Skip to content

Commit 55fc8a8

Browse files
keshav-spacekeshav-space
committed
test Gitlab Datasource
Signed-off-by: Keshav Priyadarshi <[email protected]>
1 parent 0378b6c commit 55fc8a8

File tree

9 files changed

+260
-0
lines changed

9 files changed

+260
-0
lines changed

‎vulntotal/tests/test_data/gitlab/package_advisory_url-expected.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
[
2+
"pypi/jinja2",
3+
"maven/org.apache.tomcat/tomcat",
4+
"npm/semver-regex",
5+
"go/github.com/mattermost/mattermost-server/v6/api4",
6+
"packagist/bolt/core",
7+
"nuget/moment.js"
8+
]

‎vulntotal/tests/test_data/gitlab/parsed_advisory-expected.json‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
[
2+
{
3+
"affected_versions": [
4+
"<=2.7.1"
5+
],
6+
"fixed_versions": [
7+
"2.7.2"
8+
],
9+
"aliases": [
10+
"CVE-2014-1402"
11+
]
12+
},
13+
{
14+
"affected_versions": [
15+
"<2.8.1"
16+
],
17+
"fixed_versions": [
18+
"2.8.1"
19+
],
20+
"aliases": [
21+
"GHSA-hj2j-77xm-mc5v",
22+
"CVE-2016-10745"
23+
]
24+
},
25+
{
26+
"affected_versions": [
27+
"<2.10.1"
28+
],
29+
"fixed_versions": [
30+
"2.10.1"
31+
],
32+
"aliases": [
33+
"CVE-2019-10906"
34+
]
35+
},
36+
{
37+
"affected_versions": [
38+
"<2.11.3"
39+
],
40+
"fixed_versions": [
41+
"2.11.3"
42+
],
43+
"aliases": [
44+
"CVE-2020-28493"
45+
]
46+
}
47+
]

‎vulntotal/tests/test_data/gitlab/purls.txt‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
pkg:pypi/[email protected]
2+
pkg:maven/org.apache.tomcat/[email protected]
3+
pkg:npm/[email protected]
4+
pkg:golang/github.com/mattermost/mattermost-server/v6/[email protected]
5+
pkg:composer/bolt/[email protected]
6+
pkg:nuget/[email protected]

‎vulntotal/tests/test_data/gitlab/temp_vulntotal_gitlab_datasource/gemnasium-db-master-pypi-Jinja2/pypi/Jinja2/CVE-2014-1402.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
identifier: "CVE-2014-1402"
3+
package_slug: "pypi/Jinja2"
4+
title: "Incorrect Default Permissions"
5+
description: "The default configuration for `bccache.FileSystemBytecodeCache` in Jinja2
6+
before does not properly create temporary files, which allows local users to gain
7+
privileges via a crafted `.cache` file with a name starting with `__jinja2_` in
8+
`/tmp`."
9+
date: "2017-12-21"
10+
pubdate: "2014-05-19"
11+
affected_range: "<=2.7.1"
12+
fixed_versions:
13+
- "2.7.2"
14+
affected_versions: "All versions up to 2.7.1"
15+
not_impacted: "All versions after 2.7.1"
16+
solution: "Upgrade to version 2.7.2 or above."
17+
urls:
18+
- "https://bugzilla.redhat.com/CVE-2014-1402"
19+
- "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747"
20+
- "https://github.com/mitsuhiko/jinja2/commit/acb672b6"
21+
cvss_v2: "AV:L/AC:M/Au:N/C:P/I:P/A:P"
22+
uuid: "73933300-77cd-49dd-8e3d-671763767b99"
23+
cwe_ids:
24+
- "CWE-1035"
25+
- "CWE-264"
26+
- "CWE-937"
27+
identifiers:
28+
- "CVE-2014-1402"

‎vulntotal/tests/test_data/gitlab/temp_vulntotal_gitlab_datasource/gemnasium-db-master-pypi-Jinja2/pypi/Jinja2/CVE-2016-10745.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
identifier: "CVE-2016-10745"
3+
identifiers:
4+
- "GHSA-hj2j-77xm-mc5v"
5+
- "CVE-2016-10745"
6+
package_slug: "pypi/Jinja2"
7+
title: "Use of Externally-Controlled Format String"
8+
description: "In Pallets Jinja before 2.8.1, str.format allows a sandbox escape."
9+
date: "2021-09-14"
10+
pubdate: "2019-04-10"
11+
affected_range: "<2.8.1"
12+
fixed_versions:
13+
- "2.8.1"
14+
affected_versions: "All versions before 2.8.1"
15+
not_impacted: "All versions starting from 2.8.1"
16+
solution: "Upgrade to version 2.8.1 or above."
17+
urls:
18+
- "https://nvd.nist.gov/vuln/detail/CVE-2016-10745"
19+
- "https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16"
20+
- "https://access.redhat.com/errata/RHSA-2019:1022"
21+
- "https://access.redhat.com/errata/RHSA-2019:1237"
22+
- "https://access.redhat.com/errata/RHSA-2019:1260"
23+
- "https://access.redhat.com/errata/RHSA-2019:3964"
24+
- "https://access.redhat.com/errata/RHSA-2019:4062"
25+
- "https://github.com/advisories/GHSA-hj2j-77xm-mc5v"
26+
- "https://palletsprojects.com/blog/jinja-281-released/"
27+
- "https://usn.ubuntu.com/4011-1/"
28+
- "https://usn.ubuntu.com/4011-2/"
29+
- "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html"
30+
- "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html"
31+
cvss_v2: "AV:N/AC:L/Au:N/C:P/I:N/A:N"
32+
cvss_v3: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
33+
uuid: "db196e91-7fc4-4b94-93b3-e0c0dc01bcbe"
34+
cwe_ids:
35+
- "CWE-1035"
36+
- "CWE-134"
37+
- "CWE-937"

‎vulntotal/tests/test_data/gitlab/temp_vulntotal_gitlab_datasource/gemnasium-db-master-pypi-Jinja2/pypi/Jinja2/CVE-2019-10906.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
identifier: "CVE-2019-10906"
3+
package_slug: "pypi/Jinja2"
4+
title: "Sandbox Escape"
5+
description: "In Pallets Jinja, str.format_map allows a sandbox escape."
6+
date: "2019-06-06"
7+
pubdate: "2019-04-06"
8+
affected_range: "<2.10.1"
9+
fixed_versions:
10+
- "2.10.1"
11+
affected_versions: "All versions before 2.10.1"
12+
not_impacted: "All versions starting from 2.10.1"
13+
solution: "Upgrade to version 2.10.1 or above."
14+
urls:
15+
- "https://nvd.nist.gov/vuln/detail/CVE-2019-10906"
16+
- "https://palletsprojects.com/blog/jinja-2-10-1-released"
17+
cvss_v2: "AV:N/AC:L/Au:N/C:P/I:N/A:N"
18+
cvss_v3: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
19+
uuid: "b2d59abd-b748-4d93-bb21-55f9e9aecea2"
20+
cwe_ids:
21+
- "CWE-1035"
22+
- "CWE-937"
23+
identifiers:
24+
- "CVE-2019-10906"

‎vulntotal/tests/test_data/gitlab/temp_vulntotal_gitlab_datasource/gemnasium-db-master-pypi-Jinja2/pypi/Jinja2/CVE-2019-8341.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
identifier: "CVE-2019-8341"
3+
package_slug: "pypi/Jinja2"
4+
title: "Code Injection"
5+
description: "The `from_string` function is prone to Server Side Template Injection
6+
(SSTI) where it takes the `source` parameter as a template object, renders it, and
7+
then returns it. The attacker can exploit it with `{{INJECTION COMMANDS}}` in a
8+
URI."
9+
date: "2019-08-06"
10+
pubdate: "2019-02-15"
11+
affected_range: "==2.10"
12+
fixed_versions:
13+
- "2.10.1"
14+
affected_versions: "Version 2.10"
15+
not_impacted: "All versions before 2.10, all versions after 2.10"
16+
solution: "Upgrade to version 2.10.1 or above."
17+
urls:
18+
- "https://nvd.nist.gov/vuln/detail/CVE-2019-8341"
19+
- "https://www.exploit-db.com/exploits/46386/"
20+
cvss_v2: "AV:N/AC:L/Au:N/C:P/I:P/A:P"
21+
cvss_v3: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
22+
uuid: "6b00a76b-aac8-4ce1-b7b2-122a73f22985"
23+
cwe_ids:
24+
- "CWE-1035"
25+
- "CWE-937"
26+
- "CWE-94"
27+
identifiers:
28+
- "CVE-2019-8341"

‎vulntotal/tests/test_data/gitlab/temp_vulntotal_gitlab_datasource/gemnasium-db-master-pypi-Jinja2/pypi/Jinja2/CVE-2020-28493.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
identifier: "CVE-2020-28493"
3+
package_slug: "pypi/Jinja2"
4+
title: "Regular Expression Denial of Service"
5+
description: "The ReDOS vulnerability of the regex is mainly due to the sub-pattern
6+
`[a-zA-Z0-9._-]+.[a-zA-Z0-9._-]+` This issue can be mitigated by Markdown to format
7+
user content instead of the urlize filter, or by implementing request timeouts and
8+
limiting process memory."
9+
date: "2021-07-21"
10+
pubdate: "2021-02-01"
11+
affected_range: "<2.11.3"
12+
fixed_versions:
13+
- "2.11.3"
14+
affected_versions: "All versions before 2.11.3"
15+
not_impacted: "All versions starting from 2.11.3"
16+
solution: "Upgrade to version 2.11.3 or above."
17+
urls:
18+
- "https://nvd.nist.gov/vuln/detail/CVE-2020-28493"
19+
cvss_v2: "AV:N/AC:L/Au:N/C:N/I:N/A:P"
20+
cvss_v3: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
21+
uuid: "17c4602a-c0ae-48d0-96f6-08c84d55d0cb"
22+
cwe_ids:
23+
- "CWE-1035"
24+
- "CWE-937"
25+
identifiers:
26+
- "CVE-2020-28493"

‎vulntotal/tests/test_gitlab.py‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# http://nexb.com and https://github.com/nexB/vulnerablecode/
4+
# The VulnTotal software is licensed under the Apache License version 2.0.
5+
# Data generated with VulnTotal require an acknowledgment.
6+
#
7+
# You may not use this software except in compliance with the License.
8+
# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
9+
# Unless required by applicable law or agreed to in writing, software distributed
10+
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
11+
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
12+
# specific language governing permissions and limitations under the License.
13+
#
14+
# When you publish or redistribute any data created with VulnTotal or any VulnTotal
15+
# derivative work, you must accompany this data with the following acknowledgment:
16+
#
17+
# Generated with VulnTotal and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
18+
# OR CONDITIONS OF ANY KIND, either express or implied. No content created from
19+
# VulnTotal should be considered or used as legal advice. Consult an Attorney
20+
# for any legal advice.
21+
# VulnTotal is a free software tool from nexB Inc. and others.
22+
# Visit https://github.com/nexB/vulnerablecode/ for support and download.
23+
24+
import json
25+
from pathlib import Path
26+
27+
from commoncode import testcase
28+
from packageurl import PackageURL
29+
30+
from vulnerabilities.tests import util_tests
31+
from vulntotal.datasources import gitlab
32+
33+
34+
class TestGitlab(testcase.FileBasedTesting):
35+
test_data_dir = str(Path(__file__).resolve().parent / "test_data" / "gitlab")
36+
37+
def test_generate_package_advisory_url(self):
38+
file_purls = self.get_test_loc("purls.txt")
39+
with open(file_purls) as f:
40+
purls = f.readlines()
41+
results = [gitlab.get_package_slug(PackageURL.from_string(purl)) for purl in purls]
42+
expected_file = self.get_test_loc("package_advisory_url-expected.json", must_exist=False)
43+
util_tests.check_results_against_json(results, expected_file)
44+
45+
def test_parse_html_advisory(self):
46+
advisory_folder = (
47+
Path(__file__)
48+
.resolve()
49+
.parent.joinpath("test_data/gitlab/temp_vulntotal_gitlab_datasource")
50+
)
51+
results = [
52+
adv.to_dict()
53+
for adv in gitlab.parse_interesting_advisories(advisory_folder, "0.1.1", False)
54+
]
55+
expected_file = self.get_test_loc("parsed_advisory-expected.json", must_exist=False)
56+
util_tests.check_results_against_json(results, expected_file)

0 commit comments

Comments
 (0)