github.com/CycloneDX/sbom-utility@v0.16.0/cmd/vulnerability_test.go

// SPDX-License-Identifier: Apache-2.0
/*
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package cmd

import (
	"bufio"
	"bytes"
	"io/fs"
	"testing"

	"github.com/CycloneDX/sbom-utility/common"
	"github.com/CycloneDX/sbom-utility/schema"
	"github.com/CycloneDX/sbom-utility/utils"
)

const (
	// Test "vulnerability list" command
	TEST_VULN_CDX_1_3_EXAMPLE_1_BOM     = "test/vex/cdx-1-3-example1-bom.json"
	TEST_VULN_CDX_1_3_EXAMPLE_1_BOM_VEX = "test/vex/cdx-1-3-example1-bom-vex.json"
	TEST_VULN_CDX_1_4_EXAMPLE_1_VEX     = "test/vex/cdx-1-4-example1-vex.json"
	TEST_VULN_CDX_1_3_EXAMPLE_2_BOM_VEX = "test/vex/cdx-1-3-example2-bom-vex.json"
)

type VulnTestInfo struct {
	CommonTestInfo
}

var VULN_TEST_DEFAULT_FLAGS utils.VulnerabilityCommandFlags

// Stringer interface for ResourceTestInfo (just display subset of key values)
func (ti *VulnTestInfo) String() string {
	buffer, _ := utils.EncodeAnyToDefaultIndentedJSONStr(ti)
	return buffer.String()
}

func NewVulnTestInfo(inputFile string, listFormat string, listSummary bool, whereClause string,
	resultExpectedLineCount int) *VulnTestInfo {
	var ti = new(VulnTestInfo)
	var pCommon = &ti.CommonTestInfo
	pCommon.Init(
		inputFile,
		listFormat,
		listSummary,
		whereClause,
		nil,
		resultExpectedLineCount,
		nil)
	return ti
}

func NewVulnTestInfoBasic(inputFile string, listFormat string, resultExpectedError error) *VulnTestInfo {
	var ti = new(VulnTestInfo)
	var pCommon = &ti.CommonTestInfo
	pCommon.InitBasic(inputFile, listFormat, resultExpectedError)
	return ti
}

// -------------------------------------------
// Vuln. list test helper functions
// -------------------------------------------
func innerBufferedTestVulnList(testInfo *VulnTestInfo, whereFilters []common.WhereFilter, flags utils.VulnerabilityCommandFlags) (outputBuffer bytes.Buffer, err error) {
	// Declare an output outputBuffer/outputWriter to use used during tests
	var outputWriter = bufio.NewWriter(&outputBuffer)
	// ensure all data is written to buffer before further validation
	defer outputWriter.Flush()

	// TODO: allow tests to set the flag values
	// The command looks for the input filename in global flags struct
	utils.GlobalFlags.PersistentFlags.InputFile = testInfo.InputFile
	utils.GlobalFlags.PersistentFlags.OutputFormat = testInfo.OutputFormat
	utils.GlobalFlags.PersistentFlags.OutputFile = testInfo.OutputFile
	utils.GlobalFlags.PersistentFlags.OutputIndent = testInfo.OutputIndent
	err = ListVulnerabilities(outputWriter, utils.GlobalFlags.PersistentFlags, flags, whereFilters)
	return
}

func innerTestVulnList(t *testing.T, testInfo *VulnTestInfo, flags utils.VulnerabilityCommandFlags) (outputBuffer bytes.Buffer, basicTestInfo string, err error) {
	getLogger().Tracef("TestInfo: %s", testInfo)

	// Parse out --where filters and exit out if error detected
	whereFilters, err := prepareWhereFilters(t, &testInfo.CommonTestInfo)
	if err != nil {
		return
	}

	// invoke list command with a byte buffer
	outputBuffer, err = innerBufferedTestVulnList(testInfo, whereFilters, flags)

	// Run all common tests against "result" values in the CommonTestInfo struct
	err = innerRunReportResultTests(t, &testInfo.CommonTestInfo, outputBuffer, err)

	return
}

// ----------------------------------------
// Command flag tests
// ----------------------------------------

func TestVulnListInvalidInputFileLoad(t *testing.T) {
	testInfo := NewVulnTestInfoBasic(
		TEST_INPUT_FILE_NON_EXISTENT,
		FORMAT_DEFAULT,
		&fs.PathError{})

	// verify correct error is returned
	innerTestVulnList(t, testInfo, VULN_TEST_DEFAULT_FLAGS)
}

// -------------------------------------------
// Test format unsupported (SPDX)
// -------------------------------------------
func TestVulnListFormatUnsupportedSPDXMinReq(t *testing.T) {
	testInfo := NewVulnTestInfoBasic(
		TEST_SPDX_2_2_MIN_REQUIRED,
		FORMAT_DEFAULT,
		&schema.UnsupportedFormatError{})

	// verify correct error is returned
	innerTestVulnList(t, testInfo, VULN_TEST_DEFAULT_FLAGS)
}

func TestVulnListFormatUnsupportedSPDX22(t *testing.T) {
	testInfo := NewVulnTestInfoBasic(
		TEST_SPDX_2_2_EXAMPLE_1,
		FORMAT_DEFAULT,
		&schema.UnsupportedFormatError{})

	// verify correct error is returned
	innerTestVulnList(t, testInfo, VULN_TEST_DEFAULT_FLAGS)
}

// -------------------------------------------
// CDX variants - Test for list (data) errors
// -------------------------------------------

func TestVulnListTextCdx13BOMNoVulnFound(t *testing.T) {
	testInfo := NewVulnTestInfoBasic(
		TEST_VULN_CDX_1_3_EXAMPLE_1_BOM,
		FORMAT_TEXT,
		nil)

	// verify there is a (warning) message present when no resources are found
	testInfo.ResultLineContainsValues = []string{MSG_OUTPUT_NO_VULNERABILITIES_FOUND}
	testInfo.ResultLineContainsValuesAtLineNum = 2
	innerTestVulnList(t, testInfo, VULN_TEST_DEFAULT_FLAGS)
}

// -------------------------------------------
// CDX variants - List only
// -------------------------------------------

func TestVulnListTextCdx13Example1VEXOnly(t *testing.T) {
	testInfo := NewVulnTestInfoBasic(
		TEST_VULN_CDX_1_4_EXAMPLE_1_VEX,
		FORMAT_DEFAULT,
		nil)

	innerTestVulnList(t, testInfo, VULN_TEST_DEFAULT_FLAGS)
}

// Assure default format listing (report) works
func TestVulnListTextCdx13Example1BOMWithVEX(t *testing.T) {
	testInfo := NewVulnTestInfoBasic(
		TEST_VULN_CDX_1_3_EXAMPLE_1_BOM_VEX,
		FORMAT_DEFAULT,
		nil)

	innerTestVulnList(t, testInfo, VULN_TEST_DEFAULT_FLAGS)
}

// FORMAT_TEXT
func TestVulnListCdx13TextFull(t *testing.T) {
	testInfo := NewVulnTestInfoBasic(
		TEST_VULN_CDX_1_3_EXAMPLE_1_BOM_VEX,
		FORMAT_TEXT,
		nil)

	innerTestVulnList(t, testInfo, VULN_TEST_DEFAULT_FLAGS)
}

// FORMAT_TEXT, --summary
func TestVulnListCdx13TextSummary(t *testing.T) {
	testInfo := NewVulnTestInfoBasic(
		TEST_VULN_CDX_1_3_EXAMPLE_1_BOM_VEX,
		FORMAT_TEXT,
		nil)
	testInfo.ListSummary = true

	innerTestVulnList(t, testInfo, VULN_TEST_DEFAULT_FLAGS)

	// TODO add extra tests to verify specific rows have correct data for the input test file
	// e.g., CVE-2020-25649  CVSSv31: 7.5 (high)  NVD 2020-12-03  The highest threat from this vulnerability is data integrity.
}

// Assure CSV format listing (report) works
func TestVulnListCdx13CSV(t *testing.T) {
	testInfo := NewVulnTestInfoBasic(
		TEST_VULN_CDX_1_3_EXAMPLE_1_BOM_VEX,
		FORMAT_CSV,
		nil)

	innerTestVulnList(t, testInfo, VULN_TEST_DEFAULT_FLAGS)
}

// Assure markdown format listing (report) works
func TestVulnListCdx13Markdown(t *testing.T) {
	testInfo := NewVulnTestInfoBasic(
		TEST_VULN_CDX_1_3_EXAMPLE_1_BOM_VEX,
		FORMAT_MARKDOWN,
		nil)

	innerTestVulnList(t, testInfo, VULN_TEST_DEFAULT_FLAGS)
}

// Assure json format listing (report) works
func TestVulnListCdx13JSONWithIndent(t *testing.T) {
	testInfo := NewVulnTestInfoBasic(
		TEST_VULN_CDX_1_3_EXAMPLE_1_BOM_VEX,
		FORMAT_JSON,
		nil)
	// Note: this value will keep going down as we add more custom marshallers for vuln. structs
	testInfo.ResultExpectedLineCount = 191
	testInfo.OutputIndent = 2
	testInfo.ResultExpectedIndentLength = int(testInfo.OutputIndent)
	testInfo.ResultExpectedIndentAtLineNum = 1
	buffer, _, _ := innerTestVulnList(t, testInfo, VULN_TEST_DEFAULT_FLAGS)
	getLogger().Debugf("result:\n%s", buffer.String())
	// Validate output data
	verifyFileLineCountAndIndentation(t, buffer, &testInfo.CommonTestInfo)
}

// -------------------------------------------
// CDX variants - WHERE clause tests
// -------------------------------------------

func TestVulnListTextCdx14WhereClauseAndResultsByIdStartsWith(t *testing.T) {
	TEST_INPUT_WHERE_CLAUSE := "id=CVE"
	TEST_OUTPUT_CONTAINS := []string{"CVE-2022-42004", "502", "NVD", "jackson-databind"}
	EXPECTED_OUTPUT_LINE_COUNT := 6

	testInfo := NewVulnTestInfo(
		TEST_VULN_CDX_1_3_EXAMPLE_1_BOM_VEX,
		FORMAT_TEXT,
		TI_LIST_SUMMARY_FALSE,
		TEST_INPUT_WHERE_CLAUSE,
		EXPECTED_OUTPUT_LINE_COUNT)
	testInfo.ResultLineContainsValues = TEST_OUTPUT_CONTAINS
	testInfo.ResultLineContainsValuesAtLineNum = 2
	result, _, _ := innerTestVulnList(t, testInfo, VULN_TEST_DEFAULT_FLAGS)
	getLogger().Debugf("result:\n%s", result.String())
}

func TestVulnListTextCdx14WhereClauseDescContains(t *testing.T) {
	TEST_INPUT_WHERE_CLAUSE := "description=^.*fasterxml.*"
	TEST_OUTPUT_CONTAINS := []string{"CVE-2020-25649", "611", "7.5", "jackson-databind"}
	EXPECTED_OUTPUT_LINE_COUNT := 4

	testInfo := NewVulnTestInfo(
		TEST_VULN_CDX_1_3_EXAMPLE_1_BOM_VEX,
		FORMAT_TEXT,
		TI_LIST_SUMMARY_FALSE,
		TEST_INPUT_WHERE_CLAUSE,
		EXPECTED_OUTPUT_LINE_COUNT)
	testInfo.ResultLineContainsValues = TEST_OUTPUT_CONTAINS
	testInfo.ResultLineContainsValuesAtLineNum = 2
	innerTestVulnList(t, testInfo, VULN_TEST_DEFAULT_FLAGS)
}

func TestVulnListTextCdx14WhereClauseSourceNameNVD(t *testing.T) {
	TEST_INPUT_WHERE_CLAUSE := "source-name=NVD"
	TEST_OUTPUT_CONTAINS := []string{"CVE-2022-42003", "502", "7.5", "NVD", "jackson-databind"}
	EXPECTED_OUTPUT_LINE_COUNT := 6

	testInfo := NewVulnTestInfo(
		TEST_VULN_CDX_1_3_EXAMPLE_1_BOM_VEX,
		FORMAT_TEXT,
		TI_LIST_SUMMARY_FALSE,
		TEST_INPUT_WHERE_CLAUSE,
		EXPECTED_OUTPUT_LINE_COUNT)
	testInfo.ResultLineContainsValues = TEST_OUTPUT_CONTAINS
	testInfo.ResultLineContainsValuesAtLineNum = 3
	innerTestVulnList(t, testInfo, VULN_TEST_DEFAULT_FLAGS)
}

func TestVulnListTextCdx14WhereClauseSourceUrlCVE2022(t *testing.T) {
	TEST_INPUT_WHERE_CLAUSE := "source-url=CVE-2022"
	TEST_OUTPUT_CONTAINS := []string{"CVE-2022-42003", "502", "CVSSv31", "7.5", "NVD", "2022-10-02", "FasterXML"}
	EXPECTED_OUTPUT_LINE_COUNT := 5

	testInfo := NewVulnTestInfo(
		TEST_VULN_CDX_1_3_EXAMPLE_1_BOM_VEX,
		FORMAT_TEXT,
		TI_LIST_SUMMARY_FALSE,
		TEST_INPUT_WHERE_CLAUSE,
		EXPECTED_OUTPUT_LINE_COUNT)
	testInfo.ResultLineContainsValues = TEST_OUTPUT_CONTAINS
	testInfo.ResultLineContainsValuesAtLineNum = 3
	innerTestVulnList(t, testInfo, VULN_TEST_DEFAULT_FLAGS)
}