[cravex2-reachability] Implement rule tools triaging vulnerabilities (#560)

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

component_catalog/templates/component_catalog/includes/vulnerability_info_popover.html

@@ -0,0 +1,34 @@
+<div>
+  {% if vulnerability.aliases %}
+    <div class='mb-2'>
+      <strong>Aliases</strong>
+      <div>
+        {% for alias in vulnerability.aliases %}
+          <div>
+            {% if alias|slice:':3' == 'CVE' %}
+              <a href='https://nvd.nist.gov/vuln/detail/{{ alias }}' target='_blank'>{{ alias }}</a>
+            {% elif alias|slice:':4' == 'GHSA' %}
+              <a href='https://github.com/advisories/{{ alias }}' target='_blank'>{{ alias }}</a>
+            {% elif alias|slice:':3' == 'NPM' %}
+              <a href='https://github.com/nodejs/security-wg/blob/main/vuln/npm/{{ alias|slice:"4:" }}.json' target='_blank'>{{ alias }}</a>
+            {% else %}
+              {{ alias }}
+            {% endif %}
+          </div>
+        {% endfor %}
+      </div>
+    </div>
+  {% endif %}
+  {% if vulnerability.summary %}
+    <div class='mb-2'>
+      <strong>Summary</strong>
+      <div>{{ vulnerability.summary|linebreaksbr }}</div>
+    </div>
+  {% endif %}
+  {% if vulnerability.exploitability %}
+    <div class='mb-1'><strong>Exploitability:</strong> {{ vulnerability.get_exploitability_display }}</div>
+  {% endif %}
+  {% if vulnerability.risk_score %}
+    <div><strong>Risk:</strong> {{ vulnerability.risk_score }}</div>
+  {% endif %}
+</div>

dejacode/settings.py

@@ -345,6 +345,7 @@ def gettext_noop(s):
     "policy",
     "notification",
     "vulnerabilities",
+    "vulnerabilities.triage",
 ]
 
 EXTRA_APPS = env.list("EXTRA_APPS", default=[])
@@ -478,6 +479,7 @@ def gettext_noop(s):
 hourly = "0 * * * *"
 DEJACODE_VULNERABILITIES_CRON = env.str("DEJACODE_VULNERABILITIES_CRON", default=daily_at_3am)
 DEJACODE_POLICY_RULES_CRON = env.str("DEJACODE_POLICY_RULES_CRON", default=hourly)
+DEJACODE_VULNERABILITY_TRIAGE_CRON = env.str("DEJACODE_VULNERABILITY_TRIAGE_CRON", default=hourly)
 
 
 def enable_rq_eager_mode():

dejacode/static/css/dejacode_bootstrap.css

@@ -414,10 +414,17 @@ table.vulnerabilities-table .column-summary {
 
 /* -- Vulnerability tab -- */
 #tab_vulnerabilities .column-advisory_uid {
-  width: 230px;
+  width: 240px;
 }
 #tab_vulnerabilities .column-affected_packages {
-  min-width: 250px;
+  min-width: 300px;
+  width: 300px;
+}
+#tab_vulnerabilities .column-triage_action {
+  min-width: 165px;
+}
+#tab_vulnerabilities .column-action {
+  width: 30px;
 }
 #tab_vulnerabilities .column-exploitability {
   width: 140px;
@@ -433,13 +440,13 @@ table.vulnerabilities-table .column-summary {
   width: 300px;
 }
 #tab_vulnerabilities .column-vulnerability_analyses__state {
-  min-width: 125px;
+  min-width: 100px;
 }
 #tab_vulnerabilities .column-vulnerability_analyses__justification {
   min-width: 130px;
 }
 #tab_vulnerabilities .column-vulnerability_analyses__responses {
-  width: 185px;
+  min-width: 120px;
 }
 #tab_vulnerabilities .column-vulnerability_analyses__is_reachable {
   width: 80px;
@@ -1072,3 +1079,10 @@ select.bootstrap-select-filter {
     position: absolute;
     z-index: 1;
 }
+.popover.wide-popover {
+  --bs-popover-max-width: 420px;
+  max-width: 420px;
+}
+.stretch-cell {
+  height: 1px;
+}

dje/cron_jobs.py

@@ -12,19 +12,28 @@
 
 from dje.tasks import update_vulnerabilities
 from policy.tasks import evaluate_all_products_rules_task
+from vulnerabilities.triage.tasks import evaluate_all_products_vulnerability_triage_task
 
-two_hour = 7200
+two_hours = 7200
+ten_minutes = 600
 
 cron.register(
     func=update_vulnerabilities,
     queue_name="default",
     cron=settings.DEJACODE_VULNERABILITIES_CRON,  # Daily at 3am by default
-    job_timeout=two_hour,
+    job_timeout=two_hours,
 )
 
 cron.register(
     func=evaluate_all_products_rules_task,
     queue_name="default",
     cron=settings.DEJACODE_POLICY_RULES_CRON,  # Hourly by default
-    job_timeout=two_hour,
+    job_timeout=two_hours,
+)
+
+cron.register(
+    func=evaluate_all_products_vulnerability_triage_task,
+    queue_name="default",
+    cron=settings.DEJACODE_VULNERABILITY_TRIAGE_CRON,  # Hourly by default
+    job_timeout=ten_minutes,
 )

dje/tasks.py

@@ -141,6 +141,7 @@ def scancodeio_submit_scan(uris, user_uuid, dataspace_uuid):
 def update_vulnerabilities():
     """Fetch vulnerabilities for all Dataspaces that enable vulnerablecodedb access."""
     from vulnerabilities.fetch import fetch_from_vulnerablecode
+    from vulnerabilities.triage.tasks import evaluate_all_products_vulnerability_triage_task
 
     logger.info("Entering update_vulnerabilities task")
     Dataspace = apps.get_model("dje", "Dataspace")
@@ -155,3 +156,6 @@ def update_vulnerabilities():
             timeout=60,
             log_func=logger.debug,
         )
+
+    logger.info("Vulnerability fetch complete. Enqueuing triage evaluation.")
+    evaluate_all_products_vulnerability_triage_task.delay()

dje/templates/tabs/pagination.html

@@ -19,6 +19,9 @@
           {% endif %}
         </div>
       </li>
+      {% if extra_nav_item_template %}
+        {% include extra_nav_item_template %}
+      {% endif %}
     </ul>
     <div class="mt-1">
       {% include 'includes/filters_breadcrumbs.html' with filterset=filterset fragment=tab_id only %}

dje/tests/test_forms.py

@@ -110,7 +110,7 @@ def test_tabs_permission_formset_load_perms(self):
 
     def test_copy_defaults_form_get_all_dataspaced_models(self):
         dataspaced_models = CopyDefaultsForm.get_all_dataspaced_models()
-        self.assertEqual(10, len(dataspaced_models))
+        self.assertEqual(11, len(dataspaced_models))
         self.assertEqual(7, len(dataspaced_models.get("Component Catalog")))
         self.assertIn("Subcomponent", str(dataspaced_models.get("Component Catalog")))
 

policy/signals.py

@@ -26,15 +26,9 @@ def evaluate_product_rules_on_product_save(sender, instance, **kwargs):
     evaluate_product_rules_task.delay(product_uuid=instance.uuid)
 
 
-@receiver(post_save, sender="product_portfolio.ProductPackage")
-def evaluate_product_rules_on_productpackage_save(sender, instance, **kwargs):
-    """Queue a policy rule evaluation whenever a package is added or updated in a product."""
-    evaluate_product_rules_task.delay(product_uuid=instance.product.uuid)
-
-
-@receiver(post_delete, sender="product_portfolio.ProductPackage")
-def evaluate_product_rules_on_productpackage_delete(sender, instance, **kwargs):
-    """Queue a policy rule evaluation whenever a package is removed from a product."""
+@receiver([post_save, post_delete], sender="product_portfolio.ProductPackage")
+def evaluate_product_rules_on_productpackage_change(sender, instance, **kwargs):
+    """Queue a policy rule evaluation whenever a package is added, updated, or removed."""
     evaluate_product_rules_task.delay(product_uuid=instance.product.uuid)
 
 

policy/tasks.py

@@ -33,10 +33,10 @@ def evaluate_product_rules_task(product_uuid):
         logger.error(f"evaluate_product_rules_task: product {product_uuid} not found, skipping.")
         return
 
-    logger.info(f"Evaluating policy rules for product {product}")
+    logger.info(f"Evaluating policy rules for product id={product.id}")
     new_violations, resolved_count = evaluate_rules(product)
     logger.info(
-        f"Policy rules evaluated for {product}: "
+        f"Policy rules evaluated for product id={product.id}: "
         f"{len(new_violations)} new violation(s), {resolved_count} resolved."
     )
 
@@ -59,14 +59,16 @@ def evaluate_all_products_rules_task(include_locked=False, product_uuids=None):
     logger.info(f"Starting policy rule evaluation for {count} product(s).")
 
     for product in products:
-        logger.info(f"Evaluating policy rules for product {product}")
+        logger.info(f"Evaluating policy rules for product id={product.id}")
         try:
             new_violations, resolved_count = evaluate_rules(product)
         except Exception:
-            logger.exception(f"Policy rule evaluation failed for product {product}, skipping.")
+            logger.exception(
+                f"Policy rule evaluation failed for product id={product.id}, skipping."
+            )
             continue
         logger.info(
-            f"Policy rules evaluated for {product}: "
+            f"Policy rules evaluated for product id={product.id}: "
             f"{len(new_violations)} new violation(s), {resolved_count} resolved."
         )
 

product_portfolio/admin.py

@@ -59,6 +59,8 @@
 from product_portfolio.importers import CodebaseResourceImporter
 from product_portfolio.importers import ProductComponentImporter
 from product_portfolio.importers import ProductPackageImporter
+from product_portfolio.importers import paused_product_package_reevaluation
+from product_portfolio.importers import reevaluate_products
 from product_portfolio.inlines import CodebaseResourceUsageDeployedFromInline
 from product_portfolio.inlines import CodebaseResourceUsageDeployedToInline
 from product_portfolio.inlines import ProductComponentInline
@@ -72,6 +74,7 @@
 from product_portfolio.models import ProductRelationStatus
 from product_portfolio.models import ProductStatus
 from reporting.filters import ReportingQueryListFilter
+from vulnerabilities.triage.models import ProductTriageRuleset
 
 
 @admin.register(ProductStatus, site=dejacode_site)
@@ -240,12 +243,14 @@ def save_model(self, request, obj, form, change):
         if "_saveasnew" in request.POST:
             old_product_id = request.resolver_match.kwargs.get("object_id")
             old_product = self.get_object(request, old_product_id)
-            for model_class in [ProductComponent, ProductPackage]:
-                for relationship in model_class.objects.filter(product=old_product):
-                    relationship.id = None
-                    relationship.uuid = uuid.uuid4()
-                    relationship.product = obj
-                    relationship.save()
+            with paused_product_package_reevaluation():
+                for model_class in [ProductComponent, ProductPackage, ProductTriageRuleset]:
+                    for relationship in model_class.objects.filter(product=old_product):
+                        relationship.id = None
+                        relationship.uuid = uuid.uuid4()
+                        relationship.product = obj
+                        relationship.save()
+            reevaluate_products([obj])
 
     def get_obj_perms_user_select_form(self, request):
         """