From 623b57ca06f6afd6294d1682bb3a6b12acc6a406 Mon Sep 17 00:00:00 2001
From: root <root@dashboard-dev.charterlab.com>
Date: Mon, 27 Apr 2026 16:21:19 +0000
Subject: [PATCH] =?UTF-8?q?Fix=20Atlas=20vulnerability=20response=20parsin?=
 =?UTF-8?q?g=20=E2=80=94=20API=20returns=20arrays=20per=20host,=20not=20ob?=
 =?UTF-8?q?jects?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/components/pages/ReportingPage.js     | 37 ++++++++-----------
 1 file changed, 15 insertions(+), 22 deletions(-)

diff --git a/frontend/src/components/pages/ReportingPage.js b/frontend/src/components/pages/ReportingPage.js
index 1f8cdee..c8d17ab 100644
--- a/frontend/src/components/pages/ReportingPage.js
+++ b/frontend/src/components/pages/ReportingPage.js
@@ -3907,29 +3907,22 @@ function BulkAtlasModal({ selectedFindings, onClose, onSuccess }) {
                 const data = await res.json();
                 if (cancelled) return;
 
-                // Parse response — Atlas returns { host_id: { qualys_id: vulnObj, ... }, ... }
+                // Parse response — Atlas returns { "host_id": [ { qualys_id, title, ... }, ... ], ... }
                 const qualysMap = new Map();
-                if (data && typeof data === 'object') {
-                    const entries = Array.isArray(data) ? data : Object.entries(data);
-                    for (const entry of entries) {
-                        let vulns;
-                        if (Array.isArray(entry)) {
-                            vulns = entry[1];
-                        } else if (typeof entry === 'object') {
-                            vulns = entry;
-                        } else continue;
-
-                        if (vulns && typeof vulns === 'object' && !Array.isArray(vulns)) {
-                            for (const [qid, vuln] of Object.entries(vulns)) {
-                                if (!qualysMap.has(qid)) {
-                                    qualysMap.set(qid, {
-                                        qualys_id: qid,
-                                        title: vuln?.title || vuln?.vulnerability_title || qid,
-                                        count: 1,
-                                    });
-                                } else {
-                                    qualysMap.get(qid).count++;
-                                }
+                if (data && typeof data === 'object' && !Array.isArray(data)) {
+                    for (const [, vulnList] of Object.entries(data)) {
+                        if (!Array.isArray(vulnList)) continue;
+                        for (const vuln of vulnList) {
+                            const qid = vuln.qualys_id || vuln.sourceId;
+                            if (!qid) continue;
+                            if (!qualysMap.has(qid)) {
+                                qualysMap.set(qid, {
+                                    qualys_id: qid,
+                                    title: vuln.title || qid,
+                                    count: 1,
+                                });
+                            } else {
+                                qualysMap.get(qid).count++;
                             }
                         }
                     }