// Copyright 2022 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

package cve5

import (
	"context"
	"flag"
	"reflect"
	"testing"

	"github.com/google/go-cmp/cmp"
	"golang.org/x/vulndb/internal/cvelistrepo"
	"golang.org/x/vulndb/internal/report"
)

var (
	updateTxtarRepo = flag.Bool("update-repo", false, "update the test repo (cvelist.txtar) with real CVE data - this takes a while")
	update          = flag.Bool("update", false, "update golden files")
	realProxy       = flag.Bool("proxy", false, "if true, contact the real module proxy and update expected responses")
)

var (
	testStdLibRecord = &CVERecord{
		DataType:    "CVE_RECORD",
		DataVersion: "5.0",
		Metadata: Metadata{
			ID: "CVE-9999-0001",
		},
		Containers: Containers{
			CNAContainer: CNAPublishedContainer{
				ProviderMetadata: ProviderMetadata{
					OrgID: GoOrgUUID,
				},
				Descriptions: []Description{
					{
						Lang:  "en",
						Value: `A description`,
					},
				},
				Affected: []Affected{
					{
						Vendor:        "Go standard library",
						Product:       "crypto/rand",
						CollectionURL: "https://pkg.go.dev",
						PackageName:   "crypto/rand",
						Versions: []VersionRange{
							{
								Introduced:  "0",
								Fixed:       "1.17.11",
								Status:      StatusAffected,
								VersionType: "semver",
							},
							{
								Introduced:  "1.18.0",
								Fixed:       "1.18.3",
								Status:      StatusAffected,
								VersionType: "semver",
							},
						},
						Platforms: []string{
							"windows",
						},
						ProgramRoutines: []ProgramRoutine{
							{
								Name: "TestSymbol",
							},
						},
						DefaultStatus: StatusUnaffected,
					},
				},
				ProblemTypes: []ProblemType{
					{
						Descriptions: []ProblemTypeDescription{
							{
								Lang:        "en",
								Description: "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')",
							},
						},
					},
				},
				References: []Reference{
					{
						URL: "https://go.dev/cl/12345",
					},
					{
						URL: "https://go.googlesource.com/go/+/abcde",
					},
					{
						URL: "https://go.dev/issue/12345",
					},
					{
						URL: "https://groups.google.com/g/golang-announce/c/abcdef",
					},
					{
						// This normally reports in the format .../vuln/GO-YYYY-XXXX, but our logic
						// relies on file path so this "abnormal" formatting is so that tests pass.
						URL: "https://pkg.go.dev/vuln/std-report",
					},
				},
				Credits: []Credit{
					{
						Lang:  "en",
						Value: "A Credit",
					},
				},
			},
		},
	}
	testThirdPartyRecord = &CVERecord{
		DataType:    "CVE_RECORD",
		DataVersion: "5.0",
		Metadata: Metadata{
			ID: "CVE-9999-0001",
		},
		Containers: Containers{
			CNAContainer: CNAPublishedContainer{
				ProviderMetadata: ProviderMetadata{
					OrgID: GoOrgUUID,
				},
				Descriptions: []Description{
					{
						Lang:  "en",
						Value: `Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.`,
					},
				},
				Affected: []Affected{
					{
						Vendor:        "github.com/gin-gonic/gin",
						Product:       "github.com/gin-gonic/gin",
						CollectionURL: "https://pkg.go.dev",
						PackageName:   "github.com/gin-gonic/gin",
						Versions: []VersionRange{
							{
								Introduced:  "0",
								Fixed:       "1.6.0",
								Status:      StatusAffected,
								VersionType: "semver",
							},
						},
						ProgramRoutines: []ProgramRoutine{
							{
								Name: "defaultLogFormatter",
							},
						},
						DefaultStatus: StatusUnaffected,
					},
				},
				ProblemTypes: []ProblemType{
					{
						Descriptions: []ProblemTypeDescription{
							{
								Lang:        "en",
								Description: "CWE-20: Improper Input Validation",
							},
						},
					},
				},
				References: []Reference{
					{
						URL: "https://github.com/gin-gonic/gin/pull/2237",
					},
					{
						URL: "https://github.com/gin-gonic/gin/commit/a71af9c144f9579f6dbe945341c1df37aaf09c0d",
					},
					{
						// This normally reports in the format .../vuln/GO-YYYY-XXXX, but our logic
						// relies on file path so this "abnormal" formatting is so that tests pass.
						URL: "https://pkg.go.dev/vuln/report",
					},
				},
				Credits: []Credit{
					{
						Lang:  "en",
						Value: "@thinkerou <thinkerou@gmail.com>",
					},
				},
			},
		},
	}
	testNoVersionsRecord = &CVERecord{
		DataType:    "CVE_RECORD",
		DataVersion: "5.0",
		Metadata: Metadata{
			ID: "CVE-9999-0001",
		},
		Containers: Containers{
			CNAContainer: CNAPublishedContainer{
				ProviderMetadata: ProviderMetadata{
					OrgID: GoOrgUUID,
				},
				Descriptions: []Description{
					{
						Lang:  "en",
						Value: `Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.`,
					},
				},
				Affected: []Affected{
					{
						Vendor:        "github.com/gin-gonic/gin",
						Product:       "github.com/gin-gonic/gin",
						CollectionURL: "https://pkg.go.dev",
						PackageName:   "github.com/gin-gonic/gin",
						Versions:      nil,
						ProgramRoutines: []ProgramRoutine{
							{
								Name: "defaultLogFormatter",
							},
						},
						DefaultStatus: StatusAffected,
					},
				},
				ProblemTypes: []ProblemType{
					{
						Descriptions: []ProblemTypeDescription{
							{
								Lang:        "en",
								Description: "CWE-20: Improper Input Validation",
							},
						},
					},
				},
				References: []Reference{
					{
						URL: "https://github.com/gin-gonic/gin/pull/2237",
					},
					{
						URL: "https://github.com/gin-gonic/gin/commit/a71af9c144f9579f6dbe945341c1df37aaf09c0d",
					},
					{
						// This normally reports in the format .../vuln/GO-YYYY-XXXX, but our logic
						// relies on file path so this "abnormal" formatting is so that tests pass.
						URL: "https://pkg.go.dev/vuln/no-versions",
					},
				},
				Credits: []Credit{
					{
						Lang:  "en",
						Value: "@thinkerou <thinkerou@gmail.com>",
					},
				},
			},
		},
	}
)

func TestFromReport(t *testing.T) {
	tests := []struct {
		name     string
		filename string
		want     *CVERecord
	}{
		{
			name:     "Standard Library Report",
			filename: "testdata/std-report.yaml",
			want:     testStdLibRecord,
		},
		{
			name:     "Third Party Report",
			filename: "testdata/report.yaml",
			want:     testThirdPartyRecord,
		},
		{
			name:     "No Versions Report",
			filename: "testdata/no-versions.yaml",
			want:     testNoVersionsRecord,
		},
	}
	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			r, err := report.Read(test.filename)
			if err != nil {
				t.Fatal(err)
			}
			got, err := FromReport(r)
			if err != nil {
				t.Fatalf("FromReport() failed unexpectedly; err=%v", err)
			}
			if diff := cmp.Diff(test.want, got); diff != "" {
				t.Fatalf("FromReport(): unexpected diffs (-want,+got):\n%v", diff)
			}
		})
	}
}

func TestVersionRangeToVersionRange(t *testing.T) {
	tests := []struct {
		name        string
		versions    []report.VersionRange
		wantRange   []VersionRange
		wantDefault VersionStatus
	}{
		{
			name:        "nil",
			versions:    nil,
			wantRange:   nil,
			wantDefault: StatusAffected,
		},
		{
			name:        "empty",
			versions:    []report.VersionRange{},
			wantRange:   nil,
			wantDefault: StatusAffected,
		},
		{
			name: "basic",
			versions: []report.VersionRange{
				{
					Introduced: "1.0.0",
					Fixed:      "1.0.1",
				},
				{
					Introduced: "1.2.0",
					Fixed:      "1.2.3",
				},
			},
			wantRange: []VersionRange{
				{
					Introduced:  "1.0.0",
					Fixed:       "1.0.1",
					Status:      StatusAffected,
					VersionType: typeSemver,
				},
				{
					Introduced:  "1.2.0",
					Fixed:       "1.2.3",
					Status:      StatusAffected,
					VersionType: typeSemver,
				},
			},
			wantDefault: StatusUnaffected,
		},
		{
			name: "no initial introduced",
			versions: []report.VersionRange{
				{
					Fixed: "1.0.1",
				},
				{
					Introduced: "1.2.0",
					Fixed:      "1.2.3",
				},
			},
			wantRange: []VersionRange{
				{
					Introduced:  "0",
					Fixed:       "1.0.1",
					Status:      StatusAffected,
					VersionType: typeSemver,
				},
				{
					Introduced:  "1.2.0",
					Fixed:       "1.2.3",
					Status:      StatusAffected,
					VersionType: typeSemver,
				},
			},
			wantDefault: StatusUnaffected,
		},
		{
			name: "no fix",
			versions: []report.VersionRange{
				{
					Introduced: "1.0.0",
				},
			},
			wantRange: []VersionRange{
				{
					Introduced:  "0",
					Fixed:       "1.0.0",
					Status:      StatusUnaffected,
					VersionType: typeSemver,
				},
			},
			wantDefault: StatusAffected,
		},
		{
			name: "no final fix",
			versions: []report.VersionRange{
				{
					Introduced: "1.0.0",
					Fixed:      "1.0.3",
				},
				{
					Introduced: "1.1.0",
				},
			},
			wantRange: []VersionRange{
				{
					Introduced:  "0",
					Fixed:       "1.0.0",
					Status:      StatusUnaffected,
					VersionType: typeSemver,
				},
				{
					Introduced:  "1.0.3",
					Fixed:       "1.1.0",
					Status:      StatusUnaffected,
					VersionType: typeSemver,
				},
			},
			wantDefault: StatusAffected,
		},
		{
			name: "no initial introduced and no final fix",
			versions: []report.VersionRange{
				{
					Fixed: "1.0.3",
				},
				{
					Introduced: "1.0.5",
					Fixed:      "1.0.7",
				},
				{
					Introduced: "1.1.0",
				},
			},
			wantRange: []VersionRange{
				{
					Introduced:  "1.0.3",
					Fixed:       "1.0.5",
					Status:      StatusUnaffected,
					VersionType: typeSemver,
				},
				{
					Introduced:  "1.0.7",
					Fixed:       "1.1.0",
					Status:      StatusUnaffected,
					VersionType: typeSemver,
				},
			},
			wantDefault: StatusAffected,
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			gotRange, gotStatus := versionRangeToVersionRange(tt.versions)
			if !reflect.DeepEqual(gotRange, tt.wantRange) {
				t.Errorf("versionRangeToVersionRange() got version range = %v, want %v", gotRange, tt.wantRange)
			}
			if !reflect.DeepEqual(gotStatus, tt.wantDefault) {
				t.Errorf("versionRangeToVersionRange() got default status = %v, want %v", gotStatus, tt.wantDefault)
			}
		})
	}
}

func TestToReport(t *testing.T) {
	if *updateTxtarRepo {
		cvelistrepo.UpdateTxtar(context.Background(), t, cvelistrepo.URLv5)
	}

	if err := cvelistrepo.TestToReport[*CVERecord](t, *update, *realProxy); err != nil {
		t.Fatal(err)
	}
}