Skip to content

Commit

Permalink
test: add appropriate parsed BOMs
Browse files Browse the repository at this point in the history 
Signed-off-by: knqyf263 <[email protected]>
  • Loading branch information
@knqyf263
knqyf263 committed Sep 13, 2024
1 parent 418100c commit 0bb6387
Show file tree
Hide file tree
Showing 7 changed files with 197 additions and 155 deletions.
4 changes: 2 additions & 2 deletions integration/sbom_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -59,14 +59,14 @@ func TestSBOM(t *testing.T) {
golden: "testdata/fluentd-multiple-lockfiles.json.golden",
},
{
name: "scan SBOM into SBOM",
name: "scan CycloneDX into CycloneDX",
args: args{
input: "testdata/fixtures/sbom/fluentd-multiple-lockfiles-cyclonedx.json",
format: "cyclonedx",
artifactType: "cyclonedx",
},
fakeUUID: "3ff14136-e09f-4df9-80ea-%012d",
golden: "testdata/fluentd-multiple-lockfiles-short.cdx.json.golden",
golden: "testdata/fluentd-multiple-lockfiles-reused.cdx.json.golden",
},
{
name: "minikube KBOM",
Expand Down
6 changes: 3 additions & 3 deletions integration/testdata/fixtures/sbom/fluentd-multiple-lockfiles-cyclonedx.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,7 @@
]
},
{
"bom-ref": "pkg:gem/[email protected]?file_path=var%2Flib%2Fgems%2F2.5.0%2Fspecifications%2Factivesupport-6.0.2.1.gemspec",
"bom-ref": "179eaea5-d48e-4dd3-a53d-c87c3f6e9e5b",
"type": "library",
"name": "activesupport",
"version": "6.0.2.1",
Expand Down Expand Up @@ -163,8 +163,8 @@
{
"ref": "95de56ee-980c-413d-8f68-6c674dc3e9d1",
"dependsOn": [
"353f2470-9c8b-4647-9d0d-96d893838dc8",
"pkg:gem/[email protected]?file_path=var%2Flib%2Fgems%2F2.5.0%2Fspecifications%2Factivesupport-6.0.2.1.gemspec"
"179eaea5-d48e-4dd3-a53d-c87c3f6e9e5b",
"353f2470-9c8b-4647-9d0d-96d893838dc8"
]
}
]
Expand Down
64 changes: 28 additions & 36 deletions ...-multiple-lockfiles-short.cdx.json.golden → ...multiple-lockfiles-reused.cdx.json.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:3ff14136-e09f-4df9-80ea-000000000010",
"serialNumber": "urn:uuid:3ff14136-e09f-4df9-80ea-000000000006",
"version": 1,
"metadata": {
"timestamp": "2021-08-25T12:20:30+00:00",
Expand Down Expand Up @@ -80,21 +80,21 @@
"version": "5.0-4",
"purl": "pkg:deb/debian/[email protected]?distro=debian-10.2",
"properties": [
{
"name": "aquasecurity:trivy:PkgID",
"value": "[email protected]"
},
{
"name": "aquasecurity:trivy:PkgType",
"value": "debian"
},
{
"name": "aquasecurity:trivy:SrcName",
"value": "bash"
},
{
"name": "aquasecurity:trivy:SrcVersion",
"value": "5.0-4"
},
{
"name": "aquasecurity:trivy:LayerDigest",
"value": "sha256:000eee12ec04cc914bf96e8f5dee7767510c2aca3816af6078bd9fbe3150920c"
},
{
"name": "aquasecurity:trivy:LayerDiffID",
"value": "sha256:831c5620387fb9efec59fc82a42b948546c6be601e3ab34a87108ecf852aa15f"
}
]
},
Expand All @@ -105,26 +105,26 @@
"version": "2.0.5-1",
"purl": "pkg:deb/debian/[email protected]?distro=debian-10.2",
"properties": [
{
"name": "aquasecurity:trivy:PkgID",
"value": "[email protected]"
},
{
"name": "aquasecurity:trivy:PkgType",
"value": "debian"
},
{
"name": "aquasecurity:trivy:SrcName",
"value": "libidn2"
},
{
"name": "aquasecurity:trivy:SrcVersion",
"value": "2.0.5-1"
},
{
"name": "aquasecurity:trivy:LayerDigest",
"value": "sha256:000eee12ec04cc914bf96e8f5dee7767510c2aca3816af6078bd9fbe3150920c"
},
{
"name": "aquasecurity:trivy:LayerDiffID",
"value": "sha256:831c5620387fb9efec59fc82a42b948546c6be601e3ab34a87108ecf852aa15f"
}
]
},
{
"bom-ref": "pkg:gem/[email protected]?file_path=var%2Flib%2Fgems%2F2.5.0%2Fspecifications%2Factivesupport-6.0.2.1.gemspec",
"bom-ref": "179eaea5-d48e-4dd3-a53d-c87c3f6e9e5b",
"type": "library",
"name": "activesupport",
"version": "6.0.2.1",
Expand All @@ -142,11 +142,15 @@
"value": "var/lib/gems/2.5.0/specifications/activesupport-6.0.2.1.gemspec"
},
{
"name": "aquasecurity:trivy:PkgID",
"value": "[email protected]"
"name": "aquasecurity:trivy:LayerDigest",
"value": "sha256:a8877cad19f14a7044524a145ce33170085441a7922458017db1631dcd5f7602"
},
{
"name": "aquasecurity:trivy:LayerDiffID",
"value": "sha256:75e43d55939745950bc3f8fad56c5834617c4339f0f54755e69a0dd5372624e9"
},
{
"name": "aquasecurity:trivy:PkgType",
"name": "aquasecurity:trivy:Type",
"value": "gemspec"
}
]
Expand All @@ -163,21 +167,9 @@
{
"ref": "95de56ee-980c-413d-8f68-6c674dc3e9d1",
"dependsOn": [
"353f2470-9c8b-4647-9d0d-96d893838dc8",
"pkg:gem/[email protected]?file_path=var%2Flib%2Fgems%2F2.5.0%2Fspecifications%2Factivesupport-6.0.2.1.gemspec"
"179eaea5-d48e-4dd3-a53d-c87c3f6e9e5b",
"353f2470-9c8b-4647-9d0d-96d893838dc8"
]
},
{
"ref": "pkg:deb/debian/[email protected]?distro=debian-10.2",
"dependsOn": []
},
{
"ref": "pkg:deb/debian/[email protected]?distro=debian-10.2",
"dependsOn": []
},
{
"ref": "pkg:gem/[email protected]?file_path=var%2Flib%2Fgems%2F2.5.0%2Fspecifications%2Factivesupport-6.0.2.1.gemspec",
"dependsOn": []
}
],
"vulnerabilities": [
Expand Down Expand Up @@ -512,7 +504,7 @@
"updated": "2020-10-17T12:15:00+00:00",
"affects": [
{
"ref": "pkg:gem/[email protected]?file_path=var%2Flib%2Fgems%2F2.5.0%2Fspecifications%2Factivesupport-6.0.2.1.gemspec",
"ref": "179eaea5-d48e-4dd3-a53d-c87c3f6e9e5b",
"versions": [
{
"version": "6.0.2.1",
Expand Down
2 changes: 1 addition & 1 deletion integration/testdata/fluentd-multiple-lockfiles.json.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -168,7 +168,7 @@
"PkgIdentifier": {
"PURL": "pkg:gem/[email protected]",
"UID": "66a6de64809697cd",
"BOMRef": "pkg:gem/[email protected]?file_path=var%2Flib%2Fgems%2F2.5.0%2Fspecifications%2Factivesupport-6.0.2.1.gemspec"
"BOMRef": "179eaea5-d48e-4dd3-a53d-c87c3f6e9e5b"
},
"InstalledVersion": "6.0.2.1",
"FixedVersion": "6.0.3.1, 5.2.4.3",
Expand Down
160 changes: 99 additions & 61 deletions pkg/sbom/cyclonedx/marshal_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -65,21 +65,6 @@ var (
)

func TestMarshaler_MarshalReport(t *testing.T) {
testSBOM := core.NewBOM(core.Options{GenerateBOMRef: true})
testSBOM.AddComponent(&core.Component{
Root: true,
Type: core.TypeApplication,
Name: "jackson-databind-2.13.4.1.jar",
PkgIdentifier: ftypes.PkgIdentifier{
BOMRef: "aff65b54-6009-4c32-968d-748949ef46e8",
},
Properties: []core.Property{
{
Name: "SchemaVersion",
Value: "2",
},
},
})

tests := []struct {
name string
Expand Down Expand Up @@ -1475,61 +1460,18 @@ func TestMarshaler_MarshalReport(t *testing.T) {
},
},
Vulnerabilities: []types.DetectedVulnerability{
{
VulnerabilityID: "CVE-2022-42003",
PkgName: "com.fasterxml.jackson.core:jackson-databind",
PkgPath: "jackson-databind-2.13.4.1.jar",
PkgIdentifier: ftypes.PkgIdentifier{
BOMRef: "pkg:maven/com.fasterxml.jackson.core/[email protected]",
UID: "9A5066570222D04C",
PURL: &packageurl.PackageURL{
Type: packageurl.TypeMaven,
Namespace: "com.fasterxml.jackson.core",
Name: "jackson-databind",
Version: "2.13.4.1",
},
},
InstalledVersion: "2.13.4.1",
FixedVersion: "2.12.7.1, 2.13.4.2",
Status: dtypes.StatusFixed,
SeveritySource: "ghsa",
PrimaryURL: "https://avd.aquasec.com/nvd/cve-2022-42003",
DataSource: &dtypes.DataSource{
ID: vulnerability.GHSA,
Name: "GitHub Security Advisory Maven",
URL: "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven",
},
Vulnerability: dtypes.Vulnerability{
Title: "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS",
Description: "In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.",
Severity: dtypes.SeverityHigh.String(),
VendorSeverity: dtypes.VendorSeverity{
vulnerability.GHSA: dtypes.SeverityHigh,
},
CVSS: dtypes.VendorCVSS{
vulnerability.GHSA: dtypes.CVSS{
V3Vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
V3Score: 7.5,
},
},
References: []string{
"https://access.redhat.com/security/cve/CVE-2022-42003",
},
PublishedDate: lo.ToPtr(time.Date(2022, 10, 02, 05, 15, 0, 0, time.UTC)),
LastModifiedDate: lo.ToPtr(time.Date(2022, 12, 20, 10, 15, 0, 0, time.UTC)),
},
},
vuln1,
},
},
},
BOM: testSBOM,
BOM: testSBOM(),
},
want: &cdx.BOM{
XMLNS: "http://cyclonedx.org/schema/bom/1.6",
BOMFormat: "CycloneDX",
SpecVersion: cdx.SpecVersion1_6,
JSONSchema: "http://cyclonedx.org/schema/bom-1.6.schema.json",
SerialNumber: "urn:uuid:3ff14136-e09f-4df9-80ea-000000000002",
SerialNumber: "urn:uuid:3ff14136-e09f-4df9-80ea-000000000001",
Version: 1,
Metadata: &cdx.Metadata{
Timestamp: "2021-08-25T12:20:30+00:00",
Expand Down Expand Up @@ -2110,3 +2052,99 @@ func TestMarshaler_MarshalReport(t *testing.T) {
})
}
}

var (
vuln1 = types.DetectedVulnerability{
VulnerabilityID: "CVE-2022-42003",
PkgName: "com.fasterxml.jackson.core:jackson-databind",
PkgPath: "jackson-databind-2.13.4.1.jar",
PkgIdentifier: ftypes.PkgIdentifier{
BOMRef: "pkg:maven/com.fasterxml.jackson.core/[email protected]",
UID: "9A5066570222D04C",
PURL: &packageurl.PackageURL{
Type: packageurl.TypeMaven,
Namespace: "com.fasterxml.jackson.core",
Name: "jackson-databind",
Version: "2.13.4.1",
},
},
InstalledVersion: "2.13.4.1",
FixedVersion: "2.12.7.1, 2.13.4.2",
Status: dtypes.StatusFixed,
SeveritySource: "ghsa",
PrimaryURL: "https://avd.aquasec.com/nvd/cve-2022-42003",
DataSource: &dtypes.DataSource{
ID: vulnerability.GHSA,
Name: "GitHub Security Advisory Maven",
URL: "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven",
},
Vulnerability: dtypes.Vulnerability{
Title: "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS",
Description: "In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.",
Severity: dtypes.SeverityHigh.String(),
VendorSeverity: dtypes.VendorSeverity{
vulnerability.GHSA: dtypes.SeverityHigh,
},
CVSS: dtypes.VendorCVSS{
vulnerability.GHSA: dtypes.CVSS{
V3Vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
V3Score: 7.5,
},
},
References: []string{
"https://access.redhat.com/security/cve/CVE-2022-42003",
},
PublishedDate: lo.ToPtr(time.Date(2022, 10, 02, 05, 15, 0, 0, time.UTC)),
LastModifiedDate: lo.ToPtr(time.Date(2022, 12, 20, 10, 15, 0, 0, time.UTC)),
},
}
)

func testSBOM() *core.BOM {
bom := core.NewBOM(core.Options{GenerateBOMRef: true})
appComponent := &core.Component{
Root: true,
Type: core.TypeApplication,
Name: "jackson-databind-2.13.4.1.jar",
PkgIdentifier: ftypes.PkgIdentifier{
BOMRef: "aff65b54-6009-4c32-968d-748949ef46e8",
},
Properties: []core.Property{
{
Name: "SchemaVersion",
Value: "2",
},
},
}
libComponent := &core.Component{
Type: core.TypeLibrary,
Name: "jackson-databind",
Group: "com.fasterxml.jackson.core",
Version: "2.13.4.1",
PkgIdentifier: ftypes.PkgIdentifier{
BOMRef: "pkg:maven/com.fasterxml.jackson.core/[email protected]",
UID: "9A5066570222D04C",
PURL: &packageurl.PackageURL{
Type: packageurl.TypeMaven,
Namespace: "com.fasterxml.jackson.core",
Name: "jackson-databind",
Version: "2.13.4.1",
},
},
Properties: []core.Property{
{
Name: "FilePath",
Value: "jackson-databind-2.13.4.1.jar",
},
{
Name: "PkgType",
Value: "jar",
},
},
}
bom.AddComponent(appComponent)
bom.AddComponent(libComponent)
bom.AddRelationship(appComponent, libComponent, core.RelationshipContains)
bom.AddRelationship(libComponent, nil, core.RelationshipDependsOn)
return bom
}
Loading

0 comments on commit 0bb6387

Please sign in to comment.