Preserve raw CycloneDX VEX analysis on parsed findings - #15382
Open
Jino-T wants to merge 1 commit into
Open
Conversation
The CycloneDX parser collapses vulnerabilities[].analysis into status booleans (is_mitigated/false_p) and drops justification and response entirely. Attach the raw analysis dict to the in-memory finding as `unsaved_vex` so downstream consumers can round-trip the full VEX data (state/justification/response/detail). It is an inert attribute for callers that don't read it, so OSS behavior is unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The CycloneDX JSON parser collapses each
vulnerabilities[].analysisblock into Dojo status booleans (is_mitigated/false_p) and dropsjustificationandresponseentirely. This attaches the rawanalysisdict to the in-memory finding asfinding.unsaved_vexso downstream consumers can round-trip the full VEX data (state/justification/response/detail).Why
VEX (Vulnerability Exploitability eXchange) analysis carries more than a mitigated/false-positive flag — the justification and response arrays are meaningful and standardized in CycloneDX 1.7. Preserving the original block lets a consumer re-export a schema-valid VEX document instead of reconstructing a lossy approximation from Dojo status.
Behavior
unsaved_vexis an inert in-memory attribute — the parser doesn't persist it and nothing in OSS reads it, so existing behavior is completely unchanged. It follows the sameunsaved_*convention the importers already use forunsaved_vulnerability_ids,unsaved_endpoints, etc.: a place for parsed-but-not-yet-persisted data that post-save consumers can pick up.Change
A single line in
dojo/tools/cyclonedx/json_parser.py, set right after the existinganalysishandling:No schema, model, or migration changes.