From f3e53bea4cff856337088d0f38551981d476563d Mon Sep 17 00:00:00 2001
From: Pohan Huang <pohan.huang@suse.com>
Date: Sat, 18 Jul 2026 00:03:23 +0800
Subject: [PATCH] fix: remove the all of the reject cve when building

Signed-off-by: pohanhuang <pohan.huang@suse.com>
---
 updater/fetchers/apps/apps.go     |  6 +++++-
 updater/fetchers/ubuntu/ubuntu.go |  3 +++
 updater/filter.go                 | 19 +++++++++++++++++++
 updater/filter_test.go            | 29 +++++++++++++++++++++++++++++
 4 files changed, 56 insertions(+), 1 deletion(-)
 create mode 100644 updater/filter.go
 create mode 100644 updater/filter_test.go

diff --git a/updater/fetchers/apps/apps.go b/updater/fetchers/apps/apps.go
index e3c798d..c7dbdf5 100644
--- a/updater/fetchers/apps/apps.go
+++ b/updater/fetchers/apps/apps.go
@@ -20,7 +20,7 @@ var vulCache utils.Set = utils.NewSet()
 var cveCalibrate map[string][]common.AppModuleVersion = make(map[string][]common.AppModuleVersion)
 
 // Sometimes source doesn't remove withdrawn CVEs
-var withdrawnCVEs = map[string]struct{}{"CVE-2021-23334": {}, "CVE-2024-4109": {}}
+var withdrawnCVEs = map[string]struct{}{"CVE-2021-23334": {}, "CVE-2024-4109": {}, "CVE-2026-33817": {}}
 
 // This is a workaround to use import to control app db generation
 type AppFetcher struct{}
@@ -71,6 +71,10 @@ func (f *AppFetcher) FetchUpdate() (resp updater.AppFetcherResponse, err error)
 			delete(vulMap, key)
 			continue
 		}
+		if updater.ShouldSkipDescription(mv.Description) {
+			delete(vulMap, key)
+			continue
+		}
 		// Keep all CWE and GHSA vulnerabilities for now.
 		if !strings.HasPrefix(mv.VulName, "CWE-") && !strings.HasPrefix(mv.VulName, "GHSA-") {
 			if s := strings.Index(mv.VulName, "-"); s != -1 {
diff --git a/updater/fetchers/ubuntu/ubuntu.go b/updater/fetchers/ubuntu/ubuntu.go
index 6f10c92..ca561a1 100644
--- a/updater/fetchers/ubuntu/ubuntu.go
+++ b/updater/fetchers/ubuntu/ubuntu.go
@@ -142,6 +142,9 @@ func (fetcher *UbuntuFetcher) FetchUpdate() (resp updater.FetcherResponse, err e
 
 		// Add the vulnerability to the response.
 		upstreamCalibration(&v)
+		if updater.ShouldSkipDescription(v.Description) {
+			continue
+		}
 		if len(v.FixedIn) > 0 || fetcher.CvesIncludeGoVuln.Contains(v.Name) {
 			resp.Vulnerabilities = append(resp.Vulnerabilities, v)
 		}
diff --git a/updater/filter.go b/updater/filter.go
new file mode 100644
index 0000000..1b7607d
--- /dev/null
+++ b/updater/filter.go
@@ -0,0 +1,19 @@
+package updater
+
+import "strings"
+
+var skippedDescriptionMarkers = []string{
+	"rejected reason",
+	"withdrawn advisory",
+}
+
+func ShouldSkipDescription(description string) bool {
+	lowerDescription := strings.ToLower(description)
+	for _, marker := range skippedDescriptionMarkers {
+		if strings.Contains(lowerDescription, marker) {
+			return true
+		}
+	}
+
+	return false
+}
diff --git a/updater/filter_test.go b/updater/filter_test.go
new file mode 100644
index 0000000..3cc830d
--- /dev/null
+++ b/updater/filter_test.go
@@ -0,0 +1,29 @@
+package updater
+
+import "testing"
+
+func TestShouldSkipDescription(t *testing.T) {
+	cases := []struct {
+		description string
+		want        bool
+	}{
+		{
+			description: "Rejected reason: CVE confirmed to be a false positive",
+			want:        true,
+		},
+		{
+			description: "Withdrawn Advisory: go.etcd.io/bbolt affected by index out-of-range vulnerability",
+			want:        true,
+		},
+		{
+			description: "Regular advisory description",
+			want:        false,
+		},
+	}
+
+	for _, tc := range cases {
+		if got := ShouldSkipDescription(tc.description); got != tc.want {
+			t.Fatalf("ShouldSkipDescription(%q) = %v, want %v", tc.description, got, tc.want)
+		}
+	}
+}