fix uni tests

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

Makefile

@@ -30,6 +30,7 @@ shell:
 # make test              - full suite
 # make test k=<pattern>  - filter by name, e.g. make test k=test_name
 test:
+	${EXEC} web pip install --find-links=thirdparty/dist/ --no-index --no-cache-dir '.[dev]'
 	${MANAGE} test --noinput --parallel auto $(if $(k),-k $(k),)
 
 migrations:

component_catalog/api.py

@@ -631,6 +631,7 @@ class PackageSerializer(
         many=True,
         fields=[
             "advisory_uid",
+            "advisory_id",
             "api_url",
             "uuid",
         ],

component_catalog/tests/test_views.py

@@ -3056,34 +3056,34 @@ def test_vulnerablecode_get_vulnerable_purls(self):
         with mock.patch(
             "dejacode_toolkit.vulnerablecode.VulnerableCode.bulk_search_by_purl"
         ) as bulk_search:
-            bulk_search.return_value = []
+            bulk_search.return_value = {"count": 0, "results": []}
             vulnerable_purls = vulnerablecode.get_vulnerable_purls(packages=[self.package1])
             self.assertEqual([], vulnerable_purls)
 
-            bulk_search.return_value = ["pkg:pypi/django@2.1"]
+            bulk_search.return_value = {"count": 1, "results": ["pkg:pypi/django@2.1"]}
             vulnerable_purls = vulnerablecode.get_vulnerable_purls(packages=[self.package1])
             self.assertEqual(["pkg:pypi/django@2.1"], vulnerable_purls)
 
-    @mock.patch("dejacode_toolkit.vulnerablecode.VulnerableCode.request_get")
-    def test_vulnerablecode_get_vulnerabilities_cache(self, mock_request_get):
+    @mock.patch("dejacode_toolkit.vulnerablecode.VulnerableCode.bulk_search_by_purl")
+    def test_vulnerablecode_get_vulnerabilities_cache(self, mock_bulk_search):
         vulnerablecode = VulnerableCode(self.dataspace)
 
         self.package1.set_package_url("pkg:pypi/django@2.1")
         self.package1.save()
 
-        mock_request_get.return_value = {
+        mock_bulk_search.return_value = {
             "count": 1,
             "results": True,
         }
 
         results = vulnerablecode.get_vulnerabilities_by_purl(self.package1.package_url)
-        self.assertEqual(1, mock_request_get.call_count)
+        self.assertEqual(1, mock_bulk_search.call_count)
         self.assertTrue(results)
 
         results = vulnerablecode.get_vulnerabilities_by_purl(self.package1.package_url)
-        # request.get was only called once since the results are returned from the cached
+        # bulk_search_by_purl was only called once since the results are returned from the cache
         # on the second call of `get_vulnerabilities_by_purl`.
-        self.assertEqual(1, mock_request_get.call_count)
+        self.assertEqual(1, mock_bulk_search.call_count)
         self.assertTrue(results)
 
     def test_send_scan_notification(self):

dje/tests/testfiles/outputs/csaf_security_advisory.csaf.json

@@ -53,7 +53,7 @@
       "ids": [
         {
           "system_name": "VulnerableCode",
-          "text": "VCID-0001"
+          "text": "ID-0001"
         },
         {
           "system_name": "Common Vulnerabilities and Exposures",
@@ -85,7 +85,7 @@
       "ids": [
         {
           "system_name": "VulnerableCode",
-          "text": "VCID-0002"
+          "text": "ID-0002"
         }
       ],
       "notes": [
@@ -113,7 +113,7 @@
       "ids": [
         {
           "system_name": "VulnerableCode",
-          "text": "VCID-0003"
+          "text": "ID-0003"
         }
       ],
       "notes": [

dje/tests/testfiles/outputs/openvex_document.json

@@ -7,8 +7,8 @@
   "statements": [
     {
       "vulnerability": {
-        "name": "VCID-0001",
-        "@id": "https://public.vulnerablecode.io/vulnerabilities/VCID-0001",
+        "name": "ID-0001",
+        "@id": "https://public.vulnerablecode.io/vulnerabilities/ID-0001",
         "description": "",
         "aliases": [
           "CVE-1984-1010"
@@ -27,8 +27,8 @@
     },
     {
       "vulnerability": {
-        "name": "VCID-0002",
-        "@id": "https://public.vulnerablecode.io/vulnerabilities/VCID-0002",
+        "name": "ID-0002",
+        "@id": "https://public.vulnerablecode.io/vulnerabilities/ID-0002",
         "description": "",
         "aliases": []
       },
@@ -45,7 +45,7 @@
     },
     {
       "vulnerability": {
-        "name": "VCID-0003",
+        "name": "ID-0003",
         "@id": "",
         "description": "",
         "aliases": []

product_portfolio/tests/test_views.py

@@ -330,7 +330,7 @@ def test_product_portfolio_tab_vulnerability_view_packages_row_rendering(self):
               data-bs-target="#vulnerability-analysis-modal"
               data-vulnerability-id="{vulnerability1.advisory_id}"
               data-package-identifier="{p1}"
-              data-edit-url="/products/vulnerability_analysis/{pp1.uuid}/{vulnerability1.advisory_id}/"
+              data-edit-url="/products/vulnerability_analysis/{pp1.uuid}/{vulnerability1.advisory_uid}/"
         >
         <button type="button" data-bs-toggle="tooltip" title="Edit" class="btn btn-link p-0"
                 aria-label="Edit">
@@ -3384,7 +3384,7 @@ def test_product_portfolio_vulnerability_analysis_form_view(self):
 
         url = reverse(
             "product_portfolio:vulnerability_analysis_form",
-            args=[pp1.uuid, vulnerability1.advisory_id],
+            args=[pp1.uuid, vulnerability1.advisory_uid],
         )
 
         response = self.client.get(url)

product_portfolio/urls.py

@@ -117,7 +117,7 @@ def product_path(path_segment, view):
         name="edit_productrelation_ajax",
     ),
     path(
-        "vulnerability_analysis/<uuid:productpackage_uuid>/<str:advisory_uid>/",
+        "vulnerability_analysis/<uuid:productpackage_uuid>/<path:advisory_uid>/",
         vulnerability_analysis_form_view,
         name="vulnerability_analysis_form",
     ),

product_portfolio/views.py

@@ -3232,7 +3232,7 @@ class ProductSecurityComplianceExportView(
 
     export_filename = "security_compliance"
     export_fields = {
-        "advisory_uid": "Vulnerability ID",
+        "advisory_id": "Vulnerability ID",
         "aliases": "Aliases",
         "summary": "Summary",
         "risk_level": "Risk level",

vulnerabilities/fetch.py

@@ -95,7 +95,7 @@ def fetch_for_packages(
             purl = PackageURL.from_string(vc_entry.get("purl"))
             affected_packages = queryset.filter(
                 type=purl.type,
-                namespace=purl.namespace,
+                namespace=purl.namespace or "",
                 name=purl.name,
                 version=purl.version,
             )

vulnerabilities/tests/data/vulnerabilities/idna_3.6_as_cyclonedx.json

@@ -4,132 +4,10 @@
       "ref": "pkg:type/name@1.9.0"
     }
   ],
-  "description": "Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to idna.encode",
-  "id": "VCID-j3au-usaz-aaag",
-  "references": [
-    {
-      "id": "",
-      "source": {
-        "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-3651.json"
-      }
-    },
-    {
-      "id": "",
-      "source": {
-        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3651"
-      }
-    },
-    {
-      "id": "",
-      "source": {
-        "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"
-      }
-    },
-    {
-      "id": "",
-      "source": {
-        "url": "https://github.com/kjd/idna"
-      }
-    },
-    {
-      "id": "",
-      "source": {
-        "url": "https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d"
-      }
-    },
-    {
-      "id": "",
-      "source": {
-        "url": "https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2024-60.yaml"
-      }
-    },
-    {
-      "id": "",
-      "source": {
-        "url": "https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb"
-      }
-    },
-    {
-      "id": "1069127",
-      "source": {
-        "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1069127"
-      }
-    },
-    {
-      "id": "2274779",
-      "source": {
-        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274779"
-      }
-    },
-    {
-      "id": "CVE-2024-3651",
-      "source": {
-        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3651"
-      }
-    },
-    {
-      "id": "GHSA-jjg7-2v4v-x38h",
-      "source": {
-        "url": "https://github.com/advisories/GHSA-jjg7-2v4v-x38h"
-      }
-    },
-    {
-      "id": "GHSA-jjg7-2v4v-x38h",
-      "source": {
-        "url": "https://github.com/kjd/idna/security/advisories/GHSA-jjg7-2v4v-x38h"
-      }
-    },
-    {
-      "id": "RHSA-2024:3466",
-      "source": {
-        "url": "https://access.redhat.com/errata/RHSA-2024:3466"
-      }
-    },
-    {
-      "id": "RHSA-2024:3543",
-      "source": {
-        "url": "https://access.redhat.com/errata/RHSA-2024:3543"
-      }
-    },
-    {
-      "id": "RHSA-2024:3552",
-      "source": {
-        "url": "https://access.redhat.com/errata/RHSA-2024:3552"
-      }
-    },
-    {
-      "id": "RHSA-2024:3781",
-      "source": {
-        "url": "https://access.redhat.com/errata/RHSA-2024:3781"
-      }
-    },
-    {
-      "id": "RHSA-2024:3846",
-      "source": {
-        "url": "https://access.redhat.com/errata/RHSA-2024:3846"
-      }
-    },
-    {
-      "id": "RHSA-2024:4260",
-      "source": {
-        "url": "https://access.redhat.com/errata/RHSA-2024:4260"
-      }
-    },
-    {
-      "id": "USN-6780-1",
-      "source": {
-        "url": "https://usn.ubuntu.com/6780-1/"
-      }
-    },
-    {
-      "id": "cpe:2.3:a:kjd:internationalized_domain_names_in_applications:3.6:*:*:*:*:*:*:*",
-      "source": {
-        "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:kjd:internationalized_domain_names_in_applications:3.6:*:*:*:*:*:*:*"
-      }
-    }
-  ],
+  "description": "A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.",
+  "id": "PYSEC-2024-60",
   "source": {
     "name": "VulnerableCode",
-    "url": "http://public.vulnerablecode.io/vulnerabilities/VCID-j3au-usaz-aaag"
+    "url": "http://public.vulnerablecode.io/advisories/pypa/idna/PYSEC-2024-60"
   }
-}
+}