-
-
Notifications
You must be signed in to change notification settings - Fork 44
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
16 changed files
with
223 additions
and
181 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -8,6 +8,7 @@ import ( | |
|
|
||
| cyclonedx "github.com/devops-kung-fu/bomber/formats/cyclonedx" | ||
| spdx "github.com/devops-kung-fu/bomber/formats/spdx" | ||
| syft "github.com/devops-kung-fu/bomber/formats/syft" | ||
| ) | ||
|
|
||
| func TestLoad_cyclonedx(t *testing.T) { | ||
|
|
@@ -44,6 +45,23 @@ func TestLoad_SPDX(t *testing.T) { | |
| assert.Error(t, err) | ||
| } | ||
|
|
||
| func TestLoad_syft(t *testing.T) { | ||
| afs := &afero.Afero{Fs: afero.NewMemMapFs()} | ||
|
|
||
| err := afs.WriteFile("/test-syft.json", syft.TestBytes(), 0644) | ||
| assert.NoError(t, err) | ||
|
|
||
| files, _ := afs.ReadDir("/") | ||
| assert.Len(t, files, 1) | ||
| purls, err := Load(afs, []string{"/"}) | ||
| assert.NoError(t, err) | ||
| assert.Len(t, purls, 1) | ||
| assert.Equal(t, "pkg:golang/github.com/CycloneDX/[email protected]", purls[0]) | ||
|
|
||
| _, err = afs.ReadDir("/bad-dir") | ||
| assert.Error(t, err) | ||
| } | ||
|
|
||
| func TestLoad_BadJSON_SPDX(t *testing.T) { | ||
| afs := &afero.Afero{Fs: afero.NewMemMapFs()} | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,6 +4,7 @@ import ( | |
| "os" | ||
| "testing" | ||
|
|
||
| "github.com/jarcoal/httpmock" | ||
| "github.com/stretchr/testify/assert" | ||
|
|
||
| "github.com/devops-kung-fu/bomber/models" | ||
|
|
@@ -18,6 +19,9 @@ func TestInfo(t *testing.T) { | |
| func Test_validateCredentials(t *testing.T) { | ||
| // Back up any env tokens | ||
|
|
||
| err := validateCredentials(nil) | ||
| assert.Error(t, err) | ||
|
|
||
| username := os.Getenv("BOMBER_PROVIDER_USERNAME") | ||
| token := os.Getenv("BOMBER_PROVIDER_TOKEN") | ||
|
|
||
|
|
@@ -28,7 +32,7 @@ func Test_validateCredentials(t *testing.T) { | |
| Token: "token", | ||
| } | ||
|
|
||
| err := validateCredentials(&credentials) | ||
| err = validateCredentials(&credentials) | ||
| assert.NoError(t, err) | ||
|
|
||
| credentials.Username = "" | ||
|
|
@@ -48,3 +52,54 @@ func Test_validateCredentials(t *testing.T) { | |
| os.Setenv("BOMBER_PROVIDER_USERNAME", username) | ||
| os.Setenv("BOMBER_PROVIDER_TOKEN", token) | ||
| } | ||
|
|
||
| func TestProvider_Scan_FakeCredentials(t *testing.T) { | ||
| httpmock.Activate() | ||
| defer httpmock.DeactivateAndReset() | ||
|
|
||
| httpmock.RegisterResponder("POST", OSSINDEX_URL, | ||
| httpmock.NewBytesResponder(200, ossTestResponse())) | ||
|
|
||
| credentials := models.Credentials{ | ||
| Username: "test", | ||
| Token: "token", | ||
| } | ||
|
|
||
| provider := Provider{} | ||
| packages, err := provider.Scan([]string{"pkg:golang/github.com/briandowns/[email protected]"}, &credentials) | ||
| assert.NoError(t, err) | ||
| assert.Equal(t, "pkg:gem/[email protected]", packages[0].Purl) | ||
| assert.Len(t, packages[0].Vulnerabilities, 1) | ||
| httpmock.GetTotalCallCount() | ||
| } | ||
|
|
||
| func ossTestResponse() []byte { | ||
| response := ` | ||
| [ | ||
| { | ||
| "coordinates": "pkg:gem/[email protected]", | ||
| "description": "TZInfo provides daylight savings aware transformations between times in different time zones.", | ||
| "reference": "https://ossindex.sonatype.org/component/pkg:gem/[email protected]?utm_source=mozilla&utm_medium=integration&utm_content=5.0", | ||
| "vulnerabilities": [ | ||
| { | ||
| "id": "CVE-2022-31163", | ||
| "displayName": "CVE-2022-31163", | ||
| "title": "[CVE-2022-31163] CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", | ||
| "description": "TZInfo... ", | ||
| "cvssScore": 8.1, | ||
| "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", | ||
| "cwe": "CWE-22", | ||
| "cve": "CVE-2022-31163", | ||
| "reference": "https://ossindex.sonatype.org/vulnerability/CVE-2022-31163?component-type=gem&component-name=tzinfo&utm_source=mozilla&utm_medium=integration&utm_content=5.0", | ||
| "externalReferences": [ | ||
| "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-31163", | ||
| "https://github.com/tzinfo/tzinfo/releases/tag/v0.3.61", | ||
| "https://github.com/tzinfo/tzinfo/releases/tag/v1.2.10", | ||
| "https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx" | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| ]` | ||
| return []byte(response) | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.