fix: emit CSAF impact statement for all known_not_affected products

Author: dervoeti

backend/application/vex/services/csaf_generator_vulnerability.py

@@ -18,6 +18,7 @@
     CSAFNote,
     CSAFProductStatus,
     CSAFReference,
+    CSAFThreat,
     CSAFVulnerability,
 )
 
@@ -124,38 +125,48 @@ def set_flag_or_threat(vulnerability: CSAFVulnerability, observation: Observatio
     if vex_status == CSAF_Status.CSAF_STATUS_NOT_AFFECTED:
         product_or_relationship_id = get_product_or_relationship_id(observation)
         observation_log = get_current_modifying_observation_log(observation)
-        if observation_log and observation_log.vex_justification:
+        # Prefer the observation's authoritative current justification and only fall back to the latest
+        # modifying observation log when it is empty. The log's vex_justification can be empty even
+        # though a justification was assessed, because empty log entries (for example the ones created
+        # when a rego rule is removed) count as "modifying" and shadow the real assessment. That would
+        # leave the product in known_not_affected without any impact statement (CSAF mandatory test
+        # 6.1.27.9).
+        justification = observation.current_vex_justification
+        if not justification and observation_log:
+            justification = observation_log.vex_justification
+        csaf_label = map_vex_justification_to_csaf_openvex_justification(justification)
+        if csaf_label:
             found = False
             for flag in vulnerability.flags:
-                if flag.label == map_vex_justification_to_csaf_openvex_justification(observation_log.vex_justification):
+                if flag.label == csaf_label:
                     if product_or_relationship_id not in flag.product_ids:
                         flag.product_ids.append(product_or_relationship_id)
                     found = True
                     break
             if not found:
                 csaf_flag = CSAFFlag(
-                    label=map_vex_justification_to_csaf_openvex_justification(observation_log.vex_justification),
+                    label=csaf_label,
                     product_ids=[product_or_relationship_id],
                 )
                 vulnerability.flags.append(csaf_flag)
-
-
-# else:
-#     category = "impact"
-#     details = (
-#         observation_log.comment if observation_log and observation_log.comment else "No justification available"
-#     )
-#     found = False
-#     for threat in vulnerability.threats:
-#         if threat.category == category and threat.details == details:
-#             if product_or_relationship_id not in threat.product_ids:
-#                 threat.product_ids.append(product_or_relationship_id)
-#             found = True
-#             break
-#     if not found:
-#         threat = CSAFThreat(
-#             category=category,
-#             details=details,
-#             product_ids=[product_or_relationship_id],
-#         )
-#         vulnerability.threats.append(threat)
+        elif observation_log and observation_log.comment:
+            # CSAF mandatory test 6.1.27.9 requires an impact statement for every product in
+            # known_not_affected. When no machine-readable vex_justification is set, fall back to
+            # the assessment comment as a free-text impact threat. Without a comment we emit nothing
+            # and let validation fail, so the missing justification is caught instead of masked.
+            category = "impact"
+            details = observation_log.comment
+            found = False
+            for threat in vulnerability.threats:
+                if threat.category == category and threat.details == details:
+                    if product_or_relationship_id not in threat.product_ids:
+                        threat.product_ids.append(product_or_relationship_id)
+                    found = True
+                    break
+            if not found:
+                threat = CSAFThreat(
+                    category=category,
+                    details=details,
+                    product_ids=[product_or_relationship_id],
+                )
+                vulnerability.threats.append(threat)