Пример #1
0
def test_multifix_vulnerability(
    vulnerability_with_multifix,
    vulnerable_semver_pkg1,
    vulnerable_semver_pkg2,
    monkeypatch_distros,
):
    """
    Test matches against multiple semver range fixed artifacts (e.g. like a GHSA record)

    :return:
    """
    f = vulnerability_with_multifix.fixed_in[0]
    f2 = vulnerability_with_multifix.fixed_in[1]
    logger.info("Testing package %s", vulnerable_semver_pkg1)
    logger.info("Testing vuln %s", f)
    assert isinstance(f, FixedArtifact)
    assert f.match_but_not_fixed(vulnerable_semver_pkg1)
    assert not f.match_but_not_fixed(vulnerable_semver_pkg2)

    t = ImagePackageVulnerability()
    t.package = vulnerable_semver_pkg1
    t.vulnerability = vulnerability_with_multifix
    assert t.fixed_artifact() == f
    assert t.fixed_in() == "1.1.2"

    logger.info("Testing package %s", vulnerable_semver_pkg2)
    logger.info("Testing vuln %s", f2)
    assert isinstance(f2, FixedArtifact)
    assert not f2.match_but_not_fixed(vulnerable_semver_pkg1)
    assert f2.match_but_not_fixed(vulnerable_semver_pkg2)

    t = ImagePackageVulnerability()
    t.package = vulnerable_semver_pkg2
    t.vulnerability = vulnerability_with_multifix
    assert t.fixed_artifact() == f2
    assert t.fixed_in() == "2.2.2"

    # Unset the fix version
    f2.fix_metadata = {}
    logger.info("Testing vuln with fix removed %s", f2)
    assert isinstance(f2, FixedArtifact)
    assert not f2.match_but_not_fixed(vulnerable_semver_pkg1)
    assert f2.match_but_not_fixed(vulnerable_semver_pkg2)

    t = ImagePackageVulnerability()
    t.package = vulnerable_semver_pkg2
    t.vulnerability = vulnerability_with_multifix
    assert t.fixed_artifact() == f2
    assert t.fixed_in() is None
Пример #2
0
def test_notfixed_match(vulnerability_with_nofix, vulnerable_pkg1,
                        monkeypatch_distros):
    """
    Test matches against fixed artifacts
    :return:
    """
    f = vulnerability_with_nofix.fixed_in[0]
    logger.info("Testing package %s", vulnerable_pkg1)
    logger.info("Testing vuln %s", f)
    assert isinstance(f, FixedArtifact)
    assert f.match_but_not_fixed(vulnerable_pkg1)

    pkg_vuln = ImagePackageVulnerability()
    pkg_vuln.package = vulnerable_pkg1
    pkg_vuln.vulnerability = vulnerability_with_nofix
    pkg_vuln.pkg_type = vulnerable_pkg1.name
    pkg_vuln.pkg_version = vulnerable_pkg1.version
    pkg_vuln.pkg_image_id = vulnerable_pkg1.image_id
    pkg_vuln.pkg_user_id = vulnerable_pkg1.image_user_id
    pkg_vuln.pkg_name = vulnerable_pkg1.name
    pkg_vuln.pkg_arch = vulnerable_pkg1.arch
    pkg_vuln.vulnerability_id = vulnerability_with_nofix.id
    pkg_vuln.vulnerability_namespace_name = vulnerability_with_nofix.namespace_name

    assert pkg_vuln.fixed_in() is None
Пример #3
0
def test_fixed_and_vulnerable(vulnerability_with_both, vulnerable_pkg1,
                              nonvulnerable_pkg1, monkeypatch_distros):
    """
    Test both fixed and vulnerable matches
    :return:
    """
    f = vulnerability_with_both.fixed_in[0]
    v = vulnerability_with_both.vulnerable_in[0]
    logger.info("Testing package %s", vulnerable_pkg1)
    logger.info("Testing vuln %s", f)
    assert isinstance(v, VulnerableArtifact)
    assert v.match_and_vulnerable(vulnerable_pkg1)
    assert not v.match_and_vulnerable(nonvulnerable_pkg1)

    pkg_vuln = ImagePackageVulnerability()
    pkg_vuln.package = vulnerable_pkg1
    pkg_vuln.vulnerability = vulnerability_with_both
    pkg_vuln.pkg_type = vulnerable_pkg1.name
    pkg_vuln.pkg_version = vulnerable_pkg1.version
    pkg_vuln.pkg_image_id = vulnerable_pkg1.image_id
    pkg_vuln.pkg_user_id = vulnerable_pkg1.image_user_id
    pkg_vuln.pkg_name = vulnerable_pkg1.name
    pkg_vuln.pkg_arch = vulnerable_pkg1.arch
    pkg_vuln.vulnerability_id = vulnerability_with_both.id
    pkg_vuln.vulnerability_namespace_name = vulnerability_with_both.namespace_name

    assert pkg_vuln.fixed_in() == "0:1.1.el8"
Пример #4
0
def test_vulnerable_in(vulnerability_with_vulnartifact, vulnerable_pkg1, nonvulnerable_pkg1, monkeypatch_distros):
    """
    Test vulnerable in matches
    :return:
    """

    f = vulnerability_with_vulnartifact.vulnerable_in[0]
    logger.info('Testing package %s', vulnerable_pkg1)
    logger.info('Testing vuln %s', f)
    assert isinstance(f, VulnerableArtifact)
    assert f.match_and_vulnerable(vulnerable_pkg1)
    assert not f.match_and_vulnerable(nonvulnerable_pkg1)

    f = vulnerability_with_vulnartifact.vulnerable_in[1]
    logger.info('Testing package %s', vulnerable_pkg1)
    logger.info('Testing vuln %s', f)
    assert isinstance(f, VulnerableArtifact)
    assert not f.match_and_vulnerable(vulnerable_pkg1) # Both not vuln now, this entry is for 0.9.x
    assert not f.match_and_vulnerable(nonvulnerable_pkg1)

    pkg_vuln = ImagePackageVulnerability()
    pkg_vuln.package = vulnerable_pkg1
    pkg_vuln.vulnerability = vulnerability_with_vulnartifact
    pkg_vuln.pkg_type = vulnerable_pkg1.name
    pkg_vuln.pkg_version = vulnerable_pkg1.version
    pkg_vuln.pkg_image_id = vulnerable_pkg1.image_id
    pkg_vuln.pkg_user_id = vulnerable_pkg1.image_user_id
    pkg_vuln.pkg_name = vulnerable_pkg1.name
    pkg_vuln.pkg_arch = vulnerable_pkg1.arch
    pkg_vuln.vulnerability_id = vulnerability_with_vulnartifact.id
    pkg_vuln.vulnerability_namespace_name = vulnerability_with_vulnartifact.namespace_name

    assert pkg_vuln.fixed_in() == None