|
| 1 | +# Copyright (c) nexB Inc. and others. All rights reserved. |
| 2 | +# http://nexb.com and https://github.com/nexB/vulnerablecode/ |
| 3 | +# The VulnerableCode software is licensed under the Apache License version 2.0. |
| 4 | +# Data generated with VulnerableCode require an acknowledgment. |
| 5 | +# |
| 6 | +# You may not use this software except in compliance with the License. |
| 7 | +# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0 |
| 8 | +# Unless required by applicable law or agreed to in writing, software distributed |
| 9 | +# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR |
| 10 | +# CONDITIONS OF ANY KIND, either express or implied. See the License for the |
| 11 | +# specific language governing permissions and limitations under the License. |
| 12 | +# |
| 13 | +# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode |
| 14 | +# derivative work, you must accompany this data with the following acknowledgment: |
| 15 | +# |
| 16 | +# Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES |
| 17 | +# OR CONDITIONS OF ANY KIND, either express or implied. No content created from |
| 18 | +# VulnerableCode should be considered or used as legal advice. Consult an Attorney |
| 19 | +# for any legal advice. |
| 20 | +# VulnerableCode is a free software tool from nexB Inc. and others. |
| 21 | +# Visit https://github.com/nexB/vulnerablecode/ for support and download. |
| 22 | + |
| 23 | +import os |
| 24 | +from unittest import TestCase |
| 25 | + |
| 26 | +from dephell_specifier import RangeSpecifier |
| 27 | +from packageurl import PackageURL |
| 28 | + |
| 29 | +from vulnerabilities.data_source import Advisory, Reference |
| 30 | +from vulnerabilities.package_managers import GitHubTagsAPI |
| 31 | +from vulnerabilities.importers.apache_kafka import ApacheKafkaDataSource, to_version_ranges |
| 32 | + |
| 33 | +BASE_DIR = os.path.dirname(os.path.abspath(__file__)) |
| 34 | +TEST_DATA = os.path.join(BASE_DIR, "test_data", "apache_kafka", "cve-list.html") |
| 35 | + |
| 36 | + |
| 37 | +class TestApacheKafkaDataSource(TestCase): |
| 38 | + @classmethod |
| 39 | + def setUpClass(cls): |
| 40 | + cls.data_source = ApacheKafkaDataSource(batch_size=1) |
| 41 | + cls.data_source.version_api = GitHubTagsAPI( |
| 42 | + cache={"apache/kafka": ["2.1.2", "0.10.2.2"]} |
| 43 | + ) |
| 44 | + |
| 45 | + def test_to_version_ranges(self): |
| 46 | + # Check single version |
| 47 | + assert [RangeSpecifier("==3.2.2")] == to_version_ranges("3.2.2") |
| 48 | + |
| 49 | + # Check range with lower and upper bounds |
| 50 | + assert [RangeSpecifier(">=3.2.2, <=3.2.3")] == to_version_ranges("3.2.2 to 3.2.3") |
| 51 | + |
| 52 | + # Check range with "and later" |
| 53 | + assert [RangeSpecifier(">=3.2.2")] == to_version_ranges("3.2.2 and later") |
| 54 | + |
| 55 | + # Check combination of above cases |
| 56 | + assert [ |
| 57 | + RangeSpecifier(">=3.2.2"), |
| 58 | + RangeSpecifier(">=3.2.2, <=3.2.3"), |
| 59 | + RangeSpecifier("==3.2.2"), |
| 60 | + ] == to_version_ranges("3.2.2 and later, 3.2.2 to 3.2.3, 3.2.2") |
| 61 | + |
| 62 | + def test_to_advisory(self): |
| 63 | + expected_data = [ |
| 64 | + Advisory( |
| 65 | + summary="In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to " |
| 66 | + "manually\n craft a Produce request which bypasses transaction/idempotent ACL " |
| 67 | + "validation.\n Only authenticated clients with Write permission on the " |
| 68 | + "respective topics are\n able to exploit this vulnerability. Users should " |
| 69 | + "upgrade to 2.1.1 or later\n where this vulnerability has been fixed.", |
| 70 | + impacted_package_urls=[ |
| 71 | + PackageURL( |
| 72 | + type="apache", |
| 73 | + namespace=None, |
| 74 | + name="kafka", |
| 75 | + version="0.10.2.2", |
| 76 | + qualifiers={}, |
| 77 | + subpath=None, |
| 78 | + ) |
| 79 | + ], |
| 80 | + resolved_package_urls=[ |
| 81 | + PackageURL( |
| 82 | + type="apache", |
| 83 | + namespace=None, |
| 84 | + name="kafka", |
| 85 | + version="2.1.2", |
| 86 | + qualifiers={}, |
| 87 | + subpath=None, |
| 88 | + ) |
| 89 | + ], |
| 90 | + vuln_references=[ |
| 91 | + Reference(url="https://kafka.apache.org/cve-list", reference_id=""), |
| 92 | + Reference( |
| 93 | + url="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17196", |
| 94 | + reference_id="CVE-2018-17196", |
| 95 | + ), |
| 96 | + ], |
| 97 | + cve_id="CVE-2018-17196", |
| 98 | + ) |
| 99 | + ] |
| 100 | + with open(TEST_DATA) as f: |
| 101 | + found_data = self.data_source.to_advisory(f) |
| 102 | + |
| 103 | + assert found_data == expected_data |
0 commit comments