Skip to content

Commit 7ef7684

Browse files
ziadhanyziadhany
committed
Add a test for gentoo importer v2
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
1 parent fae4098 commit 7ef7684

File tree

8 files changed

+423
-26
lines changed

8 files changed

+423
-26
lines changed

‎vulnerabilities/pipelines/v2_importers/gentoo_importer.py‎

Lines changed: 43 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,15 @@
1717
from univers.version_constraint import VersionConstraint
1818
from univers.version_range import EbuildVersionRange
1919
from univers.versions import GentooVersion
20+
from univers.versions import InvalidVersion
2021

2122
from vulnerabilities.importer import AdvisoryData
2223
from vulnerabilities.importer import AffectedPackageV2
2324
from vulnerabilities.importer import ReferenceV2
25+
from vulnerabilities.importer import VulnerabilitySeverity
26+
from vulnerabilities.management.commands.commit_export import logger
2427
from vulnerabilities.pipelines import VulnerableCodeBaseImporterPipelineV2
28+
from vulnerabilities.severity_systems import GENERIC
2529

2630

2731
class GentooImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
@@ -57,18 +61,19 @@ def collect_advisories(self) -> Iterable[AdvisoryData]:
5761
def process_file(self, file):
5862
cves = []
5963
summary = ""
60-
vuln_references = []
6164
xml_root = ET.parse(file).getroot()
6265
id = xml_root.attrib.get("id")
63-
if id:
64-
glsa = "GLSA-" + id
65-
vuln_references = [
66-
ReferenceV2(
67-
reference_id=glsa,
68-
url=f"https://security.gentoo.org/glsa/{id}",
69-
)
70-
]
66+
glsa = "GLSA-" + id
67+
68+
vuln_references = [
69+
ReferenceV2(
70+
reference_id=glsa,
71+
url=f"https://security.gentoo.org/glsa/{id}",
72+
)
73+
]
7174

75+
severities = []
76+
affected_packages = []
7277
for child in xml_root:
7378
if child.tag == "references":
7479
cves = self.cves_from_reference(child)
@@ -79,19 +84,23 @@ def process_file(self, file):
7984
if child.tag == "affected":
8085
affected_packages = list(affected_and_safe_purls(child))
8186

82-
# It is very inefficient, to create new Advisory for each CVE
83-
# this way, but there seems no alternative.
84-
for cve in cves:
85-
yield AdvisoryData(
86-
advisory_id=cve,
87-
aliases=[cve],
88-
summary=summary,
89-
references=vuln_references,
90-
affected_packages=affected_packages,
91-
url=f"https://security.gentoo.org/glsa/{id}"
92-
if id
93-
else "https://security.gentoo.org/glsa",
94-
)
87+
if child.tag == "impact":
88+
severity_value = child.attrib.get("type")
89+
if severity_value:
90+
severities.append(VulnerabilitySeverity(system=GENERIC, value=severity_value))
91+
92+
yield AdvisoryData(
93+
advisory_id=glsa,
94+
aliases=cves,
95+
summary=summary,
96+
references_v2=vuln_references,
97+
severities=severities,
98+
affected_packages=affected_packages,
99+
url=f"https://security.gentoo.org/glsa/{id}"
100+
if id
101+
else "https://security.gentoo.org/glsa",
102+
original_advisory_text=file,
103+
)
95104

96105
def clean_downloads(self):
97106
if self.vcs_response:
@@ -123,12 +132,20 @@ def affected_and_safe_purls(affected_elem):
123132
safe_versions, affected_versions = get_safe_and_affected_versions(pkg)
124133

125134
for version in safe_versions:
126-
constraints.append(
127-
VersionConstraint(version=GentooVersion(version), comparator="=").invert()
128-
)
135+
try:
136+
constraints.append(
137+
VersionConstraint(version=GentooVersion(version), comparator="=").invert()
138+
)
139+
except InvalidVersion as e:
140+
logger.error(f"InvalidVersion - version: {version} - error:{e}")
129141

130142
for version in affected_versions:
131-
constraints.append(VersionConstraint(version=GentooVersion(version), comparator="="))
143+
try:
144+
constraints.append(
145+
VersionConstraint(version=GentooVersion(version), comparator="=")
146+
)
147+
except InvalidVersion as e:
148+
logger.error(f"InvalidVersion - version: {version} - error:{e}")
132149

133150
if not constraints:
134151
continue

‎vulnerabilities/tests/pipelines/v2_importers/test_gentoo_importer_v2.py‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# VulnerableCode is a trademark of nexB Inc.
4+
# SPDX-License-Identifier: Apache-2.0
5+
# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
6+
# See https://github.com/aboutcode-org/vulnerablecode for support or download.
7+
# See https://aboutcode.org for more information about nexB OSS projects.
8+
#
9+
10+
from pathlib import Path
11+
from unittest.mock import Mock
12+
from unittest.mock import patch
13+
14+
import pytest
15+
16+
from vulnerabilities.pipelines.v2_importers.gentoo_importer import GentooImporterPipeline
17+
from vulnerabilities.tests import util_tests
18+
19+
TEST_DATA = Path(__file__).parent.parent.parent / "test_data" / "gentoo_v2"
20+
21+
TEST_CVE_FILES = [
22+
TEST_DATA / "glsa-201709-09.xml",
23+
TEST_DATA / "glsa-202511-02.xml",
24+
TEST_DATA / "glsa-202512-01.xml",
25+
]
26+
27+
28+
@pytest.mark.django_db
29+
@pytest.mark.parametrize("xml_file", TEST_CVE_FILES)
30+
def test_gentoo_advisories_per_file(xml_file):
31+
pipeline = GentooImporterPipeline()
32+
pipeline.vcs_response = Mock(dest_dir=TEST_DATA)
33+
34+
with patch.object(Path, "glob", return_value=[xml_file]):
35+
result = [adv.to_dict() for adv in pipeline.collect_advisories()]
36+
37+
expected_file = xml_file.with_name(xml_file.stem + "-expected.json")
38+
util_tests.check_results_against_json(result, expected_file)

‎vulnerabilities/tests/test_data/gentoo_v2/glsa-201709-09-expected.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
[
2+
{
3+
"advisory_id": "GLSA-201709-09",
4+
"aliases": [
5+
"CVE-2017-9800"
6+
],
7+
"summary": "A command injection vulnerability in Subversion may allow remote\n attackers to execute arbitrary code.",
8+
"affected_packages": [
9+
{
10+
"package": {
11+
"type": "ebuild",
12+
"namespace": "dev-vcs",
13+
"name": "subversion",
14+
"version": "",
15+
"qualifiers": "",
16+
"subpath": ""
17+
},
18+
"affected_version_range": "vers:ebuild/0.1.1|!=1.9.7",
19+
"fixed_version_range": null,
20+
"introduced_by_commit_patches": [],
21+
"fixed_by_commit_patches": []
22+
}
23+
],
24+
"references_v2": [
25+
{
26+
"reference_id": "GLSA-201709-09",
27+
"reference_type": "",
28+
"url": "https://security.gentoo.org/glsa/201709-09"
29+
}
30+
],
31+
"patches": [],
32+
"severities": [
33+
{
34+
"system": "generic_textual",
35+
"value": "normal",
36+
"scoring_elements": ""
37+
}
38+
],
39+
"date_published": null,
40+
"weaknesses": [],
41+
"url": "https://security.gentoo.org/glsa/201709-09"
42+
}
43+
]

‎vulnerabilities/tests/test_data/gentoo_v2/glsa-201709-09.xml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="201709-09">
4+
<title>Subversion: Arbitrary code execution</title>
5+
<synopsis>A command injection vulnerability in Subversion may allow remote
6+
attackers to execute arbitrary code.
7+
</synopsis>
8+
<product type="ebuild">subversion</product>
9+
<announced>2017-09-17</announced>
10+
<revised count="1">2017-09-17</revised>
11+
<bug>627480</bug>
12+
<access>remote</access>
13+
<affected>
14+
<package name="dev-vcs/subversion" auto="yes" arch="*">
15+
<unaffected range="ge">1.9.7</unaffected>
16+
<unaffected range="rgt">1.8.18</unaffected>
17+
<vulnerable range="lt">1.9.7</vulnerable>
18+
<vulnerable range="eq">0.1.1</vulnerable>
19+
20+
</package>
21+
</affected>
22+
<background>
23+
<p>Subversion is a version control system intended to eventually replace
24+
CVS. Like CVS, it has an optional client-server architecture (where the
25+
server can be an Apache server running mod_svn, or an ssh program as in
26+
CVS’s :ext: method). In addition to supporting the features found in
27+
CVS, Subversion also provides support for moving and copying files and
28+
directories.
29+
</p>
30+
</background>
31+
<description>
32+
<p>Specially crafted ‘ssh://...’ URLs may allow the owner of the
33+
repository to execute arbitrary commands on client’s machine if those
34+
commands are already installed on the client’s system. This is
35+
especially dangerous when the third-party repository has one or more
36+
submodules with specially crafted ‘ssh://...’ URLs. Each time the
37+
repository is recursively cloned or submodules are updated the payload
38+
will be triggered.
39+
</p>
40+
</description>
41+
<impact type="normal">
42+
<p>A remote attacker, by enticing a user to clone a specially crafted
43+
repository, could possibly execute arbitrary code with the privileges of
44+
the process.
45+
</p>
46+
</impact>
47+
<workaround>
48+
<p>There are several alternative ways to fix this vulnerability. Please
49+
refer to Subversion Team Announce for more details.
50+
</p>
51+
</workaround>
52+
<resolution>
53+
<p>All Subversion 1.9.x users should upgrade to the latest version:</p>
54+
55+
<code>
56+
# emerge --sync
57+
# emerge --ask --oneshot --verbose "&gt;=dev-vcs/subversion-1.9.7"
58+
</code>
59+
60+
<p>All Subversion 1.8.x users should upgrade to the latest version:</p>
61+
62+
<code>
63+
# emerge --sync
64+
# emerge --ask --oneshot --verbose "&gt;=dev-vcs/subversion-1.8.18"
65+
</code>
66+
</resolution>
67+
<references>
68+
<uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9800">
69+
CVE-2017-9800
70+
</uri>
71+
<uri link="https://subversion.apache.org/security/CVE-2017-9800-advisory.txt">
72+
Subversion Team Announce
73+
</uri>
74+
</references>
75+
<metadata tag="requester" timestamp="2017-09-01T12:55:21Z">b-man</metadata>
76+
<metadata tag="submitter" timestamp="2017-09-17T15:50:43Z">chrisadr</metadata>
77+
</glsa>

‎vulnerabilities/tests/test_data/gentoo_v2/glsa-202511-02-expected.json‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
[
2+
{
3+
"advisory_id": "GLSA-202511-02",
4+
"aliases": [
5+
"CVE-2024-40857",
6+
"CVE-2024-40866",
7+
"CVE-2024-44185",
8+
"CVE-2024-44187",
9+
"CVE-2024-44192",
10+
"CVE-2024-44244",
11+
"CVE-2024-44296",
12+
"CVE-2024-54467",
13+
"CVE-2024-54551",
14+
"CVE-2025-24201",
15+
"CVE-2025-24208",
16+
"CVE-2025-24209",
17+
"CVE-2025-24213",
18+
"CVE-2025-24216",
19+
"CVE-2025-24264",
20+
"CVE-2025-30427",
21+
"CVE-2025-31273",
22+
"CVE-2025-31278",
23+
"CVE-2025-43211",
24+
"CVE-2025-43212",
25+
"CVE-2025-43216",
26+
"CVE-2025-43227",
27+
"CVE-2025-43228",
28+
"CVE-2025-43240",
29+
"CVE-2025-43265"
30+
],
31+
"summary": "Multiple vulnerabilities have been discovered in WebKitGTK+, the worst of which can lead to execution of arbitary code.",
32+
"affected_packages": [
33+
{
34+
"package": {
35+
"type": "ebuild",
36+
"namespace": "net-libs",
37+
"name": "webkit-gtk",
38+
"version": "",
39+
"qualifiers": "",
40+
"subpath": ""
41+
},
42+
"affected_version_range": "vers:ebuild/!=2.48.5",
43+
"fixed_version_range": null,
44+
"introduced_by_commit_patches": [],
45+
"fixed_by_commit_patches": []
46+
}
47+
],
48+
"references_v2": [
49+
{
50+
"reference_id": "GLSA-202511-02",
51+
"reference_type": "",
52+
"url": "https://security.gentoo.org/glsa/202511-02"
53+
}
54+
],
55+
"patches": [],
56+
"severities": [
57+
{
58+
"system": "generic_textual",
59+
"value": "high",
60+
"scoring_elements": ""
61+
}
62+
],
63+
"date_published": null,
64+
"weaknesses": [],
65+
"url": "https://security.gentoo.org/glsa/202511-02"
66+
}
67+
]

0 commit comments

Comments
 (0)