fix: emit CSAF impact statement for all known_not_affected products

Author: dervoeti

backend/application/vex/services/csaf_generator_vulnerability.py

@@ -1,7 +1,7 @@
 from typing import Optional
 
 from application.core.models import Observation
-from application.core.queries.observation import get_current_modifying_observation_log
+from application.core.queries.observation import get_current_observation_log
 from application.vex.services.csaf_generator_helpers import (
     get_product_or_relationship_id,
     get_vulnerability_ecosystem,
@@ -18,6 +18,7 @@
     CSAFNote,
     CSAFProductStatus,
     CSAFReference,
+    CSAFThreat,
     CSAFVulnerability,
 )
 
@@ -123,39 +124,49 @@ def set_flag_or_threat(vulnerability: CSAFVulnerability, observation: Observatio
     vex_status = map_status(observation.current_status)
     if vex_status == CSAF_Status.CSAF_STATUS_NOT_AFFECTED:
         product_or_relationship_id = get_product_or_relationship_id(observation)
-        observation_log = get_current_modifying_observation_log(observation)
-        if observation_log and observation_log.vex_justification:
+        # get_current_observation_log (unlike get_current_modifying_observation_log) excludes empty log
+        # entries, e.g. the ones created when a rego rule is removed. Those have an empty
+        # vex_justification and comment and would otherwise shadow the real assessment, leaving the
+        # product in known_not_affected without any impact statement (CSAF mandatory test 6.1.27.9).
+        observation_log = get_current_observation_log(observation)
+
+        # Prefer the observation's authoritative current justification, fall back to the log.
+        justification = observation.current_vex_justification
+        if not justification and observation_log:
+            justification = observation_log.vex_justification
+        csaf_label = map_vex_justification_to_csaf_openvex_justification(justification)
+        if csaf_label:
             found = False
             for flag in vulnerability.flags:
-                if flag.label == map_vex_justification_to_csaf_openvex_justification(observation_log.vex_justification):
+                if flag.label == csaf_label:
                     if product_or_relationship_id not in flag.product_ids:
                         flag.product_ids.append(product_or_relationship_id)
                     found = True
                     break
             if not found:
                 csaf_flag = CSAFFlag(
-                    label=map_vex_justification_to_csaf_openvex_justification(observation_log.vex_justification),
+                    label=csaf_label,
                     product_ids=[product_or_relationship_id],
                 )
                 vulnerability.flags.append(csaf_flag)
 
-
-# else:
-#     category = "impact"
-#     details = (
-#         observation_log.comment if observation_log and observation_log.comment else "No justification available"
-#     )
-#     found = False
-#     for threat in vulnerability.threats:
-#         if threat.category == category and threat.details == details:
-#             if product_or_relationship_id not in threat.product_ids:
-#                 threat.product_ids.append(product_or_relationship_id)
-#             found = True
-#             break
-#     if not found:
-#         threat = CSAFThreat(
-#             category=category,
-#             details=details,
-#             product_ids=[product_or_relationship_id],
-#         )
-#         vulnerability.threats.append(threat)
+        # Surface the assessment comment as a free-text impact threat whenever it exists, so the human
+        # explanation is kept alongside the machine-readable flag. With neither a flag nor a comment
+        # the product has no impact statement and validation fails, which is intended.
+        if observation_log and observation_log.comment:
+            category = "impact"
+            details = observation_log.comment
+            found = False
+            for threat in vulnerability.threats:
+                if threat.category == category and threat.details == details:
+                    if product_or_relationship_id not in threat.product_ids:
+                        threat.product_ids.append(product_or_relationship_id)
+                    found = True
+                    break
+            if not found:
+                threat = CSAFThreat(
+                    category=category,
+                    details=details,
+                    product_ids=[product_or_relationship_id],
+                )
+                vulnerability.threats.append(threat)