blob: d55d5ca0c59f9751ac34395d4825f76af3aa8c2c [file] [log] [blame]
// Copyright 2021 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
package osv
import (
"reflect"
"sort"
"testing"
"time"
"github.com/google/go-cmp/cmp"
"golang.org/x/vulndb/report"
)
func TestGenerate(t *testing.T) {
r := report.Report{
Module: "example.com/vulnerable/v2",
AdditionalPackages: []report.Additional{
{
Module: "vanity.host/vulnerable",
Package: "vanity.host/vulnerable/package",
Symbols: []string{"b", "A.b"},
Versions: []report.VersionRange{
{Fixed: "v2.1.1"},
{Introduced: "v2.3.4", Fixed: "v2.3.5"},
{Introduced: "v2.5.0"},
},
},
{
Module: "example.com/also-vulnerable",
Package: "example.com/also-vulnerable/package",
Symbols: []string{"z"},
Versions: []report.VersionRange{
{Fixed: "v2.1.1"},
},
},
},
Versions: []report.VersionRange{
{Fixed: "v2.1.1"},
{Introduced: "v2.3.4", Fixed: "v2.3.5"},
{Introduced: "v2.5.0"},
},
Description: "It's a real bad one, I'll tell you that",
CVE: "CVE-0000-0000",
Credit: "ignored",
Symbols: []string{"A", "B.b"},
OS: []string{"windows"},
Arch: []string{"arm64"},
Links: report.Links{
PR: "pr",
Commit: "commit",
Context: []string{"issue-a", "issue-b"},
},
}
url := "https://vulns.golang.org/GO-1991-0001.html"
wantEntry := Entry{
ID: "GO-1991-0001",
Details: "It's a real bad one, I'll tell you that",
References: []Reference{
{Type: "FIX", URL: "pr"},
{Type: "FIX", URL: "commit"},
{Type: "WEB", URL: "issue-a"},
{Type: "WEB", URL: "issue-b"},
},
Aliases: []string{"CVE-0000-0000"},
Affected: []Affected{
{
Package: Package{
Name: "example.com/vulnerable/v2",
Ecosystem: "Go",
},
Ranges: []AffectsRange{
{
Type: TypeSemver,
Events: []RangeEvent{
{
Introduced: "0",
},
{
Fixed: "2.1.1",
},
{
Introduced: "2.3.4",
},
{
Fixed: "2.3.5",
},
{
Introduced: "2.5.0",
},
},
},
},
DatabaseSpecific: DatabaseSpecific{URL: url},
EcosystemSpecific: EcosystemSpecific{
Symbols: []string{"A", "B.b"},
GOOS: []string{"windows"},
GOARCH: []string{"arm64"},
},
},
{
Package: Package{
Name: "vanity.host/vulnerable/package",
Ecosystem: "Go",
},
Ranges: []AffectsRange{
{
Type: TypeSemver,
Events: []RangeEvent{
{
Introduced: "0",
},
{
Fixed: "2.1.1",
},
{
Introduced: "2.3.4",
},
{
Fixed: "2.3.5",
},
{
Introduced: "2.5.0",
},
},
},
},
DatabaseSpecific: DatabaseSpecific{URL: url},
EcosystemSpecific: EcosystemSpecific{
Symbols: []string{"b", "A.b"},
GOOS: []string{"windows"},
GOARCH: []string{"arm64"},
},
},
{
Package: Package{
Name: "example.com/also-vulnerable/package",
Ecosystem: "Go",
},
Ranges: []AffectsRange{
{
Type: TypeSemver,
Events: []RangeEvent{
{
Introduced: "0",
},
{
Fixed: "2.1.1",
},
},
},
},
DatabaseSpecific: DatabaseSpecific{URL: url},
EcosystemSpecific: EcosystemSpecific{
Symbols: []string{"z"},
GOOS: []string{"windows"},
GOARCH: []string{"arm64"},
},
},
},
}
wantModules := []string{"example.com/vulnerable/v2", "vanity.host/vulnerable", "example.com/also-vulnerable"}
sort.Strings(wantModules)
gotEntry, gotModules := Generate("GO-1991-0001", url, r)
if diff := cmp.Diff(wantEntry, gotEntry, cmp.Comparer(func(a, b time.Time) bool { return a.Equal(b) })); diff != "" {
t.Errorf("Generate returned unexpected entry (-want +got):\n%s", diff)
}
sort.Strings(gotModules)
if !reflect.DeepEqual(gotModules, wantModules) {
t.Errorf("Generate returned unexpected modules: got %v, want %v", gotModules, wantModules)
}
}
func TestAffectsSemver(t *testing.T) {
cases := []struct {
affects Affects
version string
want bool
}{
{
// empty Affects indicates everything is affected
affects: Affects{},
version: "v0.0.0",
want: true,
},
{
// Affects containing an empty SEMVER range also indicates
// everything is affected
affects: []AffectsRange{{Type: TypeSemver}},
version: "v0.0.0",
want: true,
},
{
// Affects containing a SEMVER range with only an "introduced":"0"
// also indicates everything is affected
affects: []AffectsRange{{Type: TypeSemver, Events: []RangeEvent{{Introduced: "0"}}}},
version: "v0.0.0",
want: true,
},
{
// v1.0.0 < v2.0.0
affects: []AffectsRange{{Type: TypeSemver, Events: []RangeEvent{{Introduced: "0"}, {Fixed: "2.0.0"}}}},
version: "v1.0.0",
want: true,
},
{
// v0.0.1 <= v1.0.0
affects: []AffectsRange{{Type: TypeSemver, Events: []RangeEvent{{Introduced: "0.0.1"}}}},
version: "v1.0.0",
want: true,
},
{
// v1.0.0 <= v1.0.0
affects: []AffectsRange{{Type: TypeSemver, Events: []RangeEvent{{Introduced: "1.0.0"}}}},
version: "v1.0.0",
want: true,
},
{
// v1.0.0 <= v1.0.0 < v2.0.0
affects: []AffectsRange{{Type: TypeSemver, Events: []RangeEvent{{Introduced: "1.0.0"}, {Fixed: "2.0.0"}}}},
version: "v1.0.0",
want: true,
},
{
// v0.0.1 <= v1.0.0 < v2.0.0
affects: []AffectsRange{{Type: TypeSemver, Events: []RangeEvent{{Introduced: "0.0.1"}, {Fixed: "2.0.0"}}}},
version: "v1.0.0",
want: true,
},
{
// v2.0.0 < v3.0.0
affects: []AffectsRange{{Type: TypeSemver, Events: []RangeEvent{{Introduced: "1.0.0"}, {Fixed: "2.0.0"}}}},
version: "v3.0.0",
want: false,
},
{
// Multiple ranges
affects: []AffectsRange{{Type: TypeSemver, Events: []RangeEvent{{Introduced: "1.0.0"}, {Fixed: "2.0.0"}, {Introduced: "3.0.0"}}}},
version: "v3.0.0",
want: true,
},
{
// Wrong type range
affects: []AffectsRange{{Type: TypeUnspecified, Events: []RangeEvent{{Introduced: "3.0.0"}}}},
version: "v3.0.0",
want: true,
},
{
// Semver ranges don't match
affects: []AffectsRange{
{Type: TypeUnspecified, Events: []RangeEvent{{Introduced: "3.0.0"}}},
{Type: TypeSemver, Events: []RangeEvent{{Introduced: "4.0.0"}}},
},
version: "v3.0.0",
want: false,
},
{
// Semver ranges do match
affects: []AffectsRange{
{Type: TypeUnspecified, Events: []RangeEvent{{Introduced: "3.0.0"}}},
{Type: TypeSemver, Events: []RangeEvent{{Introduced: "3.0.0"}}},
},
version: "v3.0.0",
want: true,
},
{
// Semver ranges match (go prefix)
affects: []AffectsRange{
{Type: TypeSemver, Events: []RangeEvent{{Introduced: "3.0.0"}}},
},
version: "go3.0.1",
want: true,
},
}
for _, c := range cases {
got := c.affects.AffectsSemver(c.version)
if c.want != got {
t.Errorf("%#v.AffectsSemver(%s): want %t, got %t", c.affects, c.version, c.want, got)
}
}
}