Use Technology in issue first (#279)

jfrog · Jan 6, 2025 · 333ac33 · 333ac33
1 parent f077d9d
commit 333ac33
Show file tree

Hide file tree

Showing 5 changed files with 36 additions and 37 deletions.
diff --git a/tests/testdata/projects/package-managers/python/poetry/poetry-project/poetry.lock b/tests/testdata/projects/package-managers/python/poetry/poetry-project/poetry.lock
diff --git a/tests/testdata/projects/package-managers/python/poetry/poetry-project/pyproject.toml b/tests/testdata/projects/package-managers/python/poetry/poetry-project/pyproject.toml
@@ -3,14 +3,15 @@ name = "poetry-project"
 version = "0.1.0"
 description = ""
 authors = ["Your Name <[email protected]>"]
+package-mode = false
 
 [tool.poetry.dependencies]
 python = "*"
 urllib3 = "<1.24"
 django = "<1.11.16"
 Werkzeug = "<0.10"
 
-[tool.poetry.dev-dependencies]
+[tool.poetry.group.dev.dependencies]
 
 [build-system]
 requires = ["poetry-core>=1.0.0"]

diff --git a/tests/testdata/projects/package-managers/python/poetry/poetry/pyproject.toml b/tests/testdata/projects/package-managers/python/poetry/poetry/pyproject.toml
@@ -3,6 +3,7 @@ name = "my-poetry-project"
 version = "1.1.0"
 description = ""
 authors = ["Severus Snape <[email protected]>"]
+package-mode = false
 
 [tool.poetry.dependencies]
 python = "^3.10"

diff --git a/utils/results/common.go b/utils/results/common.go
@@ -645,3 +645,13 @@ func ScanResultsToRuns(results []ScanResult[[]*sarif.Run]) (runs []*sarif.Run) {
 	}
 	return
 }
+
+// Resolve the actual technology from multiple sources:
+func GetIssueTechnology(responseTechnology string, targetTech techutils.Technology) techutils.Technology {
+	if responseTechnology != "" {
+		// technology returned in the vulnerability/violation obj is the most specific technology
+		return techutils.Technology(responseTechnology)
+	}
+	// if no technology is provided, use the target technology
+	return targetTech
+}
diff --git a/utils/results/conversion/simplejsonparser/simplejsonparser.go b/utils/results/conversion/simplejsonparser/simplejsonparser.go
@@ -10,7 +10,6 @@ import (
 	"github.com/jfrog/jfrog-cli-security/utils/jasutils"
 	"github.com/jfrog/jfrog-cli-security/utils/results"
 	"github.com/jfrog/jfrog-cli-security/utils/severityutils"
-	"github.com/jfrog/jfrog-cli-security/utils/techutils"
 	"github.com/jfrog/jfrog-client-go/xray/services"
 	"github.com/owenrumney/go-sarif/v2/sarif"
 )
@@ -236,10 +235,6 @@ func PrepareSimpleJsonVulnerabilities(target results.ScanTarget, scaResponse ser
 
 func addSimpleJsonVulnerability(target results.ScanTarget, vulnerabilitiesRows *[]formats.VulnerabilityOrViolationRow, pretty bool) results.ParseScaVulnerabilityFunc {
 	return func(vulnerability services.Vulnerability, cves []formats.CveRow, applicabilityStatus jasutils.ApplicabilityStatus, severity severityutils.Severity, impactedPackagesName, impactedPackagesVersion, impactedPackagesType string, fixedVersion []string, directComponents []formats.ComponentRow, impactPaths [][]formats.ComponentRow) error {
-		tech := target.Technology
-		if tech == "" {
-			tech = techutils.Technology(impactedPackagesType)
-		}
 		*vulnerabilitiesRows = append(*vulnerabilitiesRows,
 			formats.VulnerabilityOrViolationRow{
 				Summary: vulnerability.Summary,
@@ -256,7 +251,7 @@ func addSimpleJsonVulnerability(target results.ScanTarget, vulnerabilitiesRows *
 				References:               vulnerability.References,
 				JfrogResearchInformation: convertJfrogResearchInformation(vulnerability.ExtendedInformation),
 				ImpactPaths:              impactPaths,
-				Technology:               tech,
+				Technology:               results.GetIssueTechnology(vulnerability.Technology, target.Technology),
 				Applicable:               applicabilityStatus.ToString(pretty),
 			},
 		)
@@ -266,10 +261,6 @@ func addSimpleJsonVulnerability(target results.ScanTarget, vulnerabilitiesRows *
 
 func addSimpleJsonSecurityViolation(target results.ScanTarget, securityViolationsRows *[]formats.VulnerabilityOrViolationRow, pretty bool) results.ParseScaViolationFunc {
 	return func(violation services.Violation, cves []formats.CveRow, applicabilityStatus jasutils.ApplicabilityStatus, severity severityutils.Severity, impactedPackagesName, impactedPackagesVersion, impactedPackagesType string, fixedVersion []string, directComponents []formats.ComponentRow, impactPaths [][]formats.ComponentRow) error {
-		tech := target.Technology
-		if tech == "" {
-			tech = techutils.Technology(impactedPackagesType)
-		}
 		*securityViolationsRows = append(*securityViolationsRows,
 			formats.VulnerabilityOrViolationRow{
 				Summary: violation.Summary,
@@ -290,7 +281,7 @@ func addSimpleJsonSecurityViolation(target results.ScanTarget, securityViolation
 				References:               violation.References,
 				JfrogResearchInformation: convertJfrogResearchInformation(violation.ExtendedInformation),
 				ImpactPaths:              impactPaths,
-				Technology:               tech,
+				Technology:               results.GetIssueTechnology(violation.Technology, target.Technology),
 				Applicable:               applicabilityStatus.ToString(pretty),
 			},
 		)