Skip to content

Commit 77f89b8

Browse files
ziadhanyziadhany
committed
Add a test for gentoo importer v2
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
1 parent ce7d534 commit 77f89b8

File tree

6 files changed

+304
-22
lines changed

6 files changed

+304
-22
lines changed

‎vulnerabilities/pipelines/v2_importers/gentoo_importer.py‎

Lines changed: 20 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -57,17 +57,18 @@ def collect_advisories(self) -> Iterable[AdvisoryData]:
5757
def process_file(self, file):
5858
cves = []
5959
summary = ""
60-
vuln_references = []
6160
xml_root = ET.parse(file).getroot()
6261
id = xml_root.attrib.get("id")
63-
if id:
64-
glsa = "GLSA-" + id
65-
vuln_references = [
66-
ReferenceV2(
67-
reference_id=glsa,
68-
url=f"https://security.gentoo.org/glsa/{id}",
69-
)
70-
]
62+
if not id:
63+
raise ValueError("Missing `id` attribute")
64+
65+
glsa = "GLSA-" + id
66+
vuln_references = [
67+
ReferenceV2(
68+
reference_id=glsa,
69+
url=f"https://security.gentoo.org/glsa/{id}",
70+
)
71+
]
7172

7273
for child in xml_root:
7374
if child.tag == "references":
@@ -79,19 +80,16 @@ def process_file(self, file):
7980
if child.tag == "affected":
8081
affected_packages = list(affected_and_safe_purls(child))
8182

82-
# It is very inefficient, to create new Advisory for each CVE
83-
# this way, but there seems no alternative.
84-
for cve in cves:
85-
yield AdvisoryData(
86-
advisory_id=cve,
87-
aliases=[cve],
88-
summary=summary,
89-
references=vuln_references,
90-
affected_packages=affected_packages,
91-
url=f"https://security.gentoo.org/glsa/{id}"
92-
if id
93-
else "https://security.gentoo.org/glsa",
94-
)
83+
yield AdvisoryData(
84+
advisory_id=glsa,
85+
aliases=cves,
86+
summary=summary,
87+
references_v2=vuln_references,
88+
affected_packages=affected_packages,
89+
url=f"https://security.gentoo.org/glsa/{id}"
90+
if id
91+
else "https://security.gentoo.org/glsa",
92+
)
9593

9694
def clean_downloads(self):
9795
if self.vcs_response:

‎vulnerabilities/tests/pipelines/v2_importers/test_gentoo_importer_v2.py‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# VulnerableCode is a trademark of nexB Inc.
4+
# SPDX-License-Identifier: Apache-2.0
5+
# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
6+
# See https://github.com/aboutcode-org/vulnerablecode for support or download.
7+
# See https://aboutcode.org for more information about nexB OSS projects.
8+
#
9+
10+
from pathlib import Path
11+
from unittest.mock import Mock, patch
12+
13+
import pytest
14+
15+
from vulnerabilities.pipelines.v2_importers.gentoo_importer import GentooImporterPipeline
16+
from vulnerabilities.tests import util_tests
17+
18+
TEST_DATA = Path(__file__).parent.parent.parent / "test_data" / "gentoo_v2"
19+
20+
TEST_CVE_FILES = [
21+
TEST_DATA / "glsa-201709-09.xml",
22+
TEST_DATA / "glsa-202511-02.xml",
23+
]
24+
25+
26+
@pytest.mark.django_db
27+
@pytest.mark.parametrize("xml_file", TEST_CVE_FILES)
28+
def test_gentoo_advisories_per_file(xml_file):
29+
pipeline = GentooImporterPipeline()
30+
pipeline.vcs_response = Mock(dest_dir=TEST_DATA)
31+
32+
with patch.object(Path, "glob", return_value=[xml_file]):
33+
result = [adv.to_dict() for adv in pipeline.collect_advisories()]
34+
35+
expected_file = xml_file.with_name(xml_file.stem + "-expected.json")
36+
util_tests.check_results_against_json(result, expected_file)

‎vulnerabilities/tests/test_data/gentoo_v2/glsa-201709-09-expected.json‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
[
2+
{
3+
"advisory_id": "GLSA-201709-09",
4+
"aliases": [
5+
"CVE-2017-9800"
6+
],
7+
"summary": "A command injection vulnerability in Subversion may allow remote\n attackers to execute arbitrary code.",
8+
"affected_packages": [
9+
{
10+
"package": {
11+
"type": "ebuild",
12+
"namespace": "dev-vcs",
13+
"name": "subversion",
14+
"version": "",
15+
"qualifiers": "",
16+
"subpath": ""
17+
},
18+
"affected_version_range": "vers:ebuild/0.1.1|!=1.9.7",
19+
"fixed_version_range": null,
20+
"introduced_by_commit_patches": [],
21+
"fixed_by_commit_patches": []
22+
}
23+
],
24+
"references_v2": [
25+
{
26+
"reference_id": "GLSA-201709-09",
27+
"reference_type": "",
28+
"url": "https://security.gentoo.org/glsa/201709-09"
29+
}
30+
],
31+
"patches": [],
32+
"severities": [],
33+
"date_published": null,
34+
"weaknesses": [],
35+
"url": "https://security.gentoo.org/glsa/201709-09"
36+
}
37+
]

‎vulnerabilities/tests/test_data/gentoo_v2/glsa-201709-09.xml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="201709-09">
4+
<title>Subversion: Arbitrary code execution</title>
5+
<synopsis>A command injection vulnerability in Subversion may allow remote
6+
attackers to execute arbitrary code.
7+
</synopsis>
8+
<product type="ebuild">subversion</product>
9+
<announced>2017-09-17</announced>
10+
<revised count="1">2017-09-17</revised>
11+
<bug>627480</bug>
12+
<access>remote</access>
13+
<affected>
14+
<package name="dev-vcs/subversion" auto="yes" arch="*">
15+
<unaffected range="ge">1.9.7</unaffected>
16+
<unaffected range="rgt">1.8.18</unaffected>
17+
<vulnerable range="lt">1.9.7</vulnerable>
18+
<vulnerable range="eq">0.1.1</vulnerable>
19+
20+
</package>
21+
</affected>
22+
<background>
23+
<p>Subversion is a version control system intended to eventually replace
24+
CVS. Like CVS, it has an optional client-server architecture (where the
25+
server can be an Apache server running mod_svn, or an ssh program as in
26+
CVS’s :ext: method). In addition to supporting the features found in
27+
CVS, Subversion also provides support for moving and copying files and
28+
directories.
29+
</p>
30+
</background>
31+
<description>
32+
<p>Specially crafted ‘ssh://...’ URLs may allow the owner of the
33+
repository to execute arbitrary commands on client’s machine if those
34+
commands are already installed on the client’s system. This is
35+
especially dangerous when the third-party repository has one or more
36+
submodules with specially crafted ‘ssh://...’ URLs. Each time the
37+
repository is recursively cloned or submodules are updated the payload
38+
will be triggered.
39+
</p>
40+
</description>
41+
<impact type="normal">
42+
<p>A remote attacker, by enticing a user to clone a specially crafted
43+
repository, could possibly execute arbitrary code with the privileges of
44+
the process.
45+
</p>
46+
</impact>
47+
<workaround>
48+
<p>There are several alternative ways to fix this vulnerability. Please
49+
refer to Subversion Team Announce for more details.
50+
</p>
51+
</workaround>
52+
<resolution>
53+
<p>All Subversion 1.9.x users should upgrade to the latest version:</p>
54+
55+
<code>
56+
# emerge --sync
57+
# emerge --ask --oneshot --verbose "&gt;=dev-vcs/subversion-1.9.7"
58+
</code>
59+
60+
<p>All Subversion 1.8.x users should upgrade to the latest version:</p>
61+
62+
<code>
63+
# emerge --sync
64+
# emerge --ask --oneshot --verbose "&gt;=dev-vcs/subversion-1.8.18"
65+
</code>
66+
</resolution>
67+
<references>
68+
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9800">
69+
CVE-2017-9800
70+
</uri>
71+
<uri link="https://subversion.apache.org/security/CVE-2017-9800-advisory.txt">
72+
Subversion Team Announce
73+
</uri>
74+
</references>
75+
<metadata tag="requester" timestamp="2017-09-01T12:55:21Z">b-man</metadata>
76+
<metadata tag="submitter" timestamp="2017-09-17T15:50:43Z">chrisadr</metadata>
77+
</glsa>

‎vulnerabilities/tests/test_data/gentoo_v2/glsa-202511-02-expected.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
[
2+
{
3+
"advisory_id": "GLSA-202511-02",
4+
"aliases": [
5+
"CVE-2024-40857",
6+
"CVE-2024-40866",
7+
"CVE-2024-44185",
8+
"CVE-2024-44187",
9+
"CVE-2024-44192",
10+
"CVE-2024-44244",
11+
"CVE-2024-44296",
12+
"CVE-2024-54467",
13+
"CVE-2024-54551",
14+
"CVE-2025-24201",
15+
"CVE-2025-24208",
16+
"CVE-2025-24209",
17+
"CVE-2025-24213",
18+
"CVE-2025-24216",
19+
"CVE-2025-24264",
20+
"CVE-2025-30427",
21+
"CVE-2025-31273",
22+
"CVE-2025-31278",
23+
"CVE-2025-43211",
24+
"CVE-2025-43212",
25+
"CVE-2025-43216",
26+
"CVE-2025-43227",
27+
"CVE-2025-43228",
28+
"CVE-2025-43240",
29+
"CVE-2025-43265"
30+
],
31+
"summary": "Multiple vulnerabilities have been discovered in WebKitGTK+, the worst of which can lead to execution of arbitary code.",
32+
"affected_packages": [
33+
{
34+
"package": {
35+
"type": "ebuild",
36+
"namespace": "net-libs",
37+
"name": "webkit-gtk",
38+
"version": "",
39+
"qualifiers": "",
40+
"subpath": ""
41+
},
42+
"affected_version_range": "vers:ebuild/!=2.48.5",
43+
"fixed_version_range": null,
44+
"introduced_by_commit_patches": [],
45+
"fixed_by_commit_patches": []
46+
}
47+
],
48+
"references_v2": [
49+
{
50+
"reference_id": "GLSA-202511-02",
51+
"reference_type": "",
52+
"url": "https://security.gentoo.org/glsa/202511-02"
53+
}
54+
],
55+
"patches": [],
56+
"severities": [],
57+
"date_published": null,
58+
"weaknesses": [],
59+
"url": "https://security.gentoo.org/glsa/202511-02"
60+
}
61+
]

‎vulnerabilities/tests/test_data/gentoo_v2/glsa-202511-02.xml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202511-02">
4+
<title>WebKitGTK+: Multiple Vulnerabilities</title>
5+
<synopsis>Multiple vulnerabilities have been discovered in WebKitGTK+, the worst of which can lead to execution of arbitary code.</synopsis>
6+
<product type="ebuild">webkit-gtk</product>
7+
<announced>2025-11-24</announced>
8+
<revised count="1">2025-11-24</revised>
9+
<bug>938026</bug>
10+
<bug>941276</bug>
11+
<bug>951739</bug>
12+
<bug>961021</bug>
13+
<access>remote</access>
14+
<affected>
15+
<package name="net-libs/webkit-gtk" auto="yes" arch="*">
16+
<unaffected range="ge" slot="4.1">2.48.5</unaffected>
17+
<unaffected range="ge" slot="6">2.48.5</unaffected>
18+
<vulnerable range="lt" slot="4.1">2.48.5</vulnerable>
19+
<vulnerable range="lt" slot="6">2.48.5</vulnerable>
20+
</package>
21+
</affected>
22+
<background>
23+
<p>WebKitGTK+ is a full-featured port of the WebKit rendering engine, suitable for projects requiring any kind of web integration, from hybrid HTML/CSS applications to full-fledged web browsers.</p>
24+
</background>
25+
<description>
26+
<p>Multiple vulnerabilities have been discovered in WebKitGTK+. Please review the CVE identifiers referenced below for details.</p>
27+
</description>
28+
<impact type="high">
29+
<p>Please review the referenced CVE identifiers for details.</p>
30+
</impact>
31+
<workaround>
32+
<p>There is no known workaround at this time.</p>
33+
</workaround>
34+
<resolution>
35+
<p>All WebKitGTK+ users should upgrade to the latest version:</p>
36+
37+
<code>
38+
# emerge --sync
39+
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.48.5:4.1" ">=net-libs/webkit-gtk-2.48.5:6"
40+
</code>
41+
</resolution>
42+
<references>
43+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-40857">CVE-2024-40857</uri>
44+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-40866">CVE-2024-40866</uri>
45+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-44185">CVE-2024-44185</uri>
46+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-44187">CVE-2024-44187</uri>
47+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-44192">CVE-2024-44192</uri>
48+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-44244">CVE-2024-44244</uri>
49+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-44296">CVE-2024-44296</uri>
50+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-54467">CVE-2024-54467</uri>
51+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-54551">CVE-2024-54551</uri>
52+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-24201">CVE-2025-24201</uri>
53+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-24208">CVE-2025-24208</uri>
54+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-24209">CVE-2025-24209</uri>
55+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-24213">CVE-2025-24213</uri>
56+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-24216">CVE-2025-24216</uri>
57+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-24264">CVE-2025-24264</uri>
58+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-30427">CVE-2025-30427</uri>
59+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-31273">CVE-2025-31273</uri>
60+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-31278">CVE-2025-31278</uri>
61+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-43211">CVE-2025-43211</uri>
62+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-43212">CVE-2025-43212</uri>
63+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-43216">CVE-2025-43216</uri>
64+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-43227">CVE-2025-43227</uri>
65+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-43228">CVE-2025-43228</uri>
66+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-43240">CVE-2025-43240</uri>
67+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2025-43265">CVE-2025-43265</uri>
68+
<uri link="https://webkitgtk.org/security/WSA-2025-0002.html">WSA-2025-0002</uri>
69+
<uri link="https://webkitgtk.org/security/WSA-2025-0003.html">WSA-2025-0003</uri>
70+
</references>
71+
<metadata tag="requester" timestamp="2025-11-24T23:57:31.542544Z">graaff</metadata>
72+
<metadata tag="submitter" timestamp="2025-11-24T23:57:31.545141Z">sam</metadata>
73+
</glsa>

0 commit comments

Comments
 (0)