Fix undismissed scope

ee/app/models/security/finding.rb

@@ -31,7 +31,11 @@ module Security
     scope :by_confidence_levels, -> (confidence_levels) { where(confidence: confidence_levels) }
     scope :by_report_types, -> (report_types) { joins(:scan).merge(Scan.by_scan_types(report_types)) }
     scope :undismissed, -> do
-      where('NOT EXISTS (?)', Scan.select(1).has_dismissal_feedback.where('vulnerability_feedback.project_fingerprint = security_findings.project_fingerprint'))
+      where('NOT EXISTS (?)',
+            Scan.select(1)
+                .has_dismissal_feedback
+                .where('security_scans.id = security_findings.scan_id')
+                .where('vulnerability_feedback.project_fingerprint = security_findings.project_fingerprint'))
     end
     scope :ordered, -> { order(severity: :desc, confidence: :desc, id: :asc) }
     scope :with_build_and_artifacts, -> { includes(build: :job_artifacts) }

ee/spec/models/security/finding_spec.rb

@@ -81,9 +81,10 @@ RSpec.describe Security::Finding do
   end
 
   describe '.undismissed' do
-    let(:scan) { create(:security_scan) }
-    let!(:undismissed_finding) { create(:security_finding, scan: scan) }
-    let!(:dismissed_finding) { create(:security_finding, scan: scan) }
+    let(:scan_1) { create(:security_scan) }
+    let(:scan_2) { create(:security_scan) }
+    let!(:undismissed_finding) { create(:security_finding, scan: scan_1) }
+    let!(:dismissed_finding) { create(:security_finding, scan: scan_1) }
     let(:expected_findings) { [undismissed_finding] }
 
     subject { described_class.undismissed }
@@ -91,9 +92,15 @@ RSpec.describe Security::Finding do
     before do
       create(:vulnerability_feedback,
              :dismissal,
-             project: scan.project,
-             category: scan.scan_type,
+             project: scan_1.project,
+             category: scan_1.scan_type,
              project_fingerprint: dismissed_finding.project_fingerprint)
+
+      create(:vulnerability_feedback,
+             :dismissal,
+             project: scan_2.project,
+             category: scan_2.scan_type,
+             project_fingerprint: undismissed_finding.project_fingerprint)
     end
 
     it { is_expected.to match_array(expected_findings) }