{% include 'includes/filters_breadcrumbs.html' with filterset=filterset fragment=tab_id only %}
diff --git a/dje/tests/test_forms.py b/dje/tests/test_forms.py
index ed21e465..2bd70bdd 100644
--- a/dje/tests/test_forms.py
+++ b/dje/tests/test_forms.py
@@ -110,7 +110,7 @@ def test_tabs_permission_formset_load_perms(self):
def test_copy_defaults_form_get_all_dataspaced_models(self):
dataspaced_models = CopyDefaultsForm.get_all_dataspaced_models()
- self.assertEqual(10, len(dataspaced_models))
+ self.assertEqual(11, len(dataspaced_models))
self.assertEqual(7, len(dataspaced_models.get("Component Catalog")))
self.assertIn("Subcomponent", str(dataspaced_models.get("Component Catalog")))
diff --git a/product_portfolio/admin.py b/product_portfolio/admin.py
index 36ece772..ccb1789d 100644
--- a/product_portfolio/admin.py
+++ b/product_portfolio/admin.py
@@ -72,6 +72,7 @@
from product_portfolio.models import ProductRelationStatus
from product_portfolio.models import ProductStatus
from reporting.filters import ReportingQueryListFilter
+from vulnerabilities.triage.models import ProductTriageRuleset
@admin.register(ProductStatus, site=dejacode_site)
@@ -240,7 +241,7 @@ def save_model(self, request, obj, form, change):
if "_saveasnew" in request.POST:
old_product_id = request.resolver_match.kwargs.get("object_id")
old_product = self.get_object(request, old_product_id)
- for model_class in [ProductComponent, ProductPackage]:
+ for model_class in [ProductComponent, ProductPackage, ProductTriageRuleset]:
for relationship in model_class.objects.filter(product=old_product):
relationship.id = None
relationship.uuid = uuid.uuid4()
diff --git a/product_portfolio/filters.py b/product_portfolio/filters.py
index 06134052..5c40ff65 100644
--- a/product_portfolio/filters.py
+++ b/product_portfolio/filters.py
@@ -43,6 +43,8 @@
from vulnerabilities.models import RISK_SCORE_RANGES
from vulnerabilities.models import Vulnerability
from vulnerabilities.models import VulnerabilityAnalysisMixin
+from vulnerabilities.triage.models import TriageAction
+from vulnerabilities.triage.models import TriageRecord
class HasComplianceIssueFilter(django_filters.BooleanFilter):
@@ -366,6 +368,7 @@ class ProductPackageFilterSet(BaseProductRelationFilterSet):
dropdown_fields = [
"is_modified",
"weighted_risk_score",
+ "triage_action",
"vulnerability_analyses__state",
"vulnerability_analyses__justification",
"responses",
@@ -419,6 +422,12 @@ class ProductPackageFilterSet(BaseProductRelationFilterSet):
("unknown", _("Reachability not known")),
),
)
+ triage_action = django_filters.ChoiceFilter(
+ label=_("Triage action"),
+ choices=TriageAction.choices,
+ empty_label=_("All actions"),
+ method="filter_triage_action",
+ )
compliance_issues = HasComplianceIssueFilter(
field_name="package__usage_policy__compliance_alert",
distinct=True,
@@ -438,6 +447,17 @@ class Meta:
"exploitability",
]
+ @staticmethod
+ def filter_triage_action(queryset, name, value):
+ if not value:
+ return queryset
+ primary_triage = TriageRecord.objects.highest_precedence().filter(
+ product=OuterRef("product"),
+ vulnerability__affected_packages__productpackages=OuterRef("pk"),
+ recommended_action=value,
+ )
+ return queryset.filter(Exists(primary_triage)).distinct()
+
def __init__(self, *args, **kwargs):
super().__init__(*args, **kwargs)
self.filters["vulnerability_analyses__state"].extra["null_label"] = "(No values)"
diff --git a/product_portfolio/forms.py b/product_portfolio/forms.py
index 6c7482b3..57cf9eab 100644
--- a/product_portfolio/forms.py
+++ b/product_portfolio/forms.py
@@ -58,6 +58,7 @@
from product_portfolio.models import ScanCodeProject
from product_portfolio.tasks import pull_project_data_from_scancodeio_task
from product_portfolio.tasks import scancodeio_submit_project_task
+from vulnerabilities.triage.models import ProductTriageRuleset
class NameVersionValidationFormMixin:
@@ -106,6 +107,7 @@ class ProductForm(
ProductComponent,
ProductPackage,
CodebaseResource,
+ ProductTriageRuleset,
]
keywords = KeywordsField()
diff --git a/product_portfolio/models.py b/product_portfolio/models.py
index b540f38b..a14b6ae9 100644
--- a/product_portfolio/models.py
+++ b/product_portfolio/models.py
@@ -495,6 +495,9 @@ def get_export_security_compliance_url(self):
def get_evaluate_policy_rules_url(self):
return self.get_url("evaluate_policy_rules")
+ def get_manage_triage_rulesets_url(self):
+ return self.get_url("manage_triage_rulesets")
+
@property
def cyclonedx_bom_ref(self):
return str(self.uuid)
diff --git a/product_portfolio/templates/product_portfolio/includes/manage_triage_rules_nav_item.html b/product_portfolio/templates/product_portfolio/includes/manage_triage_rules_nav_item.html
new file mode 100644
index 00000000..39b21042
--- /dev/null
+++ b/product_portfolio/templates/product_portfolio/includes/manage_triage_rules_nav_item.html
@@ -0,0 +1,6 @@
+{% load i18n %}
+
+
+
+
diff --git a/product_portfolio/templates/product_portfolio/modals/manage_triage_rulesets_form.html b/product_portfolio/templates/product_portfolio/modals/manage_triage_rulesets_form.html
new file mode 100644
index 00000000..51a4aed6
--- /dev/null
+++ b/product_portfolio/templates/product_portfolio/modals/manage_triage_rulesets_form.html
@@ -0,0 +1,61 @@
+{% load i18n %}
+
diff --git a/product_portfolio/templates/product_portfolio/modals/manage_triage_rulesets_modal.html b/product_portfolio/templates/product_portfolio/modals/manage_triage_rulesets_modal.html
new file mode 100644
index 00000000..e8bc1efb
--- /dev/null
+++ b/product_portfolio/templates/product_portfolio/modals/manage_triage_rulesets_modal.html
@@ -0,0 +1,17 @@
+{% load i18n %}
+
diff --git a/product_portfolio/templates/product_portfolio/product_details.html b/product_portfolio/templates/product_portfolio/product_details.html
index cfe9dbeb..b093ccf8 100644
--- a/product_portfolio/templates/product_portfolio/product_details.html
+++ b/product_portfolio/templates/product_portfolio/product_details.html
@@ -10,7 +10,7 @@
Manage
- {% elif has_edit_productcomponent or has_edit_productpackage or has_change_codebaseresource_permission or has_add_productcomponent %}
+ {% elif has_edit_productcomponent or has_edit_productpackage or has_change_codebaseresource_permission or has_add_productcomponent or has_change_permission %}
{% endif %}
@@ -148,6 +158,9 @@
{% if request.user.dataspace.enable_vulnerablecodedb_access and product.vulnerability_count %}
{% include 'product_portfolio/modals/vulnerability_analysis_modal.html' %}
{% endif %}
+ {% if has_change_permission and request.user.dataspace.enable_vulnerablecodedb_access %}
+ {% include 'product_portfolio/modals/manage_triage_rulesets_modal.html' %}
+ {% endif %}
{% endblock %}
{% block messages-alert %}
@@ -281,6 +294,40 @@
{% endif %}
+ {% if has_change_permission and request.user.dataspace.enable_vulnerablecodedb_access %}
+
+ {% endif %}
+
{% if request.user.dataspace.enable_vulnerablecodedb_access and product.vulnerability_count %}
{% endif %}
diff --git a/product_portfolio/templates/product_portfolio/tabs/tab_packages_vulnerabilities.html b/product_portfolio/templates/product_portfolio/tabs/tab_packages_vulnerabilities.html
index 43ed66a3..9c886d78 100644
--- a/product_portfolio/templates/product_portfolio/tabs/tab_packages_vulnerabilities.html
+++ b/product_portfolio/templates/product_portfolio/tabs/tab_packages_vulnerabilities.html
@@ -1,7 +1,7 @@
{% load i18n %}
{% load as_icon from dje_tags %}
-{% include 'tabs/pagination.html' with search_verbose_name="packages" %}
+{% include 'tabs/pagination.html' with search_verbose_name="packages" extra_nav_item_template=manage_triage_rules_nav_item_template %}
{% if risk_threshold %}
@@ -14,33 +14,36 @@
{% include 'includes/object_list_table_header.html' with filter=filterset include_actions=True %}
{% for product_package in page_obj.object_list %}
+ {% if product_package.display_vulnerabilities %}
-
+
{{ product_package.package }}
- {% if product_package.purpose %}
-
- {{ product_package.purpose.label_with_icon }}
- {% if product_package.purpose.exposure_factor %}
-
-
+
+ {% with score=product_package.weighted_risk_score %}
+ {% if score %}
+
+ {% trans "Risk" %} {{ score }}
+
{% endif %}
-
- {{ product_package.is_deployed|as_icon }}
- {% if product_package.is_deployed %}Deployed{% else %}Not deployed{% endif %}
-
+ {% endwith %}
+ {% if product_package.is_deployed %}
+
{% trans "Deployed" %}
+ {% endif %}
+ {% if product_package.purpose %}
+
{{ product_package.purpose.label }}
+ {% endif %}
+
+ {% if product_package.purpose.exposure_factor %}
+
+
{% endif %}
-
- {% include 'vulnerabilities/includes/risk_score_badge.html' with risk_score=product_package.weighted_risk_score only %}
-
- {% for vulnerability in product_package.package.affected_by_vulnerabilities.all %}
+ {% for vulnerability in product_package.display_vulnerabilities %}
{% if not forloop.first %} {% endif %}
-
+
{% if vulnerability.resource_url %}
@@ -50,73 +53,148 @@
{% else %}
{{ vulnerability.advisory_id }}
{% endif %}
- {% if vulnerability.summary %}
-
-
+
{% endif %}
-
- {% include 'vulnerabilities/includes/risk_score_badge.html' with risk_score=vulnerability.risk_score label="Risk:" only %}
- {% include 'vulnerabilities/includes/exploitability.html' with instance=vulnerability only %}
-
- {% if vulnerability.aliases %}
-
- {% include 'component_catalog/includes/vulnerability_aliases.html' with aliases=vulnerability.aliases only %}
-
- {% endif %}
-
-
- {% if vulnerability.vulnerability_analysis %}
- {% if vulnerability.vulnerability_analysis.state %}
- {{ vulnerability.vulnerability_analysis.get_state_display }}
- {% endif %}
- {% if vulnerability.vulnerability_analysis.detail %}
-
-
+ {% with score=vulnerability.risk_score %}
+ {% if score %}
+
+ {% trans "Risk:" %} {{ score }}
+
+ {% endif %}
+ {% endwith %}
+ {% if vulnerability.exploitability %}
+
+ {{ vulnerability.get_exploitability_display }}
{% endif %}
- {% endif %}
-
-
- {% if vulnerability.vulnerability_analysis.justification %}
- {{ vulnerability.vulnerability_analysis.get_justification_display }}
- {% endif %}
+
+ {% if has_triage_rulesets %}
- {% if vulnerability.vulnerability_analysis.responses %}
-
- {% for response in vulnerability.vulnerability_analysis.responses %}
- {{ response }}
- {% endfor %}
-
+ {% if vulnerability.triage_record %}
+ {% with record=vulnerability.triage_record %}
+ {% if record.recommended_action %}
+
+
+ {% endif %}
+
+
+ {% if record.request %}
+
+ {% endif %}
+
+ {% trans "Since:" %} {{ record.detected_date|date:"M j, Y" }}
+
+ {% endwith %}
{% endif %}
-
- {% if vulnerability.vulnerability_analysis.is_reachable %}
-
+ {% with analysis=vulnerability.vulnerability_analysis %}
+
+ {% if analysis %}
+
+
+ {% if analysis.state %}
+
+ {{ analysis.get_state_display }}
+
+ {% endif %}
+ {% if analysis.is_reachable %}
+
+ {% if analysis.justification %}
+
{{ analysis.get_justification_display }}
+ {% endif %}
+ {% if analysis.detail %}
+
+
+ {% endif %}
+ {% if analysis.response_labels %}
+
+ {% for response in analysis.response_labels %}
+ {{ response }}
+ {% endfor %}
+
+ {% endif %}
+
+ {% if analysis.applied_by_preset %}
+
+
+ {% elif analysis.last_modified_by or analysis.created_by %}
+
+
+ {% endif %}
+ {% else %}
+
{% trans "Not analyzed" %}
+ {% endif %}
+
-
-
-
-
-
+
+
+
+ {% if vulnerability.vulnerability_analysis %}
+
+
+ {% else %}
+
+
+ {% endif %}
+
+ {% if analysis_presets and not vulnerability.vulnerability_analysis %}
+
+
+
+
+
+ {% endif %}
+
{% if not forloop.first %} {% endif %}
{% endfor %}
+ {% endif %}
{% empty %}
-
+
No results.
{% if filterset.is_active %}
@@ -127,4 +205,4 @@
{% endfor %}
-
\ No newline at end of file
+
diff --git a/product_portfolio/tests/test_admin.py b/product_portfolio/tests/test_admin.py
index 32836d5c..1e015173 100644
--- a/product_portfolio/tests/test_admin.py
+++ b/product_portfolio/tests/test_admin.py
@@ -25,6 +25,8 @@
from product_portfolio.models import ProductComponent
from product_portfolio.models import ProductPackage
from product_portfolio.tests import make_product_dependency
+from vulnerabilities.triage.models import ProductTriageRuleset
+from vulnerabilities.triage.models import TriageRuleset
class ProductPortfolioAdminsTestCase(TestCase):
@@ -430,6 +432,12 @@ def test_product_admin_changeform_save_as_includes_relationships(self):
ProductPackage.objects.create(
product=self.product1, package=self.package1, dataspace=self.dataspace
)
+ ruleset = TriageRuleset.objects.create(
+ name="Upgrade Ruleset", precedence=100, dataspace=self.dataspace
+ )
+ ProductTriageRuleset.objects.create(
+ product=self.product1, ruleset=ruleset, dataspace=self.dataspace
+ )
url = self.product1.get_admin_url()
data = {
@@ -447,6 +455,7 @@ def test_product_admin_changeform_save_as_includes_relationships(self):
new_product = Product.unsecured_objects.get(name=self.product1.name, version="new version")
self.assertEqual(1, new_product.productcomponents.count())
self.assertEqual(1, new_product.productpackages.count())
+ self.assertEqual(1, new_product.product_triage_rulesets.count())
def test_codebaseresource_admin_changeform_product_prefill_on_save_addanother(self):
self.client.login(username=self.user.username, password="secret")
diff --git a/product_portfolio/tests/test_filters.py b/product_portfolio/tests/test_filters.py
index 1dfa6173..7d5496b2 100644
--- a/product_portfolio/tests/test_filters.py
+++ b/product_portfolio/tests/test_filters.py
@@ -26,6 +26,10 @@
from product_portfolio.tests import make_product_component
from product_portfolio.tests import make_product_package
from vulnerabilities.tests import make_vulnerability
+from vulnerabilities.triage.engine import evaluate_ruleset
+from vulnerabilities.triage.models import ProductTriageRuleset
+from vulnerabilities.triage.models import TriageAction
+from vulnerabilities.triage.models import TriageRuleset
class ProductPackageFilterSetTestCase(TestCase):
@@ -187,6 +191,47 @@ def test_filter_by_vulnerability_rule_returns_distinct_results(self):
self.assertEqual(1, filterset.qs.count())
+class ProductPackageFilterByTriageActionTestCase(TestCase):
+ def setUp(self):
+ self.dataspace = Dataspace.objects.create(name="nexB")
+ self.product = make_product(self.dataspace)
+ self.pp_with_recommendation = make_product_package(
+ self.product, make_package(self.dataspace)
+ )
+ self.pp_without_recommendation = make_product_package(
+ self.product, make_package(self.dataspace)
+ )
+ make_vulnerability(
+ self.dataspace, affecting=self.pp_with_recommendation.package, risk_score=9.0
+ )
+ ruleset = TriageRuleset.objects.create(
+ name="Upgrade Ruleset",
+ recommended_action=TriageAction.UPGRADE,
+ precedence=100,
+ dataspace=self.dataspace,
+ rules_config={"risk_score": {"is_active": True, "min_risk_score": 8.0}},
+ )
+ ProductTriageRuleset.objects.create(
+ product=self.product, ruleset=ruleset, dataspace=self.dataspace
+ )
+ evaluate_ruleset(ruleset, self.product)
+
+ def test_filter_by_triage_action_filters_matching_packages(self):
+ filterset = ProductPackageFilterSet(
+ dataspace=self.dataspace,
+ data={"triage_action": "upgrade"},
+ )
+ self.assertIn(self.pp_with_recommendation, filterset.qs)
+ self.assertNotIn(self.pp_without_recommendation, filterset.qs)
+
+ def test_filter_by_triage_action_excludes_non_matching_action(self):
+ filterset = ProductPackageFilterSet(
+ dataspace=self.dataspace,
+ data={"triage_action": "notify"},
+ )
+ self.assertNotIn(self.pp_with_recommendation, filterset.qs)
+
+
class ProductComponentFilterByRuleTestCase(TestCase):
def setUp(self):
self.dataspace = Dataspace.objects.create(name="nexB")
diff --git a/product_portfolio/tests/test_views.py b/product_portfolio/tests/test_views.py
index d54ccd57..7271007f 100644
--- a/product_portfolio/tests/test_views.py
+++ b/product_portfolio/tests/test_views.py
@@ -64,6 +64,10 @@
from vulnerabilities.models import VulnerabilityAnalysis
from vulnerabilities.tests import make_vulnerability
from vulnerabilities.tests import make_vulnerability_analysis
+from vulnerabilities.triage.models import AnalysisPreset
+from vulnerabilities.triage.models import ProductTriageRuleset
+from vulnerabilities.triage.models import TriageAction
+from vulnerabilities.triage.models import TriageRuleset
from workflow.models import Request
from workflow.models import RequestTemplate
@@ -278,7 +282,7 @@ def test_product_portfolio_detail_view_tab_vulnerability_queryset(self):
self.client.login(username="nexb_user", password="secret")
url = self.product1.get_url("tab_vulnerabilities")
- with self.assertMaxQueries(9):
+ with self.assertMaxQueries(12):
response = self.client.get(url)
self.assertContains(response, "0 results")
@@ -292,20 +296,31 @@ def test_product_portfolio_detail_view_tab_vulnerability_queryset(self):
self.assertEqual(4, product1.packages.vulnerable().count())
url = product1.get_url("tab_vulnerabilities")
- with self.assertMaxQueries(12):
+ with self.assertMaxQueries(16):
response = self.client.get(url)
self.assertContains(response, "4 results")
def test_product_portfolio_tab_vulnerability_view_filters(self):
self.client.login(username="nexb_user", password="secret")
+ # The "Recommendation" column, and its triage_action filter, only render when the
+ # product has at least one enabled TriageRuleset assigned to it.
+ ruleset = TriageRuleset.objects.create(
+ name="Upgrade Ruleset",
+ recommended_action=TriageAction.UPGRADE,
+ precedence=100,
+ dataspace=self.dataspace,
+ )
+ ProductTriageRuleset.objects.create(
+ product=self.product1, ruleset=ruleset, dataspace=self.dataspace
+ )
+
url = self.product1.get_url("tab_vulnerabilities")
response = self.client.get(url)
- self.assertContains(response, "?vulnerabilities-weighted_risk_score=#vulnerabilities")
- self.assertContains(response, "?vulnerabilities-sort=weighted_risk_score#vulnerabilities")
- response = self.client.get(
- url + "?vulnerabilities-sort=weighted_risk_score#vulnerabilities"
+ self.assertContains(response, "?vulnerabilities-triage_action=#vulnerabilities")
+ self.assertContains(response, "?vulnerabilities-triage_action=upgrade#vulnerabilities")
+ self.assertContains(
+ response, "?vulnerabilities-vulnerability_analyses__state=#vulnerabilities"
)
- self.assertContains(response, "?vulnerabilities-sort=-weighted_risk_score#vulnerabilities")
def test_product_portfolio_tab_vulnerability_view_packages_row_rendering(self):
self.client.login(username="nexb_user", password="secret")
@@ -320,11 +335,9 @@ def test_product_portfolio_tab_vulnerability_view_packages_row_rendering(self):
url = product1.get_url("tab_vulnerabilities")
response = self.client.get(url)
expected = f"""
-
-
- {p1}
-
-
+
+ {p1}
+
"""
self.assertContains(response, expected, html=True)
@@ -335,8 +348,8 @@ def test_product_portfolio_tab_vulnerability_view_packages_row_rendering(self):
data-package-identifier="{p1}"
data-edit-url="/products/vulnerability_analysis/{pp1.uuid}/{vulnerability1.advisory_uid}/"
>
-
+
@@ -360,7 +373,7 @@ def test_product_portfolio_tab_vulnerability_view_queries(self):
make_vulnerability_analysis(product_package2, vulnerability2)
url = product1.get_url("tab_vulnerabilities")
- with self.assertMaxQueries(12):
+ with self.assertMaxQueries(15):
self.client.get(url)
def test_product_portfolio_tab_vulnerability_risk_threshold(self):
@@ -405,19 +418,24 @@ def test_product_portfolio_tab_vulnerability_view_analysis_rendering(self):
response = self.client.get(url)
expected = """
-
- Resolved
-
-
-
- Code Not Present
-
-
- can_not_fix
- rollback
-
+
+
+
+
+ Resolved
+
+
Code Not Present
+
+
+
+ Can Not Fix
+ Rollback
+
+
+
"""
self.assertContains(response, expected, html=True)
@@ -1982,6 +2000,12 @@ def test_product_portfolio_product_update_save_as_new(self):
CodebaseResource.objects.create(
path="/path1/", product=self.product1, dataspace=self.dataspace
)
+ ruleset = TriageRuleset.objects.create(
+ name="Upgrade Ruleset", precedence=100, dataspace=self.dataspace
+ )
+ ProductTriageRuleset.objects.create(
+ product=self.product1, ruleset=ruleset, dataspace=self.dataspace
+ )
initial_product_count = Product.objects.get_queryset(self.super_user).count()
data = {
@@ -2003,6 +2027,7 @@ def test_product_portfolio_product_update_save_as_new(self):
self.assertEqual(1, cloned_product.productcomponents.count())
self.assertEqual(1, cloned_product.productpackages.count())
self.assertEqual(1, cloned_product.codebaseresources.count())
+ self.assertEqual(1, cloned_product.product_triage_rulesets.count())
def test_product_portfolio_product_delete_view(self):
delete_url = self.product1.get_delete_url()
@@ -3411,6 +3436,54 @@ def test_product_portfolio_vulnerability_analysis_form_view(self):
self.assertEqual(vulnerability1, analysis.vulnerability)
self.assertEqual("resolved", analysis.state)
+ def test_product_portfolio_apply_analysis_preset_view(self):
+ self.client.login(username=self.super_user.username, password="secret")
+
+ package1 = make_package(self.dataspace)
+ vulnerability1 = make_vulnerability(self.dataspace, affecting=[package1])
+ product1 = make_product(self.dataspace, inventory=[package1])
+ product_package = ProductPackage.objects.get(product=product1, package=package1)
+ preset = AnalysisPreset.objects.create(
+ name="Preset1",
+ state="not_affected",
+ detail="Not deployed",
+ dataspace=self.dataspace,
+ )
+
+ url = reverse(
+ "product_portfolio:apply_analysis_preset",
+ args=[product_package.uuid, preset.pk, vulnerability1.advisory_uid],
+ )
+ response = self.client.post(url)
+ self.assertEqual(200, response.status_code)
+ self.assertEqual(b'{"success": "applied"}', response.content)
+ analysis = VulnerabilityAnalysis.objects.get()
+ self.assertEqual(product_package, analysis.product_package)
+ self.assertEqual(vulnerability1, analysis.vulnerability)
+ self.assertEqual("not_affected", analysis.state)
+ self.assertEqual(preset, analysis.applied_by_preset)
+
+ def test_product_portfolio_apply_analysis_preset_view_existing_analysis(self):
+ self.client.login(username=self.super_user.username, password="secret")
+
+ package1 = make_package(self.dataspace)
+ vulnerability1 = make_vulnerability(self.dataspace, affecting=[package1])
+ product1 = make_product(self.dataspace, inventory=[package1])
+ product_package = ProductPackage.objects.get(product=product1, package=package1)
+ make_vulnerability_analysis(product_package, vulnerability1, state="exploitable")
+ preset = AnalysisPreset.objects.create(
+ name="Preset1", state="not_affected", dataspace=self.dataspace
+ )
+
+ url = reverse(
+ "product_portfolio:apply_analysis_preset",
+ args=[product_package.uuid, preset.pk, vulnerability1.advisory_uid],
+ )
+ response = self.client.post(url)
+ self.assertEqual(400, response.status_code)
+ self.assertEqual(1, VulnerabilityAnalysis.objects.count())
+ self.assertEqual("exploitable", VulnerabilityAnalysis.objects.get().state)
+
def test_product_portfolio_tab_compliance_view_empty(self):
self.client.login(username="nexb_user", password="secret")
url = self.product1.get_url("tab_compliance")
@@ -4283,6 +4356,96 @@ def test_post_with_change_perm_evaluates_and_returns_hx_refresh(self, mock_evalu
mock_evaluate.assert_called_once_with(self.product1)
+class ManageTriageRulesetsViewTestCase(TestCase):
+ def setUp(self):
+ self.dataspace = Dataspace.objects.create(name="nexB")
+ self.super_user = create_superuser("nexb_user", self.dataspace)
+ self.basic_user = create_user("basic_user", self.dataspace)
+ self.product1 = Product.objects.create(
+ name="Product1", version="1.0", dataspace=self.dataspace
+ )
+ self.ruleset = TriageRuleset.objects.create(
+ name="Upgrade Ruleset",
+ recommended_action=TriageAction.UPGRADE,
+ precedence=100,
+ dataspace=self.dataspace,
+ )
+
+ def test_get_without_login_redirects(self):
+ url = self.product1.get_manage_triage_rulesets_url()
+ response = self.client.get(url)
+ self.assertEqual(302, response.status_code)
+
+ def test_get_without_change_perm_returns_404(self):
+ self.client.login(username="basic_user", password="secret")
+ url = self.product1.get_manage_triage_rulesets_url()
+ response = self.client.get(url)
+ self.assertEqual(404, response.status_code)
+
+ def test_get_with_change_perm_renders_available_rulesets(self):
+ self.client.login(username="nexb_user", password="secret")
+ url = self.product1.get_manage_triage_rulesets_url()
+ response = self.client.get(url)
+ self.assertEqual(200, response.status_code)
+ self.assertContains(response, self.ruleset.name)
+ self.assertNotContains(response, "checked")
+
+ def test_get_displays_the_ruleset_analysis_preset(self):
+ preset = AnalysisPreset.objects.create(
+ name="Auto-Close Preset", state="not_affected", dataspace=self.dataspace
+ )
+ self.ruleset.analysis_preset = preset
+ self.ruleset.save()
+ self.client.login(username="nexb_user", password="secret")
+ url = self.product1.get_manage_triage_rulesets_url()
+ response = self.client.get(url)
+ self.assertContains(response, preset.name)
+
+ def test_get_marks_the_assigned_rulesets_as_checked(self):
+ ProductTriageRuleset.objects.create(
+ product=self.product1, ruleset=self.ruleset, dataspace=self.dataspace
+ )
+ self.client.login(username="nexb_user", password="secret")
+ url = self.product1.get_manage_triage_rulesets_url()
+ response = self.client.get(url)
+ self.assertContains(response, "checked")
+
+ def test_post_without_change_perm_returns_404(self):
+ self.client.login(username="basic_user", password="secret")
+ url = self.product1.get_manage_triage_rulesets_url()
+ response = self.client.post(url)
+ self.assertEqual(404, response.status_code)
+
+ @patch("product_portfolio.views.evaluate_ruleset")
+ def test_post_assigns_the_submitted_rulesets(self, mock_evaluate):
+ self.client.login(username="nexb_user", password="secret")
+ url = self.product1.get_manage_triage_rulesets_url()
+ response = self.client.post(url, {"ruleset_uuids": [str(self.ruleset.uuid)]})
+ self.assertEqual(b'{"success": true}', response.content)
+ self.assertTrue(
+ ProductTriageRuleset.objects.filter(
+ product=self.product1, ruleset=self.ruleset
+ ).exists()
+ )
+ mock_evaluate.assert_called_once_with(ruleset=self.ruleset, product=self.product1)
+
+ @patch("product_portfolio.views.evaluate_ruleset")
+ def test_post_unassigns_the_deselected_rulesets(self, mock_evaluate):
+ ProductTriageRuleset.objects.create(
+ product=self.product1, ruleset=self.ruleset, dataspace=self.dataspace
+ )
+ self.client.login(username="nexb_user", password="secret")
+ url = self.product1.get_manage_triage_rulesets_url()
+ response = self.client.post(url, {"ruleset_uuids": []})
+ self.assertEqual(b'{"success": true}', response.content)
+ self.assertFalse(
+ ProductTriageRuleset.objects.filter(
+ product=self.product1, ruleset=self.ruleset
+ ).exists()
+ )
+ mock_evaluate.assert_not_called()
+
+
class TabCompliancePolicyContextTestCase(TestCase):
def setUp(self):
self.dataspace = Dataspace.objects.create(name="nexB")
diff --git a/product_portfolio/urls.py b/product_portfolio/urls.py
index 8231594a..7cfa0675 100644
--- a/product_portfolio/urls.py
+++ b/product_portfolio/urls.py
@@ -39,6 +39,7 @@
from product_portfolio.views import ProductUpdateView
from product_portfolio.views import PullProjectDataFromScanCodeIOView
from product_portfolio.views import add_customcomponent_ajax_view
+from product_portfolio.views import apply_analysis_preset_view
from product_portfolio.views import check_package_version_ajax_view
from product_portfolio.views import delete_scan_htmx_view
from product_portfolio.views import edit_productrelation_ajax_view
@@ -46,6 +47,7 @@
from product_portfolio.views import import_from_scan_view
from product_portfolio.views import import_packages_from_scancodeio_view
from product_portfolio.views import improve_packages_from_purldb_view
+from product_portfolio.views import manage_triage_rulesets_view
from product_portfolio.views import scan_all_packages_view
from product_portfolio.views import scancodeio_project_download_input_view
from product_portfolio.views import scancodeio_project_status_view
@@ -117,6 +119,11 @@ def product_path(path_segment, view):
edit_productrelation_ajax_view,
name="edit_productrelation_ajax",
),
+ path(
+ "vulnerability_analysis//preset///",
+ apply_analysis_preset_view,
+ name="apply_analysis_preset",
+ ),
path(
"vulnerability_analysis///",
vulnerability_analysis_form_view,
@@ -131,6 +138,7 @@ def product_path(path_segment, view):
*product_path("vulnerability_analysis_form", vulnerability_analysis_form_view),
*product_path("scan_all_packages", scan_all_packages_view),
*product_path("evaluate_policy_rules", evaluate_policy_rules_view),
+ *product_path("manage_triage_rulesets", manage_triage_rulesets_view),
*product_path("improve_packages_from_purldb", improve_packages_from_purldb_view),
*product_path("about_files", ProductSendAboutFilesView.as_view()),
*product_path("export_spdx", ProductExportSPDXDocumentView.as_view()),
diff --git a/product_portfolio/views.py b/product_portfolio/views.py
index baf3c463..64a59492 100644
--- a/product_portfolio/views.py
+++ b/product_portfolio/views.py
@@ -150,6 +150,39 @@
from vulnerabilities.models import Vulnerability
from vulnerabilities.models import VulnerabilityAnalysis
from vulnerabilities.models import get_risk_level
+from vulnerabilities.triage.engine import evaluate_ruleset
+from vulnerabilities.triage.models import AnalysisPreset
+from vulnerabilities.triage.models import ProductTriageRuleset
+from vulnerabilities.triage.models import TriageAction
+from vulnerabilities.triage.models import TriageRecord
+from vulnerabilities.triage.models import TriageRuleset
+from vulnerabilities.triage.rules import RULE_REGISTRY as TRIAGE_RULE_REGISTRY
+from vulnerabilities.triage.rules import rule_parameters_from_config
+
+TRIAGE_ACTION_STYLES = {
+ "upgrade": ("bg-danger-subtle text-danger-emphasis", "fa-arrow-circle-up"),
+ "apply_patch": ("bg-danger-subtle text-danger-emphasis", "fa-wrench"),
+ "replace_package": ("bg-warning-subtle text-warning-emphasis", "fa-exchange-alt"),
+ "forensic_analysis": ("bg-warning-subtle text-warning-emphasis", "fa-search"),
+ "reachability_analysis": ("bg-warning-subtle text-warning-emphasis", "fa-sitemap"),
+ "change_config": ("bg-info-subtle text-info-emphasis", "fa-cog"),
+ "notify": ("bg-primary-subtle text-primary-emphasis", "fa-bell"),
+ "create_request": ("bg-secondary-subtle text-secondary-emphasis", "fa-file-alt"),
+}
+TRIAGE_ACTION_DEFAULT_STYLE = (
+ "bg-secondary-subtle text-secondary-emphasis",
+ "fa-exclamation-circle",
+)
+
+ANALYSIS_STATE_STYLES = {
+ "exploitable": "bg-danger-subtle text-danger-emphasis",
+ "in_triage": "bg-warning-subtle text-warning-emphasis",
+ "resolved": "bg-success-subtle text-success-emphasis",
+ "resolved_with_pedigree": "bg-success-subtle text-success-emphasis",
+ "not_affected": "bg-secondary-subtle text-secondary-emphasis",
+ "false_positive": "bg-secondary-subtle text-secondary-emphasis",
+}
+ANALYSIS_STATE_DEFAULT_STYLE = "bg-secondary-subtle text-secondary-emphasis"
class BaseProductViewMixin:
@@ -1196,6 +1229,10 @@ def get_context_data(self, **kwargs):
return context_data
+def has_triage_column_condition(view):
+ return getattr(view, "has_triage_rulesets", True)
+
+
class ProductTabVulnerabilitiesView(
LoginRequiredMixin,
BaseProductViewMixin,
@@ -1211,44 +1248,134 @@ class ProductTabVulnerabilitiesView(
filterset_class = ProductPackageFilterSet
table_headers = (
Header("affected_packages", _("Package"), help_text="Affected product packages"),
- Header("weighted_risk_score", _("Risk"), filter="weighted_risk_score"),
Header(
"advisory_uid",
_("Vulnerabilities"),
help_text="Vulnerabilities affecting the product package",
),
Header(
- "vulnerability_analyses__state",
- _("Status"),
- help_text=_("Exploitability analysis status"),
- filter="vulnerability_analyses__state",
- ),
- Header(
- "vulnerability_analyses__justification",
- _("Justification"),
- help_text=_("The rationale of why the impact analysis state was asserted."),
- filter="vulnerability_analyses__justification",
- ),
- Header(
- "vulnerability_analyses__responses",
- _("Responses"),
- help_text=_(
- "A response to the vulnerability by the manufacturer, supplier, or project "
- "responsible for the affected component or service."
- ),
- filter="responses",
+ "triage_action",
+ _("Recommendation"),
+ help_text=_("Action recommended by the triage engine for this vulnerability"),
+ filter="triage_action",
+ condition=has_triage_column_condition,
),
Header(
- "vulnerability_analyses__is_reachable",
- _("Reach"),
+ "vulnerability_analyses__state",
+ _("Analysis"),
help_text=_(
- "Indicates whether the vulnerability is reachable in the context of "
- "this product package."
+ "Exploitability analysis: status, justification, responses and reachability."
),
- filter="is_reachable",
+ filter="vulnerability_analyses__state",
),
)
+ def attach_vulnerability_analyses(self, page_obj):
+ """Set the matching VulnerabilityAnalysis instance on each prefetched vulnerability."""
+ response_labels = dict(VulnerabilityAnalysis.Response.choices)
+
+ for product_package in page_obj.object_list:
+ for vulnerability in product_package.package.affected_by_vulnerabilities.all():
+ for analysis in vulnerability.vulnerability_analyses.all():
+ if analysis.product_package_id == product_package.id:
+ vulnerability.vulnerability_analysis = analysis
+ analysis.state_badge_class = ANALYSIS_STATE_STYLES.get(
+ analysis.state, ANALYSIS_STATE_DEFAULT_STYLE
+ )
+ analysis.response_labels = [
+ response_labels.get(response, response)
+ for response in analysis.responses or []
+ ]
+ break
+
+ REACHABILITY_FILTER_MAP = {"yes": True, "no": False, "unknown": None}
+
+ def get_vulnerability_display_filters(self):
+ """Return the active per-vulnerability filters from the request."""
+ params = self.request.GET
+ prefix = self.tab_id
+ return {
+ "triage_action": params.get(f"{prefix}-triage_action", ""),
+ "state": params.get(f"{prefix}-vulnerability_analyses__state", ""),
+ "justification": params.get(f"{prefix}-vulnerability_analyses__justification", ""),
+ "is_reachable": params.get(f"{prefix}-is_reachable", ""),
+ }
+
+ def vulnerability_passes_display_filters(self, vulnerability, display_filters):
+ """Return True if the vulnerability matches all active display filters."""
+ triage_action = display_filters.get("triage_action")
+ if triage_action:
+ record = getattr(vulnerability, "triage_record", None)
+ if getattr(record, "recommended_action", "") != triage_action:
+ return False
+
+ analysis = getattr(vulnerability, "vulnerability_analysis", None)
+ state = display_filters.get("state")
+ if state:
+ if getattr(analysis, "state", "") != state:
+ return False
+
+ justification = display_filters.get("justification")
+ if justification:
+ if getattr(analysis, "justification", "") != justification:
+ return False
+
+ is_reachable_filter = display_filters.get("is_reachable")
+ if is_reachable_filter in self.REACHABILITY_FILTER_MAP:
+ expected = self.REACHABILITY_FILTER_MAP[is_reachable_filter]
+ actual = None if analysis is None else analysis.is_reachable
+ if actual != expected:
+ return False
+
+ return True
+
+ def attach_triage_data(self, product, page_obj):
+ """
+ Attach the winning TriageRecord to each vulnerability and build
+ display_vulnerabilities on each product_package, filtered by any
+ active per-vulnerability filters.
+ """
+ vulnerability_ids = {
+ vulnerability.id
+ for product_package in page_obj.object_list
+ for vulnerability in product_package.package.affected_by_vulnerabilities.all()
+ }
+ action_labels = dict(TriageAction.choices)
+ triage_records = list(
+ TriageRecord.objects.filter(
+ product=product,
+ vulnerability_id__in=vulnerability_ids,
+ )
+ .highest_precedence()
+ .select_related("ruleset", "request")
+ )
+ for record in triage_records:
+ record.action_label = action_labels.get(
+ record.recommended_action, record.recommended_action
+ )
+ badge_class, icon = TRIAGE_ACTION_STYLES.get(
+ record.recommended_action, TRIAGE_ACTION_DEFAULT_STYLE
+ )
+ record.action_badge_class = badge_class
+ record.action_icon = icon
+
+ triage_by_vulnerability = {record.vulnerability_id: record for record in triage_records}
+ display_filters = self.get_vulnerability_display_filters()
+ has_display_filters = any(display_filters.values())
+
+ for product_package in page_obj.object_list:
+ all_vulnerabilities = list(product_package.package.affected_by_vulnerabilities.all())
+ for vulnerability in all_vulnerabilities:
+ vulnerability.triage_record = triage_by_vulnerability.get(vulnerability.id)
+ if has_display_filters:
+ product_package.display_vulnerabilities = [
+ vulnerability
+ for vulnerability in all_vulnerabilities
+ if self.vulnerability_passes_display_filters(vulnerability, display_filters)
+ ]
+ else:
+ product_package.display_vulnerabilities = all_vulnerabilities
+
def get_context_data(self, **kwargs):
product = self.object
@@ -1258,9 +1385,12 @@ def get_context_data(self, **kwargs):
risk_threshold = product.get_vulnerabilities_risk_threshold()
base_productpackage_qs = product.get_vulnerable_productpackages(risk_threshold)
+ vulnerability_analyses_qs = VulnerabilityAnalysis.objects.select_related(
+ "created_by", "last_modified_by", "applied_by_preset"
+ )
vulnerability_qs = Vulnerability.objects.prefetch_related(
- "vulnerability_analyses"
- ).order_by("-risk_score")
+ Prefetch("vulnerability_analyses", queryset=vulnerability_analyses_qs)
+ ).order_by(F("risk_score").desc(nulls_last=True))
package_qs = (
Package.objects.all()
.only_rendering_fields()
@@ -1278,7 +1408,7 @@ def get_context_data(self, **kwargs):
Prefetch("package", package_qs),
)
.order_by(
- "-weighted_risk_score",
+ F("weighted_risk_score").desc(nulls_last=True),
"package__name",
)
)
@@ -1291,6 +1421,10 @@ def get_context_data(self, **kwargs):
anchor=f"#{self.tab_id}",
)
+ self.has_triage_rulesets = product.product_triage_rulesets.filter(
+ ruleset__enabled=True
+ ).exists()
+
# The self.filterset needs to be set before calling super()
context_data = super().get_context_data(**kwargs)
@@ -1298,14 +1432,19 @@ def get_context_data(self, **kwargs):
page_number = self.request.GET.get(self.query_dict_page_param)
page_obj = paginator.get_page(page_number)
- # Set the proper VulnerabilityAnalysis instance on the Package instance
- for product_package in page_obj.object_list:
- for vulnerability in product_package.package.affected_by_vulnerabilities.all():
- for analysis in vulnerability.vulnerability_analyses.all():
- if analysis.product_package_id == product_package.id:
- vulnerability.vulnerability_analysis = analysis
- continue
+ self.attach_vulnerability_analyses(page_obj)
+ self.attach_triage_data(product, page_obj)
+ analysis_presets = list(AnalysisPreset.objects.scope(product.dataspace))
+ has_change_permission = "change_product" in guardian_get_perms(self.request.user, product)
+ can_manage_triage_rules = (
+ has_change_permission and self.request.user.dataspace.enable_vulnerablecodedb_access
+ )
+ manage_triage_rules_nav_item_template = None
+ if can_manage_triage_rules:
+ manage_triage_rules_nav_item_template = (
+ "product_portfolio/includes/manage_triage_rules_nav_item.html"
+ )
context_data.update(
{
"filterset": self.filterset,
@@ -1313,6 +1452,9 @@ def get_context_data(self, **kwargs):
"total_count": base_productpackage_qs.count(),
"search_query": self.request.GET.get("vulnerabilities-q", ""),
"risk_threshold": risk_threshold,
+ "has_triage_rulesets": self.has_triage_rulesets,
+ "analysis_presets": analysis_presets,
+ "manage_triage_rules_nav_item_template": manage_triage_rules_nav_item_template,
}
)
@@ -2084,6 +2226,79 @@ def evaluate_policy_rules_view(request, dataspace, name, version=""):
return HttpResponse(headers={"HX-Refresh": "true"})
+@require_http_methods(["GET", "POST"])
+@login_required
+def manage_triage_rulesets_view(request, dataspace, name, version=""):
+ guarded_qs = Product.objects.get_queryset(request.user, perms="change_product")
+ product = get_object_or_404(
+ guarded_qs,
+ name=unquote_plus(name),
+ version=unquote_plus(version),
+ dataspace__name=dataspace,
+ )
+ available_rulesets = list(
+ TriageRuleset.objects.filter(dataspace=product.dataspace, enabled=True)
+ .select_related("analysis_preset")
+ .order_by("-precedence", "name")
+ )
+
+ if request.method == "POST":
+ submitted_uuids = set(request.POST.getlist("ruleset_uuids"))
+ current_assignments = {
+ str(ptr.ruleset.uuid): ptr
+ for ptr in ProductTriageRuleset.objects.filter(
+ product=product, ruleset__enabled=True
+ ).select_related("ruleset")
+ }
+ for ruleset in available_rulesets:
+ ruleset_uuid = str(ruleset.uuid)
+ if ruleset_uuid in submitted_uuids and ruleset_uuid not in current_assignments:
+ with transaction.atomic():
+ ProductTriageRuleset.objects.create(
+ product=product,
+ ruleset=ruleset,
+ dataspace=product.dataspace,
+ )
+ evaluate_ruleset(ruleset=ruleset, product=product)
+ for ruleset_uuid, assignment in current_assignments.items():
+ if ruleset_uuid not in submitted_uuids:
+ assignment.delete()
+ return JsonResponse({"success": True})
+
+ assigned_ruleset_ids = set(product.product_triage_rulesets.values_list("ruleset_id", flat=True))
+ action_labels = dict(TriageAction.choices)
+
+ for ruleset in available_rulesets:
+ ruleset.action_label = action_labels.get(
+ ruleset.recommended_action, ruleset.recommended_action
+ )
+ action_badge_class, action_icon = TRIAGE_ACTION_STYLES.get(
+ ruleset.recommended_action, TRIAGE_ACTION_DEFAULT_STYLE
+ )
+ ruleset.action_badge_class = action_badge_class
+ ruleset.action_icon = action_icon
+ active_rules = []
+ for rule_type, config in ruleset.rules_config.items():
+ if rule_type not in TRIAGE_RULE_REGISTRY or not config.get("is_active"):
+ continue
+ handler = TRIAGE_RULE_REGISTRY[rule_type]
+ params = rule_parameters_from_config(config)
+ params_str = ", ".join(
+ f"{key.replace('_', ' ')}: {value}" for key, value in params.items()
+ )
+ active_rules.append({"label": handler.label, "params_str": params_str})
+ ruleset.active_rules = active_rules
+
+ return render(
+ request,
+ "product_portfolio/modals/manage_triage_rulesets_form.html",
+ {
+ "available_rulesets": available_rulesets,
+ "assigned_ruleset_ids": assigned_ruleset_ids,
+ },
+ )
+
+
@login_required
def import_from_scan_view(request, dataspace, name, version=""):
"""
@@ -2742,6 +2957,44 @@ def vulnerability_analysis_form_view(request, productpackage_uuid, advisory_uid)
return HttpResponse(rendered_form)
+@login_required
+@require_POST
+def apply_analysis_preset_view(request, productpackage_uuid, advisory_uid, preset_id):
+ user = request.user
+ dataspace = user.dataspace
+
+ product_package_qs = ProductPackage.objects.product_secured(user, perms="change_product")
+ product_package = get_object_or_404(product_package_qs, uuid=productpackage_uuid)
+ vulnerability = get_object_or_404(
+ Vulnerability.objects.scope(dataspace), advisory_uid=advisory_uid
+ )
+ preset = get_object_or_404(AnalysisPreset.objects.scope(dataspace), pk=preset_id)
+
+ existing = VulnerabilityAnalysis.objects.scope(dataspace).get_or_none(
+ product_package=product_package,
+ vulnerability=vulnerability,
+ )
+ if existing:
+ return JsonResponse(
+ {"error": "An analysis already exists for this vulnerability."}, status=400
+ )
+
+ analysis = VulnerabilityAnalysis(
+ product_package=product_package,
+ vulnerability=vulnerability,
+ dataspace=dataspace,
+ )
+ preset.apply_to_analysis(analysis)
+
+ if not analysis.has_content_fields():
+ return JsonResponse({"error": "This preset has no content fields to apply."}, status=400)
+
+ analysis.applied_by_preset = preset
+ analysis.save()
+
+ return JsonResponse({"success": "applied"}, status=200)
+
+
@login_required
@csrf_exempt
@require_http_methods(["DELETE"])
diff --git a/vulnerabilities/forms.py b/vulnerabilities/forms.py
index 3d87d3ba..22b27e92 100644
--- a/vulnerabilities/forms.py
+++ b/vulnerabilities/forms.py
@@ -97,6 +97,7 @@ def helper(self):
return helper
def save(self, *args, **kwargs):
+ self.instance.applied_by_preset = None
instance = super().save(*args, **kwargs)
if products := self.cleaned_data.get("propagate_to_products"):
diff --git a/vulnerabilities/migrations/0011_vulnerabilityanalysis_applied_by_preset.py b/vulnerabilities/migrations/0011_vulnerabilityanalysis_applied_by_preset.py
new file mode 100644
index 00000000..8d4c3323
--- /dev/null
+++ b/vulnerabilities/migrations/0011_vulnerabilityanalysis_applied_by_preset.py
@@ -0,0 +1,20 @@
+# Generated by Django 6.0.6 on 2026-08-14 15:02
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+ dependencies = [
+ ('vulnerabilities', '0010_api_v3_remove_old_fields'),
+ ('vulnerabilities_triage', '0001_initial'),
+ ]
+
+ operations = [
+ migrations.AddField(
+ model_name='vulnerabilityanalysis',
+ name='applied_by_preset',
+ field=models.ForeignKey(blank=True, help_text='The analysis preset that automatically created this analysis. Cleared when a user edits the analysis manually.', null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='applied_analyses', to='vulnerabilities_triage.analysispreset'),
+ ),
+ ]
diff --git a/vulnerabilities/models.py b/vulnerabilities/models.py
index b0d25a84..8a3d89d9 100644
--- a/vulnerabilities/models.py
+++ b/vulnerabilities/models.py
@@ -274,8 +274,8 @@ def as_cyclonedx(self, affected_instances, analysis=None):
)
-class VulnerabilityAnalysisMixin(models.Model):
- """Aligned with the cyclonedx.model.vulnerability.VulnerabilityAnalysis"""
+class VulnerabilityAnalysisContentMixin(models.Model):
+ """Core analysis content fields, shared with AnalysisPreset. CycloneDX-aligned."""
# cyclonedx.model.impact_analysis.ImpactAnalysisState
class State(models.TextChoices):
@@ -344,6 +344,26 @@ class Response(models.TextChoices):
"details on why the component or service is not impacted by this vulnerability."
),
)
+
+ def has_content_fields(self):
+ return any([self.state, self.justification, self.responses, self.detail])
+
+ def save(self, *args, **kwargs):
+ # At least one of those fields must be provided.
+ if not self.has_content_fields():
+ raise ValueError(
+ "At least one of state, justification, responses or detail must be provided."
+ )
+
+ super().save(*args, **kwargs)
+
+ class Meta:
+ abstract = True
+
+
+class VulnerabilityAnalysisMixin(VulnerabilityAnalysisContentMixin):
+ """Aligned with the cyclonedx.model.vulnerability.VulnerabilityAnalysis"""
+
first_issued = models.DateTimeField(
auto_now_add=True,
help_text=_("The date and time (timestamp) when the analysis was first issued."),
@@ -356,21 +376,6 @@ class Response(models.TextChoices):
class Meta:
abstract = True
- def save(self, *args, **kwargs):
- # At least one of those fields must be provided.
- main_fields = [
- self.state,
- self.justification,
- self.responses,
- self.detail,
- ]
- if not any(main_fields):
- raise ValueError(
- "At least one of state, justification, responses or detail must be provided."
- )
-
- super().save(*args, **kwargs)
-
def as_cyclonedx(self):
state = None
if self.state:
@@ -546,6 +551,17 @@ class VulnerabilityAnalysis(
"product package."
),
)
+ applied_by_preset = models.ForeignKey(
+ to="vulnerabilities_triage.AnalysisPreset",
+ on_delete=models.SET_NULL,
+ null=True,
+ blank=True,
+ related_name="applied_analyses",
+ help_text=_(
+ "The analysis preset that automatically created this analysis."
+ " Cleared when a user edits the analysis manually."
+ ),
+ )
objects = DataspacedManager.from_queryset(ProductSecuredQuerySet)()
diff --git a/vulnerabilities/tests/test_forms.py b/vulnerabilities/tests/test_forms.py
index 31bd71d6..e964a4e3 100644
--- a/vulnerabilities/tests/test_forms.py
+++ b/vulnerabilities/tests/test_forms.py
@@ -16,6 +16,7 @@
from product_portfolio.tests import make_product_package
from vulnerabilities.forms import VulnerabilityAnalysisForm
from vulnerabilities.tests import make_vulnerability
+from vulnerabilities.triage.models import AnalysisPreset
class VulnerabilitiesFormsTestCase(TestCase):
@@ -49,6 +50,31 @@ def test_vulnerability_forms_vulnerability_analysis_save(self):
self.assertEqual(product_package1.package, analysis.package)
self.assertEqual(data["detail"], analysis.detail)
+ def test_vulnerability_forms_vulnerability_analysis_save_clears_applied_by_preset(self):
+ product_package1 = make_product_package(make_product(self.dataspace))
+ vulnerability1 = make_vulnerability(
+ dataspace=self.dataspace, affecting=[product_package1.package]
+ )
+ preset = AnalysisPreset.objects.create(
+ name="Preset1", state="not_affected", dataspace=self.dataspace
+ )
+ analysis = product_package1.vulnerability_analyses.create(
+ vulnerability=vulnerability1,
+ dataspace=self.dataspace,
+ state="not_affected",
+ applied_by_preset=preset,
+ )
+
+ data = {
+ "product_package": product_package1,
+ "vulnerability": vulnerability1,
+ "detail": "Human edit",
+ }
+ form = VulnerabilityAnalysisForm(user=self.super_user, data=data, instance=analysis)
+ self.assertTrue(form.is_valid())
+ saved_analysis = form.save()
+ self.assertIsNone(saved_analysis.applied_by_preset)
+
def test_vulnerability_forms_vulnerability_analysis_propagate_to_products(self):
product_package1 = make_product_package(make_product(self.dataspace))
vulnerability1 = make_vulnerability(
diff --git a/vulnerabilities/triage/__init__.py b/vulnerabilities/triage/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/vulnerabilities/triage/admin.py b/vulnerabilities/triage/admin.py
new file mode 100644
index 00000000..57e1a714
--- /dev/null
+++ b/vulnerabilities/triage/admin.py
@@ -0,0 +1,179 @@
+#
+# Copyright (c) nexB Inc. and others. All rights reserved.
+# DejaCode is a trademark of nexB Inc.
+# SPDX-License-Identifier: AGPL-3.0-only
+# See https://github.com/aboutcode-org/dejacode for support or download.
+# See https://aboutcode.org for more information about AboutCode FOSS projects.
+#
+
+from django.contrib import admin
+from django.utils.html import escape
+from django.utils.html import mark_safe
+
+from dje.admin import DataspacedAdmin
+from dje.admin import dejacode_site
+from dje.list_display import AsLink
+from vulnerabilities.triage.forms import AnalysisPresetForm
+from vulnerabilities.triage.forms import TriageRulesetForm
+from vulnerabilities.triage.models import AnalysisPreset
+from vulnerabilities.triage.models import TriageAction
+from vulnerabilities.triage.models import TriageRuleset
+from vulnerabilities.triage.rules import RULE_REGISTRY
+from vulnerabilities.triage.rules import rule_parameters_from_config
+
+
+@admin.register(AnalysisPreset, site=dejacode_site)
+class AnalysisPresetAdmin(DataspacedAdmin):
+ short_description = (
+ "An Analysis Preset defines default vulnerability analysis values that the triage"
+ " engine applies automatically when an assigned ruleset fires."
+ )
+ long_description = (
+ "Only non-blank preset fields are applied. Analyses already modified by a human"
+ " are never overwritten. When a user edits an auto-applied analysis, the preset"
+ " link is cleared and the analysis becomes human-owned."
+ )
+ form = AnalysisPresetForm
+ list_display = [
+ "name",
+ "state",
+ "justification",
+ "get_responses",
+ "is_reachable",
+ "description",
+ "get_dataspace",
+ ]
+ search_fields = ["name"]
+ fieldsets = [
+ (
+ None,
+ {"fields": ["name", "description"]},
+ ),
+ (
+ "Analysis defaults",
+ {
+ "fields": ["state", "justification", "responses", "detail", "is_reachable"],
+ "description": (
+ "Leave a field blank to leave it unchanged on the analysis."
+ " At least one field should be set."
+ ),
+ },
+ ),
+ ]
+
+ @admin.display(description="Responses")
+ def get_responses(self, obj):
+ if not obj.responses:
+ return ""
+
+ labels = dict(AnalysisPreset.Response.choices)
+ return ", ".join(labels.get(response, response) for response in obj.responses)
+
+
+@admin.register(TriageRuleset, site=dejacode_site)
+class TriageRulesetAdmin(DataspacedAdmin):
+ short_description = (
+ "A Triage Ruleset is a named set of detection rules that, when their conditions"
+ " are met for a product, recommends a specific remediation action."
+ )
+
+ long_description = (
+ "Each ruleset combines one or more rules (such as critical vulnerability detection"
+ " or exploited vulnerability detection) with a single action to recommend"
+ " (upgrade, apply patch, notify, etc.). Multiple rulesets can be assigned to a"
+ " product; when conditions overlap, the ruleset with the highest precedence takes"
+ " effect."
+ )
+ form = TriageRulesetForm
+ list_display = [
+ "name",
+ "get_action_label",
+ "precedence",
+ "get_enabled_rules",
+ AsLink("analysis_preset"),
+ AsLink("request_template"),
+ "description",
+ "enabled",
+ "get_dataspace",
+ ]
+ list_filter = DataspacedAdmin.list_filter + ("enabled",)
+ search_fields = ["name"]
+
+ @admin.display(description="Action")
+ def get_action_label(self, obj):
+ return dict(TriageAction.choices).get(obj.recommended_action, obj.recommended_action)
+
+ @admin.display(description="Enabled rules")
+ def get_enabled_rules(self, obj):
+ lines = []
+ for rule_type, config in obj.rules_config.items():
+ if rule_type not in RULE_REGISTRY or not config.get("is_active"):
+ continue
+ handler = RULE_REGISTRY[rule_type]
+ params = rule_parameters_from_config(config)
+ if params:
+ param_str = ", ".join(f"{key}: {value}" for key, value in params.items())
+ label = f"{handler.label} ({param_str})"
+ else:
+ label = handler.label
+ lines.append(escape(label))
+
+ if not lines:
+ return ""
+
+ return mark_safe("