fix: ignore casing fix in the policy lib

[agatakrajewska]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___)
• Includes product update to be announced in the next stable release notes

What does this PR do?

We're fixing an issue where where:

You have ignores with different casing e.g. NPM:HAWK:20160119 vs npm:hawk:20160119
The first ignore is expired
The other ignores that are active do not have the same casing
Then no ignores are applied to the vuln
What was happening in the logic is that we were setting the value of the vulnId to the value of whatever matches first when checking the ignore keys. That vulnId is then used to check the ignores, so if you have other ignores that do not have the same casing exactly they are never checked.

This PR introduces logic to have a variable for all matching vuln IDs with all types of casing to then check the ignores against, so every ignore stored against the vuln ID no matter what the casing is will be checked.

What's the product update that needs to be communicated to CLI users?

We're fixing an issue where where:

You have ignores with different casing e.g. NPM:HAWK:20160119 vs npm:hawk:20160119
The first ignore is expired
The other ignores that are active do not have the same casing
Then no ignores are applied to the vuln
What was happening in the logic is that we were setting the value of the vulnId to the value of whatever matches first when checking the ignore keys. That vulnId is then used to check the ignores, so if you have other ignores that do not have the same casing exactly they are never checked.

This PR introduces logic to have a variable for all matching vuln IDs with all types of casing to then check the ignores against, so every ignore stored against the vuln ID no matter what the casing is will be checked.

Risk assessment (Low | Medium | High)?

Low

What are the relevant tickets?

https://snyksec.atlassian.net/browse/IGNR-1530

[snyk-io]

🎉 Snyk checks have passed. No issues have been found so far.

✅ security/snyk check is complete. No issues have been found. (View Details)

✅ license/snyk check is complete. No issues have been found. (View Details)

✅ code/snyk check is complete. No issues have been found. (View Details)