Add tests

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>

Author: TG1999

vulnerabilities/importers/npm.py

@@ -11,6 +11,7 @@
 
 from pathlib import Path
 from typing import Iterable
+from typing import List
 
 import pytz
 from dateutil.parser import parse
@@ -48,7 +49,7 @@ def advisory_data(self) -> Iterable[AdvisoryData]:
             if self.vcs_response:
                 self.vcs_response.delete()
 
-    def to_advisory_data(self, file: Path) -> AdvisoryData:
+    def to_advisory_data(self, file: Path) -> List[AdvisoryData]:
         data = load_json(file)
         id = data.get("id")
         description = data.get("overview") or ""
@@ -95,14 +96,29 @@ def to_advisory_data(self, file: Path) -> AdvisoryData:
         if package_name:
             affected_packages.append(self.get_affected_package(data, package_name))
         advsisory_aliases = data.get("cves") or []
-        advsisory_aliases.append(f"NPM-{id}")
-        for alias in advsisory_aliases:
+
+        # If an adviosry has more than one CVE, then we should yield more than one advisory
+        if len(advsisory_aliases) > 1:
+            print(f"Found {len(advsisory_aliases)} CVEs for {id}")
+            for alias in advsisory_aliases:
+                yield AdvisoryData(
+                    summary=build_description(summary=summary, description=description),
+                    references=references,
+                    date_published=date_published,
+                    affected_packages=affected_packages,
+                    aliases=[alias],
+                )
+
+        # If an advisory has only one CVE, then we should yield only one advisory
+        # with the NPM ID also as an alias
+        else:
+            advsisory_aliases.append(f"NPM-{id}")
             yield AdvisoryData(
                 summary=build_description(summary=summary, description=description),
                 references=references,
                 date_published=date_published,
                 affected_packages=affected_packages,
-                aliases=[alias],
+                aliases=advsisory_aliases,
             )
 
     def get_affected_package(self, data, package_name):

vulnerabilities/models.py

@@ -452,6 +452,10 @@ def url(self):
         if alias.startswith("GHSA"):
             return f"https://github.com/advisories/{alias}"
 
+        if alias.startswith("NPM-"):
+            id = alias.lstrip("NPM-")
+            return f"https://github.com/nodejs/security-wg/blob/main/vuln/npm/{id}.json"
+
 
 class Advisory(models.Model):
     """

vulnerabilities/tests/conftest.py

@@ -36,7 +36,6 @@ def no_rmtree(monkeypatch):
     "test_models.py",
     "test_mozilla.py",
     "test_msr2019.py",
-    "test_npm.py",
     "test_package_managers.py",
     "test_postgresql.py",
     "test_retiredotnet.py",

vulnerabilities/tests/test_data/npm_sample.json

@@ -0,0 +1,27 @@
+{
+    "id": 152,
+    "created_at": "2016-10-27",
+    "updated_at": "2017-03-23",
+    "title": "Predictable temp filenames allow overwrite of arbitrary files",
+    "author": {
+      "name": "Jérémy Lal",
+      "website": null,
+      "username": null
+    },
+    "module_name": "npm",
+    "publish_date": "2017-03-23",
+    "cves": [
+      "CVE-2013-4116"
+    ],
+    "vulnerable_versions": "<1.3.3",
+    "patched_versions": ">=1.3.3",
+    "overview": "npm versions before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.",
+    "recommendation": "Upgrade to the latest version of npm",
+    "references": [
+      "https://github.com/npm/npm/issues/3635",
+      "http://www.openwall.com/lists/oss-security/2013/07/10/17"
+    ],
+    "cvss_vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N",
+    "cvss_score": 3.2,
+    "coordinating_vendor": "^Lift Security"
+  }

vulnerabilities/tests/test_data/parse-advisory-npm-expected.json

@@ -0,0 +1,58 @@
+[
+  {
+    "aliases": [
+      [
+        "CVE-2013-4116",
+        "NPM-152"
+      ]
+    ],
+    "summary": "Predictable temp filenames allow overwrite of arbitrary files\nnpm versions before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.",
+    "affected_packages": [
+      {
+        "package": {
+          "type": "npm",
+          "namespace": null,
+          "name": "npm",
+          "version": null,
+          "qualifiers": null,
+          "subpath": null
+        },
+        "affected_version_range": "vers:npm/<1.3.3",
+        "fixed_version": "1.3.3"
+      }
+    ],
+    "references": [
+      {
+        "reference_id": "",
+        "url": "https://github.com/npm/npm/issues/3635",
+        "severities": [
+          {
+            "system": "cvssv3",
+            "value": 3.2
+          }
+        ]
+      },
+      {
+        "reference_id": "",
+        "url": "http://www.openwall.com/lists/oss-security/2013/07/10/17",
+        "severities": [
+          {
+            "system": "cvssv3",
+            "value": 3.2
+          }
+        ]
+      },
+      {
+        "reference_id": 152,
+        "url": "https://github.com/nodejs/security-wg/blob/main/vuln/npm/152.json",
+        "severities": [
+          {
+            "system": "cvssv3",
+            "value": 3.2
+          }
+        ]
+      }
+    ],
+    "date_published": "2016-10-27T00:00:00+00:00"
+  }
+]

vulnerabilities/tests/test_npm.py

@@ -9,138 +9,16 @@
 #
 
 import os
-import shutil
-import tempfile
-import zipfile
-from unittest.mock import patch
 
-from django.test import TestCase
-
-from vulnerabilities import models
-from vulnerabilities.import_runner import ImportRunner
-from vulnerabilities.importers.npm import categorize_versions
-from vulnerabilities.package_managers import NpmVersionAPI
-from vulnerabilities.package_managers import Version
+from vulnerabilities.importers.npm import NpmImporter
+from vulnerabilities.tests import util_tests
 
 BASE_DIR = os.path.dirname(os.path.abspath(__file__))
 TEST_DATA = os.path.join(BASE_DIR, "test_data/")
 
 
-MOCK_VERSION_API = NpmVersionAPI(
-    cache={
-        "jquery": {Version("3.4.0"), Version("3.8.0")},
-        "kerberos": {Version("0.5.8"), Version("1.2.0")},
-        "@hapi/subtext": {
-            Version("3.7.0"),
-            Version("4.1.1"),
-            Version("6.1.3"),
-            Version("7.0.0"),
-            Version("7.0.5"),
-        },
-    }
-)
-
-
-@patch("vulnerabilities.importers.NpmImporter._update_from_remote")
-class NpmImportTest(TestCase):
-
-    tempdir = None
-
-    @classmethod
-    def setUpClass(cls) -> None:
-        cls.tempdir = tempfile.mkdtemp()
-        zip_path = os.path.join(TEST_DATA, "npm.zip")
-
-        with zipfile.ZipFile(zip_path, "r") as zip_ref:
-            zip_ref.extractall(cls.tempdir)
-
-        cls.importer = models.Importer.objects.create(
-            name="npm_unittests",
-            license="",
-            last_run=None,
-            data_source="NpmImporter",
-            data_source_cfg={
-                "repository_url": "https://example.git",
-                "working_directory": os.path.join(cls.tempdir, "npm/npm_test"),
-                "create_working_directory": False,
-                "remove_working_directory": False,
-            },
-        )
-
-    @classmethod
-    def tearDownClass(cls) -> None:
-        # Make sure no requests for unexpected package names have been made during the tests.
-        shutil.rmtree(cls.tempdir)
-        assert len(MOCK_VERSION_API.cache) == 3, MOCK_VERSION_API.cache
-
-    def test_import(self, _):
-        runner = ImportRunner(self.importer, 5)
-
-        with patch("vulnerabilities.importers.NpmImporter.versions", new=MOCK_VERSION_API):
-            with patch("vulnerabilities.importers.NpmImporter.set_api"):
-                runner.run()
-
-        assert models.Vulnerability.objects.count() == 3
-        assert models.VulnerabilityReference.objects.count() == 3
-        assert models.PackageRelatedVulnerability.objects.all().count() == 4
-
-        assert models.Package.objects.count() == 8
-
-        self.assert_for_package(
-            "jquery", {"3.4.0"}, {"3.8.0"}, "1518", vulnerability_id="CVE-2020-11022"
-        )  # nopep8
-        self.assert_for_package("kerberos", {"0.5.8"}, {"1.2.0"}, "1514")
-        self.assert_for_package("subtext", {"4.1.1", "7.0.0"}, {"6.1.3", "7.0.5"}, "1476")
-
-    def assert_for_package(
-        self,
-        package_name,
-        impacted_versions,
-        resolved_versions,
-        vuln_id,
-        vulnerability_id=None,
-    ):
-        vuln = None
-
-        for version in impacted_versions:
-            pkg = models.Package.objects.get(name=package_name, version=version)
-
-            assert pkg.vulnerabilities.count() == 1
-            vuln = pkg.vulnerabilities.first()
-            if vulnerability_id:
-                assert vuln.vulnerability_id == vulnerability_id
-
-            ref_url = f"https://registry.npmjs.org/-/npm/v1/advisories/{vuln_id}"
-            assert models.VulnerabilityReference.objects.get(url=ref_url, vulnerability=vuln)
-
-        for version in resolved_versions:
-            pkg = models.Package.objects.get(name=package_name, version=version)
-            assert models.PackageRelatedVulnerability.objects.filter(
-                patched_package=pkg, vulnerability=vuln
-            )
-
-
-def test_categorize_versions_simple_ranges():
-    all_versions = {"3.4.0", "3.8.0"}
-    impacted_ranges = "<3.5.0"
-    resolved_ranges = ">=3.5.0"
-
-    impacted_versions, resolved_versions = categorize_versions(
-        all_versions, impacted_ranges, resolved_ranges
-    )
-
-    assert impacted_versions == {"3.4.0"}
-    assert resolved_versions == {"3.8.0"}
-
-
-def test_categorize_versions_complex_ranges():
-    all_versions = {"3.7.0", "4.1.1", "6.1.3", "7.0.0", "7.0.5"}
-    impacted_ranges = ">=4.1.0 <6.1.3 || >= 7.0.0 <7.0.3"
-    resolved_ranges = ">=6.1.3 <7.0.0 || >=7.0.3"
-
-    impacted_versions, resolved_versions = categorize_versions(
-        all_versions, impacted_ranges, resolved_ranges
-    )
-
-    assert impacted_versions == {"4.1.1", "7.0.0"}
-    assert resolved_versions == {"3.7.0", "6.1.3", "7.0.5"}
+def test_npm_importer():
+    file = os.path.join(TEST_DATA, "npm_sample.json")
+    result = [adv.to_dict() for adv in NpmImporter().to_advisory_data(file=file)]
+    expected_file = os.path.join(TEST_DATA, f"parse-advisory-npm-expected.json")
+    util_tests.check_results_against_json(result, expected_file)