Skip to content

Commit 4da46d3

Browse files
johnmhoranTG1999
johnmhoran
authored and
TG1999
committed
Update postgresql importer and testing #969
Reference: #969 Signed-off-by: John M. Horan <[email protected]>
1 parent b5c94bd commit 4da46d3

File tree

2 files changed

+63
-173
lines changed

2 files changed

+63
-173
lines changed

‎vulnerabilities/importers/postgresql.py‎

Lines changed: 57 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,10 +54,15 @@ def updated_advisories(self):
5454

5555

5656
def to_advisories(data):
57+
print("\n\n>> This is a test.")
58+
print("\n=====")
5759
advisories = []
5860
soup = BeautifulSoup(data, features="lxml")
5961
table = soup.select("table")[0]
62+
test_row_count = 0
6063
for row in table.select("tbody tr"):
64+
test_row_count += 1
65+
print("\ntest_row_count = {}".format(test_row_count))
6166
ref_col, affected_col, fixed_col, severity_score_col, desc_col = row.select("td")
6267
summary = desc_col.text
6368
pkg_qualifiers = {}
@@ -89,10 +94,15 @@ def to_advisories(data):
8994

9095
# This will replace the affected_packages and fixed_packages lists above. ============
9196
affected_packages = []
97+
# do I need to trim these? e.g., affected_version_list = [x.strip() for x in affected_col.text.split(',')]
9298
affected_version_list = affected_col.text.split(",")
9399
fixed_version_list = fixed_col.text.split(",")
94100
package_count = len(affected_version_list)
95101

102+
print("\naffected_version_list = {}".format(affected_version_list))
103+
print("\nfixed_version_list = {}".format(fixed_version_list))
104+
print("\npackage_count = {}".format(package_count))
105+
96106
while package_count > 0:
97107
summary = summary
98108

@@ -105,7 +115,7 @@ def to_advisories(data):
105115

106116
fixed = fixed_version_list[0]
107117
fixed_version_list.pop(0)
108-
# Do we need "if affected else None"?
118+
# Do we need "if fixed else None"?
109119
fixed_version = GenericVersion(fixed) if fixed else None
110120

111121
package_count -= 1
@@ -115,18 +125,31 @@ def to_advisories(data):
115125
name="postgresql",
116126
type="generic",
117127
namespace="postgresql",
128+
qualifiers=pkg_qualifiers,
118129
),
119130
affected_version_range=affected_version_range,
120131
fixed_version=fixed_version,
121132
)
122133
affected_packages.append(affected_package)
123134

135+
print("\naffected_package = {}".format(affected_package))
136+
print("\n\taffected_package.package = {}".format(affected_package.package))
137+
print(
138+
"\n\taffected_package.affected_version_range = {}".format(
139+
affected_package.affected_version_range
140+
)
141+
)
142+
print("\n\taffected_package.fixed_version = {}".format(affected_package.fixed_version))
143+
144+
print("\ninterim package_count = {}".format(package_count))
145+
124146
# end of initial draft insert ===================================
125147

126148
try:
127149
cve_id = ref_col.select("nobr")[0].text
128150
# This is for the anomaly in https://www.postgresql.org/support/security/8.1/ 's
129151
# last entry
152+
# Note: in this example and others, final entry/entries have no CVE in the 1st column
130153
except IndexError:
131154
pass
132155

@@ -163,6 +186,39 @@ def to_advisories(data):
163186
)
164187
)
165188

189+
print("\n------------------------------------")
190+
191+
print("\ntotal test_advisories (i.e., AdvisoryData objects) = {}".format(len(advisories)))
192+
print("\nadvisories = {}".format(advisories))
193+
194+
test_advisory_count = 0
195+
for test_advisory in advisories:
196+
test_advisory_count += 1
197+
print("\ntest_advisory #{} = {}".format(test_advisory_count, test_advisory))
198+
print("\n\ttest_advisory.aliases = {}".format(test_advisory.aliases))
199+
print("\n\ttest_advisory.summary = {}".format(test_advisory.summary))
200+
print("\n\ttest_advisory.affected_packages = {}".format(test_advisory.affected_packages))
201+
for test_affected_package in test_advisory.affected_packages:
202+
print("\n\ttest_affected_package = {}".format(test_affected_package))
203+
print("\n\t\ttest_affected_package.package = {}".format(test_affected_package.package))
204+
print(
205+
"\n\t\ttest_affected_package.affected_version_range = {}".format(
206+
test_affected_package.affected_version_range
207+
)
208+
)
209+
print(
210+
"\n\t\ttest_affected_package.fixed_version = {}".format(
211+
test_affected_package.fixed_version
212+
)
213+
)
214+
print("\n\ttest_advisory.references = {}".format(test_advisory.references))
215+
for test_reference in test_advisory.references:
216+
print("\n\ttest_test_reference = {}".format(test_reference))
217+
218+
print("\n------------------------------------")
219+
220+
print("\n>> This is the end of the test.\n")
221+
166222
return advisories
167223

168224

‎vulnerabilities/tests/test_postgresql.py‎

Lines changed: 6 additions & 172 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@
2424

2525

2626
class TestPostgreSQLImporter(TestCase):
27+
# This is the original test. When it first failed I began correcting the obvious errors,
28+
# but quickly concluded I needed to revise postgresql.py instead and left this as is.
2729
def test_to_advisories(self):
2830

2931
with open(TEST_DATA) as f:
@@ -195,181 +197,13 @@ def test_to_advisories(self):
195197
expected_advisories = list(map(AdvisoryData, expected_advisories))
196198
assert sorted(found_advisories) == sorted(expected_advisories)
197199

198-
# 10/27/2022 Thursday 6:40:04 PM. This is intended to be an updated test -- but I have barely started to work on it!
199-
# Focusing instead on postgresql.py for now.
200-
def test_to_advisories_updated(self):
200+
# My new, skeletal test, designed only to run the to_advisories() print statements
201+
# on the original advisories.html test input file.
202+
def test_to_advisories_simple(self):
201203

202204
with open(TEST_DATA) as f:
203205
raw_data = f.read()
204206

205-
expected_advisories = [
206-
AdvisoryData(
207-
summary="ALTER ... DEPENDS ON EXTENSION is missing authorization checks.more details",
208-
# 10/26/2022 Wednesday 6:40:01 PM. Throws error: TypeError: __init__() got an unexpected keyword argument 'vulnerability_id'
209-
# vulnerability_id="CVE-2020-1720",
210-
aliases=["CVE-2020-1720"],
211-
affected_packages=[
212-
AffectedPackage(
213-
vulnerable_package=PackageURL(
214-
type="generic",
215-
name="postgresql",
216-
version="10",
217-
),
218-
patched_package=PackageURL(
219-
type="generic",
220-
name="postgresql",
221-
version="10.12",
222-
),
223-
),
224-
AffectedPackage(
225-
vulnerable_package=PackageURL(
226-
type="generic",
227-
name="postgresql",
228-
version="11",
229-
),
230-
patched_package=PackageURL(
231-
type="generic",
232-
name="postgresql",
233-
version="11.7",
234-
),
235-
),
236-
AffectedPackage(
237-
vulnerable_package=PackageURL(
238-
type="generic",
239-
name="postgresql",
240-
version="12",
241-
),
242-
patched_package=PackageURL(
243-
type="generic",
244-
name="postgresql",
245-
version="12.2",
246-
),
247-
),
248-
AffectedPackage(
249-
vulnerable_package=PackageURL(
250-
type="generic",
251-
name="postgresql",
252-
version="9.6",
253-
),
254-
patched_package=PackageURL(
255-
type="generic",
256-
name="postgresql",
257-
version="9.6.17",
258-
),
259-
),
260-
],
261-
references=[
262-
Reference(
263-
reference_id="",
264-
url="https://www.postgresql.org/about/news/postgresql-122-117-1012-9617-9521-and-9426-released-2011/",
265-
),
266-
Reference(
267-
reference_id="",
268-
url="https://www.postgresql.org/support/security/CVE-2020-1720/",
269-
severities=[
270-
VulnerabilitySeverity(
271-
system=severity_systems.CVSSV3,
272-
value="3.1",
273-
),
274-
VulnerabilitySeverity(
275-
system=severity_systems.CVSSV3_VECTOR,
276-
value=["AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"],
277-
),
278-
],
279-
),
280-
],
281-
),
282-
AdvisoryData(
283-
summary="Windows installer runs executables from uncontrolled directoriesmore details",
284-
# 10/26/2022 Wednesday 6:40:01 PM. Throws error: TypeError: __init__() got an unexpected keyword argument 'vulnerability_id'
285-
# vulnerability_id="CVE-2020-10733",
286-
aliases=["CVE-2020-10733"],
287-
affected_packages=[
288-
AffectedPackage(
289-
vulnerable_package=PackageURL(
290-
type="generic",
291-
name="postgresql",
292-
version="10",
293-
qualifiers={"os": "windows"},
294-
),
295-
patched_package=PackageURL(
296-
type="generic",
297-
name="postgresql",
298-
version="10.13",
299-
qualifiers={"os": "windows"},
300-
),
301-
),
302-
AffectedPackage(
303-
vulnerable_package=PackageURL(
304-
type="generic",
305-
name="postgresql",
306-
version="11",
307-
qualifiers={"os": "windows"},
308-
),
309-
patched_package=PackageURL(
310-
type="generic",
311-
name="postgresql",
312-
version="11.8",
313-
qualifiers={"os": "windows"},
314-
),
315-
),
316-
AffectedPackage(
317-
vulnerable_package=PackageURL(
318-
type="generic",
319-
name="postgresql",
320-
version="12",
321-
qualifiers={"os": "windows"},
322-
),
323-
patched_package=PackageURL(
324-
type="generic",
325-
name="postgresql",
326-
version="12.3",
327-
qualifiers={"os": "windows"},
328-
),
329-
),
330-
AffectedPackage(
331-
vulnerable_package=PackageURL(
332-
type="generic",
333-
name="postgresql",
334-
version="9.6",
335-
qualifiers={"os": "windows"},
336-
),
337-
patched_package=PackageURL(
338-
type="generic",
339-
name="postgresql",
340-
version="9.6.18",
341-
qualifiers={"os": "windows"},
342-
),
343-
),
344-
],
345-
references=[
346-
Reference(
347-
reference_id="",
348-
url="https://www.postgresql.org/about/news/postgresql-123-118-1013-9618-and-9522-released-2038/",
349-
),
350-
Reference(
351-
reference_id="",
352-
url="https://www.postgresql.org/support/security/CVE-2020-10733/",
353-
severities=[
354-
VulnerabilitySeverity(
355-
system=severity_systems.CVSSV3,
356-
value="6.7",
357-
),
358-
VulnerabilitySeverity(
359-
system=severity_systems.CVSSV3_VECTOR,
360-
value=["AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"],
361-
),
362-
],
363-
),
364-
],
365-
),
366-
]
367-
368207
found_advisories = to_advisories(raw_data)
369208

370-
# 10/26/2022 Wednesday 7:07:13 PM. Throws error: AttributeError: type object 'AdvisoryData' has no attribute 'normalized'
371-
# found_advisories = list(map(AdvisoryData.normalized, found_advisories))
372-
# found_advisories = list(map(AdvisoryData, found_advisories))
373-
# expected_advisories = list(map(AdvisoryData.normalized, expected_advisories))
374-
# expected_advisories = list(map(AdvisoryData, expected_advisories))
375-
assert sorted(found_advisories) == sorted(expected_advisories)
209+
# do nothing more -- we're just trying to trigger print statements in to_advisories()

0 commit comments

Comments
 (0)