fix: Sanitize advisory data in vulnerable functions output OD-296

External OSV advisory strings (function names, advisory ID) were printed
raw, letting a crafted advisory smuggle terminal control sequences
(CWE-150); route them through sanitizeText() like other repo-derived
output. Also gate the vulnerable-functions line on a non-empty list and
split printFindingCard into two helpers to stay under the line-count
limit, and add the missing test for advisory-block suppression when a
finding has a linked issue.

Author: pedrobpereira

.changeset/sanitize-advisory-functions.md

@@ -0,0 +1,5 @@
+---
+"@codacy/codacy-cloud-cli": patch
+---
+
+Sanitize vulnerable/affected function names and the advisory ID (`CommitIssue.advisoryInformation` / `SrmItem.advisoryInformation`) before printing them in `issue`, `issues`, `pull-request --issue`, `finding`, and `findings`. These values come from the linked OSV advisory, so — like other repository-derived output — they are now passed through `sanitizeText()` to strip ANSI/OSC control bytes (CWE-150) instead of being printed raw.

src/commands/finding.test.ts

@@ -651,6 +651,30 @@ describe("finding command", () => {
         expect.stringContaining('"lodash.merge"'),
       );
     });
+
+    it("should suppress its own advisory block for a Codacy-source finding with a linked issue, deferring to the issue's block", async () => {
+      vi.mocked(SecurityService.getSecurityItem).mockResolvedValue({
+        data: { ...mockCodacyFinding, advisoryInformation: mockAdvisoryInformation },
+      } as any);
+      vi.mocked(AnalysisService.getIssue).mockResolvedValue({
+        data: { ...mockQualityIssue, advisoryInformation: mockAdvisoryInformation },
+      } as any);
+      vi.mocked(ToolsService.getPattern).mockResolvedValue({
+        data: mockPattern,
+      } as any);
+      vi.mocked(FileService.getFileContent).mockResolvedValue({
+        data: mockFileLines,
+      } as any);
+
+      const program = createProgram();
+      await program.parseAsync([
+        "node", "test", "finding", "gh", "test-org", "def-456-codacy",
+      ]);
+
+      const output = getAllOutput();
+      // Rendered once via printIssueCodeContext (the linked issue's block), not duplicated by finding.ts's own printAdvisoryBlock call
+      expect(output.match(/Vulnerable Functions \(CVE-2021-23337\)/g)).toHaveLength(1);
+    });
   });
 
   describe("--ignore option", () => {

src/commands/findings.ts

@@ -77,61 +77,69 @@ function normalizeScanType(input: string): string {
   );
 }
 
-function printFindingCard(item: SrmItem, showRepo: boolean): void {
-  const separator = ansis.dim("─".repeat(40));
+// Line 1: Priority | SecurityCategory ScanType | Likelihood EffortToFix | Repository
+function buildFindingHeaderLine(item: SrmItem, showRepo: boolean): string {
   const pipe = ` ${ansis.dim("|")} `;
-
-  console.log();
-
-  // Line 1: Priority | SecurityCategory ScanType | Likelihood EffortToFix | Repository
-  const line1Parts: string[] = [colorPriority(item.priority)];
+  const parts: string[] = [colorPriority(item.priority)];
 
   const catParts = [
     sanitizeText(item.securityCategory),
     item.scanType ? ansis.dim(sanitizeText(item.scanType)) : undefined,
   ]
     .filter(Boolean)
     .join(" ");
-  if (catParts) line1Parts.push(catParts);
+  if (catParts) parts.push(catParts);
 
   const penTestParts = [item.likelihood, item.effortToFix].filter(
     (v) => v && v !== "not_applicable",
   ) as string[];
-  if (penTestParts.length > 0) line1Parts.push(penTestParts.join(" "));
+  if (penTestParts.length > 0) parts.push(penTestParts.join(" "));
 
-  if (showRepo && item.repository) line1Parts.push(ansis.dim(sanitizeText(item.repository)));
+  if (showRepo && item.repository) parts.push(ansis.dim(sanitizeText(item.repository)));
 
   const idLabel = ansis.hex("#555555")(item.id);
-  console.log(line1Parts.join(pipe) + `  ${idLabel}`);
-
-  // Line 2: Title
-  console.log(sanitizeText(item.title));
-  if (item.affectedTargets) console.log(ansis.dim(sanitizeText(item.affectedTargets)));
-  console.log();
+  return parts.join(pipe) + `  ${idLabel}`;
+}
 
-  // Line 3: Status DueAt | CVE/CWE | AffectedVersion → FixedVersion | Application | AffectedTargets
-  const line3Parts: string[] = [
+// Line 3: Status DueAt | CVE/CWE | AffectedVersion → FixedVersion | Application
+function buildFindingStatusLine(item: SrmItem, hasChains: boolean): string {
+  const pipe = ` ${ansis.dim("|")} `;
+  const parts: string[] = [
     `${colorStatus(item.status)} ${ansis.dim(formatDueDate(item.dueAt))}`,
   ];
 
-  if (item.cve) line3Parts.push(ansis.dim(item.cve));
-  else if (item.cwe) line3Parts.push(ansis.dim(`CWE-${item.cwe}`));
+  if (item.cve) parts.push(ansis.dim(item.cve));
+  else if (item.cwe) parts.push(ansis.dim(`CWE-${item.cwe}`));
 
   // When dependency chains are present they carry the vulnerable package and
   // fixed version on their own line, so the redundant version segment is dropped.
-  const hasChains = !!item.dependencyChains?.length;
   if (!hasChains) {
     const versionSegment = formatVersionSegment(
       item.affectedVersion,
       item.fixedVersion,
       { includeUpdatePrefix: true },
     );
-    if (versionSegment) line3Parts.push(ansis.dim(versionSegment));
+    if (versionSegment) parts.push(ansis.dim(versionSegment));
   }
 
-  if (item.application) line3Parts.push(ansis.dim(sanitizeText(item.application)));
+  if (item.application) parts.push(ansis.dim(sanitizeText(item.application)));
 
-  console.log(line3Parts.join(pipe));
+  return parts.join(pipe);
+}
+
+function printFindingCard(item: SrmItem, showRepo: boolean): void {
+  const separator = ansis.dim("─".repeat(40));
+
+  console.log();
+  console.log(buildFindingHeaderLine(item, showRepo));
+
+  // Line 2: Title
+  console.log(sanitizeText(item.title));
+  if (item.affectedTargets) console.log(ansis.dim(sanitizeText(item.affectedTargets)));
+  console.log();
+
+  const hasChains = !!item.dependencyChains?.length;
+  console.log(buildFindingStatusLine(item, hasChains));
 
   // Line 4: dependency import chain (SCA findings with dependencyChains)
   if (hasChains) {
@@ -143,7 +151,7 @@ function printFindingCard(item: SrmItem, showRepo: boolean): void {
   }
 
   // Vulnerable functions (findings with an OSV-linked advisory), compact form
-  if (item.advisoryInformation) {
+  if (item.advisoryInformation?.vulnerableFunctions?.length) {
     console.log(
       ansis.dim(`Vulnerable functions: ${summarizeFunctions(item.advisoryInformation.vulnerableFunctions)}`),
     );

src/utils/formatting.ts

@@ -264,7 +264,7 @@ export function printIssueCard(
   }
 
   // Vulnerable functions (SCA issues with an OSV-linked advisory), compact form
-  if (issue.advisoryInformation) {
+  if (issue.advisoryInformation?.vulnerableFunctions?.length) {
     console.log();
     console.log(ansis.dim(`Vulnerable functions: ${summarizeFunctions(issue.advisoryInformation.vulnerableFunctions)}`));
   }
@@ -278,7 +278,7 @@ export function printIssueCard(
  * capping at 3 entries with a "+N more" suffix for longer lists.
  */
 export function summarizeFunctions(fns: string[], limit = 3): string {
-  const shown = fns.slice(0, limit).join(", ");
+  const shown = fns.slice(0, limit).map(sanitizeText).join(", ");
   const more = fns.length > limit ? ` (+${fns.length - limit} more)` : "";
   return `${shown}${more}`;
 }
@@ -634,13 +634,15 @@ export function printCveBlock(cve: CveRecord): void {
  */
 export function printAdvisoryBlock(advisory: AdvisoryInformation): void {
   console.log();
-  console.log(ansis.bold(`Vulnerable Functions (${advisory.advisoryId})`));
+  console.log(ansis.bold(`Vulnerable Functions (${sanitizeText(advisory.advisoryId)})`));
   if (advisory.publishedAt) {
     console.log(ansis.dim(`Published: ${formatDueDate(advisory.publishedAt)}`));
   }
-  console.log();
-  for (const fn of advisory.vulnerableFunctions) {
-    console.log(`  • ${fn}`);
+  if (advisory.vulnerableFunctions.length > 0) {
+    console.log();
+    for (const fn of advisory.vulnerableFunctions) {
+      console.log(`  • ${sanitizeText(fn)}`);
+    }
   }
 }