Merge pull request #47 from ParanoiHack/feature/findings_status

Add DD support for false positive, risk_accepted and out-of-scope

Author: Nitr4x

connectors/defectdojo/dto.go

@@ -65,6 +65,13 @@ type Finding struct {
 	// finding as a duplicate of another finding in the product. Corresponds to the
 	// "duplicate" field returned by the findings API.
 	Duplicate bool `json:"duplicate"`
+	// OutOfScope is true when a triager has marked this finding as out of scope.
+	OutOfScope bool `json:"out_of_scope"`
+	// RiskAccepted is true when a triager has accepted the risk for this finding.
+	RiskAccepted bool `json:"risk_accepted"`
+	// FalseP is true when a triager has marked this finding as a false positive.
+	// Corresponds to the "false_p" field returned by the findings API.
+	FalseP bool `json:"false_p"`
 }
 
 type GetFindingsResponse struct {

features/sync/sync.go

@@ -193,11 +193,13 @@ func GetEngagementFindings(ddService defectdojo.DefectDojoService, projectName s
 }
 
 // MarkFindingsByDDFindings sets the Status field on every local finding based on
-// the corresponding DefectDojo finding's "active" and "duplicate" fields:
+// the corresponding DefectDojo finding's "active", "duplicate", "out_of_scope",
+// "risk_accepted", and "false_p" fields:
 //
-//   - duplicate=true  → DUPLICATE  (DD deduplication identified a prior occurrence)
-//   - active=false    → INACTIVE   (suppressed, false-positive, or accepted risk)
-//   - active=true     → ACTIVE     (open, confirmed finding)
+//   - duplicate=true                                     → DUPLICATE (DD deduplication identified a prior occurrence)
+//   - active=false, out_of_scope=true, risk_accepted=true,
+//     or false_p=true                                    → INACTIVE  (suppressed, out of scope, accepted risk, or false-positive)
+//   - none of the above                                  → ACTIVE    (open, confirmed finding)
 //
 // Local findings with no matching DD finding default to ACTIVE (they are brand-new
 // findings just created by the sync import). All local findings are returned —
@@ -211,12 +213,21 @@ func GetEngagementFindings(ddService defectdojo.DefectDojoService, projectName s
 //     before upload; DD's Semgrep parser stores it as unique_id_from_tool).
 func MarkFindingsByDDFindings(local []models.Finding, ddFindings []defectdojo.Finding) []models.Finding {
 	type ddStatus struct {
-		active    bool
-		duplicate bool
+		active       bool
+		duplicate    bool
+		outOfScope   bool
+		riskAccepted bool
+		falseP       bool
 	}
 	ddMap := make(map[string]ddStatus, len(ddFindings)*2)
 	for _, f := range ddFindings {
-		s := ddStatus{active: f.Active, duplicate: f.Duplicate}
+		s := ddStatus{
+			active:       f.Active,
+			duplicate:    f.Duplicate,
+			outOfScope:   f.OutOfScope,
+			riskAccepted: f.RiskAccepted,
+			falseP:       f.FalseP,
+		}
 		// Strategy 1: hash from API fields — covers Grype and KICS.
 		ddMap[models.ComputeFindingHash(f.Severity, f.FilePath, f.Line, f.Mitigation)] = s
 		// Strategy 2: UniqueIdFromTool — covers OpenGrep.
@@ -232,7 +243,7 @@ func MarkFindingsByDDFindings(local []models.Finding, ddFindings []defectdojo.Fi
 			switch {
 			case s.duplicate:
 				result[i].Status = models.FindingStatusDuplicate
-			case !s.active:
+			case !s.active || s.outOfScope || s.riskAccepted || s.falseP:
 				result[i].Status = models.FindingStatusInactive
 			default:
 				result[i].Status = models.FindingStatusActive

features/sync/sync_test.go

@@ -370,6 +370,81 @@ func TestMarkFindingsByDDFindings(t *testing.T) {
 		assert.Equal(t, models.FindingStatusDuplicate, result[0].Status)
 	})
 
+	t.Run("Should mark finding as INACTIVE when DD finding has out_of_scope=true", func(t *testing.T) {
+		local := []models.Finding{
+			localFinding("LOW", "Info leak", "src/leak.go", 3, "Redact output"),
+		}
+		ddFindings := []defectdojo.Finding{
+			{Title: "Info leak", Severity: "Low", FilePath: "src/leak.go", Line: 3,
+				Mitigation: "Redact output", Active: false, Duplicate: false, OutOfScope: true},
+		}
+
+		result := MarkFindingsByDDFindings(local, ddFindings)
+
+		assert.Len(t, result, 1)
+		assert.Equal(t, models.FindingStatusInactive, result[0].Status)
+	})
+
+	t.Run("Should mark finding as INACTIVE when DD finding has risk_accepted=true", func(t *testing.T) {
+		local := []models.Finding{
+			localFinding("HIGH", "Weak Cipher", "src/crypto.go", 8, "Use AES-256"),
+		}
+		ddFindings := []defectdojo.Finding{
+			{Title: "Weak Cipher", Severity: "High", FilePath: "src/crypto.go", Line: 8,
+				Mitigation: "Use AES-256", Active: false, Duplicate: false, RiskAccepted: true},
+		}
+
+		result := MarkFindingsByDDFindings(local, ddFindings)
+
+		assert.Len(t, result, 1)
+		assert.Equal(t, models.FindingStatusInactive, result[0].Status)
+	})
+
+	t.Run("Should mark finding as INACTIVE when DD finding has false_p=true", func(t *testing.T) {
+		local := []models.Finding{
+			localFinding("MEDIUM", "Path Traversal", "src/files.go", 21, "Validate path"),
+		}
+		ddFindings := []defectdojo.Finding{
+			{Title: "Path Traversal", Severity: "Medium", FilePath: "src/files.go", Line: 21,
+				Mitigation: "Validate path", Active: false, Duplicate: false, FalseP: true},
+		}
+
+		result := MarkFindingsByDDFindings(local, ddFindings)
+
+		assert.Len(t, result, 1)
+		assert.Equal(t, models.FindingStatusInactive, result[0].Status)
+	})
+
+	t.Run("Should mark finding as INACTIVE when risk_accepted=true even if active=true", func(t *testing.T) {
+		local := []models.Finding{
+			localFinding("CRITICAL", "Insecure Deserialization", "src/serde.go", 55, "Use safe parser"),
+		}
+		ddFindings := []defectdojo.Finding{
+			{Title: "Insecure Deserialization", Severity: "Critical", FilePath: "src/serde.go", Line: 55,
+				Mitigation: "Use safe parser", Active: true, Duplicate: false, RiskAccepted: true},
+		}
+
+		result := MarkFindingsByDDFindings(local, ddFindings)
+
+		assert.Len(t, result, 1)
+		assert.Equal(t, models.FindingStatusInactive, result[0].Status)
+	})
+
+	t.Run("Should prioritise duplicate=true over risk_accepted=true", func(t *testing.T) {
+		local := []models.Finding{
+			localFinding("HIGH", "Vuln2", "src/main2.go", 6, "Fix it"),
+		}
+		ddFindings := []defectdojo.Finding{
+			{Title: "Vuln2", Severity: "High", FilePath: "src/main2.go", Line: 6,
+				Mitigation: "Fix it", Active: false, Duplicate: true, RiskAccepted: true},
+		}
+
+		result := MarkFindingsByDDFindings(local, ddFindings)
+
+		assert.Len(t, result, 1)
+		assert.Equal(t, models.FindingStatusDuplicate, result[0].Status)
+	})
+
 	t.Run("Should default to ACTIVE when local finding has no DD counterpart", func(t *testing.T) {
 		local := []models.Finding{
 			localFinding("HIGH", "New Finding", "src/new.go", 1, "Fix it"),