add test for elixir security

Signed-off-by: Tushar912 <tushar.912u@gmail.com>

Author: tushar912

vulnerabilities/importers/elixir_security.py

@@ -35,14 +35,15 @@
 from vulnerabilities.data_source import Reference
 
 class ElixirSecurityDataSource(GitDataSource):
-     def __enter__(self):
-        super(AlpineDataSource, self).__enter__()
+    def __enter__(self):
+        super(ElixirSecurityDataSource, self).__enter__()
 
         if not getattr(self, "_added_files", None):
             self._added_files, self._updated_files = self.file_changes(
                 recursive=True, file_ext="yml",subdir="./packages"
             )
 
+        
     def updated_advisories(self) -> Set[Advisory]:
         files = self._updated_files
         advisories = []
@@ -71,11 +72,12 @@ def generate_all_versions_list(pkg_name):
             versions_list.append(release['version'])
         return versions_list
 
-
-    @staticmethod
-    def get_pkg_from_range(versions_list,pkg_name):
+    
+    def get_pkg_from_range(self,versions_list,pkg_name):
         pkg_versions = []
-        all_versions_list = generate_all_versions_list(pkg_name)
+        all_versions_list = self.generate_all_versions_list(pkg_name)
+        if versions_list is None:
+            return
         for version in versions_list:
             if re.match('^>=',version):
                 index = all_versions_list.index(version[3:])
@@ -95,12 +97,19 @@ def process_file(self,path):
         with open(path) as f:
             yaml_file = yaml.safe_load(f)
             pkg_name = yaml_file['package']
-            safe_pkg_versions = self.get_pkg_from_range(yaml_file['patched_versions']+yaml_file['unaffected_versions'],pkg_name)
+            safe_pkg_versions =[]
+            if yaml_file.get('unaffected_versions'):
+                safe_pkg_versions = self.get_pkg_from_range(yaml_file['patched_versions']+yaml_file['unaffected_versions'],pkg_name)
+            else:
+                safe_pkg_versions = self.get_pkg_from_range(yaml_file['patched_versions'],pkg_name)
             cve_id = yaml_file['cve']
-            safe_purls ={ PackageURL(name=pkg_name,
-                type=pkg_type,
+            safe_purls = []
+            if safe_pkg_versions is not None:
+                safe_purls ={ PackageURL(name=pkg_name,
+                type='hex',
                 version=version)
                 for version in safe_pkg_versions}
+            
             vuln_reference = [Reference(
                 url=yaml_file['link'],
             )]

vulnerabilities/tests/test_data/elixir_security/test_file.yml

@@ -0,0 +1,12 @@
+---
+id: 2aae6e3a-24a3-4d5f-86ff-b964eaf7c6d1
+package: coherence
+disclosure_date: 2017-08-02
+cve: 2018-20301
+link: https://github.com/smpallen99/coherence/issues/270
+title: |
+  Permissive parameters and privilege escalation
+description: |
+  The Coherence library has "Mass Assignment"-like vulnerabilities.
+patched_versions:
+  - ">= 0.5.2"

vulnerabilities/tests/test_elixir_security.py

@@ -0,0 +1,74 @@
+# Copyright (c) 2017 nexB Inc. and others. All rights reserved.
+# http://nexb.com and https://github.com/nexB/vulnerablecode/
+# The VulnerableCode software is licensed under the Apache License version 2.0.
+# Data generated with VulnerableCode require an acknowledgment.
+#
+# You may not use this software except in compliance with the License.
+# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+#
+# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode
+# derivative work, you must accompany this data with the following acknowledgment:
+#
+#  Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
+#  OR CONDITIONS OF ANY KIND, either express or implied. No content created from
+#  VulnerableCode should be considered or used as legal advice. Consult an Attorney
+#  for any legal advice.
+#  VulnerableCode is a free software code scanning tool from nexB Inc. and others.
+#  Visit https://github.com/nexB/vulnerablecode/ for support and download.
+
+import os
+from unittest import TestCase
+from collections import OrderedDict
+
+from vulnerabilities.data_source import Reference
+from packageurl import PackageURL
+
+from vulnerabilities.importers.elixir_security import ElixirSecurityDataSource
+from vulnerabilities.data_source import Advisory
+
+BASE_DIR = os.path.dirname(os.path.abspath(__file__))
+
+
+class TestElixirSecurityDataSource(TestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        data_source_cfg = {
+            'repository_url': 'https://test.net', }
+        cls.data_src = ElixirSecurityDataSource(1, config=data_source_cfg)
+
+    def test_generate_all_versions_list(self):
+        package = 'coherence'
+        actual_list = self.data_src.generate_all_versions_list(package)
+        expected_list = ['0.5.2', '0.5.1', '0.5.0', '0.4.0', '0.3.1', '0.3.0', '0.2.0', '0.1.3', '0.1.2', '0.1.1', '0.1.0']
+        assert actual_list == expected_list
+
+    def test_process_file(self):
+
+        path = os.path.join(BASE_DIR, "test_data/elixir_security/test_file.yml")
+        expected_data = Advisory(
+            summary=('The Coherence library has "Mass Assignment"-like vulnerabilities.\n'),
+            
+            impacted_package_urls=[],
+
+            resolved_package_urls={
+                PackageURL(
+                    type='hex',
+                    name='coherence',
+                    version='0.5.2',
+                    ),
+                },
+            vuln_references=[
+                Reference(
+                    url="https://github.com/smpallen99/coherence/issues/270"
+                )
+            ],
+            cve_id='2018-20301')
+
+        found_data = self.data_src.process_file(path)
+
+        assert expected_data == found_data