def test_multifix_vulnerability(
vulnerability_with_multifix,
vulnerable_semver_pkg1,
vulnerable_semver_pkg2,
monkeypatch_distros,
):
"""
Test matches against multiple semver range fixed artifacts (e.g. like a GHSA record)
:return:
"""
f = vulnerability_with_multifix.fixed_in[0]
f2 = vulnerability_with_multifix.fixed_in[1]
logger.info("Testing package %s", vulnerable_semver_pkg1)
logger.info("Testing vuln %s", f)
assert isinstance(f, FixedArtifact)
assert f.match_but_not_fixed(vulnerable_semver_pkg1)
assert not f.match_but_not_fixed(vulnerable_semver_pkg2)
t = ImagePackageVulnerability()
t.package = vulnerable_semver_pkg1
t.vulnerability = vulnerability_with_multifix
assert t.fixed_artifact() == f
assert t.fixed_in() == "1.1.2"
logger.info("Testing package %s", vulnerable_semver_pkg2)
logger.info("Testing vuln %s", f2)
assert isinstance(f2, FixedArtifact)
assert not f2.match_but_not_fixed(vulnerable_semver_pkg1)
assert f2.match_but_not_fixed(vulnerable_semver_pkg2)
t = ImagePackageVulnerability()
t.package = vulnerable_semver_pkg2
t.vulnerability = vulnerability_with_multifix
assert t.fixed_artifact() == f2
assert t.fixed_in() == "2.2.2"
# Unset the fix version
f2.fix_metadata = {}
logger.info("Testing vuln with fix removed %s", f2)
assert isinstance(f2, FixedArtifact)
assert not f2.match_but_not_fixed(vulnerable_semver_pkg1)
assert f2.match_but_not_fixed(vulnerable_semver_pkg2)
t = ImagePackageVulnerability()
t.package = vulnerable_semver_pkg2
t.vulnerability = vulnerability_with_multifix
assert t.fixed_artifact() == f2
assert t.fixed_in() is None
def test_vulnerable_in(
vulnerability_with_vulnartifact,
vulnerable_pkg1,
nonvulnerable_pkg1,
monkeypatch_distros,
):
"""
Test vulnerable in matches
:return:
"""
f = vulnerability_with_vulnartifact.vulnerable_in[0]
logger.info("Testing package %s", vulnerable_pkg1)
logger.info("Testing vuln %s", f)
assert isinstance(f, VulnerableArtifact)
assert f.match_and_vulnerable(vulnerable_pkg1)
assert not f.match_and_vulnerable(nonvulnerable_pkg1)
f = vulnerability_with_vulnartifact.vulnerable_in[1]
logger.info("Testing package %s", vulnerable_pkg1)
logger.info("Testing vuln %s", f)
assert isinstance(f, VulnerableArtifact)
assert not f.match_and_vulnerable(
vulnerable_pkg1) # Both not vuln now, this entry is for 0.9.x
assert not f.match_and_vulnerable(nonvulnerable_pkg1)
pkg_vuln = ImagePackageVulnerability()
pkg_vuln.package = vulnerable_pkg1
pkg_vuln.vulnerability = vulnerability_with_vulnartifact
pkg_vuln.pkg_type = vulnerable_pkg1.name
pkg_vuln.pkg_version = vulnerable_pkg1.version
pkg_vuln.pkg_image_id = vulnerable_pkg1.image_id
pkg_vuln.pkg_user_id = vulnerable_pkg1.image_user_id
pkg_vuln.pkg_name = vulnerable_pkg1.name
pkg_vuln.pkg_arch = vulnerable_pkg1.arch
pkg_vuln.vulnerability_id = vulnerability_with_vulnartifact.id
pkg_vuln.vulnerability_namespace_name = (
vulnerability_with_vulnartifact.namespace_name)
assert pkg_vuln.fixed_in() == None
def test_fixed_and_vulnerable(vulnerability_with_both, vulnerable_pkg1,
nonvulnerable_pkg1, monkeypatch_distros):
"""
Test both fixed and vulnerable matches
:return:
"""
f = vulnerability_with_both.fixed_in[0]
v = vulnerability_with_both.vulnerable_in[0]
logger.info("Testing package %s", vulnerable_pkg1)
logger.info("Testing vuln %s", f)
assert isinstance(v, VulnerableArtifact)
assert v.match_and_vulnerable(vulnerable_pkg1)
assert not v.match_and_vulnerable(nonvulnerable_pkg1)
pkg_vuln = ImagePackageVulnerability()
pkg_vuln.package = vulnerable_pkg1
pkg_vuln.vulnerability = vulnerability_with_both
pkg_vuln.pkg_type = vulnerable_pkg1.name
pkg_vuln.pkg_version = vulnerable_pkg1.version
pkg_vuln.pkg_image_id = vulnerable_pkg1.image_id
pkg_vuln.pkg_user_id = vulnerable_pkg1.image_user_id
pkg_vuln.pkg_name = vulnerable_pkg1.name
pkg_vuln.pkg_arch = vulnerable_pkg1.arch
pkg_vuln.vulnerability_id = vulnerability_with_both.id
pkg_vuln.vulnerability_namespace_name = vulnerability_with_both.namespace_name
assert pkg_vuln.fixed_in() == "0:1.1.el8"
def test_notfixed_match(vulnerability_with_nofix, vulnerable_pkg1,
monkeypatch_distros):
"""
Test matches against fixed artifacts
:return:
"""
f = vulnerability_with_nofix.fixed_in[0]
logger.info("Testing package %s", vulnerable_pkg1)
logger.info("Testing vuln %s", f)
assert isinstance(f, FixedArtifact)
assert f.match_but_not_fixed(vulnerable_pkg1)
pkg_vuln = ImagePackageVulnerability()
pkg_vuln.package = vulnerable_pkg1
pkg_vuln.vulnerability = vulnerability_with_nofix
pkg_vuln.pkg_type = vulnerable_pkg1.name
pkg_vuln.pkg_version = vulnerable_pkg1.version
pkg_vuln.pkg_image_id = vulnerable_pkg1.image_id
pkg_vuln.pkg_user_id = vulnerable_pkg1.image_user_id
pkg_vuln.pkg_name = vulnerable_pkg1.name
pkg_vuln.pkg_arch = vulnerable_pkg1.arch
pkg_vuln.vulnerability_id = vulnerability_with_nofix.id
pkg_vuln.vulnerability_namespace_name = vulnerability_with_nofix.namespace_name
assert pkg_vuln.fixed_in() is None