Skip to content
This repository was archived by the owner on Sep 11, 2025. It is now read-only.

Commit 09f11c7

Browse files
queriaqueria
committed
Add SBOM Explorer feature description
Describe expected tests of behavior for SBOM Explorer page.
1 parent 28df4c5 commit 09f11c7

File tree

1 file changed

+321
-0
lines changed

1 file changed

+321
-0
lines changed

‎tests/features/sbom-explorer.feature‎

Lines changed: 321 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,321 @@
1+
Feature: SBOM Explorer - View SBOM details
2+
3+
Scenario Outline: View <sbomType> SBOM Overview
4+
Given There is ingested <sbomType> SBOM
5+
When User visits SBOM details Page
6+
# e.g. by selecting SBOM from Search results or from Latest SBOMS on Dashboard
7+
Then SBOM name should be visible in top section
8+
And link to Download SBOM should be visible
9+
# `top section` refers to "upper" part visible above tabs selection
10+
And Info tab selector should be visible
11+
And Packages tab selector should be visible
12+
And Vulnerabilities tab selector should be visible
13+
And Dependency Analytics Report tab should not be visible
14+
# D.A.R tab not present at all, this test can be removed for future versions
15+
16+
Examples:
17+
| sbomType |
18+
| CycloneDX |
19+
| SPDX |
20+
21+
Scenario Outline: <sbomType> SBOM name visible while on Packages tab
22+
Given There is ingested <sbomType> SBOM with packages
23+
When User visits SBOM details Page
24+
And User selects Packages tab
25+
Then SBOM name should be visible in top section
26+
27+
Examples:
28+
| sbomType |
29+
| CycloneDX |
30+
| SPDX |
31+
32+
Scenario Outline: <sbomType> SBOM name visible while on Vulnerabilities tab
33+
Given There is ingested <sbomType> SBOM with packages
34+
When User visits SBOM details Page
35+
And User selects Vulnerabilities tab
36+
Then SBOM name should be visible in top section
37+
38+
Examples:
39+
| sbomType |
40+
| CycloneDX |
41+
| SPDX |
42+
43+
Scenario Outline: View <sbomType> SBOM Info (Metadata)
44+
Given There is ingested <sbomType> SBOM
45+
When User visits SBOM details Page
46+
Then Info tab is selected by default
47+
And SBOM name should be visible inside the tab
48+
And SBOM namespace should be visible inside the tab
49+
And SBOM Version should be visibile inside the tab
50+
And SBOM License should be visible inside the tab
51+
And SBOM Creation date should be visible inside the tab
52+
And SBOM Creator should be visible inside the tab
53+
And SBOM size and Total number of packages should be visible inside the tab
54+
And Package overview panel should be visible inside the tab
55+
# TODO: this Package panel needs clarification
56+
Examples:
57+
| sbomType |
58+
| CycloneDX |
59+
| SPDX |
60+
61+
Scenario Outline: Downloading <sbomType> SBOM file
62+
Given There is ingested <sbomType> SBOM
63+
When User visits SBOM details Page
64+
And User clicks on Download SBOM link
65+
Then SBOM file should be downloaded
66+
And downloaded file should match original <sbomType> SBOM json file
67+
# TODO: clarify if it should be exact match/copy (including formatting)
68+
# or just in meaning (json keys/values)
69+
# or if it may even be just processed subset of information
70+
71+
Examples:
72+
| sbomType |
73+
| CycloneDX |
74+
| SPDX |
75+
76+
Scenario Outline: View list of <sbomType> SBOM Packages
77+
Given There is ingested <sbomType> SBOM with packages
78+
When User visits SBOM details Page
79+
And User selects Packages tab
80+
Then list of SBOM Packages should be sorted alphabetically by Name in ascending order
81+
82+
Examples:
83+
| sbomType |
84+
| CycloneDX |
85+
| SPDX |
86+
87+
Scenario Outline: Package tab column headers of <sbomType> SBOM
88+
Given There is ingested <sbomType> SBOM with packages
89+
When User visits SBOM details Page
90+
And User selects Packages tab
91+
Then list of packages should have columns Name, Version and Qualifiers
92+
93+
Examples:
94+
| sbomType |
95+
| CycloneDX |
96+
| SPDX |
97+
98+
Scenario Outline: Filter matching list of <sbomType> SBOM Packages
99+
Given There is ingested <sbomType> SBOM with packages
100+
When User visits SBOM details Page
101+
And User selects Packages tab
102+
# TODO clarify - search using Filter field is CASE SENSITIVE in v1.2.2 - should it be expected in v2?
103+
And Filter input is set to part of SBOM Package name shared by multiple packages
104+
Then list of SBOM Packages should show only the matching ones
105+
And list of SBOM Packages should be sorted alphabetically by Package name in ascending order
106+
107+
Examples:
108+
| sbomType |
109+
| CycloneDX |
110+
| SPDX |
111+
112+
Scenario Outline: Filter not matching list of <sbomType> SBOM Packages
113+
Given There is ingested <sbomType> SBOM with packages
114+
When User visits SBOM details Page
115+
And User selects Packages tab
116+
And Filter input is set to value not matching any SBOM Package name
117+
Then list of SBOM Packages should be empty # showing info about no-match-found?
118+
119+
Examples:
120+
| sbomType |
121+
| CycloneDX |
122+
| SPDX |
123+
124+
Scenario Outline: Clear filtering of list of <sbomType> SBOM Packages
125+
Given There is ingested <sbomType> SBOM with packages
126+
When User visits SBOM details Page
127+
And User selects Packages tab
128+
And Filter input is set to value not matching any SBOM Package name
129+
And Filter input is cleared
130+
Then list of SBOM Packages should show list of SBOM Packages
131+
132+
Examples:
133+
| sbomType |
134+
| CycloneDX |
135+
| SPDX |
136+
137+
Scenario Outline: View paginated list of <sbomType> SBOM Packages
138+
Given There is ingested <sbomType> SBOM with more packages than fits in a page
139+
When User visits SBOM details Page
140+
And User selects Packages tab
141+
Then Pagination of list of packages works
142+
143+
Examples:
144+
| sbomType |
145+
| CycloneDX |
146+
| SPDX |
147+
148+
Scenario Outline: View expanded <sbomType> SBOM Package with sufficient data
149+
# TODO: clarify 'sufficient data' (in all parts of this scenario)
150+
Given There is ingested <sbomType> SBOM with Packages with sufficient data
151+
When visiting SBOM details page
152+
And selecting Packages tab
153+
And expanding Package entry of package with sufficient data
154+
Then columns Packages, Details, Qualifiers and Version should be visible in SBOM Package details
155+
And each Package name in SBOM Package details should be link to Package Explorer
156+
157+
Examples:
158+
| sbomType |
159+
| CycloneDX |
160+
| SPDX |
161+
162+
Scenario Outline: Link to Package Explorer from <sbomType> SBOM Package with sufficient data
163+
# TODO: clarify 'sufficient data' (in all parts of this scenario)
164+
Given There is ingested <sbomType> SBOM with Packages with sufficient data
165+
When visiting SBOM details page
166+
And selecting Packages tab
167+
And expanding Package entry of package with sufficient data
168+
And clicking on first Package name link
169+
Then Application navigates to Package Explorer page for the selected Package
170+
171+
Examples:
172+
| sbomType |
173+
| CycloneDX |
174+
| SPDX |
175+
176+
Scenario Outline: View <sbomType> SBOM Vulnerabilities
177+
Given there is ingested <sbomType> SBOM which is affected by Vulnerabilities
178+
When user visits SBOM details page
179+
And user selects Vulnerabilities tab
180+
Then Vulnerability Risk Profile circle should be visible
181+
And Vulnerability Risk Profile shows summary of vulnerabilities
182+
And SBOM Name should be visible inside the tab
183+
And SBOM Version should be visible inside the tab
184+
And SBOM Creation date should be visible inside the tab
185+
And list of related Vulnerabilities should be sorted by CVSS in descending order
186+
187+
Examples:
188+
| sbomType |
189+
| CycloneDX |
190+
| SPDX |
191+
192+
Scenario Outline: Pagination of <sbomType> SBOM Vulnerabilities
193+
Given there is ingested <sbomType> SBOM which is affected by Vulnerabilities
194+
When user visits SBOM details page
195+
And user selects Vulnerabilities tab
196+
Then Pagination of Vulnerabilities list works
197+
198+
Examples:
199+
| sbomType |
200+
| CycloneDX |
201+
| SPDX |
202+
203+
Scenario Outline: Columns in list of <sbomType> SBOM Vulnerabilities
204+
Given there is ingested <sbomType> SBOM which is affected by Vulnerabilities
205+
When user visits SBOM details page
206+
And user selects Vulnerabilities tab
207+
Then list of Vulnerabilities has column ID
208+
And list of Vulnerabilities has column Description
209+
And list of Vulnerabilities has column CVSS
210+
And list of Vulnerabilities has column Affected dependencies
211+
And list of Vulnerabilities has column Published
212+
And list of Vulnerabilities has column Updated
213+
214+
Examples:
215+
| sbomType |
216+
| CycloneDX |
217+
| SPDX |
218+
219+
Scenario Outline: Sorting of <sbomType> SBOM Vulnerabilities
220+
Given there is ingested <sbomType> SBOM which is affected by Vulnerabilities
221+
When user visits SBOM details page
222+
And user selects Vulnerabilities tab
223+
Then list of Vulnerabilities can be sorted by all columns except description
224+
225+
Examples:
226+
| sbomType |
227+
| CycloneDX |
228+
| SPDX |
229+
230+
Scenario Outline: Expand description of <sbomType> SBOM Vulnerability
231+
Given there is ingested <sbomType> SBOM which is affected by Vulnerability with long description
232+
When user visits SBOM details page
233+
And user selects Vulnerabilities tab
234+
And clicks 'Show more' link
235+
Then full Vulnerability description should be visible
236+
237+
Examples:
238+
| sbomType |
239+
| CycloneDX |
240+
| SPDX |
241+
242+
Scenario Outline: Collapse description of <sbomType> SBOM Vulnerability
243+
Given there is ingested <sbomType> SBOM which is affected by Vulnerability with long description
244+
When user visits SBOM details page
245+
And user selects Vulnerabilities tab
246+
And clicks 'Show more' link
247+
And clicks 'Show less' link
248+
Then shortened Vulnerability description should be visible
249+
250+
Examples:
251+
| sbomType |
252+
| CycloneDX |
253+
| SPDX |
254+
255+
Scenario Outline: View <sbomType> SBOM Vulnerability with relevant advisory
256+
Given there is ingested <sbomType> SBOM which is affected by Vulnerability with relevant Advisory
257+
When user visits SBOM details page
258+
And user selects Vulnerabilities tab
259+
And user finds Vulnerability with relevant Advisory
260+
And user clicks on CVE ID of the Vulnerability with relevant advisory
261+
Then link to All CVE details should be visible
262+
And list of relevant Advisories should be visible
263+
And each relevant Advisory should have link to details of the Advisory
264+
265+
Examples:
266+
| sbomType |
267+
| CycloneDX |
268+
| SPDX |
269+
270+
Scenario Outline: View <sbomType> SBOM Vulnerability without relevant advisory
271+
Given there is ingested <sbomType> SBOM which is affected by Vulnerability without relevant Advisory
272+
When user visits SBOM details page
273+
And user selects Vulnerabilities tab
274+
And user finds Vulnerability with relevant Advisory
275+
And user clicks CVE ID of the Vulnerability without relevant Advisory
276+
Then link to All CVE details should be visible
277+
And list of relevant Advisories should not be visible
278+
279+
Examples:
280+
| sbomType |
281+
| CycloneDX |
282+
| SPDX |
283+
284+
# TODO: clarify if this is also expected in V2
285+
# also - if CVE is listed under SBOM Vulns. does it imply that to always have at least one affected dependency/package?
286+
#
287+
# Scenario Outline: View <sbomType> SBOM Vulnerability with affected dependency
288+
# Given there is ingested <sbomType> SBOM which is affected by Vulnerability with affected dependency
289+
#
290+
# When user visits SBOM details page
291+
# And user selects Vulnerabilities tab
292+
# And user finds Vulnerability with affected dependency
293+
# And user selects to see given Vulnerability Affected dependencis (by clicking on the count of Affected dependencies)
294+
# Then list of affected packages should be visible
295+
# And each entry should have expected fields (Type, Namespace, Name, Version, Path, Qualifiers)
296+
# And each entry name should be link to that Package details page
297+
# # And each entry should be expandable - to what - currently it says just 'Only direct dependencies'?
298+
#
299+
# Examples:
300+
# | sbomType |
301+
# | CycloneDX |
302+
# | SPDX |
303+
304+
# TODO: clarify if this belongs here, seems to me that it should be SBOM uploading feature?
305+
Scenario Outline: View <sbomType> SBOM Overview for unsafe SBOM filename
306+
Given there is ingested <sbomType> SBOM with name not compatible with S3 storage
307+
# ref for valid naming https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html
308+
# e.g. '@', '!' or ':' in file name
309+
When user visits SBOM Details page
310+
Then SBOM name should be visible
311+
And link to Download SBOM should be visible
312+
# or possibly this should be just combination of input data and Scenario Outline
313+
# (as Overview and Metadata and likely some other scenarios apply here too)
314+
# e.g. the Examples in `SBOM Overview` or `SBOM Info` scenarios could 'just' include extra types:
315+
# | CycloneDX-s3-unsafe |
316+
# | SPDX-s3-unsafe |
317+
318+
Examples:
319+
| sbomType |
320+
| CycloneDX |
321+
| SPDX |

0 commit comments

Comments
 (0)