Skip to content

Commit 1363d96

Browse files
sbs2001sbs2001
committed
Add tests for suse severity score importer
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
1 parent 95f5511 commit 1363d96

2 files changed

Lines changed: 140 additions & 0 deletions

File tree

‎vulnerabilities/tests/test_data/suse_scores/suse-cvss-scores.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
CVE-2004-0230:
3+
cvss:
4+
- version: 2.0
5+
score: 4.3
6+
vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
7+
- version: 3.1
8+
score: 3.7
9+
vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
10+
CVE-2003-1605:
11+
cvss:
12+
- version: 3
13+
score: 8.6
14+
vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

‎vulnerabilities/tests/test_suse_scores.py‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
# Copyright (c) nexB Inc. and others. All rights reserved.
2+
# http://nexb.com and https://github.com/nexB/vulnerablecode/
3+
# The VulnerableCode software is licensed under the Apache License version 2.0.
4+
# Data generated with VulnerableCode require an acknowledgment.
5+
#
6+
# You may not use this software except in compliance with the License.
7+
# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
8+
# Unless required by applicable law or agreed to in writing, software distributed
9+
# under the License is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES OR
10+
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
11+
# specific language governing permissions and limitations under the License.
12+
#
13+
# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode
14+
# derivative work, you must accompany this data with the following acknowledgment:
15+
#
16+
# Generated with VulnerableCode and provided on an 'AS IS' BASIS, WITHOUT WARRANTIES
17+
# OR CONDITIONS OF ANY KIND, either express or implied. No content created from
18+
# VulnerableCode should be considered or used as legal advice. Consult an Attorney
19+
# for any legal advice.
20+
# VulnerableCode is a free software from nexB Inc. and others.
21+
# Visit https://github.com/nexB/vulnerablecode/ for support and download.
22+
23+
import os
24+
from unittest import TestCase
25+
26+
from vulnerabilities.data_source import Advisory
27+
from vulnerabilities.data_source import Reference
28+
from vulnerabilities.data_source import VulnerabilitySeverity
29+
from vulnerabilities.importers.suse_scores import SUSESeverityScoreDataSource
30+
from vulnerabilities.helpers import load_yaml
31+
from vulnerabilities.severity_systems import ScoringSystem
32+
33+
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
34+
TEST_DATA = os.path.join(BASE_DIR, "test_data/suse_scores", "suse-cvss-scores.yaml")
35+
36+
37+
class TestSUSESeverityScoreDataSource(TestCase):
38+
def test_to_advisory(self):
39+
raw_data = load_yaml(TEST_DATA)
40+
expected_data = [
41+
Advisory(
42+
summary="",
43+
impacted_package_urls=[],
44+
resolved_package_urls=[],
45+
vuln_references=[
46+
Reference(
47+
reference_id="",
48+
url="https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml",
49+
severities=[
50+
VulnerabilitySeverity(
51+
system=ScoringSystem(
52+
identifier="cvssv2",
53+
name="CVSSv2 Base Score",
54+
url="https://www.first.org/cvss/v2/",
55+
notes="cvssv2 base score",
56+
),
57+
value="4.3",
58+
),
59+
VulnerabilitySeverity(
60+
system=ScoringSystem(
61+
identifier="cvssv2_vector",
62+
name="CVSSv2 Vector",
63+
url="https://www.first.org/cvss/v2/",
64+
notes="cvssv2 vector, used to get additional info about nature and severity of vulnerability", # nopep8
65+
),
66+
value="AV:N/AC:M/Au:N/C:N/I:N/A:P",
67+
),
68+
VulnerabilitySeverity(
69+
system=ScoringSystem(
70+
identifier="cvssv3.1",
71+
name="CVSSv3.1 Base Score",
72+
url="https://www.first.org/cvss/v3-1/",
73+
notes="cvssv3.1 base score",
74+
),
75+
value="3.7",
76+
),
77+
VulnerabilitySeverity(
78+
system=ScoringSystem(
79+
identifier="cvssv3.1_vector",
80+
name="CVSSv3.1 Vector",
81+
url="https://www.first.org/cvss/v3-1/",
82+
notes="cvssv3.1 vector, used to get additional info about nature and severity of vulnerability", # nopep8
83+
),
84+
value="CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
85+
),
86+
],
87+
)
88+
],
89+
cve_id="CVE-2004-0230",
90+
),
91+
Advisory(
92+
summary="",
93+
impacted_package_urls=[],
94+
resolved_package_urls=[],
95+
vuln_references=[
96+
Reference(
97+
reference_id="",
98+
url="https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml",
99+
severities=[
100+
VulnerabilitySeverity(
101+
system=ScoringSystem(
102+
identifier="cvssv3",
103+
name="CVSSv3 Base Score",
104+
url="https://www.first.org/cvss/v3-0/",
105+
notes="cvssv3 base score",
106+
),
107+
value="8.6",
108+
),
109+
VulnerabilitySeverity(
110+
system=ScoringSystem(
111+
identifier="cvssv3_vector",
112+
name="CVSSv3 Vector",
113+
url="https://www.first.org/cvss/v3-0/",
114+
notes="cvssv3 vector, used to get additional info about nature and severity of vulnerability", # nopep8
115+
),
116+
value="CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
117+
),
118+
],
119+
)
120+
],
121+
cve_id="CVE-2003-1605",
122+
),
123+
]
124+
125+
found_data = SUSESeverityScoreDataSource.to_advisory(raw_data)
126+
assert expected_data == found_data

0 commit comments

Comments
 (0)