def wl_items(items):
# makes deriv1 list only one CVE
items[1].add(
WhitelistRule(cve={'CVE-2018-0004'}, issue_url='https://tracker/4'))
# makes deriv2 disappear completely
items[2].add(WhitelistRule(pname='bar', comment='irrelevant'))
return items
def test_until(whitelist_toml):
rule = WhitelistRule(pname='libxslt', until='2018-04-12')
d = Derive(name='libxslt-2.0')
with freezegun.freeze_time('2018-04-11'):
assert rule.covers(d)
with freezegun.freeze_time('2018-04-12'):
assert not rule.covers(d)
def test_exitcode(items, capsys):
assert output([], json=True) == 0
# something to report
assert output(items) == 2
# get everything masked
for i in items:
i.add(WhitelistRule(pname=i.derivation.pname))
assert output(items) == 1
capsys.readouterr() # swallow stdout/stderr: it doesn't matter here
def test_add_temporary_whitelist(filt):
assert not filt.until
filt.add(WhitelistRule(pname='test', version='1.2', until='2018-03-05'))
assert filt.until == datetime.date(2018, 3, 5)
def test_add_rule_with_cves(filt):
filt.add(WhitelistRule(pname='test', version='1.2', cve={'CVE-2018-0001'}))
assert filt.report == {'CVE-2018-0002', 'CVE-2018-0003'}
assert filt.masked == {'CVE-2018-0001'}
def test_add_unspecific_rule(deriv):
f = Filtered(deriv)
f.add(WhitelistRule(pname='test', version='1.2'))
assert not f.report
def test_match_partial():
rule = WhitelistRule(cve=['CVE-2015-1197', 'CVE-2016-2037'])
d = Derive(name='cpio-2.12',
affected_by={'CVE-2015-1197', 'CVE-2015-1198'})
assert rule.covers(d)
def test_match_pname_version_cve():
rule = WhitelistRule(pname='cpio', version='2.12', cve=['CVE-2015-1197'])
d = Derive(name='cpio-2.12', affected_by={'CVE-2015-1197'})
assert rule.covers(d)
d = Derive(name='cpio-2.12', affected_by={'CVE-2015-1198'})
assert not rule.covers(d)
def test_match_pname_only():
rule = WhitelistRule(pname='libxslt', version='*')
assert rule.covers(Derive(name='libxslt-2.0'))
assert rule.covers(Derive(name='libxslt-2.1'))
assert not rule.covers(Derive(name='libxml2-2.0'))
def test_match_partial():
rule = WhitelistRule(cve=['CVE-2015-1197', 'CVE-2016-2037'])
assert rule.covers(
Derive(name='cpio-2.12'),
{V('CVE-2015-1197'), V('CVE-2015-1198')})
def test_match_cve_only():
rule = WhitelistRule(cve=['CVE-2015-1197', 'CVE-2016-2037'])
assert rule.covers(Derive(name='cpio-2.12'), {V('CVE-2015-1197')})
assert not rule.covers(Derive(name='cpio-2.12'), {V('CVE-2016-2038')})
def test_match_pname_version_cve():
rule = WhitelistRule(pname='cpio', version='2.12', cve=['CVE-2015-1197'])
assert rule.covers(Derive(name='cpio-2.12'), {V('CVE-2015-1197')})
assert not rule.covers(Derive(name='cpio-2.12'), {V('CVE-2015-1198')})