fix: reject empty/whitespace-only vulnerability_id in /v3/exploit-intelligence/analyze endpoint [Backport release/0.6.z]

[trustify-ci-bot]

Description

Backport of #2567 to release/0.6.z.

Summary by Sourcery

Validate vulnerability_id in the exploit intelligence analyze endpoint and treat invalid requests as permanent analysis errors.

Bug Fixes:

• Reject empty or whitespace-only vulnerability_id values in /v3/exploit-intelligence/analyze with a 400 Bad Request response.
• Ensure BadRequest errors from the exploit-intelligence module are surfaced with consistent JSON error information.
• Classify BadRequest errors as permanent in the exploit-intelligence analysis runner to avoid unnecessary retries.

Tests:

• Add endpoint tests verifying that blank vulnerability_id values are rejected with 400 Bad Request and the expected error payload.

[sourcery-ai]

Reviewer's Guide

This PR backports validation for the /v3/exploit-intelligence/analyze endpoint so that empty or whitespace-only vulnerability_id values are rejected with a 400 Bad Request, and wires the new error type through the endpoint and runner layers with corresponding tests.

Sequence diagram for analyze endpoint vulnerability_id validation

sequenceDiagram
    actor Client
    participant AnalyzeEndpoint as analyze
    participant ErrorType as Error
    participant Http as HttpResponse

    Client->>AnalyzeEndpoint: POST /v3/exploit-intelligence/analyze
    AnalyzeEndpoint->>AnalyzeEndpoint: vulnerability_id.trim()
    alt [vulnerability_id is empty]
        AnalyzeEndpoint->>ErrorType: Error::BadRequest("vulnerability_id must not be empty")
        ErrorType->>Http: ResponseError::error_response()
        Http-->>Client: 400 BadRequest (ErrorInformation BadRequest)
    else [vulnerability_id is non-empty]
        AnalyzeEndpoint->>AnalyzeEndpoint: create_job(..., vulnerability_id, ...)
        AnalyzeEndpoint-->>Client: 200 OK (AnalyzeResponse)
    end

Loading

File-Level Changes

Change	Details	Files
Validate vulnerability_id in analyze endpoint and reject empty/whitespace-only values with a 400 Bad Request response.	Trim vulnerability_id from the request body before use. Return BadRequest error when the trimmed vulnerability_id is empty. Pass the trimmed vulnerability_id into create_job and find_active_job instead of the raw request field.	modules/exploit-intelligence/src/endpoints/mod.rs
Extend error handling to support BadRequest and ensure it is treated as a permanent analysis error.	Add BadRequest variant to the exploit-intelligence Error enum with an appropriate error message format. Map BadRequest errors to 400 Bad Request responses using ErrorInformation with error="BadRequest". Classify BadRequest errors as permanent in AnalysisError::from(crate::Error).	modules/exploit-intelligence/src/error.rs modules/exploit-intelligence/src/runner/mod.rs
Add endpoint tests covering rejection of blank vulnerability_id values and the error response format.	Import ErrorInformation into the endpoint tests to deserialize error responses. Introduce analyze_rejects_blank_vulnerability_id test that posts analyze requests with empty and whitespace-only vulnerability_id values. Assert that such requests return 400 Bad Request with error="BadRequest" and message "vulnerability_id must not be empty".	modules/exploit-intelligence/src/endpoints/test.rs

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've left some high level feedback:

• The analyze handler now trims and validates vulnerability_id inline; consider extracting this into a small helper or validator so the same rule can be reused consistently if other endpoints accept a vulnerability_id.
• The Error::BadRequest variant currently takes a String and is mapped to ErrorInformation::new("BadRequest", msg); if you anticipate multiple BadRequest reasons, consider using a structured type or enum for the payload to distinguish causes more robustly than plain strings.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The `analyze` handler now trims and validates `vulnerability_id` inline; consider extracting this into a small helper or validator so the same rule can be reused consistently if other endpoints accept a `vulnerability_id`.
- The `Error::BadRequest` variant currently takes a `String` and is mapped to `ErrorInformation::new("BadRequest", msg)`; if you anticipate multiple BadRequest reasons, consider using a structured type or enum for the payload to distinguish causes more robustly than plain strings.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}