fix(cwe): guard save_cwes on partial update; bound CWE number to column width

Two data-safety fixes for the multi-CWE relation:

- FindingSerializer.update() called save_cwes() unconditionally, so any
  PATCH/PUT that omitted `cwes` deleted a finding's extra Finding_CWE rows
  (leaving only the primary). Guard the call on `parsed_cwes is not None`,
  mirroring the vulnerability-id path.

- cwe_number() had no upper bound, but Finding_CWE.cwe stores "CWE-<n>" in a
  varchar(11). A number > 9,999,999 passed validation then raised DataError
  at insert (API/form 500, and would abort the 0280 backfill's bulk_create,
  since ignore_conflicts does not swallow DataError). Reject it as invalid
  input (None) so it becomes a clean 400/skip.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Maffooch

dojo/finding/api/serializer.py

@@ -483,9 +483,12 @@ def update(self, instance, validated_data):
         )
 
         # Sync the CWE relation (separate from vulnerability ids) after the new cwe is applied.
+        # Only touch the CWE rows when the request actually carried `cwes`; calling save_cwes()
+        # unconditionally would wipe a finding's extra Finding_CWE rows on any partial PATCH that
+        # omits the field (mirrors the guarded vulnerability-id path above).
         if parsed_cwes is not None:
             instance.unsaved_cwes = parsed_cwes[1:]
-        save_cwes(instance)
+            save_cwes(instance)
 
         if settings.V3_FEATURE_LOCATIONS and locations is not None:
             for location_ref in instance.locations.all():

dojo/finding/cwe.py

@@ -13,7 +13,11 @@ def cwe_number(value) -> int | None:
     if not token.isdigit():
         return None
     number = int(token)
-    return number if number > 0 else None
+    # Finding_CWE.cwe stores the "CWE-<n>" label in a varchar(11), so n is bounded to 7 digits.
+    # Reject anything larger here (clean None -> 400/skip) instead of 500-ing at insert.
+    if number <= 0 or number > 9_999_999:
+        return None
+    return number
 
 
 def cwe_label(value) -> str | None: