Vulnerabilities being duplicated - appears limited to tracking calculator enabled analyzers

Summary

Steps to reproduce

Example Project

What is the current bug behavior?

We have noticed vulnerabilities being duplicated in some of our projects. This was first noticed in our SAST analyzer projects, but is also happening in our Golang test projects [1][2] as well as Gitaly.

The first observed duplication happened on July 1st, 2021. But, it appears to happen after the first pipeline run on the default branch on or after that date for a project that has the :vulnerability_finding_tracking_signatures feature flag enabled and utilizes one or more of the following analyzers: brakeman, gosec, or semgrep.

matches_signatures - is most likely the culprit

There is a spec that documents this behavior.

It is most likely happening both of the following conditions are met:

• The analyzer has tracking calculator added - currently this is brakeman, gosec, and semgrep analyzers
• The :vulnerability_finding_tracking_signatures feature flag is turned on - the flag is currently turned on for all of gitlab.com

Adding tracking calculator functionality to more analyzers will cause this to show in more projects.

Removing the :vulnerability_finding_tracking_signatures feature flag will cause this to start showing for self-managed projects with the next GitLab release.

It is unclear what the effort would be to fix this.

It is unclear if the refactoring efforts that are currently underway will make fixing this easier.

What is the expected correct behavior?

Relevant logs and/or screenshots

Output of checks

Results of GitLab environment info

Expand for output related to GitLab environment info

(For installations with omnibus-gitlab package run and paste the output of:
`sudo gitlab-rake gitlab:env:info`)

(For installations from source run and paste the output of:
`sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production`)

Results of GitLab application Check

Expand for output related to the GitLab application check

(For installations with omnibus-gitlab package run and paste the output of:
sudo gitlab-rake gitlab:check SANITIZE=true)
(For installations from source run and paste the output of:
sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production SANITIZE=true)
(we will only investigate if the tests are passing)

Possible fixes