Skip to content

Commit 5c64c01

Browse files
keshav-spacekeshav-space
committed
test: add coverage for curating advisory
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
1 parent 0494f33 commit 5c64c01

2 files changed

Lines changed: 160 additions & 13 deletions

File tree

‎vulnerabilities/tests/test_api_v3.py‎

Lines changed: 157 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ def test_packages_post_with_details(self):
116116
def test_advisories_post(self):
117117
url = reverse("advisory-v3-list")
118118

119-
with self.assertNumQueries(10):
119+
with self.assertNumQueries(11):
120120
response = self.client.post(
121121
url,
122122
data={"purls": ["pkg:pypi/sample@1.0.0"]},
@@ -133,7 +133,7 @@ def test_advisories_post(self):
133133
def test_affected_by_advisories_list(self):
134134
url = reverse("affected-by-advisories-list")
135135

136-
with self.assertNumQueries(11):
136+
with self.assertNumQueries(12):
137137
response = self.client.get(
138138
url, {"purl": "pkg:pypi/sample@1.0.0"}, HTTP_USER_AGENT="VCIO_API_AGENT"
139139
)
@@ -234,7 +234,7 @@ def setUp(self):
234234
def test_advisories_post(self):
235235
url = reverse("advisory-v3-list")
236236

237-
with self.assertNumQueries(10):
237+
with self.assertNumQueries(11):
238238
response = self.client.post(
239239
url,
240240
data={"purls": ["pkg:pypi/sample@1.0.0"]},
@@ -664,7 +664,7 @@ def setUp(self):
664664
advisory_obj.save()
665665

666666
todo = AdvisoryToDoV2.objects.create(
667-
related_advisories_id="abrakadabra",
667+
related_advisories_id="d1a9088a718d7f6f63676ccead5c",
668668
alias="GHSA-1234",
669669
advisories_count=1,
670670
issue_type="CONFLICTING_AFFECTED_PACKAGES",
@@ -692,7 +692,7 @@ def setUp(self):
692692
def test_get_todo_count_in_package_endpoint(self):
693693
url = reverse("package-v3-list")
694694

695-
with self.assertNumQueries(13):
695+
with self.assertNumQueries(14):
696696
response = self.client.post(
697697
url,
698698
data={
@@ -708,9 +708,10 @@ def test_get_todo_count_in_package_endpoint(self):
708708
results = response.data["results"]
709709
self.assertEqual(results[0]["affected_by_vulnerabilities"][0]["todo_count"], 1)
710710

711-
def test_get_todo_count_in_affected_by_advisory_endpoint(self):
711+
def test_get_todo_count_in_affected_by_advisories_endpoint(self):
712712
url = reverse("affected-by-advisories-list")
713-
with self.assertNumQueries(11):
713+
714+
with self.assertNumQueries(12):
714715
response = self.client.get(
715716
url,
716717
data={
@@ -724,10 +725,10 @@ def test_get_todo_count_in_affected_by_advisory_endpoint(self):
724725
results = response.data["results"]
725726
self.assertEqual(results[0]["todo_count"], 1)
726727

727-
def test_get_todo_count_in_advisory_endpoint(self):
728+
def test_get_todo_count_in_fixing_advisories_endpoint(self):
728729
url = reverse("fixing-advisories-list")
729730

730-
with self.assertNumQueries(10):
731+
with self.assertNumQueries(11):
731732
response = self.client.get(
732733
url,
733734
data={
@@ -739,5 +740,151 @@ def test_get_todo_count_in_advisory_endpoint(self):
739740
self.assertEqual(response.status_code, status.HTTP_200_OK)
740741

741742
results = response.data["results"]
742-
print(results)
743743
self.assertEqual(results[0]["todo_count"], 0)
744+
745+
746+
class APIV3TestCaseCuratedAdvisory(APITestCase):
747+
def setUp(self):
748+
logger = TestLogger()
749+
from vulnerabilities.importer import AdvisoryDataV2
750+
from vulnerabilities.importer import AffectedPackageV2
751+
752+
affected_packages1 = [
753+
(
754+
AffectedPackageV2(
755+
package=PackageURL(type="pypi", name=f"sample"),
756+
fixed_version_range=PypiVersionRange.from_string("vers:pypi/=1.0.0"),
757+
)
758+
)
759+
]
760+
761+
advisory1 = AdvisoryDataV2(
762+
advisory_id="GHSA-4321",
763+
aliases=["CVE-2021-4321"],
764+
summary="Sample advisory",
765+
affected_packages=affected_packages1,
766+
url="https://example.com/advisory",
767+
original_advisory_text="Sample advisory text",
768+
)
769+
advisory_obj1 = insert_advisory_v2(advisory1, "ghsa_importer", logger.write, "ghsa", 100)
770+
cur = timezone.now()
771+
advisory_obj1._all_impacts_unfurled_at = cur
772+
advisory_obj1.save()
773+
774+
todo = AdvisoryToDoV2.objects.create(
775+
related_advisories_id="d1a9088a718d7f6f63676ccead5c",
776+
alias="GHSA-4321",
777+
advisories_count=1,
778+
issue_type="CONFLICTING_AFFECTED_PACKAGES",
779+
)
780+
todo.advisories.add(advisory_obj1)
781+
782+
affected_packages = [
783+
(
784+
AffectedPackageV2(
785+
package=PackageURL(type="pypi", name=f"sample"),
786+
affected_version_range=PypiVersionRange.from_string("vers:pypi/=1.0.0"),
787+
)
788+
)
789+
]
790+
791+
advisory = AdvisoryDataV2(
792+
advisory_id="curation/GHSA-1234",
793+
aliases=["CVE-2021-1234"],
794+
summary="Sample advisory",
795+
affected_packages=affected_packages,
796+
url="https://example.com/advisory",
797+
original_advisory_text="Sample advisory text",
798+
)
799+
800+
advisory_obj = insert_advisory_v2(
801+
advisory, "curation_importer", logger.write, "curation", 100
802+
)
803+
cur = timezone.now()
804+
advisory_obj._all_impacts_unfurled_at = cur
805+
advisory_obj.is_curation = True
806+
advisory_obj.save()
807+
advisory_obj.resolves_todos.add(todo)
808+
809+
GroupAdvisoriesForPackages().execute()
810+
811+
self.client = APIClient(enforce_csrf_checks=True)
812+
813+
self.allow_request_patcher = patch(
814+
"vulnerabilities.throttling.PermissionBasedUserRateThrottle.allow_request",
815+
return_value=True,
816+
)
817+
self.allow_request_patcher.start()
818+
self.addCleanup(self.allow_request_patcher.stop)
819+
820+
self.anon_patcher = patch(
821+
"rest_framework.throttling.AnonRateThrottle.allow_request",
822+
return_value=True,
823+
)
824+
self.anon_patcher.start()
825+
self.addCleanup(self.anon_patcher.stop)
826+
827+
def test_get_curating_advisories_in_package_endpoint(self):
828+
url = reverse("package-v3-list")
829+
830+
with self.assertNumQueries(15):
831+
response = self.client.post(
832+
url,
833+
data={
834+
"purls": ["pkg:pypi/sample@1.0.0"],
835+
"details": True,
836+
},
837+
format="json",
838+
HTTP_USER_AGENT="VCIO_API_AGENT",
839+
)
840+
841+
self.assertEqual(response.status_code, status.HTTP_200_OK)
842+
843+
results = response.data["results"]
844+
affected_by_vulnerabilities = results[0]["affected_by_vulnerabilities"][0]
845+
846+
self.assertEqual(affected_by_vulnerabilities["is_curation"], True)
847+
self.assertEqual(
848+
affected_by_vulnerabilities["curating_advisories"],
849+
["http://testserver/advisories/ghsa/GHSA-4321"],
850+
)
851+
852+
def test_get_curating_advisories_in_affected_by_advisory_endpoint(self):
853+
url = reverse("affected-by-advisories-list")
854+
855+
with self.assertNumQueries(13):
856+
response = self.client.get(
857+
url,
858+
data={
859+
"purl": "pkg:pypi/sample@1.0.0",
860+
},
861+
HTTP_USER_AGENT="VCIO_API_AGENT",
862+
)
863+
864+
self.assertEqual(response.status_code, status.HTTP_200_OK)
865+
866+
results = response.data["results"][0]
867+
868+
self.assertEqual(results["is_curation"], True)
869+
self.assertEqual(
870+
results["curating_advisories"], ["http://testserver/advisories/ghsa/GHSA-4321"]
871+
)
872+
873+
def test_get_curating_advisories_in_advisory_endpoint(self):
874+
url = reverse("fixing-advisories-list")
875+
876+
with self.assertNumQueries(11):
877+
response = self.client.get(
878+
url,
879+
data={
880+
"purl": "pkg:pypi/sample@1.0.0",
881+
},
882+
HTTP_USER_AGENT="VCIO_API_AGENT",
883+
)
884+
885+
self.assertEqual(response.status_code, status.HTTP_200_OK)
886+
887+
results = response.data["results"][0]
888+
889+
self.assertEqual(results["is_curation"], False)
890+
self.assertEqual(results["curating_advisories"], [])

‎vulnerabilities/tests/test_data_migrations.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1390,9 +1390,9 @@ class TestCleanAdvisorySeverityMigration(TestMigrations):
13901390
migrate_to = "0139_cleanup_none_string_in_severity"
13911391

13921392
def setUpBeforeMigration(self, apps):
1393-
# AdvisoryV2 = apps.get_model("vulnerabilities", "AdvisoryV2")
1394-
# ImpactedPackage = apps.get_model("vulnerabilities", "ImpactedPackage")
1395-
# AdvisorySeverity = apps.get_model("vulnerabilities", "AdvisorySeverity")
1393+
AdvisoryV2 = apps.get_model("vulnerabilities", "AdvisoryV2")
1394+
ImpactedPackage = apps.get_model("vulnerabilities", "ImpactedPackage")
1395+
AdvisorySeverity = apps.get_model("vulnerabilities", "AdvisorySeverity")
13961396

13971397
self.advisory1 = AdvisoryV2.objects.create(
13981398
unique_content_id="b001d1a8952bc056d0161f1dd45dd8f90b25f62c56a887ea21d09fafd78a0f61",

0 commit comments

Comments
 (0)