test(cve-triage): guard dedup against over-rejecting unrelated patterns

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>

packages/secubox-cve-triage/tests/test_generate.py

@@ -131,3 +131,25 @@ def test_no_dedup_when_existing_absent_keeps_candidate(tmp_path):
     """)
     kept, _ = generate(subset, present=set(), present_complete=True)  # existing default None
     assert [c.cve for c in kept] == ["CVE-2024-21887"]
+
+
+def test_dedup_does_not_over_reject_unrelated_existing_patterns(tmp_path):
+    # existing is non-empty but covers a DIFFERENT path → the candidate must
+    # still be kept. Guards against a future refactor to substring/regex
+    # matching silently over-rejecting real probes.
+    subset = tmp_path / "nuclei-subset"
+    subset.mkdir()
+    _write(subset, "ivanti.yaml", """
+        id: CVE-2024-21887
+        info:
+          severity: critical
+          classification: {cve-id: CVE-2024-21887, cpe: "cpe:2.3:a:ivanti:connect_secure:*"}
+          metadata: {vendor: ivanti, product: connect_secure}
+          tags: cve,kev
+        http:
+          - method: GET
+            path: ["{{BaseURL}}/api/v1/totp/user-backup"]
+    """)
+    existing = {re.escape("/some/other/unrelated/path"): "cve_2024"}
+    kept, _ = generate(subset, present=set(), present_complete=True, existing=existing)
+    assert [c.cve for c in kept] == ["CVE-2024-21887"]