Fix SARIF parser: unwrap BlackDuck nested fingerprint dict values

[Jino-T]

Summary

• BlackDuck SARIF output wraps fingerprint values as {"value": "<hash>"} objects instead of the plain strings the SARIF 2.1.0 spec requires
• get_fingerprints_hashes() stored these dicts directly into unique_id_from_tool, which Django's CharField silently coerced to str(dict) on save — but the objects arrive as actual dicts in memory
• On second reimport, update_candidates_with_saved_finding() uses unique_id_from_tool as a Python dict key (candidates_by_uid.setdefault(finding.unique_id_from_tool, [])) — dicts are not hashable, raising TypeError: cannot use 'dict' as a set element (unhashable type: 'dict')
• This crash happens for all reimport deduplication algorithms (the update runs unconditionally), so there is no algorithm-based workaround

Fix

Unwrap the nested dict at parse time in get_fingerprints_hashes():

if isinstance(value, dict):
    value = value.get("value", "")

Test plan

• Ran manage.py test unittests.tools.test_sarif_parser — all 25 tests pass
• Added 2 new cases to test_get_fingerprints_hashes covering nested dict with value key and nested dict with missing value key (empty-string fallback)
• Added test_blackduck_nested_fingerprints integration test with a sanitized 5-finding SARIF fixture covering Medium/High/Info/Critical severity levels — verifies unique_id_from_tool is a plain string and not a dict representation
• Sanitized fixture uses fictional tool name, component names, and synthetic fingerprint hashes; real public CVE IDs are retained for authenticity

Note on existing findings in affected customer databases

Findings created before this fix will have unique_id_from_tool stored as "{'value': 'abc123...'}" (the str() repr of the dict). After deploying the fix, new reimports will produce the correct hash string — these will not match the old str-repr values, causing the old findings to be closed and new ones opened on the next reimport. Customers should be warned if they care about finding continuity.

🤖 Generated with Claude Code