Added organization in vulnerability (#2258)

added organization in vulnerability in backend

Author: Cheshiriks

db/test-data/sqlRequests/vulnerability.csv

@@ -1,6 +1,6 @@
-id;name;progress;is_active;create_date;update_date;user_id;description;short_description;language;related_link;vulnerability_identifier
-1;"CVE-2022-22978";98;1;"2021-01-01 00:00:00";"2021-01-01 00:00:00";1;"In Spring Security versions 5.5.6 and 5.6.3 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass";Incorrect Authorization;JAVA;https://spring.io/security/cve-2022-22978;
-2;"CVE-2022-44697";78;1;"2021-01-01 00:00:00";"2021-01-01 00:00:00";1;"New description";Short description;JAVA;;
-3;"CVE-2023-22475";61;1;"2021-01-01 00:00:00";"2021-01-01 00:00:00";1;"New description";Short description;JAVA;;
-4;"CVE-2022-25365";78;1;"2021-01-01 00:00:00";"2021-01-01 00:00:00";1;"New description";Short description;JAVA;;
-5;"CVE-2022-25296";73;1;"2021-01-01 00:00:00";"2021-01-01 00:00:00";1;"New description";Short description;JAVA;;
+id;name;progress;is_active;create_date;update_date;user_id;description;short_description;language;related_link;vulnerability_identifier;organization_id
+1;"CVE-2022-22978";98;1;"2021-01-01 00:00:00";"2021-01-01 00:00:00";1;"In Spring Security versions 5.5.6 and 5.6.3 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass";Incorrect Authorization;JAVA;https://spring.io/security/cve-2022-22978;;1
+2;"CVE-2022-44697";78;1;"2021-01-01 00:00:00";"2021-01-01 00:00:00";1;"New description";Short description;JAVA;;;
+3;"CVE-2023-22475";61;1;"2021-01-01 00:00:00";"2021-01-01 00:00:00";1;"New description";Short description;JAVA;;;
+4;"CVE-2022-25365";78;1;"2021-01-01 00:00:00";"2021-01-01 00:00:00";1;"New description";Short description;JAVA;;;
+5;"CVE-2022-25296";73;1;"2021-01-01 00:00:00";"2021-01-01 00:00:00";1;"New description";Short description;JAVA;;;

db/test-data/vulnerability-insert.xml

@@ -18,6 +18,7 @@
             <column header="language" name="language" type="varchar(64)"/>
             <column header="related_link" name="related_link" type="varchar(64)"/>
             <column header="vulnerability_identifier" name="vulnerability_identifier" type="varchar(64)"/>
+            <column header="organization_id" name="organization_id" type="bigint"/>
         </loadData>
     </changeSet>
 

db/v-2/tables/vulnerability.xml

@@ -76,4 +76,10 @@
         </addColumn>
     </changeSet>
 
+    <changeSet id="vulnerability-9" author="frolov" context="dev or prod">
+        <addColumn tableName="vulnerability">
+            <column name="organization_id" type="bigint"/>
+        </addColumn>
+    </changeSet>
+
 </databaseChangeLog>

save-backend/src/main/kotlin/com/saveourtool/save/backend/service/vulnerability/VulnerabilityService.kt

@@ -1,6 +1,7 @@
 package com.saveourtool.save.backend.service.vulnerability
 
 import com.saveourtool.save.authservice.utils.AuthenticationDetails
+import com.saveourtool.save.backend.repository.OrganizationRepository
 import com.saveourtool.save.backend.repository.UserRepository
 import com.saveourtool.save.backend.repository.vulnerability.VulnerabilityProjectRepository
 import com.saveourtool.save.backend.repository.vulnerability.VulnerabilityRepository
@@ -27,6 +28,7 @@ class VulnerabilityService(
     private val vulnerabilityRepository: VulnerabilityRepository,
     private val vulnerabilityProjectRepository: VulnerabilityProjectRepository,
     private val userRepository: UserRepository,
+    private val organizationRepository: OrganizationRepository,
 ) {
     /**
      * @param vulnerabilityIdentifier identifier of vulnerability
@@ -136,6 +138,7 @@ class VulnerabilityService(
     ) {
         val userId = (authentication.details as AuthenticationDetails).id
         val user = userRepository.getByIdOrNotFound(userId)
+        val organizationNew = vulnerabilityDto.organization?.name?.let { organizationRepository.findByName(it) }
         val vulnerability = Vulnerability(
             name = "default-${Random.nextInt()}",
             vulnerabilityIdentifier = vulnerabilityDto.vulnerabilityIdentifier,
@@ -147,6 +150,7 @@ class VulnerabilityService(
             projects = emptyList(),
             isActive = false,
             userId = user.requiredId(),
+            organization = organizationNew,
         )
         val vulnerabilityNew = vulnerabilityRepository.saveAndFlush(vulnerability)
         val newName = "SOTV-${LocalDateTime.now().year}-${vulnerabilityNew.id}"
@@ -206,9 +210,15 @@ class VulnerabilityService(
 
         val user = userRepository.getByIdOrNotFound(vulnerability.userId)
         user.apply {
-            rating += VULNERABILITY_RATING
+            rating += VULNERABILITY_OWNER_RATING
         }
         userRepository.save(user)
+
+        vulnerabilityDto.organization?.name?.let { organizationName ->
+            val organizationNew = organizationRepository.findByName(organizationName).orNotFound { "Not found organization by name = $organizationName" }
+            organizationNew.apply { rating += VULNERABILITY_ORGANIZATION_RATING }
+            organizationRepository.save(organizationNew)
+        }
     }
 
     /**
@@ -250,6 +260,7 @@ class VulnerabilityService(
     fun deleteProject(name: String, vulnerabilityName: String) = vulnerabilityProjectRepository.deleteByNameAndVulnerabilityName(name, vulnerabilityName)
 
     companion object {
-        private const val VULNERABILITY_RATING = 10
+        private const val VULNERABILITY_ORGANIZATION_RATING = 10
+        private const val VULNERABILITY_OWNER_RATING = 10
     }
 }

save-cloud-common/src/commonMain/kotlin/com/saveourtool/save/entities/vulnerability/VulnerabilityDto.kt

@@ -1,5 +1,6 @@
 package com.saveourtool.save.entities.vulnerability
 
+import com.saveourtool.save.entities.OrganizationDto
 import kotlinx.serialization.Serializable
 
 /**
@@ -13,6 +14,7 @@ import kotlinx.serialization.Serializable
  * @property relatedLink
  * @property language
  * @property vulnerabilityIdentifier
+ * @property organization
  */
 @Serializable
 data class VulnerabilityDto(
@@ -26,6 +28,7 @@ data class VulnerabilityDto(
     val language: VulnerabilityLanguage,
     val isActive: Boolean,
     val userId: Long,
+    val organization: OrganizationDto?
 ) {
     companion object {
         val empty = VulnerabilityDto(
@@ -39,6 +42,7 @@ data class VulnerabilityDto(
             VulnerabilityLanguage.OTHER,
             false,
             -1,
+            null,
         )
     }
 }

save-cloud-common/src/jvmMain/kotlin/com/saveourtool/save/entities/vulnerabilities/Vulnerability.kt

@@ -1,5 +1,6 @@
 package com.saveourtool.save.entities.vulnerabilities
 
+import com.saveourtool.save.entities.Organization
 import com.saveourtool.save.entities.vulnerability.VulnerabilityDto
 import com.saveourtool.save.entities.vulnerability.VulnerabilityLanguage
 import com.saveourtool.save.spring.entity.BaseEntityWithDateAndDto
@@ -19,6 +20,7 @@ import javax.persistence.*
  * @property shortDescription short description of vulnerability
  * @property relatedLink
  * @property language
+ * @property organization
  **/
 @Entity
 @Suppress("LongParameterList")
@@ -52,6 +54,10 @@ class Vulnerability(
 
     var vulnerabilityIdentifier: String?,
 
+    @ManyToOne
+    @JoinColumn(name = "organization_id")
+    var organization: Organization?,
+
 ) : BaseEntityWithDateAndDto<VulnerabilityDto>() {
     /**
      * @return a vulnerability dto
@@ -67,6 +73,7 @@ class Vulnerability(
         language = language,
         isActive = isActive,
         userId = userId,
+        organization = organization?.toDto(),
     )
 
     /**
@@ -83,5 +90,6 @@ class Vulnerability(
         language = language,
         isActive = isActive,
         userId = userId,
+        organization = organization?.toDto(),
     )
 }

save-frontend/src/main/kotlin/com/saveourtool/save/frontend/components/views/fossgraph/CreateVulnerabilityView.kt

@@ -204,7 +204,7 @@ val createVulnerabilityView: VFC = VFC {
                                     textValue = vulnerability.vulnerabilityIdentifier
                                     validInput = !duplicateVulnerability.isNotNull()
                                     classes = "col-12 mt-3 mb-3 pl-2 pr-2 text-left"
-                                    name = "Vulnerability identifier"
+                                    name = "Original vulnerability identifier"
                                     onChangeFun = { event ->
                                         setVulnerability { it.copy(vulnerabilityIdentifier = event.target.value) }
                                         setDuplicateVulnerability(null)

save-frontend/src/main/kotlin/com/saveourtool/save/frontend/components/views/fossgraph/FossGraphView.kt

@@ -190,7 +190,7 @@ val fossGraph: FC<FossGraphViewProps> = FC { props ->
                             hr { }
                             h6 {
                                 className = ClassName("font-weight-bold text-primary mb-4")
-                                +"Identifier"
+                                +"Original Identifier"
                             }
                             div {
                                 +"${vulnerability.vulnerabilityIdentifier}"