[cravex2-reachability] Implement rule tools triaging vulnerabilities

dejacode/settings.py

@@ -345,6 +345,7 @@ def gettext_noop(s):
     "policy",
     "notification",
     "vulnerabilities",
+    "vulnerabilities.triage",
 ]
 
 EXTRA_APPS = env.list("EXTRA_APPS", default=[])
@@ -478,6 +479,7 @@ def gettext_noop(s):
 hourly = "0 * * * *"
 DEJACODE_VULNERABILITIES_CRON = env.str("DEJACODE_VULNERABILITIES_CRON", default=daily_at_3am)
 DEJACODE_POLICY_RULES_CRON = env.str("DEJACODE_POLICY_RULES_CRON", default=hourly)
+DEJACODE_VULNERABILITY_TRIAGE_CRON = env.str("DEJACODE_VULNERABILITY_TRIAGE_CRON", default=hourly)
 
 
 def enable_rq_eager_mode():

dejacode/static/css/dejacode_bootstrap.css

@@ -433,13 +433,13 @@ table.vulnerabilities-table .column-summary {
   width: 300px;
 }
 #tab_vulnerabilities .column-vulnerability_analyses__state {
-  min-width: 125px;
+  min-width: 100px;
 }
 #tab_vulnerabilities .column-vulnerability_analyses__justification {
   min-width: 130px;
 }
 #tab_vulnerabilities .column-vulnerability_analyses__responses {
-  width: 185px;
+  min-width: 120px;
 }
 #tab_vulnerabilities .column-vulnerability_analyses__is_reachable {
   width: 80px;

dje/cron_jobs.py

@@ -12,19 +12,28 @@
 
 from dje.tasks import update_vulnerabilities
 from policy.tasks import evaluate_all_products_rules_task
+from vulnerabilities.triage.tasks import evaluate_all_products_vulnerability_triage_task
 
-two_hour = 7200
+two_hours = 7200
+ten_minutes = 600
 
 cron.register(
     func=update_vulnerabilities,
     queue_name="default",
     cron=settings.DEJACODE_VULNERABILITIES_CRON,  # Daily at 3am by default
-    job_timeout=two_hour,
+    job_timeout=two_hours,
 )
 
 cron.register(
     func=evaluate_all_products_rules_task,
     queue_name="default",
     cron=settings.DEJACODE_POLICY_RULES_CRON,  # Hourly by default
-    job_timeout=two_hour,
+    job_timeout=ten_minutes,
+)
+
+cron.register(
+    func=evaluate_all_products_vulnerability_triage_task,
+    queue_name="default",
+    cron=settings.DEJACODE_VULNERABILITY_TRIAGE_CRON,  # Hourly by default
+    job_timeout=ten_minutes,
 )

product_portfolio/filters.py

@@ -9,6 +9,7 @@
 from django import forms
 from django.contrib import admin
 from django.db.models import Exists
+from django.db.models import F
 from django.db.models import OuterRef
 from django.db.models import Q
 from django.utils.translation import gettext_lazy as _
@@ -43,6 +44,7 @@
 from vulnerabilities.models import RISK_SCORE_RANGES
 from vulnerabilities.models import Vulnerability
 from vulnerabilities.models import VulnerabilityAnalysisMixin
+from vulnerabilities.triage.models import TriageAction
 
 
 class HasComplianceIssueFilter(django_filters.BooleanFilter):
@@ -366,6 +368,7 @@ class ProductPackageFilterSet(BaseProductRelationFilterSet):
     dropdown_fields = [
         "is_modified",
         "weighted_risk_score",
+        "triage_action",
         "vulnerability_analyses__state",
         "vulnerability_analyses__justification",
         "responses",
@@ -419,6 +422,12 @@ class ProductPackageFilterSet(BaseProductRelationFilterSet):
             ("unknown", _("Reachability not known")),
         ),
     )
+    triage_action = django_filters.ChoiceFilter(
+        label=_("Triage action"),
+        choices=TriageAction.choices,
+        empty_label=_("All actions"),
+        method="filter_triage_action",
+    )
     compliance_issues = HasComplianceIssueFilter(
         field_name="package__usage_policy__compliance_alert",
         distinct=True,
@@ -438,6 +447,16 @@ class Meta:
             "exploitability",
         ]
 
+    @staticmethod
+    def filter_triage_action(queryset, name, value):
+        if not value:
+            return queryset
+        return queryset.filter(
+            package__affected_by_vulnerabilities__triage_records__action=value,
+            package__affected_by_vulnerabilities__triage_records__ruleset__enabled=True,
+            package__affected_by_vulnerabilities__triage_records__product=F("product"),
+        ).distinct()
+
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self.filters["vulnerability_analyses__state"].extra["null_label"] = "(No values)"

product_portfolio/forms.py

@@ -58,6 +58,7 @@
 from product_portfolio.models import ScanCodeProject
 from product_portfolio.tasks import pull_project_data_from_scancodeio_task
 from product_portfolio.tasks import scancodeio_submit_project_task
+from vulnerabilities.triage.models import ProductTriageRuleset
 
 
 class NameVersionValidationFormMixin:
@@ -106,6 +107,7 @@ class ProductForm(
         ProductComponent,
         ProductPackage,
         CodebaseResource,
+        ProductTriageRuleset,
     ]
 
     keywords = KeywordsField()

product_portfolio/models.py

@@ -495,6 +495,9 @@ def get_export_security_compliance_url(self):
     def get_evaluate_policy_rules_url(self):
         return self.get_url("evaluate_policy_rules")
 
+    def get_manage_triage_rulesets_url(self):
+        return self.get_url("manage_triage_rulesets")
+
     @property
     def cyclonedx_bom_ref(self):
         return str(self.uuid)

product_portfolio/templates/product_portfolio/modals/manage_triage_rulesets_form.html

@@ -0,0 +1,51 @@
+{% load i18n %}
+<form id="manage-triage-rulesets-form">
+  {% if available_rulesets %}
+    <p class="text-body-secondary small px-3 pt-3 mb-0">
+      {% trans "Select the rules to activate for this product. Saving triggers an evaluation of all active packages." %}
+    </p>
+    <div class="list-group list-group-flush mt-2">
+      {% for ruleset in available_rulesets %}
+        <label class="list-group-item d-flex gap-3 py-3" for="ruleset_{{ ruleset.uuid }}">
+          <input class="form-check-input flex-shrink-0 mt-1"
+                 type="checkbox"
+                 name="ruleset_uuids"
+                 value="{{ ruleset.uuid }}"
+                 id="ruleset_{{ ruleset.uuid }}"
+                 {% if ruleset.id in assigned_ruleset_ids %}checked{% endif %}>
+          <span class="flex-grow-1">
+            <span class="d-flex justify-content-between align-items-baseline mb-1">
+              <strong>{{ ruleset.name }}</strong>
+              <span class="badge bg-secondary-subtle text-secondary-emphasis ms-2 flex-shrink-0">
+                {% trans "Precedence:" %} {{ ruleset.precedence }}
+              </span>
+            </span>
+            {% if ruleset.description %}
+              <span class="d-block small text-body-secondary mb-1">{{ ruleset.description }}</span>
+            {% endif %}
+            {% if ruleset.active_rules %}
+              <span class="d-flex align-items-center flex-wrap gap-1 mb-1">
+                <span class="small text-body-secondary me-1">{% trans "Conditions:" %}</span>
+                {% for rule in ruleset.active_rules %}
+                  <span class="badge bg-secondary-subtle text-secondary-emphasis fw-normal">
+                    {{ rule.label }}{% if rule.params_str %} ({{ rule.params_str }}){% endif %}
+                  </span>
+                {% endfor %}
+              </span>
+            {% endif %}
+            <span class="d-flex align-items-center gap-2 mt-1">
+              <span class="small text-body-secondary">{% trans "Recommended action:" %}</span>
+              <span class="badge {{ ruleset.action_badge_class }} text-nowrap">
+                <i class="fas {{ ruleset.action_icon }} me-1"></i>{{ ruleset.action_label }}
+              </span>
+            </span>
+          </span>
+        </label>
+      {% endfor %}
+    </div>
+  {% else %}
+    <p class="text-body-secondary px-3 py-3 mb-0">
+      {% trans "No triage rules are available in this dataspace." %}
+    </p>
+  {% endif %}
+</form>

product_portfolio/templates/product_portfolio/modals/manage_triage_rulesets_modal.html

@@ -0,0 +1,17 @@
+{% load i18n %}
+<div id="manage-triage-rulesets-modal" class="modal" tabindex="-1" role="dialog">
+  <div class="modal-dialog modal-lg" role="document">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h5 class="modal-title">{% trans "Triage Rules" %}</h5>
+        <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+      </div>
+      <div id="manage-triage-rulesets-body" class="modal-body p-0">
+      </div>
+      <div class="modal-footer">
+        <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">{% trans "Close" %}</button>
+        <button type="button" id="submit-triage-rulesets" class="btn btn-primary">{% trans "Save" %}</button>
+      </div>
+    </div>
+  </div>
+</div>

product_portfolio/templates/product_portfolio/product_details.html

@@ -10,7 +10,7 @@
           <i class="fas fa-tasks"></i> Manage
         </button>
       </span>
-    {% elif has_edit_productcomponent or has_edit_productpackage or has_change_codebaseresource_permission or has_add_productcomponent %}
+    {% elif has_edit_productcomponent or has_edit_productpackage or has_change_codebaseresource_permission or has_add_productcomponent or has_change_permission %}
       <div class="dropdown btn-group">
         <a class="btn btn-outline-dark dropdown-toggle" data-bs-toggle="dropdown" role="button" href="#"><i class="fas fa-tasks"></i> {% trans 'Manage' %}</a>
         <div class="dropdown-menu dropdown-menu-end">
@@ -32,6 +32,16 @@
           {% if purldb_enabled %}
             <a class="dropdown-item" href="#" id="check-package-versions"><i class="fas fa-arrow-alt-circle-up"></i> {% trans 'Check for new Package versions' %}</a>
           {% endif %}
+          {% if has_change_permission and request.user.dataspace.enable_vulnerablecodedb_access %}
+            <hr class="dropdown-divider">
+            <div class="dropdown-header">{% trans "Vulnerabilities" %}</div>
+            <button class="dropdown-item" type="button"
+                    data-bs-toggle="modal"
+                    data-bs-target="#manage-triage-rulesets-modal"
+                    data-manage-url="{{ product.get_manage_triage_rulesets_url }}">
+              <i class="fas fa-filter me-1"></i> {% trans "Triage Rules" %}
+            </button>
+          {% endif %}
         </div>
       </div>
     {% endif %}
@@ -148,6 +158,9 @@
   {% if request.user.dataspace.enable_vulnerablecodedb_access and product.vulnerability_count %}
     {% include 'product_portfolio/modals/vulnerability_analysis_modal.html' %}
   {% endif %}
+  {% if has_change_permission and request.user.dataspace.enable_vulnerablecodedb_access %}
+    {% include 'product_portfolio/modals/manage_triage_rulesets_modal.html' %}
+  {% endif %}
 {% endblock %}
 
 {% block messages-alert %}
@@ -281,6 +294,39 @@
     </script>
   {% endif %}
 
+  {% if has_change_permission and request.user.dataspace.enable_vulnerablecodedb_access %}
+    <script>
+      document.addEventListener("DOMContentLoaded", function () {
+        const triageModal = document.getElementById("manage-triage-rulesets-modal");
+        if (!triageModal) return;
+
+        triageModal.addEventListener("show.bs.modal", function (event) {
+          const body = document.getElementById("manage-triage-rulesets-body");
+          body.innerHTML = "";
+          const manageUrl = event.relatedTarget.dataset.manageUrl;
+          document.getElementById("submit-triage-rulesets").dataset.manageUrl = manageUrl;
+          fetch(manageUrl)
+            .then(r => r.text())
+            .then(html => { body.innerHTML = html; })
+            .catch(() => { body.innerHTML = "Error loading content."; });
+        });
+
+        document.getElementById("submit-triage-rulesets").addEventListener("click", function () {
+          const manageUrl = this.dataset.manageUrl;
+          const form = document.getElementById("manage-triage-rulesets-form");
+          fetch(manageUrl, {
+            method: "POST",
+            headers: { "X-CSRFToken": csrftoken },
+            body: new FormData(form),
+          })
+            .then(r => r.json())
+            .then(data => { if (data.success) location.reload(); })
+            .catch(() => {});
+        });
+      });
+    </script>
+  {% endif %}
+
   {% if request.user.dataspace.enable_vulnerablecodedb_access and product.vulnerability_count %}
     <script>
       $(document).ready(function () {