fix: show matching rules for reopened vulnerabilities

[JagadeeshChandra12]

Summary

Addresses the label correction portion of issue #2114.

Previously, the vulnerability details page always displayed "Applied Rules" even when a vulnerability had been reopened and the matching VEX rule was no longer applied.

This change introduces helper functions to determine whether a VEX rule is currently applied to a vulnerability and updates the UI to display the correct label:

• Applied Rules when all matching rules are currently applied.
• Matching Rules when rules match but are no longer applied (for example, after a vulnerability has been reopened).

Changes

• Added src/utils/vexRuleHelpers.ts
• Added src/utils/vexRuleHelpers.test.ts
• Replaced the hardcoded VEX rules label with a dynamic label in the vulnerability details page

Testing

Added unit tests covering:

• false positive rule applied
• accepted rule applied
• reopened vulnerability (state=open)
• mixed rule states
• empty rule lists

Related Issue

Partially addresses #2114 (label correction).

[timbastin]

Hi @JagadeeshChandra12 thanks a lot for your contribution. I think we should determine if a vex rule is applied to a vulnerability by checking the vuln events. There should be a vuln event, which was created by a vex rule (isCreatedByVexRule - or something like this - as a property of vulnevents.) if we actually find such an event we need to determine what the exact vex rule was for this. We can do that by doing the vulnerability path matching client side and compare the state of the event. What do you think about that?

[seb-kw]

Hi @JagadeeshChandra12 thanks a lot for your contribution. I think we should determine if a vex rule is applied to a vulnerability by checking the vuln events. There should be a vuln event, which was created by a vex rule (isCreatedByVexRule - or something like this - as a property of vulnevents.) if we actually find such an event we need to determine what the exact vex rule was for this. We can do that by doing the vulnerability path matching client side and compare the state of the event. What do you think about that?

Hey @JagadeeshChandra12 thank you from my side too - can you provide a status if you will be able to continue on that?

Cheers!

[JagadeeshChandra12]

Hi @seb-kw, thanks for the explanation. I understand the approach of checking vulnerability events for one created by a VEX rule and then determining the exact rule through client-side path matching and event state comparison.

I can continue investigating this and will look into the relevant code paths and provide an update soon.