add new triage rule based on SSVC decision tree

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

vulnerabilities/triage/rules.py

@@ -11,6 +11,7 @@
 from django.apps import apps
 from django.db.models import Exists
 from django.db.models import OuterRef
+from django.db.models import Q
 from django.utils import timezone
 
 from policy.rules import BaseRule
@@ -94,6 +95,26 @@ def get_matching_vulnerabilities(self, product, parameters=None):
         ).distinct()
 
 
+class SSVCDecisionTriageRule(BaseTriageRule):
+    rule_type = "ssvc_decision"
+    label = "SSVC Decision"
+    description = (
+        "Vulnerabilities whose SSVC decision tree recommends Attend or Act"
+        " (immediate attention required)."
+    )
+
+    def get_matching_vulnerabilities(self, product, parameters=None):
+        Vulnerability = apps.get_model("vulnerabilities", "Vulnerability")
+        return (
+            Vulnerability.objects.filter(affected_packages__productpackages__product=product)
+            .filter(
+                Q(ssvc_trees__contains=[{"decision": "Attend"}])
+                | Q(ssvc_trees__contains=[{"decision": "Act"}])
+            )
+            .distinct()
+        )
+
+
 class ReachableVulnerabilityTriageRule(BaseTriageRule):
     rule_type = "reachable_vulnerability"
     label = "Reachable Vulnerability"
@@ -229,6 +250,7 @@ def get_matching_vulnerabilities(self, product, parameters=None):
     RiskScoreTriageRule.rule_type: RiskScoreTriageRule(),
     WeightedRiskTriageRule.rule_type: WeightedRiskTriageRule(),
     ExploitedVulnerabilityTriageRule.rule_type: ExploitedVulnerabilityTriageRule(),
+    SSVCDecisionTriageRule.rule_type: SSVCDecisionTriageRule(),
     ReachableVulnerabilityTriageRule.rule_type: ReachableVulnerabilityTriageRule(),
     UnresolvedVulnerabilityTriageRule.rule_type: UnresolvedVulnerabilityTriageRule(),
     StaleVulnerabilityTriageRule.rule_type: StaleVulnerabilityTriageRule(),