feat(finding): autodetected vulnerability_id type + uniqueness constraint

Adds Vulnerability_Id.vulnerability_id_type, autodetected from the id's
leading prefix (CVE-2024-1234 -> CVE, GHSA-... -> GHSA), stored and indexed
so identifiers can be filtered/grouped by type. Populated on import (bulk)
and on save(); existing rows backfilled by migration.

Also de-duplicates (finding, vulnerability_id) rows and adds a unique
constraint on the pair. CWE is a weakness class and is intentionally NOT
part of this change; vulnerability_id_type does not participate in
hash_code, so existing hash codes and deduplication are unaffected.

Migrations: 0276 (type column + lookup index), 0277 (dedupe + backfill,
data), 0278 (unique constraint).

Author: valentijnscholten

docs/content/releases/os_upgrading/3.2.md

@@ -0,0 +1,34 @@
+---
+title: 'Upgrading to DefectDojo Version 3.2.x'
+toc_hide: true
+weight: -20260701
+description: Vulnerability ids gain an autodetected type. A migration adds the type column, de-duplicates vulnerability-id rows, and adds a uniqueness constraint. Existing hash codes are unaffected.
+---
+
+## Vulnerability id type
+
+Each `Vulnerability_Id` gains an autodetected `vulnerability_id_type` — the identifier's leading
+prefix (`CVE-2024-1234` → `CVE`, `GHSA-…` → `GHSA`, `RUSTSEC-…` → `RUSTSEC`). It is derived
+structurally (no registry) and stored (indexed) so identifiers can be filtered and grouped by type
+efficiently. It is `NULL` when there is no non-numeric prefix.
+
+The type is populated automatically: on import (bulk paths) and on `save()`. Existing rows are
+backfilled by the migration below. This is a denormalized, derived attribute — it does not
+participate in `hash_code`, so **existing hash codes and deduplication are unaffected**.
+
+## Database migration
+
+Three migrations run automatically on upgrade:
+
+- `0276_vulnerability_id_type` — adds the indexed `vulnerability_id_type` column and a leading
+  index on `vulnerability_id`.
+- `0277_backfill_vulnerability_id_type` — backfills `vulnerability_id_type` for existing rows and
+  removes duplicate `(finding, vulnerability_id)` rows, keeping the earliest of each — such
+  duplicates are unintended, and consolidating them allows a uniqueness constraint to be added.
+- `0278_unique_finding_vulnerability_id` — adds a unique constraint on `(finding, vulnerability_id)`.
+
+### What you need to do
+
+The migrations are applied automatically. No manual steps are required.
+
+For more information, check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/3.2.0).

dojo/db_migrations/0276_vulnerability_id_type.py

@@ -0,0 +1,25 @@
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    """Schema only: add the autodetected vulnerability_id_type column and a leading index on
+    vulnerability_id. The data backfill (0277) and the unique constraint (0278, which requires
+    the dedupe data step first) are kept in separate migrations so data migrations are never
+    mixed with schema migrations."""
+
+    dependencies = [
+        ("dojo", "0275_usercontactinfo_user_state_details"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="vulnerability_id",
+            name="vulnerability_id_type",
+            field=models.CharField(blank=True, db_index=True, editable=False, max_length=20, null=True),
+        ),
+        migrations.AddIndex(
+            model_name="vulnerability_id",
+            index=models.Index(fields=["vulnerability_id"], name="dojo_vuln_id_lookup_idx"),
+        ),
+    ]

dojo/db_migrations/0277_backfill_vulnerability_id_type.py

@@ -0,0 +1,49 @@
+from django.db import migrations
+
+from dojo.finding.vulnerability_id import resolve_vulnerability_id_type
+
+BATCH_SIZE = 1000
+
+
+def dedupe_vulnerability_ids(apps, schema_editor):
+    """Remove duplicate (finding, vulnerability_id) rows, keeping the lowest id, so the unique
+    constraint added in the following schema migration (0278) can be created. Postgres."""
+    schema_editor.execute(
+        """
+        DELETE FROM dojo_vulnerability_id a
+        USING dojo_vulnerability_id b
+        WHERE a.finding_id = b.finding_id
+          AND a.vulnerability_id = b.vulnerability_id
+          AND a.id > b.id
+        """,
+    )
+
+
+def backfill_vulnerability_id_type(apps, schema_editor):
+    """Populate vulnerability_id_type for existing rows by autodetecting the id prefix."""
+    Vulnerability_Id = apps.get_model("dojo", "Vulnerability_Id")
+    batch = []
+    qs = Vulnerability_Id.objects.filter(vulnerability_id_type__isnull=True).only("id", "vulnerability_id")
+    for row in qs.iterator(chunk_size=BATCH_SIZE):
+        row.vulnerability_id_type = resolve_vulnerability_id_type(row.vulnerability_id)
+        batch.append(row)
+        if len(batch) >= BATCH_SIZE:
+            Vulnerability_Id.objects.bulk_update(batch, ["vulnerability_id_type"], batch_size=BATCH_SIZE)
+            batch = []
+    if batch:
+        Vulnerability_Id.objects.bulk_update(batch, ["vulnerability_id_type"], batch_size=BATCH_SIZE)
+
+
+class Migration(migrations.Migration):
+
+    """Data only (no schema changes): dedupe (finding, vulnerability_id) rows and backfill
+    vulnerability_id_type for existing rows."""
+
+    dependencies = [
+        ("dojo", "0276_vulnerability_id_type"),
+    ]
+
+    operations = [
+        migrations.RunPython(dedupe_vulnerability_ids, migrations.RunPython.noop),
+        migrations.RunPython(backfill_vulnerability_id_type, migrations.RunPython.noop),
+    ]

dojo/db_migrations/0278_unique_finding_vulnerability_id.py

@@ -0,0 +1,18 @@
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    """Schema only: add the (finding, vulnerability_id) unique constraint. Runs after the 0277
+    dedupe data step so the constraint can be created without violating existing duplicate rows."""
+
+    dependencies = [
+        ("dojo", "0277_backfill_vulnerability_id_type"),
+    ]
+
+    operations = [
+        migrations.AddConstraint(
+            model_name="vulnerability_id",
+            constraint=models.UniqueConstraint(fields=("finding", "vulnerability_id"), name="unique_finding_vulnerability_id"),
+        ),
+    ]

dojo/finding/helper.py

@@ -26,6 +26,7 @@
     do_false_positive_history_batch,
     get_finding_models_for_deduplication,
 )
+from dojo.finding.vulnerability_id import resolve_vulnerability_id_type
 from dojo.jira import services as jira_services
 from dojo.location.models import Location
 from dojo.location.status import FindingLocationStatus
@@ -1068,7 +1069,7 @@ def save_vulnerability_ids(finding, vulnerability_ids, *, delete_existing: bool
         Vulnerability_Id.objects.filter(finding=finding).delete()
 
     Vulnerability_Id.objects.bulk_create([
-        Vulnerability_Id(finding=finding, vulnerability_id=vid)
+        Vulnerability_Id(finding=finding, vulnerability_id=vid, vulnerability_id_type=resolve_vulnerability_id_type(vid))
         for vid in vulnerability_ids
     ])
 

dojo/finding/models.py

@@ -24,6 +24,7 @@
 from titlecase import titlecase
 
 from dojo.base_models.base import BaseModel
+from dojo.finding.vulnerability_id import resolve_vulnerability_id_type
 
 # get_current_date/tomorrow/copy_model_util are defined early in dojo.models, before the
 # re-export that loads this module — so this resolves despite the partial circular load, and
@@ -700,6 +701,9 @@ def copy(self, test=None):
         copy.found_by.set(old_found_by)
         # Assign any tags
         copy.tags.set(old_tags)
+        # Copy the vulnerability ids (relation rows aren't copied by copy_model_util)
+        for vulnerability_id in self.vulnerability_id_set.all():
+            Vulnerability_Id.objects.create(finding=copy, vulnerability_id=vulnerability_id.vulnerability_id)
 
         return copy
 
@@ -1377,6 +1381,19 @@ def set_hash_code(self, dedupe_option):
 class Vulnerability_Id(models.Model):
     finding = models.ForeignKey("dojo.Finding", editable=False, on_delete=models.CASCADE)
     vulnerability_id = models.TextField(max_length=50, blank=False, null=False)
+    # Autodetected from the id prefix (CVE, GHSA, ...); NULL when there is no non-numeric
+    # prefix. Denormalized/indexed so type-scoped queries (e.g. GROUP BY type) stay cheap.
+    vulnerability_id_type = models.CharField(max_length=20, null=True, blank=True, editable=False, db_index=True)
+
+    class Meta:
+        constraints = [
+            models.UniqueConstraint(fields=["finding", "vulnerability_id"], name="unique_finding_vulnerability_id"),
+        ]
+        indexes = [
+            # Leading on vulnerability_id (the unique constraint's index leads on finding), for
+            # GROUP BY vulnerability_id / lookups by exact id.
+            models.Index(fields=["vulnerability_id"], name="dojo_vuln_id_lookup_idx"),
+        ]
 
     class Meta:
         indexes = [
@@ -1391,6 +1408,11 @@ class Meta:
     def __str__(self):
         return self.vulnerability_id
 
+    def save(self, *args, **kwargs):
+        # bulk_create paths set the type at construction; this covers save()/get_or_create.
+        self.vulnerability_id_type = resolve_vulnerability_id_type(self.vulnerability_id)
+        super().save(*args, **kwargs)
+
     def get_absolute_url(self):
         return reverse("view_finding", args=[str(self.finding.id)])
 

dojo/finding/vulnerability_id.py

@@ -0,0 +1,17 @@
+"""Pure helpers for vulnerability identifiers (no model imports, safe to import anywhere)."""
+
+
+def resolve_vulnerability_id_type(vulnerability_id: str | None) -> str | None:
+    """
+    Autodetect the type from the id's leading prefix (the part before the first ``-``).
+
+    Structural, no registry: ``CVE-2024-1 -> "CVE"``, ``GHSA-... -> "GHSA"``,
+    ``RUSTSEC-2021-0001 -> "RUSTSEC"``, ``ALINUX2-SA-... -> "ALINUX2"``. Returns the uppercased
+    prefix, or ``None`` when there is no non-numeric prefix (bare numbers / UUIDs / no dash).
+    """
+    if not vulnerability_id:
+        return None
+    prefix = str(vulnerability_id).strip().split("-", 1)[0].strip()
+    if not prefix or prefix.isdigit():
+        return None
+    return prefix.upper()

dojo/importers/base_importer.py

@@ -12,6 +12,7 @@
 
 import dojo.finding.helper as finding_helper
 import dojo.risk_acceptance.helper as ra_helper
+from dojo.finding.vulnerability_id import resolve_vulnerability_id_type
 from dojo.importers.options import ImporterOptions
 from dojo.jira.services import is_keep_in_sync
 from dojo.location.models import Location
@@ -893,7 +894,7 @@ def store_vulnerability_ids(
         vulnerability_ids_to_process = list(dict.fromkeys(finding.unsaved_vulnerability_ids or []))
         vulnerability_ids_to_process = [x for x in vulnerability_ids_to_process if x.strip()]
         self.pending_vulnerability_ids.extend([
-            Vulnerability_Id(finding=finding, vulnerability_id=vid)
+            Vulnerability_Id(finding=finding, vulnerability_id=vid, vulnerability_id_type=resolve_vulnerability_id_type(vid))
             for vid in vulnerability_ids_to_process
         ])
         if vulnerability_ids_to_process:

dojo/importers/default_reimporter.py

@@ -13,6 +13,7 @@
     find_candidates_for_deduplication_unique_id,
     find_candidates_for_reimport_legacy,
 )
+from dojo.finding.vulnerability_id import resolve_vulnerability_id_type
 from dojo.importers.base_importer import BaseImporter, Parser
 from dojo.importers.base_location_manager import LocationHandler
 from dojo.importers.options import ImporterOptions
@@ -1000,7 +1001,7 @@ def reconcile_vulnerability_ids(
         # Accumulate delete + insert for batch flush
         self.pending_vuln_id_deletes.append(finding.id)
         self.pending_vulnerability_ids.extend([
-            Vulnerability_Id(finding=finding, vulnerability_id=vid)
+            Vulnerability_Id(finding=finding, vulnerability_id=vid, vulnerability_id_type=resolve_vulnerability_id_type(vid))
             for vid in vulnerability_ids_to_process
         ])
         if vulnerability_ids_to_process:

unittests/test_vulnerability_id_type.py

@@ -0,0 +1,51 @@
+"""Vulnerability_Id type autodetection, the backfill helper path, and the uniqueness constraint."""
+from django.db import IntegrityError, transaction
+from django.test import SimpleTestCase
+
+from dojo.finding.helper import save_vulnerability_ids
+from dojo.finding.vulnerability_id import resolve_vulnerability_id_type
+from dojo.models import Finding, Vulnerability_Id
+from unittests.dojo_test_case import DojoTestCase, versioned_fixtures
+
+
+class TestVulnerabilityIdTypeResolver(SimpleTestCase):
+
+    def test_autodetect(self):
+        self.assertEqual(resolve_vulnerability_id_type("CVE-2024-1234"), "CVE")
+        self.assertEqual(resolve_vulnerability_id_type("GHSA-9v3m-xxxx"), "GHSA")
+        self.assertEqual(resolve_vulnerability_id_type("RUSTSEC-2021-0001"), "RUSTSEC")
+        self.assertEqual(resolve_vulnerability_id_type("ALINUX2-SA-2021"), "ALINUX2")
+        self.assertEqual(resolve_vulnerability_id_type("cve-2024-1"), "CVE")
+        # No non-numeric prefix -> None
+        self.assertIsNone(resolve_vulnerability_id_type("1234"))
+        self.assertIsNone(resolve_vulnerability_id_type(""))
+        self.assertIsNone(resolve_vulnerability_id_type(None))
+
+
+@versioned_fixtures
+class TestVulnerabilityIdType(DojoTestCase):
+    fixtures = ["dojo_testdata.json"]
+
+    def setUp(self):
+        self.finding = Finding.objects.get(id=2)
+        Vulnerability_Id.objects.filter(finding=self.finding).delete()
+
+    def test_save_sets_type(self):
+        row = Vulnerability_Id.objects.create(finding=self.finding, vulnerability_id="CVE-2024-1234")
+        self.assertEqual(row.vulnerability_id_type, "CVE")
+        # bare number -> no type
+        row2 = Vulnerability_Id.objects.create(finding=self.finding, vulnerability_id="12345")
+        self.assertIsNone(row2.vulnerability_id_type)
+
+    def test_bulk_save_sets_type(self):
+        # save_vulnerability_ids uses bulk_create, which sets the type at construction
+        save_vulnerability_ids(self.finding, ["CVE-2024-1", "GHSA-aaaa-bbbb"])
+        types = dict(
+            Vulnerability_Id.objects.filter(finding=self.finding).values_list("vulnerability_id", "vulnerability_id_type"),
+        )
+        self.assertEqual(types, {"CVE-2024-1": "CVE", "GHSA-aaaa-bbbb": "GHSA"})
+
+    def test_unique_constraint(self):
+        Vulnerability_Id.objects.create(finding=self.finding, vulnerability_id="CVE-2024-1234")
+        with self.assertRaises(IntegrityError), transaction.atomic():
+            Vulnerability_Id.objects.create(finding=self.finding, vulnerability_id="CVE-2024-1234")