diff --git a/dojo/tools/fortify/fpr_parser.py b/dojo/tools/fortify/fpr_parser.py index 2520b7fd363..939d8f8a843 100644 --- a/dojo/tools/fortify/fpr_parser.py +++ b/dojo/tools/fortify/fpr_parser.py @@ -354,7 +354,10 @@ def format_impact(self, related_data, vuln_data) -> str: def compute_status(self, related_data, vulnerability) -> tuple[bool, bool]: """Compute the status of the vulnerability based on the instance ID. Return active, false_p""" - if vulnerability.instance_id in related_data.suppressed: + # audit.xml lists every issue with suppressed="true" OR "false"; check the + # value, not just membership, otherwise every audited finding becomes false_p + # and every reimport closes the whole test. + if related_data.suppressed.get(vulnerability.instance_id): return False, True return True, False diff --git a/unittests/tools/test_fortify_parser.py b/unittests/tools/test_fortify_parser.py index e37ce89198c..551de46a3d5 100644 --- a/unittests/tools/test_fortify_parser.py +++ b/unittests/tools/test_fortify_parser.py @@ -163,6 +163,15 @@ def test_fortify_fpr_suppressed_finding(self): self.assertFalse(finding.false_p) self.assertEqual("", finding.impact) with self.subTest(i=1): + # Present in audit.xml without suppressed="true" (audited but not suppressed). + # Regression guard: previously compute_status used `in related_data.suppressed`, + # which flipped every audited finding to false_p and closed the whole test on + # reimport. + finding = findings[1] + self.assertEqual("D3166922519EDD92D132761602EB71B4", finding.unique_id_from_tool) + self.assertTrue(finding.active) + self.assertFalse(finding.false_p) + with self.subTest(i=2): finding = findings[2] self.assertEqual("Build Misconfiguration - pom.xml: 1 (FF57412F-DD28-44DE-8F4F-0AD39620768C)", finding.title) self.assertEqual("87E3EC5CC8154C006783CC461A6DDEEB", finding.unique_id_from_tool)