add check for product uid in OCSF validation helpers

Author: ptzianos

sdk/component/utils/testing/oscf_vulnerability_finding_verification.go

@@ -23,6 +23,7 @@ func AssertVulnerabilityFindingIsValid(t *testing.T, finding *ocsf.Vulnerability
 
 	assert.NotEmpty(t, findingInfo.GetUid(), "FindingInfo.Uid is required")
 	assert.NotEmpty(t, findingInfo.GetTitle(), "FindingInfo.Title is required")
+	assert.NotEmpty(t, findingInfo.GetProductUid(), "Product Uid is required")
 
 	dataSourcesJson := findingInfo.GetDataSources()
 	require.Len(t, dataSourcesJson, 1, "Exactly one 'DataSource' JSON string is required")
@@ -136,6 +137,7 @@ func AssertFindingListsMatch(t *testing.T, expectedFindings, actualFindings []*o
 
 				assert.Equal(t, expectedDS.GetTargetType(), actualDS.GetTargetType(), "DataSource TargetType should match")
 				assert.Equal(t, expectedDS.GetUri().GetPath(), actualDS.GetUri().GetPath(), "DataSource Uri Path should match")
+				assert.Equal(t, expected.GetFindingInfo().GetProductUid(), actual.GetFindingInfo().GetProductUid(), "Product Uids don't match")
 
 				// Compare location data
 				expectedLoc := expectedDS.GetFileFindingLocationData()

sdk/component/utils/testing/oscf_vulnerability_finding_verification_test.go

@@ -10,26 +10,46 @@ import (
 
 // TestCompareVulnerabilityFindings now sets up data and calls the assertion helper.
 func TestCompareVulnerabilityFindings(t *testing.T) {
-	//repoDataSource := `{"targetType": 1, "uri": {"path": "file://user.go"}, "fileFindingLocationData": {"startLine": 50, "endLine": 55}, "sourceCodeMetadata": {"repositoryUrl": "https://github.com/my-org/my-repo", "reference": "refs/heads/main"}}`
 	containerDataSource := `{"targetType": 2, "uri": {"path": "pkg:docker/my-app@sha256:f1..."}, "fileFindingLocationData": {"startLine": 1, "endLine": 1}, "ociPackageMetadata": {"packageUrl": "my-registry/my-app", "tag": "1.2.3"}}`
-	//websiteDataSource := `{"targetType": 3, "uri": {"path": "https://example.com/login"}, "fileFindingLocationData": {"startLine": 25, "endLine": 30}, "websiteMetadata": {"url": "https://example.com/login"}}`
 
 	expectedFindings := []*ocsf.VulnerabilityFinding{
 		{
-			FindingInfo: &ocsf.FindingInfo{Uid: "G102", Title: "Outdated Container", DataSources: []string{containerDataSource}},
+			FindingInfo: &ocsf.FindingInfo{
+				Uid:         "G102",
+				Title:       "Outdated Container",
+				ProductUid:  utils.Ptr("gosec"),
+				DataSources: []string{containerDataSource},
+			},
 			Vulnerabilities: []*ocsf.Vulnerability{{
-				// Cve: &ocsf.Cve{Uid: "2023-1234"},
-				AffectedCode: []*ocsf.AffectedCode{{File: &ocsf.File{Name: "pkg:docker/my-app@sha256:f1..."}, StartLine: utils.Ptr(int32(1))}},
+				AffectedCode: []*ocsf.AffectedCode{
+					{
+						File: &ocsf.File{
+							Name: "pkg:docker/my-app@sha256:f1...",
+						},
+						StartLine: utils.Ptr(int32(1)),
+					},
+				},
 			}},
 		},
 	}
 
 	actualFindings := []*ocsf.VulnerabilityFinding{
 		{ // Matches G102 perfectly
-			FindingInfo: &ocsf.FindingInfo{Uid: "G102", Title: "Outdated Container", DataSources: []string{containerDataSource}},
+			FindingInfo: &ocsf.FindingInfo{
+				Uid:         "G102",
+				Title:       "Outdated Container",
+				ProductUid:  utils.Ptr("gosec"),
+				DataSources: []string{containerDataSource},
+			},
 			Vulnerabilities: []*ocsf.Vulnerability{{
-				// Cve: &ocsf.Cve{Uid: "2023-1234"},
-				AffectedCode: []*ocsf.AffectedCode{{File: &ocsf.File{Name: "pkg:docker/my-app@sha256:f1..."}, StartLine: utils.Ptr(int32(1))}},
+				AffectedCode: []*ocsf.AffectedCode{
+					{
+						File: &ocsf.File{
+							Name: "pkg:docker/my-app@sha256:f1...",
+						},
+						StartLine: utils.Ptr(int32(1)),
+					},
+				},
 			}},
 		},
 	}
@@ -42,8 +62,9 @@ func TestVulnerabilityFindingValidation(t *testing.T) {
 	// A valid finding that should pass all assertions
 	validFinding := &ocsf.VulnerabilityFinding{
 		FindingInfo: &ocsf.FindingInfo{
-			Uid:   "G112",
-			Title: "Uncontrolled Resource Consumption",
+			Uid:        "G112",
+			Title:      "Uncontrolled Resource Consumption",
+			ProductUid: utils.Ptr("gosec"),
 			// --- CORRECTED: JSON string is now a single object, not an array ---
 			DataSources: []string{`{
 				"targetType": 1,