refactor(finding): move CWE helpers to dojo/finding/cwe.py

Move cwe_number, cwe_label, parse_cwes, finding_cwe_labels out of
finding/vulnerability_id.py into a dedicated finding/cwe.py (CWEs are a weakness
class, distinct from vulnerability identifiers). resolve_vulnerability_id_type
stays in vulnerability_id.py. All importers updated.

Author: valentijnscholten

dojo/db_migrations/0280_backfill_finding_cwe.py

@@ -1,6 +1,6 @@
 from django.db import migrations
 
-from dojo.finding.vulnerability_id import cwe_label
+from dojo.finding.cwe import cwe_label
 
 BATCH_SIZE = 1000
 

dojo/finding/api/serializer.py

@@ -15,14 +15,14 @@
 import dojo.finding.helper as finding_helper
 from dojo.authorization.authorization import user_has_permission
 from dojo.celery_dispatch import dojo_dispatch_task
+from dojo.finding.cwe import cwe_label, cwe_number
 from dojo.finding.helper import (
     save_cwes,
     save_endpoints_template,
     save_vulnerability_ids,
     save_vulnerability_ids_template,
 )
 from dojo.finding.models import BurpRawRequestResponse
-from dojo.finding.vulnerability_id import cwe_label, cwe_number
 from dojo.jira import services as jira_services
 from dojo.jira.api.serializers import JIRAIssueSerializer
 from dojo.location.models import LocationFindingReference

dojo/finding/cwe.py

@@ -0,0 +1,49 @@
+"""Pure helpers for CWE identifiers (no model imports, safe to import anywhere)."""
+
+
+def cwe_number(value) -> int | None:
+    """
+    ``"CWE-79"`` / ``"79"`` / ``79`` -> ``79`` (positive int, case-insensitive); anything else -> ``None``.
+
+    CWE numbers are positive, so ``0`` (Finding.cwe's "unset" sentinel) and non-numeric input -> ``None``.
+    """
+    if value is None:
+        return None
+    token = str(value).strip().upper().removeprefix("CWE-")
+    if not token.isdigit():
+        return None
+    number = int(token)
+    return number if number > 0 else None
+
+
+def cwe_label(value) -> str | None:
+    """``79`` / ``"79"`` / ``"CWE-79"`` -> ``"CWE-79"`` (canonical, case-insensitive); invalid -> ``None``."""
+    number = cwe_number(value)
+    return f"CWE-{number}" if number is not None else None
+
+
+def parse_cwes(text: str | None) -> list[str]:
+    """
+    Parse CWEs from user text (one per line or comma-separated) into canonical ``CWE-<n>`` labels.
+
+    Accepts ``89`` or ``CWE-89`` (case-insensitive); ignores anything non-numeric; deduplicates.
+    """
+    result: list[str] = []
+    for token in (text or "").replace(",", "\n").split():
+        label = cwe_label(token)
+        if label is not None and label not in result:
+            result.append(label)
+    return result
+
+
+def finding_cwe_labels(cwe, unsaved_cwes=None) -> list[str]:
+    """Canonical ``CWE-<n>`` labels for a finding: the primary ``cwe`` first, then extras, deduplicated."""
+    labels: list[str] = []
+    primary = cwe_label(cwe)
+    if primary is not None:
+        labels.append(primary)
+    for extra in unsaved_cwes or []:
+        label = cwe_label(extra)
+        if label is not None:
+            labels.append(label)
+    return list(dict.fromkeys(labels))

dojo/finding/helper.py

@@ -19,14 +19,15 @@
 from dojo.celery import app
 from dojo.endpoint.utils import endpoint_get_or_create, save_endpoints_to_add
 from dojo.file_uploads.helper import delete_related_files
+from dojo.finding.cwe import finding_cwe_labels
 from dojo.finding.deduplication import (
     dedupe_batch_of_findings,
     do_dedupe_finding_task_internal,
     do_false_positive_history,
     do_false_positive_history_batch,
     get_finding_models_for_deduplication,
 )
-from dojo.finding.vulnerability_id import finding_cwe_labels, resolve_vulnerability_id_type
+from dojo.finding.vulnerability_id import resolve_vulnerability_id_type
 from dojo.jira import services as jira_services
 from dojo.location.models import Location
 from dojo.location.status import FindingLocationStatus

dojo/finding/models.py

@@ -24,7 +24,8 @@
 from titlecase import titlecase
 
 from dojo.base_models.base import BaseModel
-from dojo.finding.vulnerability_id import cwe_label, finding_cwe_labels, resolve_vulnerability_id_type
+from dojo.finding.cwe import cwe_label, finding_cwe_labels
+from dojo.finding.vulnerability_id import resolve_vulnerability_id_type
 
 # get_current_date/tomorrow/copy_model_util are defined early in dojo.models, before the
 # re-export that loads this module — so this resolves despite the partial circular load, and

dojo/finding/ui/forms.py

@@ -7,8 +7,8 @@
 from tagulous.forms import TagField
 
 from dojo.endpoint.utils import validate_endpoints_to_add
+from dojo.finding.cwe import cwe_number, parse_cwes
 from dojo.finding.queries import get_authorized_findings
-from dojo.finding.vulnerability_id import cwe_number, parse_cwes
 from dojo.jira import services as jira_services
 from dojo.location.models import Location
 from dojo.location.utils import validate_locations_to_add

dojo/finding/vulnerability_id.py

@@ -1,54 +1,6 @@
 """Pure helpers for vulnerability identifiers (no model imports, safe to import anywhere)."""
 
 
-def cwe_number(value) -> int | None:
-    """
-    ``"CWE-79"`` / ``"79"`` / ``79`` -> ``79`` (positive int, case-insensitive); anything else -> ``None``.
-
-    CWE numbers are positive, so ``0`` (Finding.cwe's "unset" sentinel) and non-numeric input -> ``None``.
-    """
-    if value is None:
-        return None
-    token = str(value).strip().upper().removeprefix("CWE-")
-    if not token.isdigit():
-        return None
-    number = int(token)
-    return number if number > 0 else None
-
-
-def cwe_label(value) -> str | None:
-    """``79`` / ``"79"`` / ``"CWE-79"`` -> ``"CWE-79"`` (canonical, case-insensitive); invalid -> ``None``."""
-    number = cwe_number(value)
-    return f"CWE-{number}" if number is not None else None
-
-
-def parse_cwes(text: str | None) -> list[str]:
-    """
-    Parse CWEs from user text (one per line or comma-separated) into canonical ``CWE-<n>`` labels.
-
-    Accepts ``89`` or ``CWE-89`` (case-insensitive); ignores anything non-numeric; deduplicates.
-    """
-    result: list[str] = []
-    for token in (text or "").replace(",", "\n").split():
-        label = cwe_label(token)
-        if label is not None and label not in result:
-            result.append(label)
-    return result
-
-
-def finding_cwe_labels(cwe, unsaved_cwes=None) -> list[str]:
-    """Canonical ``CWE-<n>`` labels for a finding: the primary ``cwe`` first, then extras, deduplicated."""
-    labels: list[str] = []
-    primary = cwe_label(cwe)
-    if primary is not None:
-        labels.append(primary)
-    for extra in unsaved_cwes or []:
-        label = cwe_label(extra)
-        if label is not None:
-            labels.append(label)
-    return list(dict.fromkeys(labels))
-
-
 def resolve_vulnerability_id_type(vulnerability_id: str | None) -> str | None:
     """
     Autodetect the type from the id's leading prefix (the part before the first ``-``).

dojo/importers/base_importer.py

@@ -12,7 +12,8 @@
 
 import dojo.finding.helper as finding_helper
 import dojo.risk_acceptance.helper as ra_helper
-from dojo.finding.vulnerability_id import finding_cwe_labels, resolve_vulnerability_id_type
+from dojo.finding.cwe import finding_cwe_labels
+from dojo.finding.vulnerability_id import resolve_vulnerability_id_type
 from dojo.importers.options import ImporterOptions
 from dojo.jira.services import is_keep_in_sync
 from dojo.location.models import Location

dojo/management/commands/migrate_cwe.py

@@ -2,7 +2,7 @@
 
 from django.core.management.base import BaseCommand
 
-from dojo.finding.vulnerability_id import cwe_label
+from dojo.finding.cwe import cwe_label
 from dojo.models import Finding, Finding_CWE
 
 logger = logging.getLogger(__name__)

dojo/tools/generic/csv_parser.py

@@ -6,7 +6,7 @@
 from dateutil.parser import parse
 from django.conf import settings
 
-from dojo.finding.vulnerability_id import cwe_number, parse_cwes
+from dojo.finding.cwe import cwe_number, parse_cwes
 from dojo.models import Endpoint, Finding
 from dojo.tools.locations import LocationData