def test_create_result():
issue = issueLib.issue_from_dict({
"description":
"MD5 is a a weak hash which is known to have collision. Use a strong hashing function.",
"filename": "InsufficientPasswordHash.js",
"line": 3,
"lines":
'function hashPassword(password) {\n var crypto = require("crypto");\n var hasher = crypto.createHash(\'md5\');\n var hashed = hasher.update(password).digest("hex"); // BAD\n return hashed;\n}',
"path": "/app/src/CWE-916/examples/InsufficientPasswordHash.js",
"sha2":
"bfc3a2dfec54a8e77e41c3e3d7a6d87477ea1ed6d1cb3b1b60b8e135b0d18368",
"tag": "node",
"title": "Weak Hash used - MD5",
})
data = convertLib.create_result("nodetest", issue, {}, {}, None,
"/app/src")
assert (data.locations[0].physical_location.artifact_location.uri ==
"file:///app/src/CWE-916/examples/InsufficientPasswordHash.js")
# Override the workspace and check the location
os.environ["WORKSPACE"] = "/foo/bar"
importlib.reload(convertLib)
data = convertLib.create_result("nodetest", issue, {}, {}, None,
"/app/src")
assert (data.locations[0].physical_location.artifact_location.uri ==
"file:///foo/bar/CWE-916/examples/InsufficientPasswordHash.js")
# Override the workspace and check the location
os.environ[
"WORKSPACE"] = "https://github.com/ShiftLeftSecurity/cdxgen/blob/master"
importlib.reload(convertLib)
data = convertLib.create_result("nodetest", issue, {}, {}, None,
"/app/src")
assert (
data.locations[0].physical_location.artifact_location.uri ==
"https://github.com/ShiftLeftSecurity/cdxgen/blob/master/CWE-916/examples/InsufficientPasswordHash.js"
)
def test_create_result_relative():
os.environ["WORKSPACE"] = ""
importlib.reload(convertLib)
issue = issueLib.issue_from_dict({
"line": "VERY_REDACTED ",
"offender": "REDACTED",
"commit": "06fd7b1f844f88fb7821df498ce6d209cb9ad875",
"repo": "app",
"rule": "Generic Credential",
"commitMessage": "Add secret\n",
"author": "Team ShiftLeft",
"email": "*****@*****.**",
"file": "src/main/README-new.md",
"date": "2020-01-12T19:45:43Z",
"tags": "key, API, generic",
})
data = convertLib.create_result("gitleaks", issue, {}, {}, None, "/app")
assert (data.locations[0].physical_location.artifact_location.uri ==
"src/main/README-new.md")
