Skip to content

Fix DAST audit eligibility and server tier handling - #1085

Merged
rsenden merged 2 commits into
fortify:feat/v3.x/aviator/26.4from
ankit2995:ankit/dast-audit
Sep 1, 2026
Merged

Fix DAST audit eligibility and server tier handling#1085
rsenden merged 2 commits into
fortify:feat/v3.x/aviator/26.4from
ankit2995:ankit/dast-audit

Conversation

@ankit2995

Copy link
Copy Markdown
Contributor

Summary

  • Download the current SSC FPR state before DAST auditing.
  • Exclude suppressed, human-audited, and Aviator-processed findings before quota submission.
  • Skip stream initialization when no eligible findings remain.
  • Introduce AuditTier for typed GOLD/SILVER handling.
  • Default missing or unknown server tiers to SILVER.
  • Harden null stream future/result handling.
  • Consolidate temporary FPR download and cleanup logic.

Download the current SSC FPR state so suppression and audit metadata are honored before quota submission. Preserve server-provided DAST tiers through a typed domain model and harden stream result handling.
@ankit2995
ankit2995 requested a review from rsenden September 1, 2026 09:15
@ankit2995
ankit2995 marked this pull request as ready for review September 1, 2026 09:16
private TagMappingConfig.Result getDastResultConfig(AuditResponse response,
TagMappingConfig tagMappingConfig) {
boolean tierOne = "GOLD".equalsIgnoreCase(response.getTier());
boolean tierOne = AuditTier.GOLD.name().equals(response.getTier());

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not use AuditTier::fromServerValue (or extra method on AuditTier to differentiate between case-sensitive/insensitive matching if needed)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @rsenden I’ve updated both DAST string boundaries to use AuditTier.fromServerValue(...). This preserves case-insensitive matching and defaults null or unknown tiers to SILVER.

@rsenden
rsenden merged commit 70ed7df into fortify:feat/v3.x/aviator/26.4 Sep 1, 2026
14 of 15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants