Discording number of vulnerabilities after the import of Aqua Scan result

[kzzz1]

Bug description
We are integrating Aqua Scan to DefectDojo. I noticed that sometimes the number of vulnerabilities found in my Aqua scan report is not the same as the number of findings I have when I import the report to DefectDojo, sometimes it's less. I don't think this is the normal behavior?

Steps to reproduce
Steps to reproduce the behavior:

1. Scan an image with the aquascanner. I scanned the Juice-shop image but this happens in different images quite often.
2. Import the Aqua scan results to defect-dojo
3. The results in Aqua:
   
4. The results after the import in DefectDojo
   

I looked in the Aqua parser code, I think this may be the issue:

A unique key is made with the resource's cpe and the vuln's name. But sometimes those 2 are the same. Maybe we could add the resource's path to that key to make it really unique? Here is an example. The vulnerability CVE-2024-4068 appears only one time in defectdojo, the cpe and vuln's name are the same, but the path is different. If I change the cpe directly in the json aqua scan file, I can now see one more vulnerabilities in defectdojo.

Expected behavior
Having the same number of vulnerabilities in Defect-Dojo after the import of the Aqua scan report

[manuel-sommer]

this can be closed @mtesauro

[kzzz1]

@manuel-sommer the fix worked good with the path added to the unique key, I now have the same number of vulnerabilities in DefectDojo than in my Aqua Report. But I'm wondering if we could display that path somewhere? I guess it's too long to put it in the finding's title, but maybe if we add a 'Path' tab after the 'Component Name' and the 'Component Version' ? Because right now we can't tell why the 2 vulnerabilities here are displayed twice (because they have different paths).

[manuel-sommer]

I added the path into the description field.

[kzzz1]

@manuel-sommer sorry if I don't see it. Here?

[manuel-sommer]

Only available for the other fix.

[kzzz1]

@manuel-sommer okay , you mean we can see the path in the description field for the sensitive datas only, that's right?

[manuel-sommer]

yeah. do you need it also for the other findings?

[kzzz1]

@manuel-sommer yeah I think it could be practical to see the path somewhere for the vulnerabilities also? Else I have something like this in the list and even when I click on one item I don't see the path in the description or somewhere else, I think it may be confusing if we don't know why they are listed multiple times in the list without more info on the path...

[manuel-sommer]

Done @kzzz1 See PR