fix(importers): stop doubling the (scan_type) suffix in dynamic Test Type names (#15149)

* fix(importers): stop doubling the (scan_type) suffix in dynamic Test Type names

Generic Findings Import (and other dynamic-test-type parsers like SARIF)
built the Test Type name by unconditionally appending " Scan ({scan_type})"
to the report's `type` field. When `type` already carried the
" ({scan_type})" suffix, the suffix was doubled, e.g.
"Prisma Cloud (Generic Findings Import) Scan (Generic Findings Import)".

Extract the name resolution into resolve_dynamic_test_type_name(), which is
now idempotent: a `type` already ending in " ({scan_type})" is used verbatim.
The intentional "{type} Scan ({scan_type})" format is unchanged for all other
cases (Tool1 -> "Tool1 Scan (Generic Findings Import)"), preserving SARIF and
existing behavior.

To avoid breaking existing data, the reimport validation accepts either the
new idempotent name or the legacy (pre-patch) name via
legacy_dynamic_test_type_name(), so reimports into tests whose test_type was
created with the old doubled name keep working without a mismatch error.

Also corrects the Generic Findings Import docs, which described a
"{Test Name} (Generic Findings Import)" format the code never produced.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(importers): restore ' Scan'-suffix guard to stop re-doubling dynamic Test Type names

The idempotency rewrite dropped the legacy guard that returned the scan type
as-is when '{type} Scan' already equals the scan_type. That re-introduced the
exact doubling the PR removes for dynamic parsers whose scan_type ends in
' Scan' (Horusec, AWS Security Hub, Rusty Hog variants), e.g. 'Horusec Scan'
became 'Horusec Scan (Horusec Scan)' on fresh import. Restore the guard and add
a regression test importing a Horusec scan.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Maffooch

docs/content/asset_modelling/OS_hierarchy/OS__asset_hierarchy.md

@@ -159,6 +159,7 @@ Examples include:
 **Report-Defined Test Type Naming Rules:**
 - If the report's `type` field equals the scan type → uses scan type directly (e.g., "Generic Findings Import")
 - If the report's `type` field differs → creates "{type} Scan ({scan_type})" format (e.g., "Tool1 Scan (Generic Findings Import)")
+- If the report's `type` field already ends with the " ({scan_type})" suffix → uses it verbatim, so the suffix is never doubled (e.g., "Tool1 (Generic Findings Import)" stays "Tool1 (Generic Findings Import)")
 - If no `type` field is provided → uses scan type directly
 
 **Important Considerations:**

docs/content/asset_modelling/engagements_tests/OS__tests.md

@@ -37,7 +37,7 @@ While each method differs primarily in how scan data is parsed and ingested, the
 
 When no native parser exists for a given tool, **Generic Findings Import** allows you to import findings using a standardized JSON or CSV schema, regardless of the original source. 
 
-DefectDojo parses the provided data, creates a new Test (or imports into an existing one), and attaches the Findings. A corresponding Test Type is also created in the format “{Test Name} (Generic Findings Import).”
+DefectDojo parses the provided data, creates a new Test (or imports into an existing one), and attaches the Findings. A corresponding Test Type is also created based on the report's optional `type` field: when `type` is omitted (or equals the scan type) the Test Type is “Generic Findings Import”; when `type` is provided it becomes “{type} Scan (Generic Findings Import)” (a `type` that already ends with the “(Generic Findings Import)” suffix is used verbatim).
 
 |  | **Native Parsers** | **Generic Findings Import** | 
 |----------|---------------|------------------------|

docs/content/asset_modelling/engagements_tests/PRO__tests.md

@@ -35,7 +35,7 @@ While each method differs primarily in how scan data is parsed and ingested, the
 
 When no native parser exists for a given tool, [**Generic Findings Import**](/supported_tools/parsers/generic_findings_import) allows you to import findings using a standardized JSON or CSV schema, regardless of the original source. 
 
-DefectDojo parses the provided data, creates a new Test (or imports into an existing one), and attaches the Findings. A corresponding Test Type is also created in the format “`{Test Name}` (Generic Findings Import).”
+DefectDojo parses the provided data, creates a new Test (or imports into an existing one), and attaches the Findings. A corresponding Test Type is also created based on the report's optional `type` field: when `type` is omitted (or equals the scan type) the Test Type is “Generic Findings Import”; when `type` is provided it becomes “`{type}` Scan (Generic Findings Import)” (a `type` that already ends with the “(Generic Findings Import)” suffix is used verbatim).
 
 #### Universal Parser 
 

docs/content/supported_tools/parsers/file/generic.md

@@ -226,6 +226,8 @@ Example:
 }
 ```
 
+The resulting Test Type name is derived from the `type` field: when `type` is omitted (or equals the scan type) the Test Type is `Generic Findings Import`; when `type` is provided it becomes `{type} Scan (Generic Findings Import)` (for the example above, `My custom Test type Scan (Generic Findings Import)`). A `type` that already ends with the `(Generic Findings Import)` suffix is used verbatim, so the suffix is never doubled.
+
 ### Sample Scan Data
 
 Sample Generic Findings Import scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/generic).

docs/content/supported_tools/parsers/generic_findings_import.md

@@ -6,14 +6,28 @@ weight: 2
 
 Open-source and Pro users can use Generic Findings Import as a method to ingest JSON or CSV files into DefectDojo which are not already in the supported Tools list.
 
-Using Generic Findings Import will create a new Test Type in your DefectDojo instance called "`{The Name Of Your Test}` (Generic Findings Import)".  For example, this JSON content will result in a Test Type called "Example Report (Generic Findings Import)":
-
-```
-{
-    "name": "Example Report",
-    "findings": []
-}
-```
+Using Generic Findings Import creates a Test Type in your DefectDojo instance based on the optional `type` field in the report. The naming rules are:
+
+- If no `type` field is provided (or it equals the scan type), the Test Type is simply **"Generic Findings Import"**. For example, this JSON content results in the Test Type "Generic Findings Import":
+
+  ```
+  {
+      "name": "Example Report",
+      "findings": []
+  }
+  ```
+
+- If a `type` field is provided and differs from the scan type, the Test Type is **"`{type}` Scan (Generic Findings Import)"**. For example, `"type": "Tool1"` results in the Test Type "Tool1 Scan (Generic Findings Import)":
+
+  ```
+  {
+      "name": "Example Report",
+      "type": "Tool1",
+      "findings": []
+  }
+  ```
+
+- If the `type` field already ends with the "(Generic Findings Import)" suffix, it is used verbatim (the suffix is never doubled). For example, `"type": "Tool1 (Generic Findings Import)"` results in the Test Type "Tool1 (Generic Findings Import)".
 
 DefectDojo Pro users can also consider using the [Universal Parser](../universal_parser), a tool which allows for highly customizable JSON, XML and CSV imports.
 

dojo/importers/base_importer.py

@@ -282,33 +282,18 @@ def consolidate_dynamic_tests(self, tests: list[Test]) -> list[Finding]:
         # only if they are different. This is to support meta format like SARIF
         # so a report that have the label 'CodeScanner' will be changed to 'CodeScanner Scan (SARIF)'
         test_raw = tests[0]
-        test_type_name = self.scan_type
         # Create a new test if it has not already been created
         if not self.test:
-            # Determine if we should use a custom test type name
-            if test_raw.type:
-                # If test_raw.type equals scan_type, use scan_type directly
-                if test_raw.type == self.scan_type:
-                    test_type_name = self.scan_type
-                else:
-                    test_type_name = f"{tests[0].type} Scan"
-                    if test_type_name != self.scan_type:
-                        test_type_name = f"{test_type_name} ({self.scan_type})"
-            self.test = self.create_test(test_type_name)
+            # Resolve the Test_Type name from the report's type (idempotent: a type that already
+            # carries the " (scan_type)" suffix is used verbatim rather than doubled)
+            self.test = self.create_test(self.resolve_dynamic_test_type_name(test_raw.type))
         else:
-            # During reimport, validate that the test_type matches
-            # Calculate the expected test_type_name from the incoming report
-            expected_test_type_name = self.scan_type
-            if test_raw.type:
-                # If test_raw.type equals scan_type, use scan_type directly
-                if test_raw.type == self.scan_type:
-                    expected_test_type_name = self.scan_type
-                else:
-                    expected_test_type_name = f"{test_raw.type} Scan"
-                    if expected_test_type_name != self.scan_type:
-                        expected_test_type_name = f"{expected_test_type_name} ({self.scan_type})"
-            # Compare with existing test's test_type name
-            if self.test.test_type.name != expected_test_type_name:
+            # During reimport, validate that the test_type matches the incoming report.
+            # Accept either the current (idempotent) name or the legacy name the pre-patch code
+            # produced, so reimports into tests created before the doubling fix keep working.
+            expected_test_type_name = self.resolve_dynamic_test_type_name(test_raw.type)
+            legacy_test_type_name = self.legacy_dynamic_test_type_name(test_raw.type)
+            if self.test.test_type.name not in {expected_test_type_name, legacy_test_type_name}:
                 msg = (
                     f"Test type mismatch: Test {self.test.id} has test_type '{self.test.test_type.name}', "
                     f"but the report contains test_type '{expected_test_type_name}'. "
@@ -653,6 +638,42 @@ def update_test_progress(
         self.test.percent_complete = percentage_value
         self.test.save()
 
+    def resolve_dynamic_test_type_name(self, raw_type: str | None) -> str:
+        """
+        Compute the Test_Type name for a dynamic-test-type report (e.g. Generic, SARIF).
+
+        - No type, or type already equals the scan type -> use the scan type as-is.
+        - Type already carries the scan-type suffix (e.g. "Prisma Cloud (Generic Findings
+          Import)") -> use it verbatim. This keeps the composition idempotent and prevents
+          doubled names like "X (scan_type) Scan (scan_type)".
+        - Type plus a " Scan" suffix already equals the scan type (e.g. type "Horusec" with
+          scan_type "Horusec Scan") -> use the scan type as-is. This preserves the behavior of
+          dynamic parsers whose scan_type already ends in " Scan" (Horusec, AWS Security Hub,
+          Rusty Hog, ...) so their Test_Type name is not doubled into "Horusec Scan (Horusec Scan)".
+        - Otherwise -> the intentional "{type} Scan ({scan_type})" format (also used by SARIF,
+          so a report labeled 'CodeScanner' becomes 'CodeScanner Scan (SARIF)').
+        """
+        if not raw_type or raw_type == self.scan_type:
+            return self.scan_type
+        if raw_type.endswith(f" ({self.scan_type})"):
+            return raw_type
+        if f"{raw_type} Scan" == self.scan_type:
+            return self.scan_type
+        return f"{raw_type} Scan ({self.scan_type})"
+
+    def legacy_dynamic_test_type_name(self, raw_type: str | None) -> str:
+        """
+        Reproduce the name the pre-idempotency code produced. Used only for the reimport
+        compatibility check so reimports into existing (pre-patch) tests whose test_type
+        already has a doubled suffix keep working instead of raising a mismatch error.
+        """
+        if not raw_type or raw_type == self.scan_type:
+            return self.scan_type
+        name = f"{raw_type} Scan"
+        if name != self.scan_type:
+            name = f"{name} ({self.scan_type})"
+        return name
+
     def get_or_create_test_type(
         self,
         test_type_name: str,

unittests/scans/generic/generic_test_type_suffix.json

@@ -0,0 +1,13 @@
+{
+    "name": "Prisma Cloud",
+    "type": "Prisma Cloud (Generic Findings Import)",
+    "findings": [
+        {
+            "title": "Test Finding Prisma",
+            "description": "This is a test finding whose type already carries the scan-type suffix",
+            "severity": "High",
+            "active": true,
+            "verified": true
+        }
+    ]
+}