Skip to content

Commit d3c12d8

Browse files
sbs2001sbs2001
committed
Add tests for postgresql importer
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
1 parent cb0d5f4 commit d3c12d8

2 files changed

Lines changed: 355 additions & 0 deletions

File tree

‎vulnerabilities/tests/test_data/postgresql/advisories.html‎

Lines changed: 231 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,231 @@
1+
<!doctype html>
2+
<html lang="en">
3+
<head>
4+
<title>PostgreSQL: Security Information</title>
5+
6+
</head>
7+
<body>
8+
<div class="container-fluid">
9+
<div class="row justify-content-center pg-shout-box">
10+
<div class="col text-white text-center">12th November 2020: <a href="https://www.postgresql.org/about/news/postgresql-131-125-1110-1015-9620-and-9524-released-2111/">
11+
PostgreSQL 13.1, 12.5, 11.10, 10.15, 9.6.20, &amp; 9.5.24 Released</a>!
12+
13+
</div>
14+
</div>
15+
</div>
16+
17+
<div class="container-fluid margin">
18+
<div class="row">
19+
<div class="col-lg-2">
20+
<div id="pgSideWrap">
21+
22+
<div id="pgSideNav">
23+
<h2>Quick Links</h2>
24+
25+
<ul>
26+
27+
28+
<li><a href="/support/">Support</a>
29+
30+
31+
32+
</li>
33+
<li><a href="/support/versioning/">Versioning Policy</a>
34+
35+
36+
37+
</li>
38+
<li><a href="/support/security/">Security</a>
39+
40+
41+
42+
</li>
43+
<li><a href="/support/professional_support/">Professional Services</a>
44+
45+
46+
47+
</li>
48+
<li><a href="/support/professional_hosting/">Hosting Solutions</a>
49+
50+
51+
52+
</li>
53+
<li class="last-child"><a href="/account/submitbug/">Report a Bug</a>
54+
55+
56+
</li>
57+
58+
59+
</ul>
60+
61+
</div>
62+
63+
</div> <!-- pgSideWrap -->
64+
</div>
65+
<div class="col-lg-10">
66+
<div id="pgContentWrap">
67+
68+
69+
<h1>Security Information <i class="fas fa-lock"></i></h1>
70+
71+
<p>
72+
If you wish to report a new security vulnerability in PostgreSQL, please
73+
send an email to
74+
<a href="mailto:security@postgresql.org">security@postgresql.org</a>.
75+
For reporting non-security bugs, please see the <a href="/account/submitbug/">Report a Bug</a> page.
76+
</p>
77+
78+
79+
<h2>Known security issues in all supported versions</h2>
80+
<p>
81+
You can filter the view of patches to show just patches for version:<br/>
82+
83+
<a href="/support/security/13/">13</a> -
84+
85+
<a href="/support/security/12/">12</a> -
86+
87+
<a href="/support/security/11/">11</a> -
88+
89+
<a href="/support/security/10/">10</a> -
90+
91+
<a href="/support/security/9.6/">9.6</a> -
92+
93+
<a href="/support/security/9.5/">9.5</a>
94+
95+
- <a href="/support/security/">all</a>
96+
</p>
97+
98+
<table class="table table-striped">
99+
<thead class="thead-light">
100+
<tr>
101+
<th>Reference</th>
102+
<th>Affected</th>
103+
<th>Fixed</th>
104+
<th><a href="#comp">Component</a> & CVSS v3 Base Score</th>
105+
<th>Description</th>
106+
</tr>
107+
</thead>
108+
<tbody>
109+
110+
<tr>
111+
<td>
112+
<nobr>CVE-2020-10733</nobr><br/>
113+
<a href="/about/news/postgresql-123-118-1013-9618-and-9522-released-2038/">Announcement</a><br/>
114+
</td>
115+
<td>9.5</td>
116+
<td>9.5.22</td>
117+
<td>packaging<br/>
118+
<a href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H">6.7</a><br/><span class="cvssvector">AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H</span>
119+
</td>
120+
<td>Windows installer runs executables from uncontrolled directories</td>
121+
</tr>
122+
123+
<tr>
124+
<td>
125+
<nobr><a href="https://access.redhat.com/security/cve/CVE-2020-1720">CVE-2020-1720</a></nobr><br/>
126+
<a href="/about/news/postgresql-122-117-1012-9617-9521-and-9426-released-2011/">Announcement</a><br/>
127+
</td>
128+
<td>11, 12</td>
129+
<td></td>
130+
<td>core server<br/>
131+
<a href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N">3.1</a><br/><span class="cvssvector">AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N</span>
132+
</td>
133+
<td>ALTER ... DEPENDS ON EXTENSION is missing authorization checks.</td>
134+
</tr>
135+
136+
</tbody>
137+
</table>
138+
139+
<h3>Unsupported versions</h3>
140+
<p>
141+
You can also view archived security patches for unsupported versions. Note that no further
142+
security patches are made available for these versions as they are end of life.<br/>
143+
144+
<a href="/support/security/9.4/">9.4</a> -
145+
146+
<a href="/support/security/9.3/">9.3</a> -
147+
148+
<a href="/support/security/9.2/">9.2</a> -
149+
150+
<a href="/support/security/9.1/">9.1</a> -
151+
152+
<a href="/support/security/9.0/">9.0</a> -
153+
154+
<a href="/support/security/8.4/">8.4</a> -
155+
156+
<a href="/support/security/8.3/">8.3</a> -
157+
158+
<a href="/support/security/8.2/">8.2</a> -
159+
160+
<a href="/support/security/8.1/">8.1</a> -
161+
162+
<a href="/support/security/8.0/">8.0</a> -
163+
164+
<a href="/support/security/7.4/">7.4</a> -
165+
166+
<a href="/support/security/7.3/">7.3</a>
167+
168+
</p>
169+
170+
171+
<a name="comp"></a>
172+
<h2>Components</h2>
173+
<p>
174+
The following component references are used in the above table:
175+
</p>
176+
177+
<table class="table table-striped">
178+
<thead class="thead-light">
179+
<tr>
180+
<th>Component</th>
181+
<th>Description</th>
182+
</tr>
183+
</thead>
184+
<tbody>
185+
<tr>
186+
<td>core server</td>
187+
<td>This vulnerability exists in the core server product.</td>
188+
</tr>
189+
190+
<tr>
191+
<td>client</td>
192+
<td>This vulnerability exists in a client library or client application only.</td>
193+
</tr>
194+
195+
<tr>
196+
<td>contrib module</td>
197+
<td>This vulnerability exists in a contrib module. Contrib modules are not installed by default when PostgreSQL is installed from source. They may be installed by binary packages.</td>
198+
</tr>
199+
200+
<tr>
201+
<td>client contrib module</td>
202+
<td>This vulnerability exists in a contrib module used on the client only.</td>
203+
</tr>
204+
205+
<tr>
206+
<td>packaging</td>
207+
<td>This vulnerability exists in PostgreSQL binary packaging, e.g. an installer or RPM.</td>
208+
</tr>
209+
</tbody>
210+
</table>
211+
212+
213+
214+
</div> <!-- pgContentWrap -->
215+
</div>
216+
</div>
217+
</div>
218+
219+
<!-- Footer -->
220+
<footer id="footer">
221+
<!-- Copyright -->
222+
<div class="container">
223+
<a href="/about/policies/">Policies</a> |
224+
<a href="/about/policies/coc/">Code of Conduct</a> |
225+
<a href="/about/">About PostgreSQL</a> |
226+
<a href="/about/contact/">Contact</a><br/>
227+
<p>Copyright &copy; 1996-2020 The PostgreSQL Global Development Group</p>
228+
</div>
229+
</footer>
230+
</body>
231+
</html>

‎vulnerabilities/tests/test_postgresql.py‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
# Copyright (c) nexB Inc. and others. All rights reserved.
2+
# http://nexb.com and https://github.com/nexB/vulnerablecode/
3+
# The VulnerableCode software is licensed under the Apache License version 2.0.
4+
# Data generated with VulnerableCode require an acknowledgment.
5+
#
6+
# You may not use this software except in compliance with the License.
7+
# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
8+
# Unless required by applicable law or agreed to in writing, software distributed
9+
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
10+
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
11+
# specific language governing permissions and limitations under the License.
12+
#
13+
# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode
14+
# derivative work, you must accompany this data with the following acknowledgment:
15+
#
16+
# Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
17+
# OR CONDITIONS OF ANY KIND, either express or implied. No content created from
18+
# VulnerableCode should be considered or used as legal advice. Consult an Attorney
19+
# for any legal advice.
20+
# VulnerableCode is a free software tool from nexB Inc. and others.
21+
# Visit https://github.com/nexB/vulnerablecode/ for support and download.
22+
23+
import os
24+
from unittest import TestCase
25+
from unittest.mock import patch
26+
27+
from packageurl import PackageURL
28+
29+
from vulnerabilities.data_source import Advisory
30+
from vulnerabilities.data_source import Reference
31+
from vulnerabilities.importers.postgresql import to_advisories
32+
33+
34+
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
35+
TEST_DATA = os.path.join(BASE_DIR, "test_data/postgresql", "advisories.html")
36+
37+
38+
class TestPostgreSQLDataSource(TestCase):
39+
def test_to_advisories(self):
40+
41+
with open(TEST_DATA) as f:
42+
raw_data = f.read()
43+
44+
expected_data = sorted(
45+
[
46+
Advisory(
47+
summary="Windows installer runs executables from uncontrolled directories",
48+
impacted_package_urls=[
49+
PackageURL(
50+
type="generic",
51+
namespace=None,
52+
name="postgresql",
53+
version="9.5",
54+
qualifiers={"os": "windows"},
55+
subpath=None,
56+
)
57+
],
58+
resolved_package_urls=[
59+
PackageURL(
60+
type="generic",
61+
namespace=None,
62+
name="postgresql",
63+
version="9.5.22",
64+
qualifiers={"os": "windows"},
65+
subpath=None,
66+
)
67+
],
68+
vuln_references=[
69+
Reference(
70+
url="https://www.postgresql.org/about/news/postgresql-123-118-1013-9618-and-9522-released-2038/", # nopep8
71+
reference_id="",
72+
)
73+
],
74+
cve_id="CVE-2020-10733",
75+
),
76+
Advisory(
77+
summary="ALTER ... DEPENDS ON EXTENSION is missing authorization checks.",
78+
impacted_package_urls=[
79+
PackageURL(
80+
type="generic",
81+
namespace=None,
82+
name="postgresql",
83+
version="11",
84+
qualifiers={},
85+
subpath=None,
86+
),
87+
PackageURL(
88+
type="generic",
89+
namespace=None,
90+
name="postgresql",
91+
version="12",
92+
qualifiers={},
93+
subpath=None,
94+
),
95+
],
96+
resolved_package_urls=[
97+
PackageURL(
98+
type="generic",
99+
namespace=None,
100+
name="postgresql",
101+
version=None,
102+
qualifiers={},
103+
subpath=None,
104+
)
105+
],
106+
vuln_references=[
107+
Reference(
108+
url="https://access.redhat.com/security/cve/CVE-2020-1720",
109+
reference_id="",
110+
),
111+
Reference(
112+
url="https://www.postgresql.org/about/news/postgresql-122-117-1012-9617-9521-and-9426-released-2011/", # nopep8
113+
reference_id="",
114+
),
115+
],
116+
cve_id="CVE-2020-1720",
117+
),
118+
],
119+
key=lambda adv: adv.cve_id,
120+
)
121+
122+
found_data = sorted(to_advisories(raw_data), key=lambda adv: adv.cve_id)
123+
124+
assert expected_data == found_data

0 commit comments

Comments
 (0)