def test_create_result(): issue = issueLib.issue_from_dict({ "description": "MD5 is a a weak hash which is known to have collision. Use a strong hashing function.", "filename": "InsufficientPasswordHash.js", "line": 3, "lines": 'function hashPassword(password) {\n var crypto = require("crypto");\n var hasher = crypto.createHash(\'md5\');\n var hashed = hasher.update(password).digest("hex"); // BAD\n return hashed;\n}', "path": "/app/src/CWE-916/examples/InsufficientPasswordHash.js", "sha2": "bfc3a2dfec54a8e77e41c3e3d7a6d87477ea1ed6d1cb3b1b60b8e135b0d18368", "tag": "node", "title": "Weak Hash used - MD5", }) data = convertLib.create_result("nodetest", issue, {}, {}, None, "/app/src") assert (data.locations[0].physical_location.artifact_location.uri == "file:///app/src/CWE-916/examples/InsufficientPasswordHash.js") # Override the workspace and check the location os.environ["WORKSPACE"] = "/foo/bar" importlib.reload(convertLib) data = convertLib.create_result("nodetest", issue, {}, {}, None, "/app/src") assert (data.locations[0].physical_location.artifact_location.uri == "file:///foo/bar/CWE-916/examples/InsufficientPasswordHash.js") # Override the workspace and check the location os.environ[ "WORKSPACE"] = "https://github.com/ShiftLeftSecurity/cdxgen/blob/master" importlib.reload(convertLib) data = convertLib.create_result("nodetest", issue, {}, {}, None, "/app/src") assert ( data.locations[0].physical_location.artifact_location.uri == "https://github.com/ShiftLeftSecurity/cdxgen/blob/master/CWE-916/examples/InsufficientPasswordHash.js" )
def test_create_result_relative(): os.environ["WORKSPACE"] = "" importlib.reload(convertLib) issue = issueLib.issue_from_dict({ "line": "VERY_REDACTED ", "offender": "REDACTED", "commit": "06fd7b1f844f88fb7821df498ce6d209cb9ad875", "repo": "app", "rule": "Generic Credential", "commitMessage": "Add secret\n", "author": "Team ShiftLeft", "email": "*****@*****.**", "file": "src/main/README-new.md", "date": "2020-01-12T19:45:43Z", "tags": "key, API, generic", }) data = convertLib.create_result("gitleaks", issue, {}, {}, None, "/app") assert (data.locations[0].physical_location.artifact_location.uri == "src/main/README-new.md")