inconsistent behavior when organization is not found

[ElectricNroff]

For a POST /cve/{id}/reject request, when the organization (that owns the CVE ID) is not found, the implementation apparently works around this by creating a CVE Record in which the required assignerOrgId field is set, but the optional assignerShortName field is omitted:

cve-services/src/controller/cve.controller/cve.controller.js

Lines 415 to 419 in b083cfe

	const owningCnaObj = await orgRepo.findOneByUUID(cveIdObj.owning_cna)
	let owningCnaShortName = null
	if (owningCnaObj) {
	owningCnaShortName = owningCnaObj.short_name
	}

cve-services/src/model/cve.js

Lines 85 to 87 in b083cfe

	if (owningCnaShortName) {
	rejectedRecord.cveMetadata.assignerShortName = owningCnaShortName
	}

By contrast, for a POST /cve/{id}/cna request, the implementation assumes that the organization will be found and proceeds to access the short_name field:

cve-services/src/controller/cve.controller/cve.controller.js

Lines 271 to 272 in b083cfe

	const owningCna = await orgRepo.findOneByUUID(cveId.owning_cna)
	const assignerShortName = owningCna.short_name

The organization isn't inherently less likely to exist in one case than in the other. This is a bug only in the sense that there's no apparent reason for a missing organization to be considered a normal event in one place but an error in analogous code elsewhere.

If a missing organization is supposed to be handled, then the latter code should be fixed so that owningCna.short_name isn't accessed unless owningCna is a valid data structure. For example, this allows CVE Services to be used in a testing environment in which it happens to be convenient for some CVE ID objects to be associated with CNAs that don't exist in the database.

Also, in general, if an organization is missing, logging that information would be useful.