refactor(detector): scope verified-product suppression per-CVE

MaineK00n · claude · MaineK00n · commit 4906fd7b18a6 · 2026-07-01T01:21:55.000+09:00
collectVerifiedProducts keyed the verified part:vendor:product set by
RootID, unioning it across every CVE under the root. For multi-CVE JVN
roots (a JVNDB note covers several CVEs) this over-suppressed: a VulnCheck /
JVN match for product P was dropped for every CVE in the note when P was
verified for any one of them, hiding sibling CVEs the verified source does
not actually cover.

Key the verified set per (RootID, CVE) and walk each suppressed source's CPE
criteria once per constituent CVE with that CVE's own verified set, so
suppression is scoped to the CVE and AND/OR criteria satisfaction stays
correct. (Empirically JVN/VulnCheck criteria are all single/OR with no AND of
multiple CPEs, so the result matches a simpler post-walk filter, but keeping
suppression inside walkCPECriteria stays correct even if AND criteria appear.)

Co-Authored-By: Claude Opus 4.8 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/detector/vuls2/vuls2.go b/detector/vuls2/vuls2.go
@@ -593,6 +593,14 @@ type sourceData struct {
 	// confidence instead of ExactVersionMatch — the vuls2 replacement for
 	// go-cve-dictionary's fuzzy CPE reporting.
 	vpCpes []string
+	// exactCpesByCVE / vpCpesByCVE hold the per-CVE matched CPEs for SUPPRESSED
+	// CPE sources (VulnCheck / JVN). Those sources are walked once per
+	// constituent CVE with that CVE's own verified-product set, so a verified
+	// product for one CVE never suppresses a sibling and the AND/OR criteria
+	// satisfaction stays correct per CVE. Non-suppressed sources keep using the
+	// per-root exactCpes / vpCpes above.
+	exactCpesByCVE map[string][]string
+	vpCpesByCVE    map[string][]string
 }
 
 type rootTag struct {
@@ -632,7 +640,7 @@ func appendMissing(dst, src []string) []string {
 // VulnInfo.CpeURIs so the report shows the user-supplied CPE rather than
 // the internal FS-with-wildcards form. Nil / missing keys fall back to
 // the FS string as-is.
-func postConvert(scanned scanTypes.ScanResult, detected detectTypes.DetectResult, fsToOriginalCPE map[string][]string, noJVNCPEs map[string]struct{}, verifiedProductsByRoot map[dataTypes.RootID]map[string]struct{}) (models.VulnInfos, error) {
+func postConvert(scanned scanTypes.ScanResult, detected detectTypes.DetectResult, fsToOriginalCPE map[string][]string, noJVNCPEs map[string]struct{}, verifiedProductsByRoot map[dataTypes.RootID]map[string]map[string]struct{}) (models.VulnInfos, error) {
 	m := make(map[source]sourceData)
 
 	if err := walkVulnerabilityDetections(m, scanned, detected.Detected, noJVNCPEs, verifiedProductsByRoot); err != nil {
@@ -716,14 +724,24 @@ func postConvert(scanned scanTypes.ScanResult, detected detectTypes.DetectResult
 				}
 			}
 
+			// Suppressed CPE sources (VulnCheck / JVN) were walked per CVE, so
+			// pick this vulninfo's own matched CPEs rather than the per-root
+			// union — a verified product for a sibling CVE must not surface or
+			// gate this one.
+			exactForCVE, vpForCVE := vd.exactCpes, vd.vpCpes
+			if isSuppressedCPESource(src.SourceID) {
+				exactForCVE = vd.exactCpesByCVE[vi.CveID]
+				vpForCVE = vd.vpCpesByCVE[vi.CveID]
+			}
+
 			base.kbIDs = appendMissing(base.kbIDs, vd.kbIDs)
-			base.exactCpes = appendMissing(base.exactCpes, vd.exactCpes)
-			base.vpCpes = appendMissing(base.vpCpes, vd.vpCpes)
+			base.exactCpes = appendMissing(base.exactCpes, exactForCVE)
+			base.vpCpes = appendMissing(base.vpCpes, vpForCVE)
 
 			// A KB/CPE detection signal marks this CVE emittable. packStatuses
 			// are deliberately excluded — packages are gated separately through
 			// comparePack's per-source winner selection.
-			if len(vd.kbIDs) > 0 || len(vd.exactCpes) > 0 || len(vd.vpCpes) > 0 {
+			if len(vd.kbIDs) > 0 || len(exactForCVE) > 0 || len(vpForCVE) > 0 {
 				if !slices.Contains(vd.detectableCveIDs, vi.CveID) {
 					vd.detectableCveIDs = append(vd.detectableCveIDs, vi.CveID)
 				}
@@ -830,30 +848,49 @@ func postConvert(scanned scanTypes.ScanResult, detected detectTypes.DetectResult
 	return vim, nil
 }
 
-func walkVulnerabilityDetections(m map[source]sourceData, scanned scanTypes.ScanResult, vs []detectTypes.VulnerabilityData, noJVNCPEs map[string]struct{}, verifiedProductsByRoot map[dataTypes.RootID]map[string]struct{}) error {
+func walkVulnerabilityDetections(m map[source]sourceData, scanned scanTypes.ScanResult, vs []detectTypes.VulnerabilityData, noJVNCPEs map[string]struct{}, verifiedProductsByRoot map[dataTypes.RootID]map[string]map[string]struct{}) error {
 	for _, v := range vs {
-		// The part:vendor:product set DEFINED by the verified CPE sources
-		// (NVD / Fortinet / Cisco / PaloAlto) for this CVE — used to suppress
-		// overlapping VulnCheck / JVN matches, mirroring go-cve-dictionary's
-		// isCpeURIAlsoDefinedInVerifiedDataSource. Nil when no verified source
-		// defines anything for the CVE.
-		verifiedProducts := verifiedProductsByRoot[v.ID]
 		for _, d := range v.Detections {
 			for sourceID, fconds := range d.Contents {
 				for _, fcond := range fconds {
 					var (
-						statuses  []packStatus
-						kbIDs     []string
-						exactCpes []string
-						vpCpes    []string
+						statuses   []packStatus
+						kbIDs      []string
+						exactCpes  []string
+						vpCpes     []string
+						exactByCVE map[string][]string
+						vpByCVE    map[string][]string
 					)
-					if d.Ecosystem == ecosystemTypes.EcosystemTypeCPE {
-						exact, vp, err := walkCPECriteria(sourceID, fcond.Criteria, scanned, noJVNCPEs, verifiedProducts)
+					switch {
+					case d.Ecosystem == ecosystemTypes.EcosystemTypeCPE && isSuppressedCPESource(sourceID):
+						// Suppressed sources (VulnCheck / JVN) are walked ONCE
+						// PER constituent CVE with that CVE's own verified
+						// product set — the part:vendor:product the verified CPE
+						// sources (NVD / Fortinet / Cisco / PaloAlto) DEFINE for
+						// that CVE, mirroring go-cve-dictionary's
+						// isCpeURIAlsoDefinedInVerifiedDataSource. Per-CVE keeps a
+						// verified product for one CVE from suppressing a sibling
+						// and keeps AND/OR satisfaction correct per CVE.
+						exactByCVE, vpByCVE = map[string][]string{}, map[string][]string{}
+						for _, cveID := range cveIDsOf(v) {
+							exact, vp, err := walkCPECriteria(sourceID, fcond.Criteria, scanned, noJVNCPEs, verifiedProductsByRoot[v.ID][cveID])
+							if err != nil {
+								return xerrors.Errorf("Failed to walk cpe criteria. err: %w", err)
+							}
+							if len(exact) > 0 {
+								exactByCVE[cveID] = append(exactByCVE[cveID], exact...)
+							}
+							if len(vp) > 0 {
+								vpByCVE[cveID] = append(vpByCVE[cveID], vp...)
+							}
+						}
+					case d.Ecosystem == ecosystemTypes.EcosystemTypeCPE:
+						exact, vp, err := walkCPECriteria(sourceID, fcond.Criteria, scanned, noJVNCPEs, nil)
 						if err != nil {
 							return xerrors.Errorf("Failed to walk cpe criteria. err: %w", err)
 						}
 						exactCpes, vpCpes = exact, vp
-					} else {
+					default:
 						s, k, err := walkPkgCriteria(d.Ecosystem, sourceID, fcond.Criteria, fcond.Tag, scanned)
 						if err != nil {
 							return xerrors.Errorf("Failed to walk pkg criteria. err: %w", err)
@@ -865,8 +902,9 @@ func walkVulnerabilityDetections(m map[source]sourceData, scanned scanTypes.Scan
 					// WITHOUT registering it in m: the downstream walk
 					// treats presence in m as "this source detected
 					// something", and an empty entry would emit contents
-					// for an undetected CVE.
-					if len(statuses) == 0 && len(kbIDs) == 0 && len(exactCpes) == 0 && len(vpCpes) == 0 {
+					// for an undetected CVE. A suppressed source's per-CVE
+					// result counts as a signal here too.
+					if len(statuses) == 0 && len(kbIDs) == 0 && len(exactCpes) == 0 && len(vpCpes) == 0 && len(exactByCVE) == 0 && len(vpByCVE) == 0 {
 						continue
 					}
 
@@ -885,6 +923,18 @@ func walkVulnerabilityDetections(m map[source]sourceData, scanned scanTypes.Scan
 					base.kbIDs = append(base.kbIDs, kbIDs...)
 					base.exactCpes = append(base.exactCpes, exactCpes...)
 					base.vpCpes = append(base.vpCpes, vpCpes...)
+					for cveID, cpes := range exactByCVE {
+						if base.exactCpesByCVE == nil {
+							base.exactCpesByCVE = map[string][]string{}
+						}
+						base.exactCpesByCVE[cveID] = append(base.exactCpesByCVE[cveID], cpes...)
+					}
+					for cveID, cpes := range vpByCVE {
+						if base.vpCpesByCVE == nil {
+							base.vpCpesByCVE = map[string][]string{}
+						}
+						base.vpCpesByCVE[cveID] = append(base.vpCpesByCVE[cveID], cpes...)
+					}
 					m[src] = base
 				}
 			}
@@ -1161,9 +1211,10 @@ func hasSuppressedCPESource(v detectTypes.VulnerabilityData) bool {
 // while NVD is under the CVE root), so the verified data is gathered across all
 // roots that alias the CVE via GetVulnerabilityDataByVulnerabilityID. Results
 // are cached per CVE so VulnCheck and JVN detections of the same CVE share one
-// bolt read. The returned map is keyed by the suppressed source's RootID for a
-// direct lookup in walkVulnerabilityDetections.
-func collectVerifiedProducts(sesh *session.Session, detected detectTypes.DetectResult) (map[dataTypes.RootID]map[string]struct{}, error) {
+// bolt read. The returned map is keyed by the suppressed source's RootID, then
+// by constituent CVE ID, so a multi-CVE root keeps each CVE's verified product
+// set separate (a verified product for one CVE must not suppress a sibling).
+func collectVerifiedProducts(sesh *session.Session, detected detectTypes.DetectResult) (map[dataTypes.RootID]map[string]map[string]struct{}, error) {
 	cache := make(map[string]map[string]struct{})
 	productsFor := func(cveID string) (map[string]struct{}, error) {
 		if set, ok := cache[cveID]; ok {
@@ -1193,23 +1244,23 @@ func collectVerifiedProducts(sesh *session.Session, detected detectTypes.DetectR
 		return set, nil
 	}
 
-	out := make(map[dataTypes.RootID]map[string]struct{})
+	out := make(map[dataTypes.RootID]map[string]map[string]struct{})
 	for _, v := range detected.Detected {
 		if !hasSuppressedCPESource(v) {
 			continue
 		}
-		merged := make(map[string]struct{})
+		byCVE := make(map[string]map[string]struct{})
 		for _, cveID := range cveIDsOf(v) {
 			set, err := productsFor(cveID)
 			if err != nil {
 				return nil, xerrors.Errorf("Failed to get verified products. CVE-ID: %s, err: %w", cveID, err)
 			}
-			for k := range set {
-				merged[k] = struct{}{}
+			if len(set) > 0 {
+				byCVE[cveID] = set
 			}
 		}
-		if len(merged) > 0 {
-			out[v.ID] = merged
+		if len(byCVE) > 0 {
+			out[v.ID] = byCVE
 		}
 	}
 	return out, nil
diff --git a/detector/vuls2/vuls2_test.go b/detector/vuls2/vuls2_test.go
@@ -711,6 +711,7 @@ func Test_postConvert(t *testing.T) {
 		scanned         scanTypes.ScanResult
 		detected        detectTypes.DetectResult
 		fsToOriginalCPE map[string][]string
+		verified        map[dataTypes.RootID]map[string]map[string]struct{}
 	}
 	tests := []struct {
 		name    string
@@ -11353,10 +11354,194 @@ func Test_postConvert(t *testing.T) {
 				},
 			},
 		},
+		{
+			// A multi-CVE JVN root: one advisory and one CPE detection block
+			// shared by CVE-2024-30001 and CVE-2024-30002. A verified source
+			// defines a:vendor:product only for CVE-2024-30001, so the per-CVE
+			// walk suppresses the scanned CPE for that CVE alone — CVE-2024-30001
+			// drops out entirely while its sibling CVE-2024-30002 still detects
+			// (demoted to vendor:product, with the shared DistroAdvisory).
+			name: "cpe jvn multi-CVE root: verified product suppresses only its own CVE, not the sibling",
+			args: args{
+				scanned: scanTypes.ScanResult{
+					CPE: []string{
+						"cpe:2.3:a:vendor:product:0.0.0:*:*:*:*:*:*:*",
+					},
+				},
+				fsToOriginalCPE: map[string][]string{
+					"cpe:2.3:a:vendor:product:0.0.0:*:*:*:*:*:*:*": {"cpe:/a:vendor:product:0.0.0"},
+				},
+				verified: map[dataTypes.RootID]map[string]map[string]struct{}{
+					"JVNDB-2024-000456": {
+						"CVE-2024-30001": {"a:vendor:product": {}},
+					},
+				},
+				detected: detectTypes.DetectResult{
+					Detected: []detectTypes.VulnerabilityData{
+						{
+							ID: "JVNDB-2024-000456",
+							Advisories: []dbTypes.VulnerabilityDataAdvisory{
+								{
+									ID: "JVNDB-2024-000456",
+									Contents: map[sourceTypes.SourceID]map[dataTypes.RootID][]advisoryTypes.Advisory{
+										sourceTypes.JVNFeedRSS: {
+											dataTypes.RootID("JVNDB-2024-000456"): []advisoryTypes.Advisory{
+												{
+													Content: advisoryContentTypes.Content{
+														ID:          "JVNDB-2024-000456",
+														Title:       "advisory title",
+														Description: "advisory description",
+														Published:   new(time.Date(2024, 1, 2, 0, 0, 0, 0, time.UTC)),
+													},
+													Segments: []segmentTypes.Segment{
+														{
+															Ecosystem: ecosystemTypes.EcosystemTypeCPE,
+														},
+													},
+												},
+											},
+										},
+									},
+								},
+							},
+							Vulnerabilities: []dbTypes.VulnerabilityDataVulnerability{
+								{
+									ID: "CVE-2024-30001",
+									Contents: map[sourceTypes.SourceID]map[dataTypes.RootID][]vulnerabilityTypes.Vulnerability{
+										sourceTypes.JVNFeedRSS: {
+											dataTypes.RootID("JVNDB-2024-000456"): {
+												{
+													Content: vulnerabilityContentTypes.Content{
+														ID:          "CVE-2024-30001",
+														Title:       "title 30001",
+														Description: "description 30001",
+														References: []referenceTypes.Reference{
+															{
+																URL: "https://jvn.jp/vu/JVNVU90009999/index.html",
+															},
+														},
+														Published: new(time.Date(2024, 1, 1, 0, 0, 0, 0, time.UTC)),
+													},
+													Segments: []segmentTypes.Segment{
+														{
+															Ecosystem: ecosystemTypes.EcosystemTypeCPE,
+														},
+													},
+												},
+											},
+										},
+									},
+								},
+								{
+									ID: "CVE-2024-30002",
+									Contents: map[sourceTypes.SourceID]map[dataTypes.RootID][]vulnerabilityTypes.Vulnerability{
+										sourceTypes.JVNFeedRSS: {
+											dataTypes.RootID("JVNDB-2024-000456"): {
+												{
+													Content: vulnerabilityContentTypes.Content{
+														ID:          "CVE-2024-30002",
+														Title:       "title 30002",
+														Description: "description 30002",
+														References: []referenceTypes.Reference{
+															{
+																URL: "https://jvn.jp/vu/JVNVU90009999/index.html",
+															},
+														},
+														Published: new(time.Date(2024, 1, 1, 0, 0, 0, 0, time.UTC)),
+													},
+													Segments: []segmentTypes.Segment{
+														{
+															Ecosystem: ecosystemTypes.EcosystemTypeCPE,
+														},
+													},
+												},
+											},
+										},
+									},
+								},
+							},
+							Detections: []detectTypes.VulnerabilityDataDetection{
+								{
+									Ecosystem: ecosystemTypes.EcosystemTypeCPE,
+									Contents: map[sourceTypes.SourceID][]conditionTypes.FilteredCondition{
+										sourceTypes.JVNFeedRSS: {
+											{
+												Criteria: criteriaTypes.FilteredCriteria{
+													Operator: criteriaTypes.CriteriaOperatorTypeOR,
+													Criterions: []criterionTypes.FilteredCriterion{
+														{
+															Criterion: criterionTypes.Criterion{
+																Type: criterionTypes.CriterionTypeCPE,
+																CPE: new(ccTypes.Criterion{
+																	Vulnerable: true,
+																	FixStatus: new(vcFixStatusTypes.FixStatus{
+																		Class: vcFixStatusTypes.ClassUnknown,
+																	}),
+																	CPE: ccTypes.CPE("cpe:2.3:a:vendor:product:0.0.0:*:*:*:*:*:*:*"),
+																}),
+															},
+															Accepts: criterionTypes.AcceptQueries{
+																CPE: criterionTypes.CPEAccepts{Exact: []int{0}},
+															},
+														},
+													},
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			want: models.VulnInfos{
+				"CVE-2024-30002": {
+					CveID:       "CVE-2024-30002",
+					Confidences: models.Confidences{models.JvnVendorProductMatch},
+					CpeURIs:     []string{"cpe:/a:vendor:product:0.0.0"},
+					DistroAdvisories: models.DistroAdvisories{
+						{
+							AdvisoryID:  "JVNDB-2024-000456",
+							Description: "advisory description",
+							Issued:      time.Date(2024, 1, 2, 0, 0, 0, 0, time.UTC),
+							Updated:     time.Date(1000, time.January, 1, 0, 0, 0, 0, time.UTC),
+						},
+					},
+					CveContents: models.CveContents{
+						models.Jvn: []models.CveContent{
+							{
+								Type:       models.Jvn,
+								CveID:      "CVE-2024-30002",
+								Title:      "title 30002",
+								Summary:    "description 30002",
+								SourceLink: "https://jvndb.jvn.jp/ja/contents/2024/JVNDB-2024-000456.html",
+								References: models.References{
+									{
+										Link:   "https://jvn.jp/vu/JVNVU90009999/index.html",
+										Source: "MISC",
+									},
+									{
+										Link:   "https://jvndb.jvn.jp/ja/contents/2024/JVNDB-2024-000456.html",
+										Source: "JVN",
+										RefID:  "JVNDB-2024-000456",
+									},
+								},
+								Published:    time.Date(2024, 1, 1, 0, 0, 0, 0, time.UTC),
+								LastModified: time.Date(1000, time.January, 1, 0, 0, 0, 0, time.UTC),
+								Optional: map[string]string{
+									"vuls2-sources": "[{\"root_id\":\"JVNDB-2024-000456\",\"source_id\":\"jvn-feed-rss\",\"segment\":{\"ecosystem\":\"cpe\"}}]",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got, err := vuls2.PostConvert(tt.args.scanned, tt.args.detected, tt.args.fsToOriginalCPE, nil, nil)
+			got, err := vuls2.PostConvert(tt.args.scanned, tt.args.detected, tt.args.fsToOriginalCPE, nil, tt.args.verified)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("postConvert() error = %v, wantErr %v", err, tt.wantErr)
 				return
