vulnerability_test.go

package vulnerability_test

import (
	"testing"

	"github.com/stretchr/testify/assert"

	"github.com/aquasecurity/trivy-db/pkg/db"
	"github.com/aquasecurity/trivy-db/pkg/dbtest"
	"github.com/aquasecurity/trivy-db/pkg/types"
	"github.com/aquasecurity/trivy-db/pkg/utils"
	"github.com/aquasecurity/trivy-db/pkg/vulnsrc/vulnerability"
)

func TestGetDetails(t *testing.T) {
	testCases := []struct {
		name     string
		vulnID   string
		fixtures []string
		want     map[types.SourceID]types.VulnerabilityDetail
	}{
		{
			name:     "happy path",
			vulnID:   "CVE-2020-1234",
			fixtures: []string{"testdata/fixtures/happy.yaml"},
			want: map[types.SourceID]types.VulnerabilityDetail{
				vulnerability.NVD: {
					CvssScore:        4.2,
					CvssVector:       "AV:N/AC:M/Au:N/C:N/I:P/A:N",
					CvssScoreV3:      5.6,
					CvssVectorV3:     "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
					SeverityV3:       types.SeverityHigh,
					CweIDs:           []string{"CWE-125", "CWE-200"},
					LastModifiedDate: utils.MustTimeParse("2020-01-01T01:02:03Z"),
					PublishedDate:    utils.MustTimeParse("2001-01-01T01:02:03Z"),
				},
				vulnerability.RedHat: {
					CvssScoreV3:  6.7,
					CvssVectorV3: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
					SeverityV3:   types.SeverityHigh,
					Title:        "test vulnerability",
					Description:  "a test vulnerability where vendor rates it lower than NVD",
					References:   []string{"http://foo-bar.com/baz"},
				},
			},
		},
		{
			name:     "no advisories are returned",
			fixtures: []string{"testdata/fixtures/happy.yaml"},
			vulnID:   "CVE-2020-9999",
			want:     nil,
		},
		{
			name:     "GetVulnerabilityDetail returns an error",
			fixtures: []string{"testdata/fixtures/sad.yaml"},
			vulnID:   "CVE-2020-1234",
			want:     nil,
		},
	}

	for _, tc := range testCases {
		t.Run(tc.name, func(t *testing.T) {
			_ = dbtest.InitDB(t, tc.fixtures)
			defer db.Close()

			v := vulnerability.New(db.Config{})
			got := v.GetDetails(tc.vulnID)

			assert.Equal(t, tc.want, got)
		})
	}
}

func TestIsRejected(t *testing.T) {
	testCases := []struct {
		name    string
		details map[types.SourceID]types.VulnerabilityDetail
		want    bool
	}{
		{
			name: "happy path",
			details: map[types.SourceID]types.VulnerabilityDetail{
				vulnerability.NVD: {
					ID:          "CVE-2020-1234",
					CvssScore:   9.1,
					Title:       "test vulnerability",
					Description: "a test vulnerability where vendor rates it lower than NVD",
					VulnStatus:  "Modified",
				},
				vulnerability.RedHat: {
					ID:          "CVE-2020-1234",
					CvssScoreV3: 5.6,
					Title:       "test vulnerability",
					Description: "a test vulnerability where vendor rates it lower than NVD",
				},
			},
			want: false,
		},
		{
			name: "happy path, when vulnerability from redhat and ubuntu is rejected by Nvd",
			details: map[types.SourceID]types.VulnerabilityDetail{
				vulnerability.RedHat: {
					ID:          "CVE-2020-1234",
					CvssScoreV3: 5.6,
					Title:       "test vulnerability",
					Description: "a test vulnerability where vendor rates it lower than NVD",
				},
				vulnerability.Ubuntu: {
					ID:          "CVE-2020-1234",
					CvssScore:   1.2,
					CvssScoreV3: 3.4,
					Severity:    types.SeverityLow,
					SeverityV3:  types.SeverityMedium,
					Title:       "test vulnerability",
					Description: "a test vulnerability where vendor rates it lower than NVD",
				},
				vulnerability.NVD: {
					ID:          "CVE-2020-1234",
					CvssScore:   9.1,
					Title:       "test vulnerability",
					Description: "** REJECT ** a test vulnerability where vendor rates it lower than NVD",
					VulnStatus:  "Rejected",
				},
			},
			want: true,
		},
	}

	for _, tc := range testCases {
		t.Run(tc.name, func(t *testing.T) {
			got := vulnerability.New(nil).IsRejected(tc.details)
			assert.Equal(t, tc.want, got)
		})
	}
}

func TestNormalize(t *testing.T) {
	testCases := []struct {
		name    string
		vulnID  string
		details map[types.SourceID]types.VulnerabilityDetail
		want    types.Vulnerability
	}{
		{
			name:   "happy path",
			vulnID: "CVE-2020-1234",
			details: map[types.SourceID]types.VulnerabilityDetail{
				vulnerability.NVD: {
					CvssScore:        4.2,
					CvssVector:       "AV:N/AC:M/Au:N/C:N/I:P/A:N",
					CvssScoreV3:      5.6,
					CvssVectorV3:     "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
					SeverityV3:       types.SeverityMedium,
					CweIDs:           []string{"CWE-125", "CWE-200"},
					LastModifiedDate: utils.MustTimeParse("2020-01-01T01:02:03Z"),
					PublishedDate:    utils.MustTimeParse("2001-01-01T01:02:03Z"),
				},
				vulnerability.RedHat: {
					CvssScoreV3:  6.7,
					CvssVectorV3: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
					SeverityV3:   types.SeverityHigh,
					Title:        "test vulnerability",
					Description:  "a test vulnerability where vendor rates it lower than NVD",
					References:   []string{"http://foo-bar.com/baz"},
				},
			},
			want: types.Vulnerability{
				Title:       "test vulnerability",
				Description: "a test vulnerability where vendor rates it lower than NVD",
				Severity:    types.SeverityMedium.String(),
				VendorSeverity: types.VendorSeverity{
					vulnerability.NVD:    types.SeverityMedium,
					vulnerability.RedHat: types.SeverityHigh,
				},
				CVSS: types.VendorCVSS{
					vulnerability.NVD: types.CVSS{
						V2Vector: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
						V3Vector: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
						V2Score:  4.2,
						V3Score:  5.6,
					},
					vulnerability.RedHat: types.CVSS{
						V2Vector: "",
						V3Vector: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
						V2Score:  0,
						V3Score:  6.7,
					},
				},
				CweIDs:           []string{"CWE-125", "CWE-200"},
				References:       []string{"http://foo-bar.com/baz"},
				LastModifiedDate: utils.MustTimeParse("2020-01-01T01:02:03Z"),
				PublishedDate:    utils.MustTimeParse("2001-01-01T01:02:03Z"),
			},
		},
		{
			name:   "happy path, classifications for redhat, ubuntu and nodejs with variety of scores and vectors",
			vulnID: "CVE-2020-1234",
			details: map[types.SourceID]types.VulnerabilityDetail{
				vulnerability.RedHat: {
					ID:           "CVE-2020-1234",
					CvssScore:    4.2,
					CvssVector:   "AV:N/AC:M/Au:N/C:N/I:P/A:N",
					CvssScoreV3:  5.6,
					CvssVectorV3: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
					SeverityV3:   types.SeverityCritical,
					Title:        "test vulnerability",
					Description:  "a test vulnerability where vendor rates it lower than NVD",
					References:   []string{"http://foo-bar.com/baz"},
				},
				vulnerability.Ubuntu: {
					ID:           "CVE-2020-1234",
					CvssScoreV3:  3.4,
					CvssVectorV3: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
					Severity:     types.SeverityLow,
					SeverityV3:   types.SeverityMedium,
					Title:        "test vulnerability",
					Description:  "a test vulnerability where vendor rates it lower than NVD",
				},
				vulnerability.NodejsSecurityWg: {
					ID:          "CVE-2020-1234",
					CvssScore:   -1,
					Title:       "test vulnerability",
					Description: "a test vulnerability where vendor rates it lower than NVD",
				},
			},
			want: types.Vulnerability{
				Title:       "test vulnerability",
				Description: "a test vulnerability where vendor rates it lower than NVD",
				Severity:    types.SeverityMedium.String(), // from Red Hat
				VendorSeverity: types.VendorSeverity{
					vulnerability.RedHat: types.SeverityCritical,
					vulnerability.Ubuntu: types.SeverityMedium,
				},
				CVSS: types.VendorCVSS{
					vulnerability.RedHat: types.CVSS{
						V2Vector: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
						V3Vector: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
						V2Score:  4.2,
						V3Score:  5.6,
					},
					vulnerability.Ubuntu: types.CVSS{
						V3Vector: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
						V3Score:  3.4,
					},
				},
				References: []string{"http://foo-bar.com/baz"},
			},
		},
		{
			name:   "happy path, classifications for ubuntu and nodejs with variety vectors but no scores",
			vulnID: "CVE-2020-1234",
			details: map[types.SourceID]types.VulnerabilityDetail{
				vulnerability.Ubuntu: {
					ID:          "CVE-2020-1234",
					Severity:    types.SeverityLow,
					SeverityV3:  types.SeverityMedium,
					Title:       "test vulnerability",
					Description: "a test vulnerability where vendor rates it lower than NVD",
				},
				vulnerability.NodejsSecurityWg: {
					ID:          "CVE-2020-1234",
					Title:       "test vulnerability",
					Description: "a test vulnerability where vendor rates it lower than NVD",
				},
			},
			want: types.Vulnerability{
				Severity: types.SeverityMedium.String(),
				VendorSeverity: types.VendorSeverity{
					vulnerability.Ubuntu: types.SeverityMedium,
				},
				CVSS:        types.VendorCVSS{},
				Title:       "test vulnerability",
				Description: "a test vulnerability where vendor rates it lower than NVD",
			},
		},
		{
			name:   "happy path, nvd CVSS v4.0",
			vulnID: "CVE-2020-1234",
			details: map[types.SourceID]types.VulnerabilityDetail{
				vulnerability.NVD: {
					Description:   "a test vulnerability for NVD CVSS v4.0",
					CvssScoreV3:   9.8,
					CvssVectorV3:  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
					CvssScoreV40:  6.9,
					CvssVectorV40: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
					SeverityV3:    types.SeverityCritical,
					SeverityV40:   types.SeverityMedium,
					CweIDs:        []string{"CWE-287"},
					References: []string{
						"https://github.com/GTA12138/vul/blob/main/clash%20for%20windows.md",
						"https://vuldb.com/?ctiid.267406", "https://vuldb.com/?id.267406",
						"https://vuldb.com/?submit.345469",
					},
					LastModifiedDate: utils.MustTimeParse("2024-06-11T17:57:13.767Z"),
					PublishedDate:    utils.MustTimeParse("2024-06-07T10:15:12.293Z"),
				},
			},
			want: types.Vulnerability{
				Description: "a test vulnerability for NVD CVSS v4.0",
				Severity:    types.SeverityMedium.String(),
				VendorSeverity: types.VendorSeverity{
					vulnerability.NVD: types.SeverityMedium,
				},
				CVSS: types.VendorCVSS{
					vulnerability.NVD: types.CVSS{
						V3Vector:  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
						V40Vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
						V3Score:   9.8,
						V40Score:  6.9,
					},
				},
				CweIDs: []string{"CWE-287"},
				References: []string{
					"https://github.com/GTA12138/vul/blob/main/clash%20for%20windows.md",
					"https://vuldb.com/?ctiid.267406", "https://vuldb.com/?id.267406",
					"https://vuldb.com/?submit.345469",
				},
				LastModifiedDate: utils.MustTimeParse("2024-06-11T17:57:13.767Z"),
				PublishedDate:    utils.MustTimeParse("2024-06-07T10:15:12.293Z"),
			},
		},
		{
			name:   "happy path, both nvd and ghsa have published & modified date information and nvd is preferred",
			vulnID: "CVE-2020-1234",
			details: map[types.SourceID]types.VulnerabilityDetail{
				vulnerability.NVD: {
					LastModifiedDate: utils.MustTimeParse("2024-06-11T17:57:13.767Z"),
					PublishedDate:    utils.MustTimeParse("2024-06-07T10:15:12.293Z"),
				},
				vulnerability.GHSA: {
					LastModifiedDate: utils.MustTimeParse("2023-06-11T17:57:13.767Z"),
					PublishedDate:    utils.MustTimeParse("2023-06-07T10:15:12.293Z"),
				},
			},
			want: types.Vulnerability{
				LastModifiedDate: utils.MustTimeParse("2024-06-11T17:57:13.767Z"),
				PublishedDate:    utils.MustTimeParse("2024-06-07T10:15:12.293Z"),
				Severity:         types.SeverityUnknown.String(),
				VendorSeverity:   types.VendorSeverity{},
				CVSS:             types.VendorCVSS{},
			},
		},
		{
			name:   "happy path, only ghsa has published & modified date information and ghsa is preferred",
			vulnID: "GHSA-1234-5678-0000",
			details: map[types.SourceID]types.VulnerabilityDetail{
				vulnerability.NVD: {},
				vulnerability.GHSA: {
					LastModifiedDate: utils.MustTimeParse("2023-06-11T17:57:13.767Z"),
					PublishedDate:    utils.MustTimeParse("2023-06-07T10:15:12.293Z"),
				},
			},
			want: types.Vulnerability{
				LastModifiedDate: utils.MustTimeParse("2023-06-11T17:57:13.767Z"),
				PublishedDate:    utils.MustTimeParse("2023-06-07T10:15:12.293Z"),
				Severity:         types.SeverityUnknown.String(),
				VendorSeverity:   types.VendorSeverity{},
				CVSS:             types.VendorCVSS{},
			},
		},
	}

	for _, tc := range testCases {
		t.Run(tc.name, func(t *testing.T) {
			got := vulnerability.New(nil).Normalize(tc.vulnID, tc.details)
			assert.Equal(t, tc.want, got)
		})
	}
}