SONAR-22914 Issues on different CVEs are different issues

2 files changed, 16 insertions, 1 deletions

diff --git a/server/sonar-ce-task-projectanalysis/src/main/java/org/sonar/ce/task/projectanalysis/issue/SiblingIssue.java b/server/sonar-ce-task-projectanalysis/src/main/java/org/sonar/ce/task/projectanalysis/issue/SiblingIssue.java
index 11d896a0c6a..c8825883bc5 100644
--- a/server/sonar-ce-task-projectanalysis/src/main/java/org/sonar/ce/task/projectanalysis/issue/SiblingIssue.java
+++ b/server/sonar-ce-task-projectanalysis/src/main/java/org/sonar/ce/task/projectanalysis/issue/SiblingIssue.java
@@ -38,9 +38,15 @@ public class SiblingIssue implements Trackable {
   private final String prKey;
   private final BranchType branchType;
   private final Date updateDate;
+  private final String cveId;
 
   SiblingIssue(String key, @Nullable Integer line, @Nullable String message, @Nullable String lineHash, RuleKey ruleKey, String status, String prKey, BranchType branchType,
     Date updateDate) {
+    this(key, line, message, lineHash, ruleKey, status, prKey, branchType, updateDate, null);
+  }
+
+  SiblingIssue(String key, @Nullable Integer line, @Nullable String message, @Nullable String lineHash, RuleKey ruleKey, String status, String prKey, BranchType branchType,
+    Date updateDate, @Nullable String cveId) {
     this.key = key;
     this.line = line;
     this.message = message;
@@ -50,6 +56,7 @@ public class SiblingIssue implements Trackable {
     this.prKey = prKey;
     this.branchType = branchType;
     this.updateDate = updateDate;
+    this.cveId = cveId;
   }
 
   public String getKey() {
@@ -97,6 +104,12 @@ public class SiblingIssue implements Trackable {
     return updateDate;
   }
 
+  @CheckForNull
+  @Override
+  public String getCveId() {
+    return cveId;
+  }
+
   @Override
   public int hashCode() {
     return key.hashCode();
diff --git a/server/sonar-ce-task-projectanalysis/src/main/java/org/sonar/ce/task/projectanalysis/issue/TrackerRawInputFactory.java b/server/sonar-ce-task-projectanalysis/src/main/java/org/sonar/ce/task/projectanalysis/issue/TrackerRawInputFactory.java
index 93b6054564e..4f014fde255 100644
--- a/server/sonar-ce-task-projectanalysis/src/main/java/org/sonar/ce/task/projectanalysis/issue/TrackerRawInputFactory.java
+++ b/server/sonar-ce-task-projectanalysis/src/main/java/org/sonar/ce/task/projectanalysis/issue/TrackerRawInputFactory.java
@@ -270,7 +270,9 @@ public class TrackerRawInputFactory {
       }
       issue.setIsFromExternalRuleEngine(true);
       issue.setLocations(dbLocationsBuilder.build());
-      issue.setCveId(reportExternalIssue.getCveId());
+      if (reportExternalIssue.hasCveId()) {
+        issue.setCveId(reportExternalIssue.getCveId());
+      }
 
       return issue;
     }