join(affected_func)}"

references = f"{advisory.get('url')}\n" + "\n".join(
advisory["references"],
Expand Down Expand Up @@ -130,7 +119,6 @@ def get_findings(self, filename, test):
title=title,
test=test,
severity=severity,
tags=tags,
description=description,
component_name=package_name,
component_version=package_version,
Expand All @@ -140,6 +128,7 @@ def get_findings(self, filename, test):
references=references,
mitigation=mitigation,
)
finding.unsaved_tags = tags
finding.unsaved_vulnerability_ids = vulnerability_ids
if settings.V3_FEATURE_LOCATIONS and package_name:
finding.unsaved_locations.append(
Expand Down
Loading
Loading