OpenVAS XML parser loses scanner-reported IP address when hostname is present

[Whitehorse2]

Bug description
The OpenVAS XML parser creates DefectDojo endpoints.

However, when the XML report contains both an IP address and an optional
hostname/FQDN, only one of these values is retained as the endpoint host.

Observed behavior:

• If <hostname> contains a value, the DefectDojo endpoint uses the FQDN.
• If <hostname> is empty or absent, the DefectDojo endpoint uses the IP
  address from <host>.
• When an FQDN is present, the scanner-reported IP address is not retained
  in the endpoint.

For the first result, the created DefectDojo endpoint contains only the FQDN:

Host: host01.example.com
Port: 443
Protocol: tcp

The source IP address 192.0.2.10 is not retained.

For the second result, where the FQDN is empty, the endpoint contains the IP:

Host: 192.0.2.11
Port: 443
Protocol: tcp

This means that the endpoint identity changes depending on DNS/hostname
availability in the scan report.

Sanitized OpenVAS XML example

xml
<report>
  <results start="1" max="-1">
    <result id="00000000-0000-0000-0000-000000000001">
      <name>Example Vulnerability</name>

      <host>
        192.0.2.10
        <asset asset_id="00000000-0000-0000-0000-000000000002"/>
        <hostname>host01.example.com</hostname>
      </host>

      <port>443/tcp</port>

      <nvt oid="1.3.6.1.4.1.25623.1.0.100000">
        <type>nvt</type>
        <name>Example NVT</name>
      </nvt>

      <severity>7.5</severity>
    </result>

    <result id="00000000-0000-0000-0000-000000000003">
      <name>Example Vulnerability</name>

      <host>
        192.0.2.11
        <asset asset_id="00000000-0000-0000-0000-000000000004"/>
        <hostname/>
      </host>

      <port>443/tcp</port>

      <nvt oid="1.3.6.1.4.1.25623.1.0.100000">
        <type>nvt</type>
        <name>Example NVT</name>
      </nvt>

      <severity>7.5</severity>
    </result>
  </results>
</report>

Expected behavior
Both values from the scanner report should be preserved:

IP address: 192.0.2.10
Hostname: host01.example.com
Port: 443
Protocol: tcp

Suggested source mapping:

<host>.text                 -> IP address
<host>/<hostname>.text      -> hostname/FQDN, if present
<port>                      -> endpoint port and protocol
<nvt oid="...">             -> scanner vulnerability identity

The IP address should be the stable technical endpoint identity.
The FQDN should be retained as additional endpoint metadata or as an
endpoint alias.

An FQDN alone is not a stable technical asset identifier:

• DNS resolution can fail temporarily.
• Hostnames can change.
• Multiple hostnames can point to the same IP address.
• A later Greenbone scan may report only the IP address.

The same target can otherwise be represented differently between scans:

Scan 1: host01.example.com
Scan 2: 192.0.2.10

This can negatively affect endpoint correlation, finding deduplication,
and continuous vulnerability management workflows.

The OpenVAS XML source report already provides both values. The IP address
should therefore not be discarded when a hostname is available.

Deployment method

• [ x] Docker Compose

Environment information

• Operating System: Rocky 10
• Podman Compose : 1.6.
• DefectDojo version: 3.2.4
• Deployment: Podman 5.8.2
• Scan type: OpenVAS XML