Skip to content

fix(dedupe): prevent duplicate test processing in batch dedupe command#14601

Merged
rossops merged 1 commit into
DefectDojo:bugfixfrom
valentijnscholten:fix/dedupe-batch-duplicate-test-ids
Mar 30, 2026
Merged

fix(dedupe): prevent duplicate test processing in batch dedupe command#14601
rossops merged 1 commit into
DefectDojo:bugfixfrom
valentijnscholten:fix/dedupe-batch-duplicate-test-ids

Conversation

@valentijnscholten
Copy link
Copy Markdown
Member

Summary

  • Finding.Meta.ordering defines multiple columns (numerical_severity, date, title, epss_score, epss_percentile). When Django generates SELECT DISTINCT test_id ... ORDER BY <those columns>, PostgreSQL requires all ORDER BY columns to appear in the SELECT list — so Django silently adds them to the projection. As a result, DISTINCT operates on the full tuple (test_id, numerical_severity, date, title, epss_score, epss_percentile) instead of test_id alone.
  • This causes the same test to appear multiple times in the test_ids iterator inside _dedupe_batch_mode, so findings for that test are submitted to Celery over and over — visible as the dedupe command appearing to loop indefinitely on the same test.
  • Fix: call .order_by("test_id") before .values_list("test_id", flat=True).distinct() to override the model-level ordering. The resulting query is SELECT DISTINCT test_id ORDER BY test_id, which correctly deduplicates by test only.

Finding.Meta.ordering includes multiple columns (numerical_severity, date,
title, epss_score, epss_percentile). When Django generates
SELECT DISTINCT test_id ... ORDER BY those columns, PostgreSQL requires
them in the SELECT list, so Django silently adds them. The DISTINCT then
operates on the full tuple instead of test_id alone, causing the same test
to appear multiple times in the iterator and be processed repeatedly.

Fix by calling .order_by("test_id") before .values_list().distinct() to
override the model-level ordering, so the query stays SELECT DISTINCT test_id
ORDER BY test_id.
@valentijnscholten valentijnscholten added this to the 2.56.4 milestone Mar 28, 2026
@paulOsinski paulOsinski self-requested a review March 30, 2026 14:37
@rossops rossops merged commit 367d9f8 into DefectDojo:bugfix Mar 30, 2026
156 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants