feat(finding): make the CWE set a hashable dedup field (cwes)

Add 'cwes' to HASHCODE_ALLOWED_FIELDS and hash it via a new get_cwes(), which
mirrors get_vulnerability_ids. Because the primary cwe is a scalar that is always
set (so Finding.cwes is non-empty even before the extra Finding_CWE rows are
written during import), get_cwes prefers unsaved_cwes whenever present, so the
pre-save and post-save import hashes agree.

Tests: get_cwes prefers unsaved_cwes, is stable across save, empty with no cwe,
and cwes participates in compute_hash_code.

Author: valentijnscholten

dojo/finding/models.py

@@ -22,7 +22,7 @@
 from titlecase import titlecase
 
 from dojo.base_models.base import BaseModel
-from dojo.finding.vulnerability_id import cwe_label, resolve_vulnerability_id_type
+from dojo.finding.vulnerability_id import cwe_label, finding_cwe_labels, resolve_vulnerability_id_type
 
 # get_current_date/tomorrow/copy_model_util are defined early in dojo.models, before the
 # re-export that loads this module — so this resolves despite the partial circular load, and
@@ -787,6 +787,11 @@ def compute_hash_code(self):
                 my_vulnerability_ids = self.get_vulnerability_ids()
                 fields_to_hash += my_vulnerability_ids
                 deduplicationLogger.debug(hashcodeField + " : " + my_vulnerability_ids)
+            elif hashcodeField == "cwes":
+                # For the CWE set (primary cwe + additional CWEs), need to compute the field
+                my_cwes = self.get_cwes()
+                fields_to_hash += my_cwes
+                deduplicationLogger.debug(hashcodeField + " : " + my_cwes)
             else:
                 # Generically use the finding attribute having the same name, converts to str in case it's integer
                 fields_to_hash += str(getattr(self, hashcodeField))
@@ -832,6 +837,22 @@ def _get_saved_vulnerability_ids(finding) -> str:
 
         return _get_saved_vulnerability_ids(self) or _get_unsaved_vulnerability_ids(self)
 
+    # Get CWEs (canonical CWE-<n> labels) to use for hash_code computation
+    def get_cwes(self):
+        # The extra CWE rows (finding_cwe_set) are written *after* the finding is saved during
+        # import, but unsaved_cwes carries them at hash time. Unlike vulnerability_ids there is a
+        # primary scalar (self.cwe) that is always set, so self.cwes is non-empty even before the
+        # extra rows exist — a plain "saved or unsaved" fallback would miss the extras. Prefer
+        # unsaved_cwes whenever it is present so the pre-save and post-save hashes agree.
+        if self.unsaved_cwes:
+            labels = finding_cwe_labels(self.cwe, self.unsaved_cwes)
+        elif self.id is not None:
+            labels = self.cwes
+        else:
+            labels = finding_cwe_labels(self.cwe, None)
+        # sort for a deterministic hash regardless of row/label ordering
+        return "".join(sorted(labels))
+
     # Get locations/endpoints to use for hash_code computation
     def get_locations(self):
         # TODO: Delete this after the move to Locations

dojo/settings/settings.dist.py

@@ -1201,7 +1201,7 @@ def generate_url(scheme, double_slashes, user, password, host, port, path, param
 # List of fields that are known to be usable in hash_code computation)
 # 'endpoints' is a pseudo field that uses the endpoints (for dynamic scanners). If `V3_FEATURE_LOCATIONS` is True, Dojo uses locations (URLs) instead.
 # 'unique_id_from_tool' is often not needed here as it can be used directly in the dedupe algorithm, but it's also possible to use it for hashing
-HASHCODE_ALLOWED_FIELDS = ["title", "cwe", "vulnerability_ids", "line", "file_path", "payload", "component_name", "component_version", "description", "endpoints", "unique_id_from_tool", "severity", "vuln_id_from_tool", "mitigation"]
+HASHCODE_ALLOWED_FIELDS = ["title", "cwe", "cwes", "vulnerability_ids", "line", "file_path", "payload", "component_name", "component_version", "description", "endpoints", "unique_id_from_tool", "severity", "vuln_id_from_tool", "mitigation"]
 
 # Adding fields to the hash_code calculation regardless of the previous settings
 HASH_CODE_FIELDS_ALWAYS = ["service"]

unittests/test_finding_cwe.py

@@ -1,5 +1,5 @@
 """CWE-as-a-separate-relationship (Finding_CWE) and the API."""
-from django.test import SimpleTestCase
+from django.test import SimpleTestCase, override_settings
 from rest_framework.authtoken.models import Token
 from rest_framework.test import APIClient
 
@@ -123,3 +123,53 @@ def test_finding_create_with_cwes(self):
         # primary cwe (legacy int) set from the first entry; both stored as canonical Finding_CWE rows
         self.assertEqual(79, finding.cwe)
         self.assertEqual({"CWE-79", "CWE-89"}, set(finding.finding_cwe_set.values_list("cwe", flat=True)))
+
+
+@versioned_fixtures
+class TestFindingCweHashCode(DojoTestCase):
+
+    """get_cwes() and its use in compute_hash_code, incl. the unsaved_cwes import path."""
+
+    fixtures = ["dojo_testdata.json"]
+
+    def setUp(self):
+        self.finding = Finding.objects.get(id=2)
+        Finding_CWE.objects.filter(finding=self.finding).delete()
+
+    def test_get_cwes_prefers_unsaved_cwes(self):
+        # Extra CWE rows are not written yet; get_cwes must still reflect them via unsaved_cwes.
+        self.finding.cwe = 79
+        self.finding.unsaved_cwes = [89, 22]
+        self.assertEqual(self.finding.get_cwes(), "".join(sorted(["CWE-79", "CWE-89", "CWE-22"])))
+
+    def test_get_cwes_stable_before_and_after_save(self):
+        # The pre-save (unsaved_cwes) and post-save (finding_cwe_set) hashes must agree.
+        self.finding.cwe = 79
+        self.finding.unsaved_cwes = [89, 22]
+        before = self.finding.get_cwes()
+        save_cwes(self.finding)
+        reloaded = Finding.objects.get(id=2)  # unsaved_cwes is None on a fresh load
+        self.assertEqual(before, reloaded.get_cwes())
+        self.assertEqual(reloaded.get_cwes(), "".join(sorted(["CWE-79", "CWE-89", "CWE-22"])))
+
+    def test_get_cwes_empty_when_no_cwe(self):
+        self.finding.cwe = 0
+        self.finding.unsaved_cwes = None
+        save_cwes(self.finding)
+        self.assertEqual(Finding.objects.get(id=2).get_cwes(), "")
+
+    def test_compute_hash_code_uses_cwe_set(self):
+        self.finding.cwe = 79
+        scanner = self.finding.test.test_type.name
+        # FINDING_COMPUTE_HASH_METHOD=None forces the OSS compute_hash_code path under test
+        # (a Pro deployment would otherwise delegate to its tuner-driven hash method).
+        with override_settings(
+            FINDING_COMPUTE_HASH_METHOD=None,
+            HASHCODE_FIELDS_PER_SCANNER={scanner: ["title", "cwes"]},
+        ):
+            self.finding.unsaved_cwes = [89]
+            hash_with_89 = self.finding.compute_hash_code()
+            self.finding.unsaved_cwes = [22]
+            hash_with_22 = self.finding.compute_hash_code()
+        # Different CWE set -> different hash, so cwes participates in the hash.
+        self.assertNotEqual(hash_with_89, hash_with_22)