Skip to content

feat: Add --force-reaudit to re-audit Aviator-processed issues - #1082

Merged
rsenden merged 9 commits into
fortify:dev/v3.xfrom
kireetivar:p/kireetivar/force_audit
Aug 28, 2026
Merged

feat: Add --force-reaudit to re-audit Aviator-processed issues #1082
rsenden merged 9 commits into
fortify:dev/v3.xfrom
kireetivar:p/kireetivar/force_audit

Conversation

@kireetivar

@kireetivar kireetivar commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

NOTE: This PR merges into dev/v3.x

Adds --force-reaudit to fcli aviator ssc audit so issues Aviator already processed can be sent again.

Behavior

  • Re-includes Aviator-processed issues, including ones SSC already marks audited (Analysis tag set).
  • Never overwrites suppressed issues or human triage.
  • Human vs Aviator is the last audit.xml TagHistory username on result tags (Analysis, Auditor Status, FoD, filter-template Analysis id, --tag-mapping GUID). Not “any Auditor Status value.”
  • Aviator usernames: Fortify Remediation Aviator, Fortify Aviator, Core SAST Aviator.
  • Custom --tag-mapping onto Auditor Status does not make force-reaudit a no-op when Aviator wrote that tag.
  • Output message for source context matching multiple location
> java -jar '.\fcli.jar' aviator ssc apply-remediations --source-dir C:\Users\cdatla\Desktop\test\repos\aviatordemo\src\main\ --av gold_test:1.6 --latest 
Skipping remediation 7239ED25696B7CA174B0E77C5E35F7C8: Source context matched multiple locations in file 'java/com/fortify/aviator_fod_demo/HomeController.java'; candidate lines: 60, 66
Skipping remediation 8F7000582F24B8B678135EF2F8A10CA2: Source context matched multiple locations in file 'java/com/fortify/aviator_fod_demo/HomeController.java'; candidate lines: 61, 67
Skipping remediation 7239ED25696B7CA174B0E77C5E35F7C7: Source context matched multiple locations in file 'java/com/fortify/aviator_fod_demo/HomeController.java'; candidate lines: 60, 66
Skipping remediation C8FF8DC0AFB73405944FC6DA37C73E39: Original code not found for file 'java/com/fortify/aviator_fod_demo/HomeController.java'; file may have changed or remediation may overlap a previous change
Skipping remediation 8F7000582F24B8B678135EF2F8A10CA4: Source context matched multiple locations in file 'java/com/fortify/aviator_fod_demo/HomeController.java'; candidate lines: 60, 66
Skipping remediation 8F7000582F24B8B678135EF2F8A10CA3: Original code not found for file 'java/com/fortify/aviator_fod_demo/HomeController.java'; file may have changed or remediation may overlap a previous change
Skipping remediation 7239ED25696B7CA174B0E77C5E35F7C9: Source context matched multiple locations in file 'java/com/fortify/aviator_fod_demo/HomeController.java'; candidate lines: 59, 65
---
appVersionId: 137
artifactId: 3222
artifactsProcessed: 1
artifactsSkipped: 0
totalRemediation: 7
appliedRemediation: 0
skippedRemediation: 7
skippedReasons: "Source context matched multiple locations=5, Original code not found=2"
skippedByReason:
  Source context matched multiple locations: 5
  Original code not found: 2
modifiedFiles: []
__action__: No-Remediation-Applied

Preflight

  • Drops q=audited:false under --force-reaudit; otherwise Analysis-tagged Aviator issues skip the whole AV.
  • Also excludes suppressed issues.
  • SSC issue list has no TagHistory usernames, so last-writer identity is applied when the FPR is parsed.

Tests: IssueAuditorTest, AuditProcessorLastTagUsernamesTest, AviatorSSCAuditHelperTest.

Commit:

feat: `fcli aviator ssc audit`: Add `--force-reaudit` to re-audit Aviator-processed issues without overwriting human triage
fix: `fcli aviator ssc apply-remediations`: Skip remediations when source context matches multiple locations

@kireetivar
kireetivar marked this pull request as ready for review August 27, 2026 09:22
@kireetivar
kireetivar requested a review from rsenden August 27, 2026 09:22

@rsenden rsenden left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Only focusing on code quality, three minor comments.

private final AuditFprOptions options;
private final Set<String> resultTagIds;

public IssueAuditor(List<Vulnerability> vulnerabilities, AuditProcessor auditProcessor, Map<String, AuditIssue> auditIssueMap,

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Although already present before this PR, given the number of constructor arguments, probably better to use @Builder?

contextIndex++; // Skip empty context lines
continue;
}
private static Integer findContextMatchStart(List<String> normalizedSource, List<String> normalizedContext,

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks like a fairly long method (although difficult to see from PR view); any way to shorten/split this method?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's about 20 lines. I still added one helper for the blank-start skip

return noFilterSet;
}

boolean isForceReaudit() {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Better to use @Getter on option declaration, but why do we need this getter anyway? I think it's only used in a unit test, which could use setAccessible to read the field value directly.

@rsenden
rsenden merged commit 840ee90 into fortify:dev/v3.x Aug 28, 2026
14 of 15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants