Skip to content

Commit cce5f23

Browse files
johnmhoranjohnmhoran
committed
Begin work on patch-based tests #597
Reference: #597 Reference: #935 Signed-off-by: John M. Horan <[email protected]>
1 parent 6be3186 commit cce5f23

File tree

5 files changed

+108
-192
lines changed

5 files changed

+108
-192
lines changed

‎vulnerabilities/importers/archlinux.py‎

Lines changed: 3 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -40,34 +40,21 @@ def advisory_data(self) -> Iterable[AdvisoryData]:
4040

4141
def parse_advisory(self, record) -> List[AdvisoryData]:
4242
advisories = []
43-
# aliases = record["issues"]
4443
aliases = record.get("issues") or []
45-
# for alias in record["issues"]:
4644
for alias in aliases:
4745
affected_packages = []
4846
for name in record["packages"]:
4947
summary = record.get("type") or ""
5048
if summary == "unknown":
5149
summary = ""
52-
53-
# affected_packages = AffectedPackage(
54-
# PackageURL(
55-
# name=name,
56-
# type="alpm",
57-
# namespace="archlinux",
58-
# ),
59-
# affected_version_range=ArchLinuxVersionRange.from_versions(
60-
# [record.get("affected") or ""]
61-
# ),
62-
# fixed_version=ArchLinuxVersion(record.get("fixed") or ""),
63-
# )
6450
affected = record.get("affected") or ""
6551
affected_version_range = (
6652
ArchLinuxVersionRange.from_versions([affected]) if affected else None
6753
)
6854
fixed = record.get("fixed") or ""
6955
fixed_version = ArchLinuxVersion(fixed) if fixed else None
70-
affected_packages = AffectedPackage(
56+
affected_packages = []
57+
affected_package = AffectedPackage(
7158
package=PackageURL(
7259
name=name,
7360
type="alpm",
@@ -76,6 +63,7 @@ def parse_advisory(self, record) -> List[AdvisoryData]:
7663
affected_version_range=affected_version_range,
7764
fixed_version=fixed_version,
7865
)
66+
affected_packages.append(affected_package)
7967

8068
references = []
8169
references.append(
@@ -107,57 +95,4 @@ def parse_advisory(self, record) -> List[AdvisoryData]:
10795
)
10896
)
10997

110-
# The print statements below will print the structure of each test advisory when either of these tests is run:
111-
# pytest -vvs -k test_parse_advisory_single vulnerabilities/tests/test_archlinux.py
112-
# pytest -vvs -k test_parse_advisory_multi vulnerabilities/tests/test_archlinux.py
113-
114-
print("\n\r=================================\n\r")
115-
116-
for advisory in advisories:
117-
print(f"1. aliases: {advisory.aliases}\r\n")
118-
for alias in advisory.aliases:
119-
120-
print("\talias: {}\r\n".format(alias))
121-
122-
print(f"2. summary: {advisory.summary}\r\n")
123-
124-
print(f"3. affected_packages: {advisory.affected_packages}\r\n")
125-
126-
print("\tpackage: {}\r\n".format(advisory.affected_packages.package))
127-
128-
print("\t\ttype: {}\r".format(advisory.affected_packages.package.type))
129-
130-
print("\t\tnamespace: {}\r".format(advisory.affected_packages.package.namespace))
131-
132-
print("\t\tname: {}\r".format(advisory.affected_packages.package.name))
133-
134-
print("\t\tversion: {}\r".format(advisory.affected_packages.package.version))
135-
136-
print("\t\tqualifiers: {}\r".format(advisory.affected_packages.package.qualifiers))
137-
138-
print("\t\tsubpath: {}\r\n".format(advisory.affected_packages.package.subpath))
139-
140-
print(
141-
"\taffected_version_range: {}\r\n".format(
142-
advisory.affected_packages.affected_version_range
143-
)
144-
)
145-
146-
print("\tfixed_version: {}\r\n".format(advisory.affected_packages.fixed_version))
147-
148-
print(f"4. references: {advisory.references}\r")
149-
for ref in advisory.references:
150-
151-
print("\r\nref: {}\r\n".format(ref))
152-
153-
print("\treference_id: {}\r\n".format(ref.reference_id))
154-
155-
print("\turl: {}\r\n".format(ref.url))
156-
157-
print("\tseverities: {}\r\n".format(ref.severities))
158-
159-
print(f"5. date_published: {advisory.date_published}\r")
160-
161-
print("\n\r=================================\n\r")
162-
16398
return advisories

‎vulnerabilities/tests/test_archlinux.py‎

Lines changed: 15 additions & 124 deletions
Original file line numberDiff line numberDiff line change
@@ -17,90 +17,10 @@
1717
from vulnerabilities import models
1818
from vulnerabilities.import_runner import ImportRunner
1919
from vulnerabilities.importers import archlinux
20+
from vulnerabilities.tests import util_tests
2021

2122
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
22-
TEST_DATA = os.path.join(BASE_DIR, "test_data/")
23-
24-
25-
class ArchlinuxImportTest(TestCase):
26-
@classmethod
27-
def setUpClass(cls) -> None:
28-
fixture_path = os.path.join(TEST_DATA, "archlinux.json")
29-
with open(fixture_path) as f:
30-
cls.mock_response = json.load(f)
31-
32-
cls.importer = models.Importer.objects.create(
33-
name="archlinux_unittests",
34-
license="",
35-
last_run=None,
36-
data_source="ArchlinuxImporter",
37-
data_source_cfg={
38-
"archlinux_tracker_url": "https://security.example.com/json",
39-
},
40-
)
41-
42-
@classmethod
43-
def tearDownClass(cls) -> None:
44-
pass
45-
46-
def test_import(self):
47-
runner = ImportRunner(self.importer, 5)
48-
49-
with patch(
50-
"vulnerabilities.importers.ArchlinuxImporter._fetch", return_value=self.mock_response
51-
):
52-
runner.run()
53-
assert models.Vulnerability.objects.count() == 6
54-
assert models.VulnerabilityReference.objects.count() == 10
55-
assert models.PackageRelatedVulnerability.objects.all().count() == 12
56-
assert (
57-
models.PackageRelatedVulnerability.objects.filter(patched_package__isnull=False).count()
58-
== 8
59-
)
60-
assert models.Package.objects.count() == 10
61-
62-
self.assert_for_package(
63-
"squid",
64-
"4.10-2",
65-
cve_ids={"CVE-2020-11945", "CVE-2019-12521", "CVE-2019-12519"},
66-
)
67-
self.assert_for_package("openconnect", "1:8.05-1", cve_ids={"CVE-2020-12823"})
68-
self.assert_for_package(
69-
"wireshark-common",
70-
"2.6.0-1",
71-
cve_ids={"CVE-2018-11362", "CVE-2018-11361"},
72-
)
73-
self.assert_for_package(
74-
"wireshark-gtk",
75-
"2.6.0-1",
76-
cve_ids={"CVE-2018-11362", "CVE-2018-11361"},
77-
)
78-
self.assert_for_package(
79-
"wireshark-cli",
80-
"2.6.0-1",
81-
cve_ids={"CVE-2018-11362", "CVE-2018-11361"},
82-
)
83-
self.assert_for_package(
84-
"wireshark-qt",
85-
"2.6.0-1",
86-
cve_ids={"CVE-2018-11362", "CVE-2018-11361"},
87-
)
88-
self.assert_for_package("wireshark-common", "2.6.1-1")
89-
self.assert_for_package("wireshark-gtk", "2.6.1-1")
90-
self.assert_for_package("wireshark-cli", "2.6.1-1")
91-
self.assert_for_package("wireshark-qt", "2.6.1-1")
92-
93-
def assert_for_package(self, name, version, cve_ids=None):
94-
qs = models.Package.objects.filter(
95-
name=name,
96-
version=version,
97-
type="pacman",
98-
namespace="archlinux",
99-
)
100-
assert qs
101-
102-
if cve_ids:
103-
assert cve_ids == {v.vulnerability_id for v in qs[0].vulnerabilities.all()}
23+
TEST_DATA = os.path.join(BASE_DIR, "test_data/archlinux")
10424

10525

10626
def test_parse_advisory_single():
@@ -117,48 +37,19 @@ def test_parse_advisory_single():
11737
"advisories": [],
11838
}
11939

120-
assert archlinux.ArchlinuxImporter().parse_advisory(record)
40+
advisory_data = archlinux.ArchlinuxImporter().parse_advisory(record)
41+
result = [data.to_dict() for data in advisory_data]
42+
expected_file = os.path.join(TEST_DATA, f"parse-advisory-archlinux-expected.json")
43+
util_tests.check_results_against_json(result, expected_file)
12144

12245

123-
def test_parse_advisory_multi():
124-
record_list = [
125-
{
126-
"name": "AVG-2781",
127-
"packages": ["python-pyjwt"],
128-
"status": "Unknown",
129-
"severity": "Unknown",
130-
"type": "unknown",
131-
"affected": "2.3.0-1",
132-
"fixed": "2.4.0-1",
133-
"ticket": None,
134-
"issues": ["CVE-2022-29217"],
135-
"advisories": [],
136-
},
137-
{
138-
"name": "AVG-2780",
139-
"packages": ["wpewebkit"],
140-
"status": "Unknown",
141-
"severity": "Unknown",
142-
"type": "unknown",
143-
"affected": "2.36.3-1",
144-
"fixed": "2.36.4-1",
145-
"ticket": None,
146-
"issues": ["CVE-2022-26710", "CVE-2022-22677", "CVE-2022-22662"],
147-
"advisories": [],
148-
},
149-
{
150-
"name": "AVG-4",
151-
"packages": ["bzip2"],
152-
"status": "Fixed",
153-
"severity": "Low",
154-
"type": "denial of service",
155-
"affected": "1.0.6-5",
156-
"fixed": "1.0.6-6",
157-
"ticket": None,
158-
"issues": ["CVE-2016-3189"],
159-
"advisories": ["ASA-201702-19"],
160-
},
161-
]
46+
@patch("vulnerabilities.importers.archlinux.ArchlinuxImporter.fetch")
47+
def test_archlinux_importer(mock_response):
48+
with open(os.path.join(TEST_DATA, "archlinux-multi.json")) as f:
49+
mock_response.return_value = json.load(f)
16250

163-
for record in record_list:
164-
assert archlinux.ArchlinuxImporter().parse_advisory(record)
51+
expected_file = os.path.join(TEST_DATA, f"archlinux-multi-expected.json")
52+
result = [data.to_dict() for data in list(archlinux.ArchlinuxImporter().advisory_data())]
53+
# result = [data.to_dict() for data in archlinux.ArchlinuxImporter().advisory_data()]
54+
# result = archlinux.ArchlinuxImporter().advisory_data()
55+
util_tests.check_results_against_json(result, expected_file)

‎vulnerabilities/tests/test_data/archlinux/archlinux-multi-expected.json‎

Whitespace-only changes.

‎vulnerabilities/tests/test_data/archlinux/archlinux-multi.json‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
[
2+
{
3+
"name": "AVG-2781",
4+
"packages": [
5+
"python-pyjwt"
6+
],
7+
"status": "Unknown",
8+
"severity": "Unknown",
9+
"type": "unknown",
10+
"affected": "2.3.0-1",
11+
"fixed": "2.4.0-1",
12+
"ticket": null,
13+
"issues": [
14+
"CVE-2022-29217"
15+
],
16+
"advisories": []
17+
},
18+
{
19+
"name": "AVG-2780",
20+
"packages": [
21+
"wpewebkit"
22+
],
23+
"status": "Unknown",
24+
"severity": "Unknown",
25+
"type": "unknown",
26+
"affected": "2.36.3-1",
27+
"fixed": "2.36.4-1",
28+
"ticket": null,
29+
"issues": [
30+
"CVE-2022-26710",
31+
"CVE-2022-22677",
32+
"CVE-2022-22662"
33+
],
34+
"advisories": []
35+
},
36+
{
37+
"name": "AVG-4",
38+
"packages": [
39+
"bzip2"
40+
],
41+
"status": "Fixed",
42+
"severity": "Low",
43+
"type": "denial of service",
44+
"affected": "1.0.6-5",
45+
"fixed": "1.0.6-6",
46+
"ticket": null,
47+
"issues": [
48+
"CVE-2016-3189"
49+
],
50+
"advisories": [
51+
"ASA-201702-19"
52+
]
53+
}
54+
]

‎vulnerabilities/tests/test_data/archlinux/parse-advisory-archlinux-expected.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
[
2+
{
3+
"aliases": [
4+
"CVE-2022-29217",
5+
"AVG-2781"
6+
],
7+
"summary": "",
8+
"affected_packages": [
9+
{
10+
"package": {
11+
"type": "alpm",
12+
"namespace": "archlinux",
13+
"name": "python-pyjwt",
14+
"version": null,
15+
"qualifiers": null,
16+
"subpath": null
17+
},
18+
"affected_version_range": "vers:alpm/2.3.0-1",
19+
"fixed_version": "2.4.0-1"
20+
}
21+
],
22+
"references": [
23+
{
24+
"reference_id": "AVG-2781",
25+
"url": "https://security.archlinux.org/AVG-2781",
26+
"severities": [
27+
{
28+
"system": "archlinux",
29+
"value": "Unknown"
30+
}
31+
]
32+
}
33+
],
34+
"date_published": null
35+
}
36+
]

0 commit comments

Comments
 (0)