cwe: remove prohibited vulnerability-mapping entries on refresh - #992
Open
Bornunique911 wants to merge 3 commits into
Open
cwe: remove prohibited vulnerability-mapping entries on refresh#992Bornunique911 wants to merge 3 commits into
Bornunique911 wants to merge 3 commits into
Conversation
Bornunique911
requested review from
Pa04rth,
northdpole,
paoga87 and
robvanderveer
as code owners
July 23, 2026 17:25
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
Summary by CodeRabbit
WalkthroughThe CWE parser detects prohibited weaknesses and categories, removes matching stale database entries, skips prohibited weaknesses during registration, and preserves allowed-entry processing. Tests and the update script reflect the new behavior. ChangesCWE prohibited-entry handling
Estimated code review effort: 4 (Complex) | ~40 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@application/utils/external_project_parsers/parsers/cwe.py`:
- Around line 133-138: Update delete_cwe_entries so its final
cache.session.commit() is wrapped in the same IntegrityError handling pattern
used by add_node: catch the commit failure, roll back the session, and handle
the error without aborting the surrounding register_cwe/parse flow. Keep the
successful deletion log unchanged.
- Around line 107-139: Update delete_cwe_entries to remove every embedding
associated with each entry, rather than deleting only the single result returned
by cache.get_embeddings_for_doc. Iterate through all matching embeddings and
delete each one before deleting the node, preserving the existing link cleanup
and commit flow.
In `@scripts/update-cwe.sh`:
- Around line 18-21: Update the dependency bootstrap in update-cwe.sh to install
the repository’s existing requirements.txt when pytest is unavailable, replacing
the nonexistent requirements-dev.txt reference; preserve the current pytest
check and installation flow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro Plus
Run ID: 6d5333a1-abeb-4b7c-9b3f-b966a3517b86
📒 Files selected for processing (3)
application/tests/cwe_parser_test.pyapplication/utils/external_project_parsers/parsers/cwe.pyscripts/update-cwe.sh
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/update-cwe.sh`:
- Around line 32-33: Update the status message before the cre.py invocation to
state that entries marked PROHIBITED by either `@Status` or Mapping_Notes -> Usage
are skipped, covering both weaknesses and categories.
- Around line 18-20: Update the dependency bootstrap sentinel in the script’s
Python import check to use an explicit marker or a runtime dependency required
by cre.py, rather than pytest from requirements-dev.txt. Ensure the check
succeeds after installing requirements.txt and prevents repeated installation
attempts before the parser runs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro Plus
Run ID: 14db9b6a-9e48-45c0-b13d-aa066c96d1ca
📒 Files selected for processing (2)
application/utils/external_project_parsers/parsers/cwe.pyscripts/update-cwe.sh
🚧 Files skipped from review as they are similar to previous changes (1)
- application/utils/external_project_parsers/parsers/cwe.py
Bornunique911
force-pushed
the
fix/cwe-prohibited-mapping-filter-main
branch
from
July 23, 2026 18:28
e6c3f13 to
06a5c64
Compare
Bornunique911
force-pushed
the
fix/cwe-prohibited-mapping-filter-main
branch
2 times, most recently
from
July 30, 2026 17:57
b252a5b to
c5a348b
Compare
…nd improve update script and fixed linting issue.
Bornunique911
force-pushed
the
fix/cwe-prohibited-mapping-filter-main
branch
from
July 31, 2026 18:15
c5a348b to
55dad3d
Compare
Contributor
There was a problem hiding this comment.
♻️ Duplicate comments (1)
application/utils/external_project_parsers/parsers/cwe.py (1)
142-151: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winCatch all commit failures, not only
IntegrityError.If the commit fails with another
SQLAlchemyError(for exampleOperationalError), the session stays in a failed state. Every latercache.add_nodecall inregister_cwethen fails. Roll back on any commit error, and keep the log.🛡️ Proposed fix
try: cache.session.commit() logger.info( "Deleted %s prohibited CWE entries from the local database", len(entries), ) - except IntegrityError as e: + except SQLAlchemyError as e: cache.session.rollback() logger.error("Failed to delete prohibited CWE entries: %s", e)Update the import accordingly:
from sqlalchemy.exc import SQLAlchemyError🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@application/utils/external_project_parsers/parsers/cwe.py` around lines 142 - 151, Update the exception handling around cache.session.commit in the CWE deletion flow to catch SQLAlchemyError instead of only IntegrityError, while preserving the rollback and existing error log. Adjust the sqlalchemy.exc import accordingly so register_cwe can continue using the session after any commit failure.
🧹 Nitpick comments (2)
application/utils/external_project_parsers/parsers/cwe.py (1)
311-315: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueRename the local
idvariable.Ruff reports A001 on Line 312.
idshadows the builtin. Rename it tocapec_id_value.♻️ Proposed fix
else: - id = lst["`@CAPEC_ID`"] + capec_id_value = lst["`@CAPEC_ID`"] cwe = self.link_cwe_to_capec_cre( - cwe=cwe, cache=cache, capec_id=id + cwe=cwe, cache=cache, capec_id=capec_id_value )🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@application/utils/external_project_parsers/parsers/cwe.py` around lines 311 - 315, Rename the local id variable in the CAPEC linking branch to capec_id_value, and update the capec_id argument in self.link_cwe_to_capec_cre accordingly.Source: Linters/SAST tools
application/tests/cwe_parser_test.py (1)
299-308: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueRemove the redundant session write.
Node_collection.add_nodeinserts and commits the node already. The extrasession.add(stale_category)andsession.commit()add no state.♻️ Proposed simplification
stale_category = self.collection.add_node( defs.Standard( name="CWE", sectionID="16", section="Configuration", hyperlink="https://cwe.mitre.org/data/definitions/16.html", ) ) - self.collection.session.add(stale_category) - self.collection.session.commit()🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@application/tests/cwe_parser_test.py` around lines 299 - 308, Remove the redundant self.collection.session.add(stale_category) and self.collection.session.commit() calls after Node_collection.add_node; retain the add_node invocation so it remains responsible for inserting and committing stale_category.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@application/utils/external_project_parsers/parsers/cwe.py`:
- Around line 142-151: Update the exception handling around cache.session.commit
in the CWE deletion flow to catch SQLAlchemyError instead of only
IntegrityError, while preserving the rollback and existing error log. Adjust the
sqlalchemy.exc import accordingly so register_cwe can continue using the session
after any commit failure.
---
Nitpick comments:
In `@application/tests/cwe_parser_test.py`:
- Around line 299-308: Remove the redundant
self.collection.session.add(stale_category) and self.collection.session.commit()
calls after Node_collection.add_node; retain the add_node invocation so it
remains responsible for inserting and committing stale_category.
In `@application/utils/external_project_parsers/parsers/cwe.py`:
- Around line 311-315: Rename the local id variable in the CAPEC linking branch
to capec_id_value, and update the capec_id argument in
self.link_cwe_to_capec_cre accordingly.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro Plus
Run ID: 02913147-ee8b-4333-9ab0-a12dc25b074b
📒 Files selected for processing (3)
application/tests/cwe_parser_test.pyapplication/utils/external_project_parsers/parsers/cwe.pyscripts/update-cwe.sh
🚧 Files skipped from review as they are similar to previous changes (1)
- scripts/update-cwe.sh
…, and rename shadowed variable
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to merged PR #939.
This PR fixes the remaining prohibited-CWE import gap by filtering against the upstream CWE vulnerability-mapping field (
Mapping_Notes -> Usage = Prohibited) and removing stale prohibited CWE entries that may already exist in the local database.A concrete example is
CWE-16, which is still reachable on OpenCRE even though the upstream CWE entry marks its vulnerability mapping asProhibited.Problem
PR #939 improved CWE filtering, but the current logic is still incomplete.
The merged code filters primarily from the XML
@Statusfield on imported weaknesses. That misses entries whose import exclusion is driven by the CWE vulnerability-mapping metadata instead, especially:Mapping_Notes -> Usage = ProhibitedCWE-16As a result, prohibited CWE entries can remain visible after refresh.
Fix
This PR updates the CWE parser to:
Mapping_Notes -> Usage = Prohibitedas the authoritative exclusion signalWeaknessesandCategoriesIt also adds regression coverage for both:
CWE-16The refresh script message is updated as well so it reflects the actual filtering rule.
Review Note For Maintainer
This is a small corrective follow-up to merged PR #939.
I verified that prohibited CWE entries can still remain visible after refresh because the current filter does not fully honor the upstream vulnerability-mapping field (
Mapping_Notes -> Usage = Prohibited) and does not remove stale prohibited rows already present in the DB.CWE-16is a concrete live example of that gap.This PR keeps the scope narrow:
Tested locally with:
/home/born/Important_Stuff/OpenCRE/venv/bin/python -m pytest application/tests/cwe_parser_test.py -k 'prohibited or register_CWE' -q