github.com/devseccon/trivy@v0.47.1-0.20231123133102-bd902a0bd996/pkg/report/predicate/vuln_test.go (about)

     1  package predicate_test
     2  
     3  import (
     4  	"bytes"
     5  	"encoding/json"
     6  	"testing"
     7  	"time"
     8  
     9  	"github.com/stretchr/testify/require"
    10  
    11  	dbTypes "github.com/aquasecurity/trivy-db/pkg/types"
    12  	"github.com/aquasecurity/trivy-db/pkg/vulnsrc/vulnerability"
    13  	"github.com/devseccon/trivy/pkg/clock"
    14  	ftypes "github.com/devseccon/trivy/pkg/fanal/types"
    15  	"github.com/devseccon/trivy/pkg/report/predicate"
    16  	"github.com/devseccon/trivy/pkg/types"
    17  )
    18  
    19  func TestWriter_Write(t *testing.T) {
    20  	tests := []struct {
    21  		name          string
    22  		detectedVulns []types.DetectedVulnerability
    23  		want          predicate.CosignVulnPredicate
    24  	}{
    25  		{
    26  			name: "happy path",
    27  			detectedVulns: []types.DetectedVulnerability{
    28  				{
    29  					VulnerabilityID:  "CVE-2020-0001",
    30  					PkgName:          "foo",
    31  					InstalledVersion: "1.2.3",
    32  					FixedVersion:     "3.4.5",
    33  					PrimaryURL:       "https://avd.aquasec.com/nvd/cve-2020-0001",
    34  					Vulnerability: dbTypes.Vulnerability{
    35  						Title:       "foobar",
    36  						Description: "baz",
    37  						Severity:    "HIGH",
    38  						VendorSeverity: map[dbTypes.SourceID]dbTypes.Severity{
    39  							vulnerability.NVD: dbTypes.SeverityHigh,
    40  						},
    41  					},
    42  				},
    43  			},
    44  			want: predicate.CosignVulnPredicate{
    45  				Scanner: predicate.Scanner{
    46  					URI:     "pkg:github/devseccon/trivy@dev",
    47  					Version: "dev",
    48  					Result: types.Report{
    49  						SchemaVersion: 2,
    50  						ArtifactName:  "alpine:3.14",
    51  						ArtifactType:  ftypes.ArtifactType(""),
    52  						Metadata:      types.Metadata{},
    53  						Results: types.Results{
    54  							{
    55  								Target: "foojson",
    56  								Vulnerabilities: []types.DetectedVulnerability{
    57  									{
    58  										VulnerabilityID:  "CVE-2020-0001",
    59  										PkgName:          "foo",
    60  										InstalledVersion: "1.2.3",
    61  										FixedVersion:     "3.4.5",
    62  										PrimaryURL:       "https://avd.aquasec.com/nvd/cve-2020-0001",
    63  										Vulnerability: dbTypes.Vulnerability{
    64  											Title:       "foobar",
    65  											Description: "baz",
    66  											Severity:    "HIGH",
    67  										},
    68  									},
    69  								},
    70  							},
    71  						},
    72  					},
    73  				},
    74  				Metadata: predicate.Metadata{
    75  					ScanStartedOn:  time.Date(2022, time.July, 22, 12, 20, 30, 5, time.UTC),
    76  					ScanFinishedOn: time.Date(2022, time.July, 22, 12, 20, 30, 5, time.UTC),
    77  				},
    78  			},
    79  		},
    80  	}
    81  
    82  	for _, tt := range tests {
    83  		t.Run(tt.name, func(t *testing.T) {
    84  
    85  			inputResults := types.Report{
    86  				SchemaVersion: 2,
    87  				ArtifactName:  "alpine:3.14",
    88  				Results: types.Results{
    89  					{
    90  						Target:          "foojson",
    91  						Vulnerabilities: tt.detectedVulns,
    92  					},
    93  				},
    94  			}
    95  
    96  			output := bytes.NewBuffer(nil)
    97  
    98  			clock.SetFakeTime(t, time.Date(2022, 7, 22, 12, 20, 30, 5, time.UTC))
    99  			writer := predicate.NewVulnWriter(output, "dev")
   100  
   101  			err := writer.Write(inputResults)
   102  			require.NoError(t, err)
   103  
   104  			var got predicate.CosignVulnPredicate
   105  			err = json.Unmarshal(output.Bytes(), &got)
   106  			require.NoError(t, err, "invalid json written")
   107  
   108  			require.Equal(t, tt.want, got, tt.name)
   109  
   110  		})
   111  	}
   112  }