fix(fortify): only flag suppressed FPR findings as false_p (reimport closing all findings)

dojo/tools/fortify/fpr_parser.py

@@ -354,7 +354,10 @@ def format_impact(self, related_data, vuln_data) -> str:
 
     def compute_status(self, related_data, vulnerability) -> tuple[bool, bool]:
         """Compute the status of the vulnerability based on the instance ID. Return active, false_p"""
-        if vulnerability.instance_id in related_data.suppressed:
+        # audit.xml lists every issue with suppressed="true" OR "false"; check the
+        # value, not just membership, otherwise every audited finding becomes false_p
+        # and every reimport closes the whole test.
+        if related_data.suppressed.get(vulnerability.instance_id):
             return False, True
         return True, False
 

unittests/tools/test_fortify_parser.py

@@ -163,6 +163,15 @@ def test_fortify_fpr_suppressed_finding(self):
                 self.assertFalse(finding.false_p)
                 self.assertEqual("", finding.impact)
             with self.subTest(i=1):
+                # Present in audit.xml without suppressed="true" (audited but not suppressed).
+                # Regression guard: previously compute_status used `in related_data.suppressed`,
+                # which flipped every audited finding to false_p and closed the whole test on
+                # reimport.
+                finding = findings[1]
+                self.assertEqual("D3166922519EDD92D132761602EB71B4", finding.unique_id_from_tool)
+                self.assertTrue(finding.active)
+                self.assertFalse(finding.false_p)
+            with self.subTest(i=2):
                 finding = findings[2]
                 self.assertEqual("Build Misconfiguration - pom.xml: 1 (FF57412F-DD28-44DE-8F4F-0AD39620768C)", finding.title)
                 self.assertEqual("87E3EC5CC8154C006783CC461A6DDEEB", finding.unique_id_from_tool)