Add opt-in template-based vulnerability ID generation

src/main/java/org/dependencytrack/model/ConfigPropertyConstants.java

@@ -129,7 +129,13 @@ public enum ConfigPropertyConstants {
     DEFAULT_LANGUAGE("general", "default.locale", null, PropertyType.STRING, "Determine the default Language to use", true),
     TELEMETRY_SUBMISSION_ENABLED("telemetry", "submission.enabled", String.valueOf(!"true".equals(System.getProperty("dev.mode.enabled")) && Config.getInstance().getPropertyAsBoolean(ConfigKey.TELEMETRY_SUBMISSION_ENABLED_DEFAULT)), PropertyType.BOOLEAN, "Whether submission of telemetry data is enabled"),
     TELEMETRY_LAST_SUBMISSION_DATA("telemetry", "last.submission.data", null, PropertyType.STRING, "Data of the last telemetry submission"),
-    TELEMETRY_LAST_SUBMISSION_EPOCH_SECONDS("telemetry", "last.submission.epoch.seconds", null, PropertyType.INTEGER, "Timestamp of the last telemetry submission in epoch seconds");
+    TELEMETRY_LAST_SUBMISSION_EPOCH_SECONDS("telemetry", "last.submission.epoch.seconds", null, PropertyType.INTEGER, "Timestamp of the last telemetry submission in epoch seconds"),
+    VULNERABILITY_ID_USE_CUSTOM("vulnerability-id", "use.custom.id", "false", PropertyType.BOOLEAN, "Use custom sequential ID generator; when false, uses the default random INT- format"),
+    VULNERABILITY_ID_ORG_CODE("vulnerability-id", "org.code", SystemUtils.getEnvironmentVariable("VULNERABILITY_ID_ORG_CODE_DEFAULT", "DT"), PropertyType.STRING, "Organization code used in vulnerability IDs"),
+    VULNERABILITY_ID_PROJECT_CODE("vulnerability-id", "project.code", SystemUtils.getEnvironmentVariable("VULNERABILITY_ID_PROJECT_CODE_DEFAULT", "project"), PropertyType.STRING, "Default project code used in vulnerability IDs when no project name is provided"),
+    VULNERABILITY_ID_TEMPLATE("vulnerability-id", "template", SystemUtils.getEnvironmentVariable("VULNERABILITY_ID_TEMPLATE_DEFAULT", "{ORG_CODE}-{YYYY}-{SEQUENCE}"), PropertyType.STRING, "Template for generating vulnerability IDs with variables: {ORG_CODE}, {PROJECT_NAME}, {PROJECT_CODE}, {YYYY}, {MM}, {DD}, {SEQUENCE}"),
+    VULNERABILITY_ID_RESET_POLICY("vulnerability-id", "reset.policy", SystemUtils.getEnvironmentVariable("VULNERABILITY_ID_RESET_POLICY_DEFAULT", "YEARLY"), PropertyType.STRING, "Sequence reset policy: YEARLY, MONTHLY, DAILY, NEVER"),
+    VULNERABILITY_ID_SEQUENCE_PADDING("vulnerability-id", "sequence.padding", SystemUtils.getEnvironmentVariable("VULNERABILITY_ID_SEQUENCE_PADDING_DEFAULT", "5"), PropertyType.INTEGER, "Number of digits for sequence padding");
 
     private final String groupName;
     private final String propertyName;

src/main/java/org/dependencytrack/model/VulnerabilitySequence.java

@@ -0,0 +1,123 @@
+/*
+ * This file is part of Dependency-Track.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * Copyright (c) OWASP Foundation. All Rights Reserved.
+ */
+package org.dependencytrack.model;
+
+import com.fasterxml.jackson.annotation.JsonIgnore;
+
+import javax.jdo.annotations.Column;
+import javax.jdo.annotations.IdGeneratorStrategy;
+import javax.jdo.annotations.Index;
+import javax.jdo.annotations.PersistenceCapable;
+import javax.jdo.annotations.Persistent;
+import javax.jdo.annotations.PrimaryKey;
+import javax.jdo.annotations.Unique;
+import java.io.Serializable;
+import java.util.Date;
+
+/**
+ * Tracks sequence counters for internally generated vulnerability IDs.
+ * Sequence scope is per organization code + project key.
+ */
+@PersistenceCapable(table = "VULNERABILITY_SEQUENCE_V2")
+@Unique(name = "VULNSEQV2_ORG_PROJECT_IDX", members = {"orgCode", "projectKey"})
+public class VulnerabilitySequence implements Serializable {
+
+    @PrimaryKey
+    @Persistent(valueStrategy = IdGeneratorStrategy.NATIVE)
+    @JsonIgnore
+    private long id;
+
+    @Persistent(defaultFetchGroup = "true")
+    @Column(name = "ORG_CODE", allowsNull = "false")
+    @Index(name = "VULNSEQV2_ORG_IDX")
+    private String orgCode;
+
+    @Persistent(defaultFetchGroup = "true")
+    @Column(name = "PROJECT_KEY", allowsNull = "false")
+    @Index(name = "VULNSEQV2_PROJECT_IDX")
+    private String projectKey;
+
+    @Persistent(defaultFetchGroup = "true")
+    @Column(name = "CURRENT_SEQUENCE", allowsNull = "false")
+    private long currentSequence;
+
+    @Persistent(defaultFetchGroup = "true")
+    @Column(name = "LAST_RESET_DATE")
+    private Date lastResetDate;
+
+    @Persistent(defaultFetchGroup = "true")
+    @Column(name = "RESET_POLICY", allowsNull = "false")
+    private String resetPolicy;
+
+    @Persistent(defaultFetchGroup = "true")
+    @Column(name = "CREATED_AT")
+    private Date createdAt;
+
+    public long getId() {
+        return id;
+    }
+
+    public String getOrgCode() {
+        return orgCode;
+    }
+
+    public void setOrgCode(final String orgCode) {
+        this.orgCode = orgCode;
+    }
+
+    public String getProjectKey() {
+        return projectKey;
+    }
+
+    public void setProjectKey(final String projectKey) {
+        this.projectKey = projectKey;
+    }
+
+    public long getCurrentSequence() {
+        return currentSequence;
+    }
+
+    public void setCurrentSequence(final long currentSequence) {
+        this.currentSequence = currentSequence;
+    }
+
+    public Date getLastResetDate() {
+        return lastResetDate;
+    }
+
+    public void setLastResetDate(final Date lastResetDate) {
+        this.lastResetDate = lastResetDate;
+    }
+
+    public String getResetPolicy() {
+        return resetPolicy;
+    }
+
+    public void setResetPolicy(final String resetPolicy) {
+        this.resetPolicy = resetPolicy;
+    }
+
+    public Date getCreatedAt() {
+        return createdAt;
+    }
+
+    public void setCreatedAt(final Date createdAt) {
+        this.createdAt = createdAt;
+    }
+}

src/main/java/org/dependencytrack/persistence/QueryManager.java

@@ -920,6 +920,22 @@ public void synchronizeVulnerableSoftware(
         getVulnerableSoftwareQueryManager().synchronizeVulnerableSoftware(persistentVuln, vsList, source);
     }
 
+    public synchronized String generateNextVulnerabilityId(final String projectName) {
+        return getVulnerabilityQueryManager().generateNextVulnerabilityId(projectName);
+    }
+
+    public synchronized String previewNextVulnerabilityId(final String projectName) {
+        return getVulnerabilityQueryManager().previewNextVulnerabilityId(projectName);
+    }
+
+    public synchronized String allocateNextVulnerabilityIdInTransaction(final String projectName) {
+        return getVulnerabilityQueryManager().allocateNextVulnerabilityIdInTransaction(projectName);
+    }
+
+    public boolean vulnerabilityIdExists(final String vulnerabilityId) {
+        return getVulnerabilityQueryManager().vulnerabilityIdExists(vulnerabilityId);
+    }
+
     public boolean contains(Vulnerability vulnerability, Component component) {
         return getVulnerabilityQueryManager().contains(vulnerability, component);
     }