fix(generic parser): prevent nested list when cve and vulnerability_ids are both present

docs/content/supported_tools/parsers/file/generic.md

@@ -48,6 +48,7 @@ The list of supported fields in JSON format:
 - date: Date
 - cwe: Int
 - cve: String
+- vulnerability_ids: List of Strings
 - epss_score: Float
 - epss_percentile: Float
 - cvssv3: String
@@ -120,6 +121,7 @@ The list of supported fields in JSON format:
             "kev_date": "2024-05-01",
             "file_path": "src/first.cpp",
             "line": 13,
+            "vulnerability_ids": ["GHSA-5mrr-rgp6-x4gr", "OSV-2021-1234"],
             "endpoints": [
                 {
                     "host": "exemple.com"

dojo/tools/generic/json_parser.py

@@ -168,13 +168,15 @@ def _get_test_json(self, data):
             if finding.cve:
                 finding.unsaved_vulnerability_ids = [finding.cve]
             if unsaved_vulnerability_ids:
+                if isinstance(unsaved_vulnerability_ids, str):
+                    unsaved_vulnerability_ids = [unsaved_vulnerability_ids]
                 if finding.unsaved_vulnerability_ids:
-                    finding.unsaved_vulnerability_ids.append(
+                    finding.unsaved_vulnerability_ids.extend(
                         unsaved_vulnerability_ids,
                     )
                 else:
-                    finding.unsaved_vulnerability_ids = (
-                        unsaved_vulnerability_ids
+                    finding.unsaved_vulnerability_ids = list(
+                        unsaved_vulnerability_ids,
                     )
             test_internal.findings.append(finding)
         return test_internal

unittests/scans/generic/generic_cve_and_vulnerability_ids.json

@@ -0,0 +1,9 @@
+{
+  "findings": [{
+    "title": "Test CVE + Vuln IDs",
+    "severity": "High",
+    "description": "Test description",
+    "cve": "CVE-2020-36234",
+    "vulnerability_ids": ["GHSA-5mrr-rgp6-x4gr", "OSV-2021-1234"]
+  }]
+}

unittests/tools/test_generic_parser.py

@@ -716,3 +716,17 @@ def test_parse_csv_with_fix_version(self):
 
             finding = findings[1]
             self.assertEqual("Test finding without fix_version", finding.title)
+
+    def test_parse_json_with_cve_and_vulnerability_ids(self):
+        with (get_unit_tests_scans_path("generic") / "generic_cve_and_vulnerability_ids.json").open(encoding="utf-8") as file:
+            parser = GenericParser()
+            findings = parser.get_findings(file, Test())
+            self.validate_locations(findings)
+            self.assertEqual(1, len(findings))
+            finding = findings[0]
+            self.assertEqual(3, len(finding.unsaved_vulnerability_ids))
+            self.assertEqual("CVE-2020-36234", finding.unsaved_vulnerability_ids[0])
+            self.assertEqual("GHSA-5mrr-rgp6-x4gr", finding.unsaved_vulnerability_ids[1])
+            self.assertEqual("OSV-2021-1234", finding.unsaved_vulnerability_ids[2])
+            for vid in finding.unsaved_vulnerability_ids:
+                self.assertIsInstance(vid, str)