add tests for vulnerability_ids

Author: valentijnscholten

dojo/api_v2/serializers.py

@@ -1741,12 +1741,13 @@ def update(self, instance, validated_data):
         push_to_jira = validated_data.pop("push_to_jira")
 
         # Save vulnerability ids and pop them
-        if "vulnerability_id_set" in validated_data:
-            vulnerability_id_set = validated_data.pop("vulnerability_id_set")
-            vulnerability_ids = []
-            if vulnerability_id_set:
-                vulnerability_ids.extend(vulnerability_id["vulnerability_id"] for vulnerability_id in vulnerability_id_set)
-            save_vulnerability_ids(instance, vulnerability_ids)
+        parsed_vulnerability_ids = []
+        if (vulnerability_ids := validated_data.pop("vulnerability_id_set", None)):
+            logger.debug("VULNERABILITY_ID_SET: %s", vulnerability_ids)
+            parsed_vulnerability_ids.extend(vulnerability_id["vulnerability_id"] for vulnerability_id in vulnerability_ids)
+            logger.debug("SETTING CVE FROM VULNERABILITY_ID_SET: %s", parsed_vulnerability_ids[0])
+            validated_data["cve"] = parsed_vulnerability_ids[0]
+
         # Save the reporter on the finding
         if reporter_id := validated_data.get("reporter"):
             instance.reporter = reporter_id
@@ -1755,6 +1756,9 @@ def update(self, instance, validated_data):
             instance, validated_data,
         )
 
+        if parsed_vulnerability_ids:
+            save_vulnerability_ids(instance, parsed_vulnerability_ids)
+
         if push_to_jira:
             jira_helper.push_to_jira(instance)
 
@@ -1869,12 +1873,16 @@ def create(self, validated_data):
         # Process the vulnerability IDs specially
         parsed_vulnerability_ids = []
         if (vulnerability_ids := validated_data.pop("vulnerability_id_set", None)):
+            logger.debug("VULNERABILITY_ID_SET: %s", vulnerability_ids)
             parsed_vulnerability_ids.extend(vulnerability_id["vulnerability_id"] for vulnerability_id in vulnerability_ids)
+            logger.debug("SETTING CVE FROM VULNERABILITY_ID_SET: %s", parsed_vulnerability_ids[0])
             validated_data["cve"] = parsed_vulnerability_ids[0]
 
         new_finding = super().create(
             validated_data)
 
+        logger.debug(f"New finding CVE: {new_finding.cve}")
+
         # Deal with all of the many to many things
         if notes:
             new_finding.notes.set(notes)
@@ -1886,7 +1894,7 @@ def create(self, validated_data):
             save_vulnerability_ids(new_finding, parsed_vulnerability_ids)
             # can we avoid this extra save? the cve has already been set above in validated_data. but there are no tests for this
             # on finding update nothing is done # with vulnerability_ids?
-            new_finding.save()
+            # new_finding.save()
 
         if push_to_jira:
             jira_helper.push_to_jira(new_finding)

unittests/test_finding_helper.py

@@ -6,11 +6,13 @@
 from crum import impersonate
 from django.contrib.auth.models import User
 from django.utils import timezone
+from rest_framework.authtoken.models import Token
+from rest_framework.test import APIClient
 
 from dojo.finding.helper import save_vulnerability_ids, save_vulnerability_ids_template
 from dojo.models import Finding, Finding_Template, Test, Vulnerability_Id, Vulnerability_Id_Template
 
-from .dojo_test_case import DojoTestCase
+from .dojo_test_case import DojoAPITestCase, DojoTestCase
 
 logger = logging.getLogger(__name__)
 
@@ -245,3 +247,91 @@ def test_save_vulnerability_id_templates(self, save_mock, delete_mock, filter_mo
         delete_mock.assert_called_once()
         self.assertEqual(save_mock.call_count, 2)
         self.assertEqual("REF-1", finding_template.cve)
+
+
+class TestFindingVulnerabilityIdsAPI(DojoAPITestCase):
+    fixtures = ["dojo_testdata.json"]
+
+    def setUp(self):
+        super().setUp()
+        self.system_settings(enable_jira=True)
+        self.testuser = User.objects.get(username="admin")
+        self.testuser.usercontactinfo.block_execution = True
+        self.testuser.usercontactinfo.save()
+        token = Token.objects.get(user=self.testuser)
+        self.client = APIClient()
+        self.client.credentials(HTTP_AUTHORIZATION="Token " + token.key)
+        self.client.force_login(self.get_test_admin())
+
+    def test_finding_create_without_cve(self):
+        # use existing finding as template for a new finding. this finding has no cve
+        finding_details = self.get_finding_api(2)
+        del finding_details["id"]
+        if "cve" in finding_details:
+            del finding_details["cve"]
+        new_vulnerability_ids = [
+            {"vulnerability_id": "RHSA-12345"},
+            {"vulnerability_id": "GHSA-7890"},
+        ]
+        finding_details["vulnerability_ids"] = new_vulnerability_ids
+        response = self.post_new_finding_api(finding_details)
+        # assert resopnse data
+        self.assertIsNone(response.get("cve"))
+        self.assertEqual(new_vulnerability_ids, response.get("vulnerability_ids"))
+
+        # assert GET finding
+        finding_id = response.get("id")
+        response = self.get_finding_api(finding_id)
+        self.assertIsNone(response.get("cve"))
+        self.assertEqual(new_vulnerability_ids, response.get("vulnerability_ids"))
+
+    def test_finding_create_with_cve(self):
+        # use existing finding as template for a new finding. this finding has no cve
+        finding_details = self.get_finding_api(2)
+        del finding_details["id"]
+        if "cve" in finding_details:
+            del finding_details["cve"]
+        new_vulnerability_ids = [
+            {"vulnerability_id": "CVE-2025-12345"},
+            {"vulnerability_id": "RHSA-12345"},
+            {"vulnerability_id": "GHSA-7890"},
+        ]
+        finding_details["vulnerability_ids"] = new_vulnerability_ids
+        response = self.post_new_finding_api(finding_details)
+        # assert response data
+        self.assertEqual(new_vulnerability_ids, response.get("vulnerability_ids"))
+
+        # CVE is not in the response, so get it fromt the database
+        self.assertEqual("CVE-2025-12345", Finding.objects.get(id=response.get("id")).cve)
+
+    def test_finding_create_and_update_with_cve(self):
+        # use existing finding as template for a new finding. this finding has no cve
+        finding_details = self.get_finding_api(2)
+        del finding_details["id"]
+        if "cve" in finding_details:
+            del finding_details["cve"]
+        new_vulnerability_ids = [
+            {"vulnerability_id": "CVE-2025-12345"},
+            {"vulnerability_id": "RHSA-12345"},
+            {"vulnerability_id": "GHSA-7890"},
+        ]
+        finding_details["vulnerability_ids"] = new_vulnerability_ids
+        response = self.post_new_finding_api(finding_details)
+        finding_id = response.get("id")
+        # assert resopnse data
+        self.assertEqual(new_vulnerability_ids, response.get("vulnerability_ids"))
+
+        # CVE is not in the response, so get it fromt the database
+        self.assertEqual("CVE-2025-12345", Finding.objects.get(id=finding_id).cve)
+
+        # change vulnerability_id and remove cve
+        updated_vulnerability_ids = [
+            {"vulnerability_id": "RHSA-000000"},
+        ]
+        response = self.patch_finding_api(finding_id, {"vulnerability_ids": updated_vulnerability_ids})
+        # assert resopnse data
+        self.assertEqual(updated_vulnerability_ids, response.get("vulnerability_ids"))
+
+        # CVE is not in the response, so get it fromt the database
+        # current behaviour is that the cve is taken from the first vulnerability_id...
+        self.assertEqual("RHSA-000000", Finding.objects.get(id=finding_id).cve)