Populate vulnerability.reference with a link to NVD (#1303)

* opulate vulnerability.reference with a link to NVD

* revert the if statemenet

.gitignore

@@ -73,3 +73,4 @@ terraform.rc
 # Vulnerability management
 db/
 fanal/
+java-db/

vulnerability/events_creator.go

@@ -322,7 +322,7 @@ func (e EventsCreator) generateEvent(reportResult trivyTypes.Result, vul trivyTy
 				ID:             vul.VulnerabilityID,
 				Title:          vul.Title,
 				Enumeration:    getIdentifierType(vul.VulnerabilityID),
-				Reference:      vul.PrimaryURL,
+				Reference:      getReference(vul),
 				Description:    vul.Description,
 				Severity:       vul.Severity,
 				Classification: vulScoreSystemClass,
@@ -391,6 +391,16 @@ func (e EventsCreator) getCVSSScore(vul trivyTypes.DetectedVulnerability) float6
 	return getCVSSValue(vul, func(cvss dbTypes.CVSS) float64 { return cvss.V2Score }, zeroVal)
 }
 
+const NVDVulnDetailBaseURL = "https://nvd.nist.gov/vuln/detail/"
+
+func getReference(vul trivyTypes.DetectedVulnerability) string {
+	if _, ok := vul.CVSS[trivyVul.NVD]; !ok {
+		return vul.PrimaryURL
+	}
+
+	return fmt.Sprintf("%s%s", NVDVulnDetailBaseURL, vul.VulnerabilityID)
+}
+
 func getCVSSValue[T comparable](vul trivyTypes.DetectedVulnerability, value func(cvss dbTypes.CVSS) T, zeroVal T) T {
 	// Get all the sources
 	sources := maps.Keys(vul.CVSS)

vulnerability/events_creator_test.go

@@ -289,3 +289,66 @@ func TestEventsCreator_getCVSSScore(t *testing.T) {
 		})
 	}
 }
+
+func TestEventsCreator_getReference(t *testing.T) {
+	tests := []struct {
+		name string
+		vul  types.DetectedVulnerability
+		want string
+	}{
+		{
+			name: "CVSS is nil",
+			vul: types.DetectedVulnerability{
+				Vulnerability: dbTypes.Vulnerability{
+					CVSS: nil,
+				},
+				PrimaryURL:      "https://example.com/primary",
+				VulnerabilityID: "someID",
+			},
+			want: "https://example.com/primary",
+		},
+		{
+			name: "CVSS contains NVD",
+			vul: types.DetectedVulnerability{
+				Vulnerability: dbTypes.Vulnerability{
+					CVSS: dbTypes.VendorCVSS{
+						trivyVul.RedHat: dbTypes.CVSS{
+							V2Vector: "AV:N/AC:M/Au:N/C:V/I:P/A:N",
+							V2Score:  3.0,
+						},
+						trivyVul.NVD: dbTypes.CVSS{
+							V2Vector: "AV:L/AC:L/Au:N/C:C/I:C/A:C",
+							V2Score:  3.2,
+						},
+					},
+				},
+				PrimaryURL:      "https://example.com/primary",
+				VulnerabilityID: "someID",
+			},
+			want: "https://nvd.nist.gov/vuln/detail/someID",
+		},
+		{
+			name: "CVSS does not contain NVD",
+			vul: types.DetectedVulnerability{
+				Vulnerability: dbTypes.Vulnerability{
+					CVSS: dbTypes.VendorCVSS{
+						trivyVul.RedHat: dbTypes.CVSS{
+							V2Vector: "AV:N/AC:M/Au:N/C:V/I:P/A:N",
+							V2Score:  3.0,
+						},
+					},
+				},
+				PrimaryURL:      "https://example.com/primary",
+				VulnerabilityID: "someID",
+			},
+			want: "https://example.com/primary",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			result := getReference(test.vul)
+			assert.Equal(t, test.want, result)
+		})
+	}
+}