feat: parse description for redhat csaf advisory (#682)

Author: gshanbhag525

pkg/vulnsrc/redhat-csaf/csaf.go

@@ -60,6 +60,8 @@ type PutInput struct {
 	// no RHSA (CVE-only rows) or when the feed omits Remediation.Date. Intended for
 	// Store implementations that want to expose an advisory publish date.
 	ReleaseDate time.Time
+	// Description is the vulnerability description from CSAF notes[category=description].
+	Description string
 }
 
 // defaultStore is the OSS default implementation of Store.
@@ -205,6 +207,7 @@ func (vs VulnSrc) update(tx *bolt.Tx, dir string) error {
 			Advisory:    advisory,
 			CPEList:     cpeList,
 			ReleaseDate: vs.parser.ReleaseDate(bkt.VulnerabilityID),
+			Description: vs.parser.Description(bkt.VulnerabilityID),
 		}
 		if err := vs.store.Put(vs.dbc, tx, input); err != nil {
 			return eb.Wrapf(err, "failed to put advisory")

pkg/vulnsrc/redhat-csaf/csaf_test.go

@@ -316,6 +316,12 @@ func TestVulnSrc_Update_WithCustomStore(t *testing.T) {
 	// Verify the custom store was called with Put
 	assert.NotEmpty(t, store.putInputs, "custom Store.Put should have been called")
 
+	mustTime := func(s string) time.Time {
+		ts, err := time.Parse(time.RFC3339, s)
+		require.NoError(t, err)
+		return ts
+	}
+
 	// Verify the extra CPE was merged
 	// The merged list should contain both CSAF CPEs and the extra one
 	for _, input := range store.putInputs {
@@ -324,17 +330,26 @@ func TestVulnSrc_Update_WithCustomStore(t *testing.T) {
 
 		vid := string(input.Bucket.VulnerabilityID)
 		switch vid {
-		case "RHSA-2024:9941", "RHSA-2024:9999":
-			want, err := time.Parse(time.RFC3339, "2024-11-19T04:46:55Z")
-			require.NoError(t, err)
-			assert.True(t, input.ReleaseDate.Equal(want), "ReleaseDate for %s", vid)
+		case "RHSA-2024:9941":
+			assert.True(t, input.ReleaseDate.Equal(mustTime("2024-11-19T04:46:55Z")), "ReleaseDate for %s", vid)
+			assert.Equal(t, "A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute.", input.Description)
+		case "RHSA-2024:9999":
+			assert.True(t, input.ReleaseDate.Equal(mustTime("2024-11-19T04:46:55Z")), "ReleaseDate for %s", vid)
+			assert.Equal(t, "Description from CVE-2024-11111 (stored for RHSA-2024:9999)", input.Description)
 		case "RHSA-2025:0001":
-			want, err := time.Parse(time.RFC3339, "2025-01-01T00:00:00Z")
-			require.NoError(t, err)
-			assert.True(t, input.ReleaseDate.Equal(want), "ReleaseDate for %s", vid)
+			assert.True(t, input.ReleaseDate.Equal(mustTime("2025-01-01T00:00:00Z")), "ReleaseDate for %s", vid)
+			assert.Equal(t, "Test vulnerability for new rpmmod qualifier format", input.Description)
+		case "CVE-2024-11111":
+			// Unpatched rows use the CVE as bucket ID; there is no RHSA remediation date.
+			assert.True(t, input.ReleaseDate.IsZero(), "ReleaseDate for %q", vid)
+			assert.Equal(t, "Description from CVE-2024-11111 (stored for RHSA-2024:9999)", input.Description)
+		case "CVE-2024-22222":
+			assert.True(t, input.ReleaseDate.IsZero(), "ReleaseDate for %q", vid)
+			assert.Equal(t, "Description from CVE-2024-22222 (not stored for RHSA-2024:9999)", input.Description)
 		default:
 			// Unpatched rows use the CVE as bucket ID; there is no RHSA remediation date.
 			assert.True(t, input.ReleaseDate.IsZero(), "ReleaseDate for %q", vid)
+			assert.Empty(t, input.Description, "Description for %q", vid)
 		}
 	}