fix: exclude automated parser logs from CSAF not_affected impact statement

Author: dervoeti

backend/application/core/services/assessment.py

@@ -31,7 +31,11 @@
     calculate_risk_acceptance_expiry_date,
 )
 from application.core.services.security_gate import check_security_gate
-from application.core.types import Assessment_Status, Status
+from application.core.types import (
+    Assessment_Status,
+    Observation_Log_Comment,
+    Status,
+)
 from application.issue_tracker.services.issue_tracker import (
     push_observation_to_issue_tracker,
 )
@@ -503,7 +507,7 @@ def set_propagated_assessment_for_new_observation(observation: Observation) -> N
         )
         .exclude(observation__branch=observation.branch)
         .exclude(severity="", status="")
-        .exclude(comment="Set by parser")
+        .exclude(comment=Observation_Log_Comment.COMMENT_SET_BY_PARSER)
         .select_related("observation__branch")
         .order_by("observation__branch", "-created")
     )

backend/application/core/types.py

@@ -92,6 +92,20 @@ class Assessment_Status:
     ]
 
 
+class Observation_Log_Comment:
+    COMMENT_SET_BY_PARSER = "Set by parser"
+    COMMENT_UPDATED_BY_PARSER = "Updated by parser"
+    COMMENT_NOT_FOUND_IN_LATEST_SCAN = "Observation not found in latest scan"
+
+    # Comments written automatically during import. They carry no human assessment and must not be
+    # used as a VEX justification or impact statement.
+    AUTOMATED_COMMENTS = [
+        COMMENT_SET_BY_PARSER,
+        COMMENT_UPDATED_BY_PARSER,
+        COMMENT_NOT_FOUND_IN_LATEST_SCAN,
+    ]
+
+
 class VEX_Justification:
     JUSTIFICATION_COMPONENT_NOT_PRESENT = "component_not_present"
     JUSTIFICATION_VULNERABLE_CODE_NOT_PRESENT = "vulnerable_code_not_present"

backend/application/import_observations/services/import_observations.py

@@ -36,7 +36,11 @@
     calculate_risk_acceptance_expiry_date,
 )
 from application.core.services.security_gate import check_security_gate
-from application.core.types import Assessment_Status, Status
+from application.core.types import (
+    Assessment_Status,
+    Observation_Log_Comment,
+    Status,
+)
 from application.epss.services.cvss_bt import apply_exploit_information
 from application.epss.services.epss import apply_epss
 from application.import_observations.exceptions import ParserError
@@ -695,7 +699,7 @@ def _process_current_observation(
             observation=observation_before,
             severity=severity,
             status=status,
-            comment="Updated by parser",
+            comment=Observation_Log_Comment.COMMENT_UPDATED_BY_PARSER,
             vex_justification="",
             vex_remediations=None,
             assessment_status=Assessment_Status.ASSESSMENT_STATUS_AUTO_APPROVED,
@@ -745,7 +749,7 @@ def _process_new_observation(imported_observation: Observation, settings: Settin
         observation=imported_observation,
         severity=imported_observation.current_severity,
         status=imported_observation.current_status,
-        comment="Set by parser",
+        comment=Observation_Log_Comment.COMMENT_SET_BY_PARSER,
         vex_justification="",
         vex_remediations=None,
         assessment_status=Assessment_Status.ASSESSMENT_STATUS_AUTO_APPROVED,
@@ -805,7 +809,7 @@ def _resolve_unimported_observations(
                 observation=observation,
                 severity="",
                 status=observation.current_status,
-                comment="Observation not found in latest scan",
+                comment=Observation_Log_Comment.COMMENT_NOT_FOUND_IN_LATEST_SCAN,
                 vex_justification="",
                 vex_remediations=None,
                 assessment_status=Assessment_Status.ASSESSMENT_STATUS_AUTO_APPROVED,

backend/application/vex/services/csaf_generator_vulnerability.py

@@ -1,6 +1,7 @@
 from typing import Optional
 
 from application.core.models import Observation, Observation_Log
+from application.core.types import Observation_Log_Comment
 from application.vex.services.csaf_generator_helpers import (
     get_product_or_relationship_id,
     get_vulnerability_ecosystem,
@@ -131,9 +132,11 @@ def set_flag_or_threat(vulnerability: CSAFVulnerability, observation: Observatio
         # "current"/"modifying" observation log helpers are unreliable here: automated log entries
         # (for example from rule changes) carry no status but still pass those filters and would then
         # provide a misleading justification and comment. Filtering on the current status skips those
-        # entries.
+        # entries. Automated parser comments (e.g. "Updated by parser") do carry a status, so they are
+        # excluded explicitly to keep their meaningless text out of the impact statement.
         assessment_log = (
             Observation_Log.objects.filter(observation=observation, status=observation.current_status)
+            .exclude(comment__in=Observation_Log_Comment.AUTOMATED_COMMENTS)
             .order_by("-created")
             .first()
         )

backend/unittests/vex/services/test_csaf_generator_vulnerability.py

@@ -0,0 +1,83 @@
+from django.core.management import call_command
+from django.test import TestCase
+from django.utils import timezone
+
+from application.access_control.models import User
+from application.core.models import Observation, Observation_Log, Product
+from application.core.types import (
+    Assessment_Status,
+    Observation_Log_Comment,
+    Severity,
+    Status,
+    VEX_Justification,
+)
+from application.import_observations.models import Parser
+from application.vex.services.csaf_generator_vulnerability import (
+    create_vulnerability,
+    set_flag_or_threat,
+)
+
+
+class TestSetFlagOrThreat(TestCase):
+    def setUp(self):
+        call_command("loaddata", "unittests/fixtures/vex_fixtures.json")
+        self.product = Product.objects.get(pk=1)
+        self.parser = Parser.objects.get(pk=1)
+        self.user = User.objects.get(pk=1)
+
+    def _create_observation(self, current_vex_justification=""):
+        return Observation.objects.create(
+            product=self.product,
+            parser=self.parser,
+            title="CVE-2026-0001",
+            current_severity=Severity.SEVERITY_HIGH,
+            numerical_severity=Severity.NUMERICAL_SEVERITIES[Severity.SEVERITY_HIGH],
+            # assessment_status is the manual assessment; current_status is derived from it on save.
+            assessment_status=Status.STATUS_NOT_AFFECTED,
+            current_status=Status.STATUS_NOT_AFFECTED,
+            current_vex_justification=current_vex_justification,
+            import_last_seen=timezone.now(),
+        )
+
+    def _create_observation_log(self, observation, comment, vex_justification=""):
+        return Observation_Log.objects.create(
+            observation=observation,
+            user=self.user,
+            status=Status.STATUS_NOT_AFFECTED,
+            comment=comment,
+            vex_justification=vex_justification,
+            assessment_status=Assessment_Status.ASSESSMENT_STATUS_AUTO_APPROVED,
+        )
+
+    def test_human_assessment_is_preferred_over_automated_parser_log(self):
+        observation = self._create_observation()
+        self._create_observation_log(
+            observation,
+            comment="Vulnerable function is never called in this build.",
+            vex_justification=VEX_Justification.JUSTIFICATION_VULNERABLE_CODE_NOT_PRESENT,
+        )
+        # The automated parser log is created last, so it is the newest entry with a matching status.
+        self._create_observation_log(observation, comment=Observation_Log_Comment.COMMENT_UPDATED_BY_PARSER)
+
+        vulnerability = create_vulnerability("CVE-2026-0001")
+        set_flag_or_threat(vulnerability, observation)
+
+        self.assertEqual(1, len(vulnerability.threats))
+        self.assertEqual(
+            "Vulnerable function is never called in this build.",
+            vulnerability.threats[0].details,
+        )
+        self.assertEqual(1, len(vulnerability.flags))
+
+    def test_no_impact_statement_when_only_automated_parser_logs_exist(self):
+        observation = self._create_observation()
+        self._create_observation_log(observation, comment=Observation_Log_Comment.COMMENT_UPDATED_BY_PARSER)
+        self._create_observation_log(observation, comment=Observation_Log_Comment.COMMENT_NOT_FOUND_IN_LATEST_SCAN)
+
+        vulnerability = create_vulnerability("CVE-2026-0001")
+        set_flag_or_threat(vulnerability, observation)
+
+        # Neither a flag nor a threat is emitted, so validation fails and surfaces the missing
+        # assessment instead of publishing a meaningless "Updated by parser" impact statement.
+        self.assertEqual(0, len(vulnerability.threats))
+        self.assertEqual(0, len(vulnerability.flags))