Merge pull request #4490 from GSA-TTS/main

.github/workflows/pull-containers-and-push-to-ghcr.yml

@@ -34,7 +34,7 @@ jobs:
         run: docker pull ${{ matrix.image.name }}
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.28.0
+        uses: aquasecurity/trivy-action@0.29.0
         env:
           TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db,ghcr.io/aquasecurity/trivy-db
           TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db,ghcr.io/aquasecurity/trivy-java-db

.github/workflows/trivy.yml

@@ -40,7 +40,7 @@ jobs:
         run: docker build -t ${{ env.DOCKER_NAME }}:${{ steps.date.outputs.date }} .
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.28.0
+        uses: aquasecurity/trivy-action@0.29.0
         env:
           TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db,ghcr.io/aquasecurity/trivy-db
           TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db,ghcr.io/aquasecurity/trivy-java-db
@@ -82,7 +82,7 @@ jobs:
         run: docker pull ${{ matrix.image.name }}
 
       - name: Run Trivy vulnerability scanner on Third Party Images
-        uses: aquasecurity/trivy-action@0.28.0
+        uses: aquasecurity/trivy-action@0.29.0
         env:
           TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db,ghcr.io/aquasecurity/trivy-db
           TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db,ghcr.io/aquasecurity/trivy-java-db

.github/workflows/zap-scan.yml

@@ -18,7 +18,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: ZAP Scan of ${{ env.url }}
-        uses: zaproxy/action-baseline@v0.13.0
+        uses: zaproxy/action-baseline@v0.14.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           docker_name: 'ghcr.io/zaproxy/zaproxy:stable'

CONTRIBUTING.md

@@ -10,7 +10,7 @@ We want to ensure a welcoming environment for all of our projects. Our staff fol
 
 We adhere to the [18F Open Source Policy](https://github.com/18f/open-source-policy). If you have any questions, just [send us an email](mailto:18f@gsa.gov).
 
-As part of a U.S. government agency, the General Services Administration (GSA)’s Technology Transformation Services (TTS) takes seriously our responsibility to protect the public’s information, including financial and personal information, from unwarranted disclosure. For more information about security and vulnerability disclosure for our projects, please read our [18F Vulnerability Disclosure Policy](https://18f.gsa.gov/vulnerability-disclosure-policy/).
+As part of a U.S. government agency, the General Services Administration (GSA)’s Technology Transformation Services (TTS) takes seriously our responsibility to protect the public’s information, including financial and personal information, from unwarranted disclosure. For more information about security and vulnerability disclosure for our projects, please read the [GSA Vulnerability Disclosure Policy](https://www.gsa.gov/vulnerability-disclosure-policy/).
 
 ## Public domain
 

backend/audit/admin.py

@@ -180,6 +180,17 @@ def save_model(self, request, obj, form, change):
                 logger.info(
                     f"Duplicate finding reference number waiver applied to SAC {sac.report_id} by user: {request.user.email}."
                 )
+            elif (
+                STATUS.IN_PROGRESS
+                and SacValidationWaiver.TYPES.PRIOR_REFERENCES in obj.waiver_types
+            ):
+                logger.info(
+                    f"User {request.user.email} is applying waiver for SAC with status: {sac.submission_status}"
+                )
+                super().save_model(request, obj, form, change)
+                logger.info(
+                    f"Invalid prior reference waiver applied to SAC {sac.report_id} by user: {request.user.email}."
+                )
             else:
                 messages.set_level(request, messages.WARNING)
                 messages.warning(

backend/audit/cross_validation/__init__.py

@@ -61,6 +61,7 @@
 from .check_award_ref_declaration import check_award_ref_declaration
 from .check_award_ref_existence import check_award_ref_existence
 from .check_award_reference_uniqueness import check_award_reference_uniqueness
+from .check_finding_prior_references import check_finding_prior_references
 from .check_biennial_low_risk import check_biennial_low_risk
 from .check_certifying_contacts import check_certifying_contacts
 from .check_finding_reference_uniqueness import check_finding_reference_uniqueness
@@ -82,6 +83,7 @@
     check_biennial_low_risk,
     check_certifying_contacts,
     check_finding_reference_uniqueness,
+    check_finding_prior_references,
     check_findings_count_consistency,
     check_has_federal_awards,
     check_ref_number_in_cap,

backend/audit/cross_validation/check_finding_prior_references.py

@@ -0,0 +1,129 @@
+from audit.fixtures.excel import (
+    FINDINGS_UNIFORM_TEMPLATE_DEFINITION,
+)
+from .errors import err_prior_ref_not_found
+from dissemination.models import (
+    Finding,
+    General,
+)
+
+from django.conf import settings
+
+from datetime import date
+import json
+
+
+def check_finding_prior_references(sac_dict, *_args, **_kwargs):
+    """
+    Check that prior references numbers point to findings that actually exist
+    in a previously submitted report
+    """
+    # Importing here to avoid circular import
+    from audit.models import SacValidationWaiver
+
+    if SacValidationWaiver.TYPES.PRIOR_REFERENCES in sac_dict.get("waiver_types", []):
+        return []
+
+    all_sections = sac_dict.get("sf_sac_sections")
+    findings_uniform_guidance_section = (
+        all_sections.get("findings_uniform_guidance") or {}
+    )
+    findings_uniform_guidance = findings_uniform_guidance_section.get(
+        "findings_uniform_guidance_entries", []
+    )
+    all_prior_refs = _get_prior_refs(findings_uniform_guidance)
+
+    # No prior reference numbers to validate
+    if not all_prior_refs:
+        return []
+
+    general_information = all_sections.get("general_information")
+    auditee_uei = general_information["auditee_uei"]
+    audit_year = date.fromisoformat(
+        general_information["auditee_fiscal_period_start"]
+    ).year
+
+    # UEIs only become reliable as of 2022, so don't bother invalidating
+    # prior references before that
+    if audit_year < 2023:
+        return []
+
+    # Get the report_ids for previous reports
+    previous_report_ids = General.objects.filter(auditee_uei=auditee_uei).values_list(
+        "report_id", flat=True
+    )
+    errors = []
+
+    # Validate all prior reference numbers for each award
+    for award_ref, prior_refs_strings in all_prior_refs.items():
+        prior_refs = prior_refs_strings.split(",")
+        _validate_prior_refs(
+            prior_refs,
+            award_ref,
+            auditee_uei,
+            previous_report_ids,
+            errors,
+        )
+
+    return errors
+
+
+def _get_prior_refs(findings_uniform_guidance):
+    """
+    Returns a dict that maps award references to a list of prior references
+    strings
+    """
+    all_prior_refs = {}
+
+    for finding in findings_uniform_guidance:
+        if finding["findings"]["repeat_prior_reference"] == "Y":
+            award_ref = finding["program"]["award_reference"]
+            cur_prior_refs = finding["findings"]["prior_references"]
+            all_prior_refs[award_ref] = cur_prior_refs
+
+    return all_prior_refs
+
+
+TEMPLATE_DEFINITION_PATH = (
+    settings.XLSX_TEMPLATE_JSON_DIR / FINDINGS_UNIFORM_TEMPLATE_DEFINITION
+)
+FINDINGS_TEMPLATE = json.loads(TEMPLATE_DEFINITION_PATH.read_text(encoding="utf-8"))
+
+
+def _validate_prior_refs(
+    prior_refs, award_ref, auditee_uei, previous_report_ids, errors
+):
+    """
+    Performs validation on the given list of prior reference numbers
+    """
+    first_row = FINDINGS_TEMPLATE["title_row"]
+
+    for index, prior_ref in enumerate(prior_refs):
+        current_row = first_row + index + 1
+        prior_ref_year = prior_ref[:4]
+
+        if prior_ref_year.isnumeric() and int(prior_ref_year) < 2022:
+            # Skip validation for pre-UEI prior references
+            continue
+        elif not previous_report_ids:
+            errors.append(
+                {
+                    "error": err_prior_ref_not_found(
+                        auditee_uei, prior_ref, award_ref, current_row
+                    ),
+                }
+            )
+
+            continue
+        elif not Finding.objects.filter(
+            report_id__in=previous_report_ids,
+            reference_number=prior_ref,
+        ).exists():
+            # Error if we can't find the prior finding in previous reports
+            errors.append(
+                {
+                    "error": err_prior_ref_not_found(
+                        auditee_uei, prior_ref, award_ref, current_row
+                    ),
+                }
+            )

backend/audit/cross_validation/errors.py

@@ -57,6 +57,13 @@ def err_duplicate_finding_reference(award_ref, ref_number):
     return f"Award {award_ref} repeats reference {ref_number}. The reference {ref_number} should only appear once for award {award_ref}."
 
 
+def err_prior_ref_not_found(auditee_uei, prior_ref, award_ref, row):
+    return (
+        f"The {SECTION_NAMES.FEDERAL_AWARDS_AUDIT_FINDINGS} workbook contains prior reference {prior_ref} (award {award_ref}, row {row}). "
+        f"However, that reference was not found in any previous reports for UEI {auditee_uei}."
+    )
+
+
 def err_findings_count_inconsistent(total_expected, total_counted, award_ref):
     return (
         f"You reported {total_expected} findings for award {award_ref} in the {SECTION_NAMES.FEDERAL_AWARDS} workbook, "