cli: version 2.6 generating different vulnerability hashes from 2.5

[matheusalcantarazup]

What happened:
The vulnerability hashes from version 2.6.0 is different from 2.5.0. This causes new vulnerabilities to be reported. Vulnerabilities previously registered as false positive and accepted risk are reported again, but with a different hash.

What you expected to happen:
All vulnerability hashes are the same after update

How to reproduce it (as minimally and precisely as possible):
Create a example file with a leak:

package main

import  "fmt"

var password = "bla"

func main() {
        fmt.Println(password)
}

Execute horusec v2.5.0 results in this vulnerability:

$ horusecv2.5.0 start -p testdata -D

Language: Leaks
Severity: CRITICAL
Line: 10
Column: 1
SecurityTool: HorusecEngine
Confidence: MEDIUM
File: testdata/main.go
Code: password = "bla"
Details: Hard-coded password
The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. For more information checkout the CWE-798 (https://cwe.mitre.org/data/definitions/798.html) advisory.
Type: Vulnerability
ReferenceHash: d0d384ba41837ca2ccdf68aadcb1ac91bcada34c6b403bd9824ca3624ea5768c

Execute horusec v2.6.0 results in this vulnerability:

$ horusecv2.6.0 start -p testdata -D

Language: Leaks
Severity: CRITICAL
Line: 10
Column: 1
SecurityTool: HorusecEngine
Confidence: MEDIUM
File: testdata/main.go
Code: password = "bla"
Details: HS-LEAKS-26: Hard-coded password
The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. For more information checkout the CWE-798 (https://cwe.mitre.org/data/definitions/798.html) advisory.
Type: Vulnerability
ReferenceHash: 55e2ffceadb5dd08f812f395ab54fb4a70b6acd4516acd006d4ca3abf0016fd8

Note that the ReferenceHash from two versions is different. Was expected to be equals.

Anything else we need to know?:
Affected versions:

• v2.6.0
• v2.6.1
• v2.6.2

[matheusalcantarazup]

This issue was fixed on version v2.6.3. Users getting this problem please upgrade to this version or greater.