Exclude Adobe plugins from vulnerability scanning

[juan-fdz-hawa]

Closes #49061

Adobe plugins are inventory-only: no vulnerability data source maps an Adobe CEP or UXP extension to a CVE. Adobe files CVEs against the host application (Photoshop, Acrobat, and so on) keyed to that app's version, which Fleet already scans via the apps/programs sources, so any match on an extension row would be a false positive pinned to the wrong version.

• Added adobe_plugins to the excluded sources on the NVD/CPE software iterator so they are excluded from vuln scanning.
• Adobe plugins show as "Not supported" on the vulnerability column.

Summary by CodeRabbit

• New Features
  • Added Adobe CEP and UXP plugins to software inventory on macOS and Windows.
  • Adobe plugins now display as “Plugin (Adobe)” with version and host details.
  • Adobe plugins show “Not supported” in vulnerability fields and are excluded from vulnerability scanning.
• Bug Fixes
  • Updated software and host views to consistently identify unsupported vulnerability sources.
  • Improved messaging for software types that do not support vulnerability detection.

[juan-fdz-hawa]

@coderabbitai full review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.03%. Comparing base (d87001f) to head (54cd634).
⚠️ Report is 2 commits behind head on 45414-software-inventory-vulnerabilities-add-adobe-plugins.

Additional details and impacted files

@@                                      Coverage Diff                                       @@
##           45414-software-inventory-vulnerabilities-add-adobe-plugins   #50568      +/-   ##
==============================================================================================
- Coverage                                                       68.03%   68.03%   -0.01%     
==============================================================================================
  Files                                                            3930     3930              
  Lines                                                          250268   250268              
  Branches                                                        13270    13270              
==============================================================================================
- Hits                                                           170273   170272       -1     
- Misses                                                          64692    64695       +3     
+ Partials                                                        15303    15301       -2     

Flag	Coverage Δ
backend	69.37% <100.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

Walkthrough

Adobe CEP and UXP plugins are added to software inventory on macOS and Windows. Fleet displays them as “Plugin (Adobe)” with version and host count. Adobe plugins are marked “Not supported” for vulnerability detection across inventory, detail, and host software views. NVD CPE translation excludes the adobe_plugins source. Tests cover source classification, UI rendering, and NVD query exclusions.

Possibly related issues

• fleetdm/fleet#45414 — Defines the Adobe plugin inventory and vulnerability-handling implementation.
• Adobe extensions: roll up vulnerabilities from bundled third-party components #50460 — Concerns Adobe plugin vulnerability handling and source attribution.

Possibly related PRs

• fleetdm/fleet#49379 — Also changes software vulnerability-support handling and “Not supported” UI messaging.

🚥 Pre-merge checks | ✅ 2 | ❌ 3

❌ Failed checks (3 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR contradicts #49061 by excluding adobe_plugins from NVD scanning and marking the vulnerability column unsupported instead of keeping it live with a guardrail.	Remove adobe_plugins from the NVD exclude list, keep the column live, add an Adobe application CPE guardrail, and test real and synthetic extensions.
Out of Scope Changes check	⚠️ Warning	The exclusion-list change and unsupported-column behavior contradict the linked issue's required live-column and guardrail approach.	Limit the changes to live scanning with an Adobe application CPE guardrail; remove the exclusion and unsupported UI behavior.
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the primary implementation change: excluding Adobe plugins from vulnerability scanning.
Description check	✅ Passed	The description identifies issue #49061, explains the false-positive risk, and summarizes the NVD and UI changes, but omits checklist details.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 49061-adobe-plugins-keep-vulnerability-column-live-false-positive-guardrail

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

frontend/pages/hosts/details/cards/Software/HostSoftwareTableConfig.tests.tsx (1)

74-82: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Assert the rendered vulnerability value.

The test name promises a vulnerability count, but the test only checks that "Not supported" is absent. A blank or broken VulnerabilitiesCell would pass. Assert the exact count or vulnerability element rendered for CVE-2024-1234.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@frontend/pages/hosts/details/cards/Software/HostSoftwareTableConfig.tests.tsx`
around lines 74 - 82, Update the test around the Cell component to assert the
exact vulnerability count or rendered vulnerability element for CVE-2024-1234,
rather than only verifying that “Not supported” is absent. Keep the scanned apps
source setup unchanged and ensure the assertion matches the value rendered by
VulnerabilitiesCell.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@frontend/interfaces/software.ts`:
- Around line 918-937: Keep adobe_plugins out of
NO_VULNERABILITY_DETECTION_SOURCES and add an NVD matching guard that rejects
host-application CPEs for Adobe plugin rows while preserving extension-level
matching and zero-vulnerability results. Update
frontend/interfaces/software.tests.ts:303-317 to assert Adobe plugins remain
supported; preserve normal vulnerability rendering and lookups in
frontend/pages/SoftwarePage/SoftwareInventory/SoftwareInventoryTable/SoftwareInventoryTableConfig.tsx:166-175,
frontend/pages/SoftwarePage/SoftwareInventory/SoftwareInventoryTable/SoftwareVersionsTableConfig.tsx:89-99,
frontend/pages/SoftwarePage/SoftwareVersionDetailsPage/SoftwareVersionDetailsPage.tsx:135-145,
frontend/pages/hosts/details/cards/Software/DeviceSoftwareTableConfig.tsx:87-97,
and
frontend/pages/hosts/details/cards/Software/HostSoftwareTableConfig.tsx:213-224.
Add coverage for the normal zero-vulnerability state in
frontend/pages/SoftwarePage/SoftwareInventory/SoftwareInventoryTable/SoftwareInventoryTableConfig.tests.tsx:50-76.

In `@server/vulnerabilities/nvd/cpe.go`:
- Around line 867-871: Keep Adobe plugins in the NVD/CPE flow by removing
adobe_plugins from ExcludedSources in server/vulnerabilities/nvd/cpe.go and add
source-aware candidate filtering that rejects host-application CPE matches while
preserving extension handling. Update TitleVersionsTableConfig.tsx to keep the
Vulnerabilities column live, revise TitleVersionsTable.tests.tsx and
HostSoftwareTableConfig.tests.tsx for live/no-match Adobe behavior, add real and
synthetic extension guardrail coverage in cpe_test.go, and document the
guardrail and current lack of meaningful extension-level matching in
changes/45414-adobe-plugins.

---

Nitpick comments:
In
`@frontend/pages/hosts/details/cards/Software/HostSoftwareTableConfig.tests.tsx`:
- Around line 74-82: Update the test around the Cell component to assert the
exact vulnerability count or rendered vulnerability element for CVE-2024-1234,
rather than only verifying that “Not supported” is absent. Keep the scanned apps
source setup unchanged and ensure the assertion matches the value rendered by
VulnerabilitiesCell.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a4a54d51-9dc0-40a8-951e-728275925716

📥 Commits

Reviewing files that changed from the base of the PR and between d87001f and a6ca429.

📒 Files selected for processing (17)

• changes/45414-adobe-plugins
• frontend/interfaces/software.tests.ts
• frontend/interfaces/software.ts
• frontend/pages/SoftwarePage/SoftwareInventory/SoftwareInventoryTable/SoftwareInventoryTableConfig.tests.tsx
• frontend/pages/SoftwarePage/SoftwareInventory/SoftwareInventoryTable/SoftwareInventoryTableConfig.tsx
• frontend/pages/SoftwarePage/SoftwareInventory/SoftwareInventoryTable/SoftwareVersionsTableConfig.tsx
• frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsPage.tsx
• frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/TitleVersionsTable/TitleVersionsTable.tests.tsx
• frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/TitleVersionsTable/TitleVersionsTable.tsx
• frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/TitleVersionsTable/TitleVersionsTableConfig.tsx
• frontend/pages/SoftwarePage/SoftwareVersionDetailsPage/SoftwareVersionDetailsPage.tsx
• frontend/pages/SoftwarePage/components/tables/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx
• frontend/pages/hosts/details/cards/Software/DeviceSoftwareTableConfig.tsx
• frontend/pages/hosts/details/cards/Software/HostSoftwareTableConfig.tests.tsx
• frontend/pages/hosts/details/cards/Software/HostSoftwareTableConfig.tsx
• server/vulnerabilities/nvd/cpe.go
• server/vulnerabilities/nvd/cpe_test.go