1
|
|
|
/* Vuls - Vulnerability Scanner |
2
|
|
|
Copyright (C) 2016 Future Corporation , Japan. |
3
|
|
|
|
4
|
|
|
This program is free software: you can redistribute it and/or modify |
5
|
|
|
it under the terms of the GNU General Public License as published by |
6
|
|
|
the Free Software Foundation, either version 3 of the License, or |
7
|
|
|
(at your option) any later version. |
8
|
|
|
|
9
|
|
|
This program is distributed in the hope that it will be useful, |
10
|
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of |
11
|
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
12
|
|
|
GNU General Public License for more details. |
13
|
|
|
|
14
|
|
|
You should have received a copy of the GNU General Public License |
15
|
|
|
along with this program. If not, see <http://www.gnu.org/licenses/>. |
16
|
|
|
*/ |
17
|
|
|
package models |
18
|
|
|
|
19
|
|
|
import ( |
20
|
|
|
"reflect" |
21
|
|
|
"testing" |
22
|
|
|
) |
23
|
|
|
|
24
|
|
|
func TestTitles(t *testing.T) { |
25
|
|
|
type in struct { |
26
|
|
|
lang string |
27
|
|
|
cont VulnInfo |
28
|
|
|
} |
29
|
|
|
var tests = []struct { |
30
|
|
|
in in |
31
|
|
|
out []CveContentStr |
32
|
|
|
}{ |
33
|
|
|
// lang: ja |
34
|
|
|
{ |
35
|
|
|
in: in{ |
36
|
|
|
lang: "ja", |
37
|
|
|
cont: VulnInfo{ |
38
|
|
|
CveContents: CveContents{ |
39
|
|
|
Jvn: { |
40
|
|
|
Type: Jvn, |
41
|
|
|
Title: "Title1", |
42
|
|
|
}, |
43
|
|
|
RedHat: { |
44
|
|
|
Type: RedHat, |
45
|
|
|
Summary: "Summary RedHat", |
46
|
|
|
}, |
47
|
|
|
NvdXML: { |
48
|
|
|
Type: NvdXML, |
49
|
|
|
Summary: "Summary NVD", |
50
|
|
|
// Severity is NIOT included in NVD |
51
|
|
|
}, |
52
|
|
|
}, |
53
|
|
|
}, |
54
|
|
|
}, |
55
|
|
|
out: []CveContentStr{ |
56
|
|
|
{ |
57
|
|
|
Type: Jvn, |
58
|
|
|
Value: "Title1", |
59
|
|
|
}, |
60
|
|
|
{ |
61
|
|
|
Type: NvdXML, |
62
|
|
|
Value: "Summary NVD", |
63
|
|
|
}, |
64
|
|
|
{ |
65
|
|
|
Type: RedHat, |
66
|
|
|
Value: "Summary RedHat", |
67
|
|
|
}, |
68
|
|
|
}, |
69
|
|
|
}, |
70
|
|
|
// lang: en |
71
|
|
|
{ |
72
|
|
|
in: in{ |
73
|
|
|
lang: "en", |
74
|
|
|
cont: VulnInfo{ |
75
|
|
|
CveContents: CveContents{ |
76
|
|
|
Jvn: { |
77
|
|
|
Type: Jvn, |
78
|
|
|
Title: "Title1", |
79
|
|
|
}, |
80
|
|
|
RedHat: { |
81
|
|
|
Type: RedHat, |
82
|
|
|
Summary: "Summary RedHat", |
83
|
|
|
}, |
84
|
|
|
NvdXML: { |
85
|
|
|
Type: NvdXML, |
86
|
|
|
Summary: "Summary NVD", |
87
|
|
|
// Severity is NIOT included in NVD |
88
|
|
|
}, |
89
|
|
|
}, |
90
|
|
|
}, |
91
|
|
|
}, |
92
|
|
|
out: []CveContentStr{ |
93
|
|
|
{ |
94
|
|
|
Type: NvdXML, |
95
|
|
|
Value: "Summary NVD", |
96
|
|
|
}, |
97
|
|
|
{ |
98
|
|
|
Type: RedHat, |
99
|
|
|
Value: "Summary RedHat", |
100
|
|
|
}, |
101
|
|
|
}, |
102
|
|
|
}, |
103
|
|
|
// lang: empty |
104
|
|
|
{ |
105
|
|
|
in: in{ |
106
|
|
|
lang: "en", |
107
|
|
|
cont: VulnInfo{}, |
108
|
|
|
}, |
109
|
|
|
out: []CveContentStr{ |
110
|
|
|
{ |
111
|
|
|
Type: Unknown, |
112
|
|
|
Value: "-", |
113
|
|
|
}, |
114
|
|
|
}, |
115
|
|
|
}, |
116
|
|
|
} |
117
|
|
|
for _, tt := range tests { |
118
|
|
|
actual := tt.in.cont.Titles(tt.in.lang, "redhat") |
119
|
|
|
if !reflect.DeepEqual(tt.out, actual) { |
120
|
|
|
t.Errorf("\nexpected: %v\n actual: %v\n", tt.out, actual) |
121
|
|
|
} |
122
|
|
|
} |
123
|
|
|
} |
124
|
|
|
|
125
|
|
|
func TestSummaries(t *testing.T) { |
126
|
|
|
type in struct { |
127
|
|
|
lang string |
128
|
|
|
cont VulnInfo |
129
|
|
|
} |
130
|
|
|
var tests = []struct { |
131
|
|
|
in in |
132
|
|
|
out []CveContentStr |
133
|
|
|
}{ |
134
|
|
|
// lang: ja |
135
|
|
|
{ |
136
|
|
|
in: in{ |
137
|
|
|
lang: "ja", |
138
|
|
|
cont: VulnInfo{ |
139
|
|
|
CveContents: CveContents{ |
140
|
|
|
Jvn: { |
141
|
|
|
Type: Jvn, |
142
|
|
|
Title: "Title JVN", |
143
|
|
|
Summary: "Summary JVN", |
144
|
|
|
}, |
145
|
|
|
RedHat: { |
146
|
|
|
Type: RedHat, |
147
|
|
|
Summary: "Summary RedHat", |
148
|
|
|
}, |
149
|
|
|
NvdXML: { |
150
|
|
|
Type: NvdXML, |
151
|
|
|
Summary: "Summary NVD", |
152
|
|
|
// Severity is NIOT included in NVD |
153
|
|
|
}, |
154
|
|
|
}, |
155
|
|
|
}, |
156
|
|
|
}, |
157
|
|
|
out: []CveContentStr{ |
158
|
|
|
{ |
159
|
|
|
Type: Jvn, |
160
|
|
|
Value: "Title JVN\nSummary JVN", |
161
|
|
|
}, |
162
|
|
|
{ |
163
|
|
|
Type: NvdXML, |
164
|
|
|
Value: "Summary NVD", |
165
|
|
|
}, |
166
|
|
|
{ |
167
|
|
|
Type: RedHat, |
168
|
|
|
Value: "Summary RedHat", |
169
|
|
|
}, |
170
|
|
|
}, |
171
|
|
|
}, |
172
|
|
|
// lang: en |
173
|
|
|
{ |
174
|
|
|
in: in{ |
175
|
|
|
lang: "en", |
176
|
|
|
cont: VulnInfo{ |
177
|
|
|
CveContents: CveContents{ |
178
|
|
|
Jvn: { |
179
|
|
|
Type: Jvn, |
180
|
|
|
Title: "Title JVN", |
181
|
|
|
Summary: "Summary JVN", |
182
|
|
|
}, |
183
|
|
|
RedHat: { |
184
|
|
|
Type: RedHat, |
185
|
|
|
Summary: "Summary RedHat", |
186
|
|
|
}, |
187
|
|
|
NvdXML: { |
188
|
|
|
Type: NvdXML, |
189
|
|
|
Summary: "Summary NVD", |
190
|
|
|
// Severity is NIOT included in NVD |
191
|
|
|
}, |
192
|
|
|
}, |
193
|
|
|
}, |
194
|
|
|
}, |
195
|
|
|
out: []CveContentStr{ |
196
|
|
|
{ |
197
|
|
|
Type: NvdXML, |
198
|
|
|
Value: "Summary NVD", |
199
|
|
|
}, |
200
|
|
|
{ |
201
|
|
|
Type: RedHat, |
202
|
|
|
Value: "Summary RedHat", |
203
|
|
|
}, |
204
|
|
|
}, |
205
|
|
|
}, |
206
|
|
|
// lang: empty |
207
|
|
|
{ |
208
|
|
|
in: in{ |
209
|
|
|
lang: "en", |
210
|
|
|
cont: VulnInfo{}, |
211
|
|
|
}, |
212
|
|
|
out: []CveContentStr{ |
213
|
|
|
{ |
214
|
|
|
Type: Unknown, |
215
|
|
|
Value: "-", |
216
|
|
|
}, |
217
|
|
|
}, |
218
|
|
|
}, |
219
|
|
|
} |
220
|
|
|
for _, tt := range tests { |
221
|
|
|
actual := tt.in.cont.Summaries(tt.in.lang, "redhat") |
222
|
|
|
if !reflect.DeepEqual(tt.out, actual) { |
223
|
|
|
t.Errorf("\nexpected: %v\n actual: %v\n", tt.out, actual) |
224
|
|
|
} |
225
|
|
|
} |
226
|
|
|
} |
227
|
|
|
|
228
|
|
|
func TestCountGroupBySeverity(t *testing.T) { |
229
|
|
|
var tests = []struct { |
230
|
|
|
in VulnInfos |
231
|
|
|
out map[string]int |
232
|
|
|
}{ |
233
|
|
|
{ |
234
|
|
|
in: VulnInfos{ |
235
|
|
|
"CVE-2017-0002": { |
236
|
|
|
CveID: "CVE-2017-0002", |
237
|
|
|
CveContents: CveContents{ |
238
|
|
|
NvdXML: { |
239
|
|
|
Type: NvdXML, |
240
|
|
|
Cvss2Score: 6.0, |
241
|
|
|
}, |
242
|
|
|
RedHat: { |
243
|
|
|
Type: RedHat, |
244
|
|
|
Cvss2Score: 7.0, |
245
|
|
|
}, |
246
|
|
|
}, |
247
|
|
|
}, |
248
|
|
|
"CVE-2017-0003": { |
249
|
|
|
CveID: "CVE-2017-0003", |
250
|
|
|
CveContents: CveContents{ |
251
|
|
|
NvdXML: { |
252
|
|
|
Type: NvdXML, |
253
|
|
|
Cvss2Score: 2.0, |
254
|
|
|
}, |
255
|
|
|
}, |
256
|
|
|
}, |
257
|
|
|
"CVE-2017-0004": { |
258
|
|
|
CveID: "CVE-2017-0004", |
259
|
|
|
CveContents: CveContents{ |
260
|
|
|
NvdXML: { |
261
|
|
|
Type: NvdXML, |
262
|
|
|
Cvss2Score: 5.0, |
263
|
|
|
}, |
264
|
|
|
}, |
265
|
|
|
}, |
266
|
|
|
"CVE-2017-0005": { |
267
|
|
|
CveID: "CVE-2017-0005", |
268
|
|
|
}, |
269
|
|
|
}, |
270
|
|
|
out: map[string]int{ |
271
|
|
|
"High": 1, |
272
|
|
|
"Medium": 1, |
273
|
|
|
"Low": 1, |
274
|
|
|
"Unknown": 1, |
275
|
|
|
}, |
276
|
|
|
}, |
277
|
|
|
} |
278
|
|
|
for _, tt := range tests { |
279
|
|
|
actual := tt.in.CountGroupBySeverity() |
280
|
|
|
for k := range tt.out { |
281
|
|
|
if tt.out[k] != actual[k] { |
282
|
|
|
t.Errorf("\nexpected %s: %d\n actual %d\n", |
283
|
|
|
k, tt.out[k], actual[k]) |
284
|
|
|
} |
285
|
|
|
} |
286
|
|
|
} |
287
|
|
|
} |
288
|
|
|
|
289
|
|
|
func TestToSortedSlice(t *testing.T) { |
290
|
|
|
var tests = []struct { |
291
|
|
|
in VulnInfos |
292
|
|
|
out []VulnInfo |
293
|
|
|
}{ |
294
|
|
|
{ |
295
|
|
|
in: VulnInfos{ |
296
|
|
|
"CVE-2017-0002": { |
297
|
|
|
CveID: "CVE-2017-0002", |
298
|
|
|
CveContents: CveContents{ |
299
|
|
|
NvdXML: { |
300
|
|
|
Type: NvdXML, |
301
|
|
|
Cvss2Score: 6.0, |
302
|
|
|
}, |
303
|
|
|
RedHat: { |
304
|
|
|
Type: RedHat, |
305
|
|
|
Cvss3Score: 7.0, |
306
|
|
|
}, |
307
|
|
|
}, |
308
|
|
|
}, |
309
|
|
|
"CVE-2017-0001": { |
310
|
|
|
CveID: "CVE-2017-0001", |
311
|
|
|
CveContents: CveContents{ |
312
|
|
|
NvdXML: { |
313
|
|
|
Type: NvdXML, |
314
|
|
|
Cvss2Score: 7.0, |
315
|
|
|
}, |
316
|
|
|
RedHat: { |
317
|
|
|
Type: RedHat, |
318
|
|
|
Cvss3Score: 8.0, |
319
|
|
|
}, |
320
|
|
|
}, |
321
|
|
|
}, |
322
|
|
|
}, |
323
|
|
|
out: []VulnInfo{ |
324
|
|
|
{ |
325
|
|
|
CveID: "CVE-2017-0001", |
326
|
|
|
CveContents: CveContents{ |
327
|
|
|
NvdXML: { |
328
|
|
|
Type: NvdXML, |
329
|
|
|
Cvss2Score: 7.0, |
330
|
|
|
}, |
331
|
|
|
RedHat: { |
332
|
|
|
Type: RedHat, |
333
|
|
|
Cvss3Score: 8.0, |
334
|
|
|
}, |
335
|
|
|
}, |
336
|
|
|
}, |
337
|
|
|
{ |
338
|
|
|
CveID: "CVE-2017-0002", |
339
|
|
|
CveContents: CveContents{ |
340
|
|
|
NvdXML: { |
341
|
|
|
Type: NvdXML, |
342
|
|
|
Cvss2Score: 6.0, |
343
|
|
|
}, |
344
|
|
|
RedHat: { |
345
|
|
|
Type: RedHat, |
346
|
|
|
Cvss3Score: 7.0, |
347
|
|
|
}, |
348
|
|
|
}, |
349
|
|
|
}, |
350
|
|
|
}, |
351
|
|
|
}, |
352
|
|
|
// When max scores are the same, sort by CVE-ID |
353
|
|
|
{ |
354
|
|
|
in: VulnInfos{ |
355
|
|
|
"CVE-2017-0002": { |
356
|
|
|
CveID: "CVE-2017-0002", |
357
|
|
|
CveContents: CveContents{ |
358
|
|
|
NvdXML: { |
359
|
|
|
Type: NvdXML, |
360
|
|
|
Cvss2Score: 6.0, |
361
|
|
|
}, |
362
|
|
|
RedHat: { |
363
|
|
|
Type: RedHat, |
364
|
|
|
Cvss3Score: 7.0, |
365
|
|
|
}, |
366
|
|
|
}, |
367
|
|
|
}, |
368
|
|
|
"CVE-2017-0001": { |
369
|
|
|
CveID: "CVE-2017-0001", |
370
|
|
|
CveContents: CveContents{ |
371
|
|
|
RedHat: { |
372
|
|
|
Type: RedHat, |
373
|
|
|
Cvss2Score: 7.0, |
374
|
|
|
}, |
375
|
|
|
}, |
376
|
|
|
}, |
377
|
|
|
}, |
378
|
|
|
out: []VulnInfo{ |
379
|
|
|
{ |
380
|
|
|
CveID: "CVE-2017-0001", |
381
|
|
|
CveContents: CveContents{ |
382
|
|
|
RedHat: { |
383
|
|
|
Type: RedHat, |
384
|
|
|
Cvss2Score: 7.0, |
385
|
|
|
}, |
386
|
|
|
}, |
387
|
|
|
}, |
388
|
|
|
{ |
389
|
|
|
CveID: "CVE-2017-0002", |
390
|
|
|
CveContents: CveContents{ |
391
|
|
|
NvdXML: { |
392
|
|
|
Type: NvdXML, |
393
|
|
|
Cvss2Score: 6.0, |
394
|
|
|
}, |
395
|
|
|
RedHat: { |
396
|
|
|
Type: RedHat, |
397
|
|
|
Cvss3Score: 7.0, |
398
|
|
|
}, |
399
|
|
|
}, |
400
|
|
|
}, |
401
|
|
|
}, |
402
|
|
|
}, |
403
|
|
|
// When there are no cvss scores, sort by severity |
404
|
|
|
{ |
405
|
|
|
in: VulnInfos{ |
406
|
|
|
"CVE-2017-0002": { |
407
|
|
|
CveID: "CVE-2017-0002", |
408
|
|
|
CveContents: CveContents{ |
409
|
|
|
Ubuntu: { |
410
|
|
|
Type: Ubuntu, |
411
|
|
|
Cvss2Severity: "High", |
412
|
|
|
}, |
413
|
|
|
}, |
414
|
|
|
}, |
415
|
|
|
"CVE-2017-0001": { |
416
|
|
|
CveID: "CVE-2017-0001", |
417
|
|
|
CveContents: CveContents{ |
418
|
|
|
Ubuntu: { |
419
|
|
|
Type: Ubuntu, |
420
|
|
|
Cvss2Severity: "Low", |
421
|
|
|
}, |
422
|
|
|
}, |
423
|
|
|
}, |
424
|
|
|
}, |
425
|
|
|
out: []VulnInfo{ |
426
|
|
|
{ |
427
|
|
|
CveID: "CVE-2017-0002", |
428
|
|
|
CveContents: CveContents{ |
429
|
|
|
Ubuntu: { |
430
|
|
|
Type: Ubuntu, |
431
|
|
|
Cvss2Severity: "High", |
432
|
|
|
}, |
433
|
|
|
}, |
434
|
|
|
}, |
435
|
|
|
{ |
436
|
|
|
CveID: "CVE-2017-0001", |
437
|
|
|
CveContents: CveContents{ |
438
|
|
|
Ubuntu: { |
439
|
|
|
Type: Ubuntu, |
440
|
|
|
Cvss2Severity: "Low", |
441
|
|
|
}, |
442
|
|
|
}, |
443
|
|
|
}, |
444
|
|
|
}, |
445
|
|
|
}, |
446
|
|
|
} |
447
|
|
|
for _, tt := range tests { |
448
|
|
|
actual := tt.in.ToSortedSlice() |
449
|
|
|
if !reflect.DeepEqual(tt.out, actual) { |
450
|
|
|
t.Errorf("\nexpected: %v\n actual: %v\n", tt.out, actual) |
451
|
|
|
} |
452
|
|
|
} |
453
|
|
|
} |
454
|
|
|
|
455
|
|
|
func TestCvss2Scores(t *testing.T) { |
456
|
|
|
var tests = []struct { |
457
|
|
|
in VulnInfo |
458
|
|
|
out []CveContentCvss |
459
|
|
|
}{ |
460
|
|
|
{ |
461
|
|
|
in: VulnInfo{ |
462
|
|
|
CveContents: CveContents{ |
463
|
|
|
Jvn: { |
464
|
|
|
Type: Jvn, |
465
|
|
|
Cvss2Severity: "HIGH", |
466
|
|
|
Cvss2Score: 8.2, |
467
|
|
|
Cvss2Vector: "AV:N/AC:L/Au:N/C:N/I:N/A:P", |
468
|
|
|
}, |
469
|
|
|
RedHat: { |
470
|
|
|
Type: RedHat, |
471
|
|
|
Cvss2Severity: "HIGH", |
472
|
|
|
Cvss2Score: 8.0, |
473
|
|
|
Cvss2Vector: "AV:N/AC:L/Au:N/C:N/I:N/A:P", |
474
|
|
|
}, |
475
|
|
|
NvdXML: { |
476
|
|
|
Type: NvdXML, |
477
|
|
|
Cvss2Score: 8.1, |
478
|
|
|
Cvss2Vector: "AV:N/AC:L/Au:N/C:N/I:N/A:P", |
479
|
|
|
Cvss2Severity: "HIGH", |
480
|
|
|
}, |
481
|
|
|
}, |
482
|
|
|
}, |
483
|
|
|
out: []CveContentCvss{ |
484
|
|
|
{ |
485
|
|
|
Type: NvdXML, |
486
|
|
|
Value: Cvss{ |
487
|
|
|
Type: CVSS2, |
488
|
|
|
Score: 8.1, |
489
|
|
|
Vector: "AV:N/AC:L/Au:N/C:N/I:N/A:P", |
490
|
|
|
Severity: "HIGH", |
491
|
|
|
}, |
492
|
|
|
}, |
493
|
|
|
{ |
494
|
|
|
Type: RedHat, |
495
|
|
|
Value: Cvss{ |
496
|
|
|
Type: CVSS2, |
497
|
|
|
Score: 8.0, |
498
|
|
|
Vector: "AV:N/AC:L/Au:N/C:N/I:N/A:P", |
499
|
|
|
Severity: "HIGH", |
500
|
|
|
}, |
501
|
|
|
}, |
502
|
|
|
{ |
503
|
|
|
Type: Jvn, |
504
|
|
|
Value: Cvss{ |
505
|
|
|
Type: CVSS2, |
506
|
|
|
Score: 8.2, |
507
|
|
|
Vector: "AV:N/AC:L/Au:N/C:N/I:N/A:P", |
508
|
|
|
Severity: "HIGH", |
509
|
|
|
}, |
510
|
|
|
}, |
511
|
|
|
}, |
512
|
|
|
}, |
513
|
|
|
// Empty |
514
|
|
|
{ |
515
|
|
|
in: VulnInfo{}, |
516
|
|
|
out: nil, |
517
|
|
|
}, |
518
|
|
|
} |
519
|
|
|
for i, tt := range tests { |
520
|
|
|
actual := tt.in.Cvss2Scores("redhat") |
521
|
|
|
if !reflect.DeepEqual(tt.out, actual) { |
522
|
|
|
t.Errorf("[%d]\nexpected: %v\n actual: %v\n", i, tt.out, actual) |
523
|
|
|
} |
524
|
|
|
} |
525
|
|
|
} |
526
|
|
|
|
527
|
|
|
func TestMaxCvss2Scores(t *testing.T) { |
528
|
|
|
var tests = []struct { |
529
|
|
|
in VulnInfo |
530
|
|
|
out CveContentCvss |
531
|
|
|
}{ |
532
|
|
|
{ |
533
|
|
|
in: VulnInfo{ |
534
|
|
|
CveContents: CveContents{ |
535
|
|
|
Jvn: { |
536
|
|
|
Type: Jvn, |
537
|
|
|
Cvss2Severity: "HIGH", |
538
|
|
|
Cvss2Score: 8.2, |
539
|
|
|
Cvss2Vector: "AV:N/AC:L/Au:N/C:N/I:N/A:P", |
540
|
|
|
}, |
541
|
|
|
RedHat: { |
542
|
|
|
Type: RedHat, |
543
|
|
|
Cvss2Severity: "HIGH", |
544
|
|
|
Cvss2Score: 8.0, |
545
|
|
|
Cvss2Vector: "AV:N/AC:L/Au:N/C:N/I:N/A:P", |
546
|
|
|
}, |
547
|
|
|
NvdXML: { |
548
|
|
|
Type: NvdXML, |
549
|
|
|
Cvss2Score: 8.1, |
550
|
|
|
Cvss2Vector: "AV:N/AC:L/Au:N/C:N/I:N/A:P", |
551
|
|
|
// Severity is NIOT included in NVD |
552
|
|
|
}, |
553
|
|
|
}, |
554
|
|
|
}, |
555
|
|
|
out: CveContentCvss{ |
556
|
|
|
Type: Jvn, |
557
|
|
|
Value: Cvss{ |
558
|
|
|
Type: CVSS2, |
559
|
|
|
Score: 8.2, |
560
|
|
|
Vector: "AV:N/AC:L/Au:N/C:N/I:N/A:P", |
561
|
|
|
Severity: "HIGH", |
562
|
|
|
}, |
563
|
|
|
}, |
564
|
|
|
}, |
565
|
|
|
// Severity in OVAL |
566
|
|
|
{ |
567
|
|
|
in: VulnInfo{ |
568
|
|
|
CveContents: CveContents{ |
569
|
|
|
Ubuntu: { |
570
|
|
|
Type: Ubuntu, |
571
|
|
|
Cvss2Severity: "HIGH", |
572
|
|
|
}, |
573
|
|
|
}, |
574
|
|
|
}, |
575
|
|
|
out: CveContentCvss{ |
576
|
|
|
Type: Ubuntu, |
577
|
|
|
Value: Cvss{ |
578
|
|
|
Type: CVSS2, |
579
|
|
|
Score: 8.9, |
580
|
|
|
CalculatedBySeverity: true, |
581
|
|
|
Severity: "HIGH", |
582
|
|
|
}, |
583
|
|
|
}, |
584
|
|
|
}, |
585
|
|
|
// Empty |
586
|
|
|
{ |
587
|
|
|
in: VulnInfo{}, |
588
|
|
|
out: CveContentCvss{ |
589
|
|
|
Type: Unknown, |
590
|
|
|
Value: Cvss{ |
591
|
|
|
Type: CVSS2, |
592
|
|
|
Score: 0.0, |
593
|
|
|
Vector: "", |
594
|
|
|
Severity: "", |
595
|
|
|
}, |
596
|
|
|
}, |
597
|
|
|
}, |
598
|
|
|
} |
599
|
|
|
for i, tt := range tests { |
600
|
|
|
actual := tt.in.MaxCvss2Score() |
601
|
|
|
if !reflect.DeepEqual(tt.out, actual) { |
602
|
|
|
t.Errorf("[%d] expected: %v\n actual: %v\n", i, tt.out, actual) |
603
|
|
|
} |
604
|
|
|
} |
605
|
|
|
} |
606
|
|
|
|
607
|
|
|
func TestCvss3Scores(t *testing.T) { |
608
|
|
|
var tests = []struct { |
609
|
|
|
in VulnInfo |
610
|
|
|
out []CveContentCvss |
611
|
|
|
}{ |
612
|
|
|
{ |
613
|
|
|
in: VulnInfo{ |
614
|
|
|
CveContents: CveContents{ |
615
|
|
|
RedHat: { |
616
|
|
|
Type: RedHat, |
617
|
|
|
Cvss3Severity: "HIGH", |
618
|
|
|
Cvss3Score: 8.0, |
619
|
|
|
Cvss3Vector: "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", |
620
|
|
|
}, |
621
|
|
|
NvdXML: { |
622
|
|
|
Type: NvdXML, |
623
|
|
|
Cvss2Score: 8.1, |
624
|
|
|
Cvss2Vector: "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", |
625
|
|
|
Cvss2Severity: "HIGH", |
626
|
|
|
}, |
627
|
|
|
}, |
628
|
|
|
}, |
629
|
|
|
out: []CveContentCvss{ |
630
|
|
|
{ |
631
|
|
|
Type: RedHat, |
632
|
|
|
Value: Cvss{ |
633
|
|
|
Type: CVSS3, |
634
|
|
|
Score: 8.0, |
635
|
|
|
Vector: "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", |
636
|
|
|
Severity: "HIGH", |
637
|
|
|
}, |
638
|
|
|
}, |
639
|
|
|
}, |
640
|
|
|
}, |
641
|
|
|
// Empty |
642
|
|
|
{ |
643
|
|
|
in: VulnInfo{}, |
644
|
|
|
out: nil, |
645
|
|
|
}, |
646
|
|
|
} |
647
|
|
|
for _, tt := range tests { |
648
|
|
|
actual := tt.in.Cvss3Scores() |
649
|
|
|
if !reflect.DeepEqual(tt.out, actual) { |
650
|
|
|
t.Errorf("\nexpected: %v\n actual: %v\n", tt.out, actual) |
651
|
|
|
} |
652
|
|
|
} |
653
|
|
|
} |
654
|
|
|
|
655
|
|
|
func TestMaxCvss3Scores(t *testing.T) { |
656
|
|
|
var tests = []struct { |
657
|
|
|
in VulnInfo |
658
|
|
|
out CveContentCvss |
659
|
|
|
}{ |
660
|
|
|
{ |
661
|
|
|
in: VulnInfo{ |
662
|
|
|
CveContents: CveContents{ |
663
|
|
|
RedHat: { |
664
|
|
|
Type: RedHat, |
665
|
|
|
Cvss3Severity: "HIGH", |
666
|
|
|
Cvss3Score: 8.0, |
667
|
|
|
Cvss3Vector: "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", |
668
|
|
|
}, |
669
|
|
|
}, |
670
|
|
|
}, |
671
|
|
|
out: CveContentCvss{ |
672
|
|
|
Type: RedHat, |
673
|
|
|
Value: Cvss{ |
674
|
|
|
Type: CVSS3, |
675
|
|
|
Score: 8.0, |
676
|
|
|
Vector: "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", |
677
|
|
|
Severity: "HIGH", |
678
|
|
|
}, |
679
|
|
|
}, |
680
|
|
|
}, |
681
|
|
|
// Empty |
682
|
|
|
{ |
683
|
|
|
in: VulnInfo{}, |
684
|
|
|
out: CveContentCvss{ |
685
|
|
|
Type: Unknown, |
686
|
|
|
Value: Cvss{ |
687
|
|
|
Type: CVSS3, |
688
|
|
|
Score: 0.0, |
689
|
|
|
Vector: "", |
690
|
|
|
Severity: "", |
691
|
|
|
}, |
692
|
|
|
}, |
693
|
|
|
}, |
694
|
|
|
} |
695
|
|
|
for _, tt := range tests { |
696
|
|
|
actual := tt.in.MaxCvss3Score() |
697
|
|
|
if !reflect.DeepEqual(tt.out, actual) { |
698
|
|
|
t.Errorf("\nexpected: %v\n actual: %v\n", tt.out, actual) |
699
|
|
|
} |
700
|
|
|
} |
701
|
|
|
} |
702
|
|
|
|
703
|
|
|
func TestMaxCvssScores(t *testing.T) { |
704
|
|
|
var tests = []struct { |
705
|
|
|
in VulnInfo |
706
|
|
|
out CveContentCvss |
707
|
|
|
}{ |
708
|
|
|
{ |
709
|
|
|
in: VulnInfo{ |
710
|
|
|
CveContents: CveContents{ |
711
|
|
|
NvdXML: { |
712
|
|
|
Type: NvdXML, |
713
|
|
|
Cvss3Score: 7.0, |
714
|
|
|
}, |
715
|
|
|
RedHat: { |
716
|
|
|
Type: RedHat, |
717
|
|
|
Cvss2Score: 8.0, |
718
|
|
|
}, |
719
|
|
|
}, |
720
|
|
|
}, |
721
|
|
|
out: CveContentCvss{ |
722
|
|
|
Type: RedHat, |
723
|
|
|
Value: Cvss{ |
724
|
|
|
Type: CVSS2, |
725
|
|
|
Score: 8.0, |
726
|
|
|
}, |
727
|
|
|
}, |
728
|
|
|
}, |
729
|
|
|
{ |
730
|
|
|
in: VulnInfo{ |
731
|
|
|
CveContents: CveContents{ |
732
|
|
|
RedHat: { |
733
|
|
|
Type: RedHat, |
734
|
|
|
Cvss3Score: 8.0, |
735
|
|
|
}, |
736
|
|
|
}, |
737
|
|
|
}, |
738
|
|
|
out: CveContentCvss{ |
739
|
|
|
Type: RedHat, |
740
|
|
|
Value: Cvss{ |
741
|
|
|
Type: CVSS3, |
742
|
|
|
Score: 8.0, |
743
|
|
|
}, |
744
|
|
|
}, |
745
|
|
|
}, |
746
|
|
|
//2 |
747
|
|
|
{ |
748
|
|
|
in: VulnInfo{ |
749
|
|
|
CveContents: CveContents{ |
750
|
|
|
Ubuntu: { |
751
|
|
|
Type: Ubuntu, |
752
|
|
|
Cvss2Severity: "HIGH", |
753
|
|
|
}, |
754
|
|
|
}, |
755
|
|
|
}, |
756
|
|
|
out: CveContentCvss{ |
757
|
|
|
Type: Ubuntu, |
758
|
|
|
Value: Cvss{ |
759
|
|
|
Type: CVSS2, |
760
|
|
|
Score: 8.9, |
761
|
|
|
CalculatedBySeverity: true, |
762
|
|
|
Severity: "HIGH", |
763
|
|
|
}, |
764
|
|
|
}, |
765
|
|
|
}, |
766
|
|
|
//3 |
767
|
|
|
{ |
768
|
|
|
in: VulnInfo{ |
769
|
|
|
CveContents: CveContents{ |
770
|
|
|
Ubuntu: { |
771
|
|
|
Type: Ubuntu, |
772
|
|
|
Cvss2Severity: "MEDIUM", |
773
|
|
|
}, |
774
|
|
|
NvdXML: { |
775
|
|
|
Type: NvdXML, |
776
|
|
|
Cvss2Score: 7.0, |
777
|
|
|
Cvss2Severity: "HIGH", |
778
|
|
|
}, |
779
|
|
|
}, |
780
|
|
|
}, |
781
|
|
|
out: CveContentCvss{ |
782
|
|
|
Type: NvdXML, |
783
|
|
|
Value: Cvss{ |
784
|
|
|
Type: CVSS2, |
785
|
|
|
Score: 7.0, |
786
|
|
|
Severity: "HIGH", |
787
|
|
|
}, |
788
|
|
|
}, |
789
|
|
|
}, |
790
|
|
|
//4 |
791
|
|
|
{ |
792
|
|
|
in: VulnInfo{ |
793
|
|
|
DistroAdvisories: []DistroAdvisory{ |
794
|
|
|
{ |
795
|
|
|
Severity: "HIGH", |
796
|
|
|
}, |
797
|
|
|
}, |
798
|
|
|
}, |
799
|
|
|
out: CveContentCvss{ |
800
|
|
|
Type: "Vendor", |
801
|
|
|
Value: Cvss{ |
802
|
|
|
Type: CVSS2, |
803
|
|
|
Score: 8.9, |
804
|
|
|
CalculatedBySeverity: true, |
805
|
|
|
Vector: "-", |
806
|
|
|
Severity: "HIGH", |
807
|
|
|
}, |
808
|
|
|
}, |
809
|
|
|
}, |
810
|
|
|
{ |
811
|
|
|
in: VulnInfo{ |
812
|
|
|
CveContents: CveContents{ |
813
|
|
|
Ubuntu: { |
814
|
|
|
Type: Ubuntu, |
815
|
|
|
Cvss2Severity: "MEDIUM", |
816
|
|
|
}, |
817
|
|
|
NvdXML: { |
818
|
|
|
Type: NvdXML, |
819
|
|
|
Cvss2Score: 4.0, |
820
|
|
|
Cvss2Severity: "MEDIUM", |
821
|
|
|
}, |
822
|
|
|
}, |
823
|
|
|
DistroAdvisories: []DistroAdvisory{ |
824
|
|
|
{ |
825
|
|
|
Severity: "HIGH", |
826
|
|
|
}, |
827
|
|
|
}, |
828
|
|
|
}, |
829
|
|
|
out: CveContentCvss{ |
830
|
|
|
Type: NvdXML, |
831
|
|
|
Value: Cvss{ |
832
|
|
|
Type: CVSS2, |
833
|
|
|
Score: 4, |
834
|
|
|
Severity: "MEDIUM", |
835
|
|
|
}, |
836
|
|
|
}, |
837
|
|
|
}, |
838
|
|
|
// Empty |
839
|
|
|
{ |
840
|
|
|
in: VulnInfo{}, |
841
|
|
|
out: CveContentCvss{ |
842
|
|
|
Type: Unknown, |
843
|
|
|
Value: Cvss{ |
844
|
|
|
Type: CVSS2, |
845
|
|
|
Score: 0, |
846
|
|
|
}, |
847
|
|
|
}, |
848
|
|
|
}, |
849
|
|
|
} |
850
|
|
|
for i, tt := range tests { |
851
|
|
|
actual := tt.in.MaxCvssScore() |
852
|
|
|
if !reflect.DeepEqual(tt.out, actual) { |
853
|
|
|
t.Errorf("\n[%d] expected: %v\n actual: %v\n", i, tt.out, actual) |
854
|
|
|
} |
855
|
|
|
} |
856
|
|
|
} |
857
|
|
|
|
858
|
|
|
func TestFormatMaxCvssScore(t *testing.T) { |
859
|
|
|
var tests = []struct { |
860
|
|
|
in VulnInfo |
861
|
|
|
out string |
862
|
|
|
}{ |
863
|
|
|
{ |
864
|
|
|
in: VulnInfo{ |
865
|
|
|
CveContents: CveContents{ |
866
|
|
|
Jvn: { |
867
|
|
|
Type: Jvn, |
868
|
|
|
Cvss2Severity: "HIGH", |
869
|
|
|
Cvss2Score: 8.3, |
870
|
|
|
}, |
871
|
|
|
RedHat: { |
872
|
|
|
Type: RedHat, |
873
|
|
|
Cvss2Severity: "HIGH", |
874
|
|
|
Cvss3Score: 8.0, |
875
|
|
|
}, |
876
|
|
|
NvdXML: { |
877
|
|
|
Type: NvdXML, |
878
|
|
|
Cvss2Score: 8.1, |
879
|
|
|
// Severity is NIOT included in NVD |
880
|
|
|
}, |
881
|
|
|
}, |
882
|
|
|
}, |
883
|
|
|
out: "8.3 HIGH (jvn)", |
884
|
|
|
}, |
885
|
|
|
{ |
886
|
|
|
in: VulnInfo{ |
887
|
|
|
CveContents: CveContents{ |
888
|
|
|
Jvn: { |
889
|
|
|
Type: Jvn, |
890
|
|
|
Cvss2Severity: "HIGH", |
891
|
|
|
Cvss2Score: 8.3, |
892
|
|
|
}, |
893
|
|
|
RedHat: { |
894
|
|
|
Type: RedHat, |
895
|
|
|
Cvss2Severity: "HIGH", |
896
|
|
|
Cvss2Score: 8.0, |
897
|
|
|
Cvss3Severity: "HIGH", |
898
|
|
|
Cvss3Score: 9.9, |
899
|
|
|
}, |
900
|
|
|
NvdXML: { |
901
|
|
|
Type: NvdXML, |
902
|
|
|
Cvss2Score: 8.1, |
903
|
|
|
}, |
904
|
|
|
}, |
905
|
|
|
}, |
906
|
|
|
out: "9.9 HIGH (redhat)", |
907
|
|
|
}, |
908
|
|
|
} |
909
|
|
|
for _, tt := range tests { |
910
|
|
|
actual := tt.in.FormatMaxCvssScore() |
911
|
|
|
if !reflect.DeepEqual(tt.out, actual) { |
912
|
|
|
t.Errorf("\nexpected: %v\n actual: %v\n", tt.out, actual) |
913
|
|
|
} |
914
|
|
|
} |
915
|
|
|
} |
916
|
|
|
|
917
|
|
|
func TestSortPackageStatues(t *testing.T) { |
918
|
|
|
var tests = []struct { |
919
|
|
|
in PackageFixStatuses |
920
|
|
|
out PackageFixStatuses |
921
|
|
|
}{ |
922
|
|
|
{ |
923
|
|
|
in: PackageFixStatuses{ |
924
|
|
|
{Name: "b"}, |
925
|
|
|
{Name: "a"}, |
926
|
|
|
}, |
927
|
|
|
out: PackageFixStatuses{ |
928
|
|
|
{Name: "a"}, |
929
|
|
|
{Name: "b"}, |
930
|
|
|
}, |
931
|
|
|
}, |
932
|
|
|
} |
933
|
|
|
for _, tt := range tests { |
934
|
|
|
tt.in.Sort() |
935
|
|
|
if !reflect.DeepEqual(tt.in, tt.out) { |
936
|
|
|
t.Errorf("\nexpected: %v\n actual: %v\n", tt.out, tt.in) |
937
|
|
|
} |
938
|
|
|
} |
939
|
|
|
} |
940
|
|
|
|
941
|
|
|
func TestStorePackageStatueses(t *testing.T) { |
942
|
|
|
var tests = []struct { |
943
|
|
|
pkgstats PackageFixStatuses |
944
|
|
|
in PackageFixStatus |
945
|
|
|
out PackageFixStatuses |
946
|
|
|
}{ |
947
|
|
|
{ |
948
|
|
|
pkgstats: PackageFixStatuses{ |
949
|
|
|
{Name: "a"}, |
950
|
|
|
{Name: "b"}, |
951
|
|
|
}, |
952
|
|
|
in: PackageFixStatus{ |
953
|
|
|
Name: "c", |
954
|
|
|
}, |
955
|
|
|
out: PackageFixStatuses{ |
956
|
|
|
{Name: "a"}, |
957
|
|
|
{Name: "b"}, |
958
|
|
|
{Name: "c"}, |
959
|
|
|
}, |
960
|
|
|
}, |
961
|
|
|
} |
962
|
|
|
for _, tt := range tests { |
963
|
|
|
out := tt.pkgstats.Store(tt.in) |
964
|
|
|
if ok := reflect.DeepEqual(tt.out, out); !ok { |
965
|
|
|
t.Errorf("\nexpected: %v\n actual: %v\n", tt.out, out) |
966
|
|
|
} |
967
|
|
|
} |
968
|
|
|
} |
969
|
|
|
|
970
|
|
|
func TestAppendIfMissing(t *testing.T) { |
971
|
|
|
var tests = []struct { |
972
|
|
|
in Confidences |
973
|
|
|
arg Confidence |
974
|
|
|
out Confidences |
975
|
|
|
}{ |
976
|
|
|
{ |
977
|
|
|
in: Confidences{ |
978
|
|
|
CpeNameMatch, |
979
|
|
|
}, |
980
|
|
|
arg: CpeNameMatch, |
981
|
|
|
out: Confidences{ |
982
|
|
|
CpeNameMatch, |
983
|
|
|
}, |
984
|
|
|
}, |
985
|
|
|
{ |
986
|
|
|
in: Confidences{ |
987
|
|
|
CpeNameMatch, |
988
|
|
|
}, |
989
|
|
|
arg: ChangelogExactMatch, |
990
|
|
|
out: Confidences{ |
991
|
|
|
CpeNameMatch, |
992
|
|
|
ChangelogExactMatch, |
993
|
|
|
}, |
994
|
|
|
}, |
995
|
|
|
} |
996
|
|
|
for _, tt := range tests { |
997
|
|
|
tt.in.AppendIfMissing(tt.arg) |
998
|
|
|
if !reflect.DeepEqual(tt.in, tt.out) { |
999
|
|
|
t.Errorf("\nexpected: %v\n actual: %v\n", tt.out, tt.in) |
1000
|
|
|
} |
1001
|
|
|
} |
1002
|
|
|
} |
1003
|
|
|
|
1004
|
|
|
func TestSortByConfiden(t *testing.T) { |
1005
|
|
|
var tests = []struct { |
1006
|
|
|
in Confidences |
1007
|
|
|
out Confidences |
1008
|
|
|
}{ |
1009
|
|
|
{ |
1010
|
|
|
in: Confidences{ |
1011
|
|
|
OvalMatch, |
1012
|
|
|
CpeNameMatch, |
1013
|
|
|
}, |
1014
|
|
|
out: Confidences{ |
1015
|
|
|
OvalMatch, |
1016
|
|
|
CpeNameMatch, |
1017
|
|
|
}, |
1018
|
|
|
}, |
1019
|
|
|
{ |
1020
|
|
|
in: Confidences{ |
1021
|
|
|
CpeNameMatch, |
1022
|
|
|
OvalMatch, |
1023
|
|
|
}, |
1024
|
|
|
out: Confidences{ |
1025
|
|
|
OvalMatch, |
1026
|
|
|
CpeNameMatch, |
1027
|
|
|
}, |
1028
|
|
|
}, |
1029
|
|
|
} |
1030
|
|
|
for _, tt := range tests { |
1031
|
|
|
act := tt.in.SortByConfident() |
1032
|
|
|
if !reflect.DeepEqual(tt.out, act) { |
1033
|
|
|
t.Errorf("\nexpected: %v\n actual: %v\n", tt.out, act) |
1034
|
|
|
} |
1035
|
|
|
} |
1036
|
|
|
} |
1037
|
|
|
|