[cravex2-reachability] Implement rule tools triaging vulnerabilities

component_catalog/templates/component_catalog/includes/vulnerability_info_popover.html

@@ -0,0 +1,34 @@
+<div>
+  {% if vulnerability.aliases %}
+    <div class='mb-2'>
+      <strong>Aliases</strong>
+      <div>
+        {% for alias in vulnerability.aliases %}
+          <div>
+            {% if alias|slice:':3' == 'CVE' %}
+              <a href='https://nvd.nist.gov/vuln/detail/{{ alias }}' target='_blank'>{{ alias }}</a>
+            {% elif alias|slice:':4' == 'GHSA' %}
+              <a href='https://github.com/advisories/{{ alias }}' target='_blank'>{{ alias }}</a>
+            {% elif alias|slice:':3' == 'NPM' %}
+              <a href='https://github.com/nodejs/security-wg/blob/main/vuln/npm/{{ alias|slice:"4:" }}.json' target='_blank'>{{ alias }}</a>
+            {% else %}
+              {{ alias }}
+            {% endif %}
+          </div>
+        {% endfor %}
+      </div>
+    </div>
+  {% endif %}
+  {% if vulnerability.summary %}
+    <div class='mb-2'>
+      <strong>Summary</strong>
+      <div>{{ vulnerability.summary|linebreaksbr }}</div>
+    </div>
+  {% endif %}
+  {% if vulnerability.exploitability %}
+    <div class='mb-1'><strong>Exploitability:</strong> {{ vulnerability.get_exploitability_display }}</div>
+  {% endif %}
+  {% if vulnerability.risk_score %}
+    <div><strong>Risk:</strong> {{ vulnerability.risk_score }}</div>
+  {% endif %}
+</div>

dejacode/settings.py

@@ -345,6 +345,7 @@ def gettext_noop(s):
     "policy",
     "notification",
     "vulnerabilities",
+    "vulnerabilities.triage",
 ]
 
 EXTRA_APPS = env.list("EXTRA_APPS", default=[])
@@ -478,6 +479,7 @@ def gettext_noop(s):
 hourly = "0 * * * *"
 DEJACODE_VULNERABILITIES_CRON = env.str("DEJACODE_VULNERABILITIES_CRON", default=daily_at_3am)
 DEJACODE_POLICY_RULES_CRON = env.str("DEJACODE_POLICY_RULES_CRON", default=hourly)
+DEJACODE_VULNERABILITY_TRIAGE_CRON = env.str("DEJACODE_VULNERABILITY_TRIAGE_CRON", default=hourly)
 
 
 def enable_rq_eager_mode():

dejacode/static/css/dejacode_bootstrap.css

@@ -414,10 +414,17 @@ table.vulnerabilities-table .column-summary {
 
 /* -- Vulnerability tab -- */
 #tab_vulnerabilities .column-advisory_uid {
-  width: 230px;
+  width: 240px;
 }
 #tab_vulnerabilities .column-affected_packages {
-  min-width: 250px;
+  min-width: 300px;
+  width: 300px;
+}
+#tab_vulnerabilities .column-triage_action {
+  min-width: 165px;
+}
+#tab_vulnerabilities .column-action {
+  width: 30px;
 }
 #tab_vulnerabilities .column-exploitability {
   width: 140px;
@@ -433,13 +440,13 @@ table.vulnerabilities-table .column-summary {
   width: 300px;
 }
 #tab_vulnerabilities .column-vulnerability_analyses__state {
-  min-width: 125px;
+  min-width: 100px;
 }
 #tab_vulnerabilities .column-vulnerability_analyses__justification {
   min-width: 130px;
 }
 #tab_vulnerabilities .column-vulnerability_analyses__responses {
-  width: 185px;
+  min-width: 120px;
 }
 #tab_vulnerabilities .column-vulnerability_analyses__is_reachable {
   width: 80px;
@@ -1072,3 +1079,10 @@ select.bootstrap-select-filter {
     position: absolute;
     z-index: 1;
 }
+.popover.wide-popover {
+  --bs-popover-max-width: 420px;
+  max-width: 420px;
+}
+.stretch-cell {
+  height: 1px;
+}

dje/cron_jobs.py

@@ -12,19 +12,28 @@
 
 from dje.tasks import update_vulnerabilities
 from policy.tasks import evaluate_all_products_rules_task
+from vulnerabilities.triage.tasks import evaluate_all_products_vulnerability_triage_task
 
-two_hour = 7200
+two_hours = 7200
+ten_minutes = 600
 
 cron.register(
     func=update_vulnerabilities,
     queue_name="default",
     cron=settings.DEJACODE_VULNERABILITIES_CRON,  # Daily at 3am by default
-    job_timeout=two_hour,
+    job_timeout=two_hours,
 )
 
 cron.register(
     func=evaluate_all_products_rules_task,
     queue_name="default",
     cron=settings.DEJACODE_POLICY_RULES_CRON,  # Hourly by default
-    job_timeout=two_hour,
+    job_timeout=two_hours,
+)
+
+cron.register(
+    func=evaluate_all_products_vulnerability_triage_task,
+    queue_name="default",
+    cron=settings.DEJACODE_VULNERABILITY_TRIAGE_CRON,  # Hourly by default
+    job_timeout=ten_minutes,
 )

dje/tasks.py

@@ -141,6 +141,7 @@ def scancodeio_submit_scan(uris, user_uuid, dataspace_uuid):
 def update_vulnerabilities():
     """Fetch vulnerabilities for all Dataspaces that enable vulnerablecodedb access."""
     from vulnerabilities.fetch import fetch_from_vulnerablecode
+    from vulnerabilities.triage.tasks import evaluate_all_products_vulnerability_triage_task
 
     logger.info("Entering update_vulnerabilities task")
     Dataspace = apps.get_model("dje", "Dataspace")
@@ -155,3 +156,6 @@ def update_vulnerabilities():
             timeout=60,
             log_func=logger.debug,
         )
+
+    logger.info("Vulnerability fetch complete. Enqueuing triage evaluation.")
+    evaluate_all_products_vulnerability_triage_task.delay()

dje/templates/tabs/pagination.html

@@ -19,6 +19,9 @@
           {% endif %}
         </div>
       </li>
+      {% if extra_nav_item_template %}
+        {% include extra_nav_item_template %}
+      {% endif %}
     </ul>
     <div class="mt-1">
       {% include 'includes/filters_breadcrumbs.html' with filterset=filterset fragment=tab_id only %}

dje/tests/test_forms.py

@@ -110,7 +110,7 @@ def test_tabs_permission_formset_load_perms(self):
 
     def test_copy_defaults_form_get_all_dataspaced_models(self):
         dataspaced_models = CopyDefaultsForm.get_all_dataspaced_models()
-        self.assertEqual(10, len(dataspaced_models))
+        self.assertEqual(11, len(dataspaced_models))
         self.assertEqual(7, len(dataspaced_models.get("Component Catalog")))
         self.assertIn("Subcomponent", str(dataspaced_models.get("Component Catalog")))
 

policy/signals.py

@@ -26,15 +26,9 @@ def evaluate_product_rules_on_product_save(sender, instance, **kwargs):
     evaluate_product_rules_task.delay(product_uuid=instance.uuid)
 
 
-@receiver(post_save, sender="product_portfolio.ProductPackage")
-def evaluate_product_rules_on_productpackage_save(sender, instance, **kwargs):
-    """Queue a policy rule evaluation whenever a package is added or updated in a product."""
-    evaluate_product_rules_task.delay(product_uuid=instance.product.uuid)
-
-
-@receiver(post_delete, sender="product_portfolio.ProductPackage")
-def evaluate_product_rules_on_productpackage_delete(sender, instance, **kwargs):
-    """Queue a policy rule evaluation whenever a package is removed from a product."""
+@receiver([post_save, post_delete], sender="product_portfolio.ProductPackage")
+def evaluate_product_rules_on_productpackage_change(sender, instance, **kwargs):
+    """Queue a policy rule evaluation whenever a package is added, updated, or removed."""
     evaluate_product_rules_task.delay(product_uuid=instance.product.uuid)
 
 

product_portfolio/admin.py

@@ -72,6 +72,8 @@
 from product_portfolio.models import ProductRelationStatus
 from product_portfolio.models import ProductStatus
 from reporting.filters import ReportingQueryListFilter
+from vulnerabilities.triage.engine import reevaluate_product_rulesets
+from vulnerabilities.triage.models import ProductTriageRuleset
 
 
 @admin.register(ProductStatus, site=dejacode_site)
@@ -240,12 +242,13 @@ def save_model(self, request, obj, form, change):
         if "_saveasnew" in request.POST:
             old_product_id = request.resolver_match.kwargs.get("object_id")
             old_product = self.get_object(request, old_product_id)
-            for model_class in [ProductComponent, ProductPackage]:
+            for model_class in [ProductComponent, ProductPackage, ProductTriageRuleset]:
                 for relationship in model_class.objects.filter(product=old_product):
                     relationship.id = None
                     relationship.uuid = uuid.uuid4()
                     relationship.product = obj
                     relationship.save()
+            reevaluate_product_rulesets(obj)
 
     def get_obj_perms_user_select_form(self, request):
         """

product_portfolio/filters.py

@@ -43,6 +43,8 @@
 from vulnerabilities.models import RISK_SCORE_RANGES
 from vulnerabilities.models import Vulnerability
 from vulnerabilities.models import VulnerabilityAnalysisMixin
+from vulnerabilities.triage.models import TriageAction
+from vulnerabilities.triage.models import TriageRecord
 
 
 class HasComplianceIssueFilter(django_filters.BooleanFilter):
@@ -366,6 +368,7 @@ class ProductPackageFilterSet(BaseProductRelationFilterSet):
     dropdown_fields = [
         "is_modified",
         "weighted_risk_score",
+        "triage_action",
         "vulnerability_analyses__state",
         "vulnerability_analyses__justification",
         "responses",
@@ -419,6 +422,12 @@ class ProductPackageFilterSet(BaseProductRelationFilterSet):
             ("unknown", _("Reachability not known")),
         ),
     )
+    triage_action = django_filters.ChoiceFilter(
+        label=_("Triage action"),
+        choices=TriageAction.choices,
+        empty_label=_("All actions"),
+        method="filter_triage_action",
+    )
     compliance_issues = HasComplianceIssueFilter(
         field_name="package__usage_policy__compliance_alert",
         distinct=True,
@@ -438,6 +447,17 @@ class Meta:
             "exploitability",
         ]
 
+    @staticmethod
+    def filter_triage_action(queryset, name, value):
+        if not value:
+            return queryset
+        primary_triage = TriageRecord.objects.highest_precedence().filter(
+            product=OuterRef("product"),
+            vulnerability__affected_packages__productpackages=OuterRef("pk"),
+            recommended_action=value,
+        )
+        return queryset.filter(Exists(primary_triage)).distinct()
+
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self.filters["vulnerability_analyses__state"].extra["null_label"] = "(No values)"

product_portfolio/forms.py

@@ -58,6 +58,7 @@
 from product_portfolio.models import ScanCodeProject
 from product_portfolio.tasks import pull_project_data_from_scancodeio_task
 from product_portfolio.tasks import scancodeio_submit_project_task
+from vulnerabilities.triage.models import ProductTriageRuleset
 
 
 class NameVersionValidationFormMixin:
@@ -106,6 +107,7 @@ class ProductForm(
         ProductComponent,
         ProductPackage,
         CodebaseResource,
+        ProductTriageRuleset,
     ]
 
     keywords = KeywordsField()

product_portfolio/importers.py

@@ -20,6 +20,8 @@
 from django.db import transaction
 from django.db.models import ObjectDoesNotExist
 from django.db.models import Q
+from django.db.models.signals import post_delete
+from django.db.models.signals import post_save
 from django.utils.translation import gettext_lazy as _
 
 from license_expression import Licensing
@@ -40,6 +42,8 @@
 from dje.models import Dataspace
 from dje.utils import get_help_text
 from dje.utils import is_uuid4
+from policy.signals import evaluate_product_rules_on_productpackage_change
+from policy.tasks import evaluate_product_rules_task
 from product_portfolio.forms import ProductComponentLicenseExpressionFormMixin
 from product_portfolio.models import CodebaseResource
 from product_portfolio.models import CodebaseResourceUsage
@@ -50,6 +54,8 @@
 from product_portfolio.models import ProductPackage
 from product_portfolio.models import ProductRelationStatus
 from product_portfolio.models import ScanCodeProject
+from vulnerabilities.triage.signals import reevaluate_on_product_package_change
+from vulnerabilities.triage.tasks import reevaluate_product_triage_rulesets_task
 
 logger = logging.getLogger(__name__)
 
@@ -62,6 +68,35 @@ def log_elapsed(label):
     logger.info(f"{label}: {time.perf_counter() - start:.1f}s")
 
 
+@contextmanager
+def paused_product_package_reevaluation():
+    """
+    Pause the policy and triage re-evaluation signals triggered by ProductPackage changes,
+    for the duration of a bulk import. Call `reevaluate_products()` once the import completes
+    to evaluate each affected product exactly once, instead of once per imported row.
+    """
+    receivers = [
+        evaluate_product_rules_on_productpackage_change,
+        reevaluate_on_product_package_change,
+    ]
+    for receiver in receivers:
+        post_save.disconnect(receiver, sender=ProductPackage)
+        post_delete.disconnect(receiver, sender=ProductPackage)
+    try:
+        yield
+    finally:
+        for receiver in receivers:
+            post_save.connect(receiver, sender=ProductPackage)
+            post_delete.connect(receiver, sender=ProductPackage)
+
+
+def reevaluate_products(products):
+    """Queue the policy and triage re-evaluation once for each of the given products."""
+    for product in products:
+        evaluate_product_rules_task.delay(product_uuid=product.uuid)
+        reevaluate_product_triage_rulesets_task.delay(product_uuid=product.uuid)
+
+
 class CleanProductMixin(ComponentRelatedFieldImportMixin):
     def clean_product(self):
         queryset = Product.objects.get_queryset(self.user)
@@ -230,6 +265,14 @@ def clean_package(self):
 class ProductPackageImporter(BaseImporter):
     model_form = ProductPackageImportForm
 
+    def save_all(self):
+        with paused_product_package_reevaluation():
+            super().save_all()
+
+        touched_product_packages = self.results["added"] + self.results["modified"]
+        products = {product_package.product for product_package in touched_product_packages}
+        reevaluate_products(products)
+
 
 class CodebaseResourceImportForm(CleanProductMixin, BaseImportModelForm):
     product = forms.CharField(
@@ -434,7 +477,9 @@ def save(self):
         self.create_scancode_project()
         self.load_data_from_file()
         self.validate_headers()
-        self.import_packages()
+        with paused_product_package_reevaluation():
+            self.import_packages()
+        reevaluate_products([self.product])
         if self.create_codebase_resources:
             self.import_codebase_resources()
         self.update_scancode_project()
@@ -720,7 +765,9 @@ def save(self):
                 self.dependencies = scancodeio.fetch_project_dependencies(self.project_uuid)
 
         with log_elapsed("import_packages"):
-            self.import_packages()
+            with paused_product_package_reevaluation():
+                self.import_packages()
+        reevaluate_products([self.product])
 
         if self.create_dependencies:
             with log_elapsed("import_dependencies"):

product_portfolio/models.py

@@ -495,6 +495,9 @@ def get_export_security_compliance_url(self):
     def get_evaluate_policy_rules_url(self):
         return self.get_url("evaluate_policy_rules")
 
+    def get_manage_triage_rulesets_url(self):
+        return self.get_url("manage_triage_rulesets")
+
     @property
     def cyclonedx_bom_ref(self):
         return str(self.uuid)

product_portfolio/templates/product_portfolio/includes/manage_triage_rules_nav_item.html

@@ -0,0 +1,6 @@
+{% load i18n %}
+<li class="nav-item ms-auto">
+  <a href="#" class="small text-body-secondary" data-bs-toggle="modal" data-bs-target="#manage-triage-rulesets-modal" data-manage-url="{{ product.get_manage_triage_rulesets_url }}">
+    <i class="fas fa-sliders me-1"></i>{% trans "Manage triage rules" %}
+  </a>
+</li>