Redundant Vulnerabilities::StateTransition records that don't actually present a state transition.
Per #324860 (comment 1099509574), it was noted that Vulnerabilities::StateTransition records are being created that don't appear to actually represent a state transition at all.
Example:
#<Vulnerabilities::StateTransition:0x00007ff15d452288
id: 1251521,
to_state: "dismissed",
from_state: "dismissed",
created_at: Tue, 13 Sep 2022 16:39:48.646844000 UTC +00:00,
updated_at: Tue, 13 Sep 2022 16:39:48.646844000 UTC +00:00,
author_id: nil,
comment: nil,
dismissal_reason: nil>
At time of discovery, this appears to already have occurred a substantial amount in Production, and is potentially polluting the vulnerability_state_transitions table with thousands of redundant records. We need to investigate how these are being created, and if it's reasonable to have a state transition that doesn't actually present any form of useful information.
Implementation plan:
-
If the vulnerability state is already in state which is requested by change status
, skip state transition entry. for this servicesee/app/services/vulnerabilities /{resolve,dismiss,revert_to_detected,confirm}\_service.rb
Edited by Subashis Chakraborty