nvd-json_feeds 0.1.0

data/spec/schema/impact/base_metric_v3_spec.rb

@@ -0,0 +1,80 @@
+require 'spec_helper'
+require 'schema/shared_examples'
+require 'nvd/json_feeds/schema/impact/base_metric_v3'
+
+describe Schema::Impact::BaseMetricV3 do
+  describe "#initialize" do
+    context "when cvss_v3: is given" do
+      let(:cvss_v3) { double(:CVSSv3) }
+
+      subject { described_class.new(cvss_v3: cvss_v3) }
+
+      it "must set #cvss_v3" do
+        expect(subject.cvss_v3).to eq(cvss_v3)
+      end
+
+      context "and when exploitability_score: is given" do
+        let(:exploitability_score) { 5.0 }
+
+        subject do
+          described_class.new(
+            cvss_v3:              cvss_v3,
+            exploitability_score: exploitability_score
+          )
+        end
+
+        it "must set #exploitability_score" do
+          expect(subject.exploitability_score).to eq(exploitability_score)
+        end
+      end
+
+      context "but when exploitability_score: is not given" do
+        it { expect(subject.exploitability_score).to be(nil) }
+      end
+
+      context "and when impact_score: is given" do
+        let(:impact_score) { 5.0 }
+
+        subject do
+          described_class.new(
+            cvss_v3:              cvss_v3,
+            impact_score: impact_score
+          )
+        end
+
+        it "must set #impact_score" do
+          expect(subject.impact_score).to eq(impact_score)
+        end
+      end
+
+      context "but when impact_score: is not given" do
+        it { expect(subject.impact_score).to be(nil) }
+      end
+    end
+
+    context "when cvss_v3: is not given" do
+      it do
+        expect {
+          described_class.new
+        }.to raise_error(ArgumentError)
+      end
+    end
+  end
+
+  describe ".load" do
+    include_examples ".load"
+
+    let(:json_node) { json_tree['CVE_Items'][0]['impact']['baseMetricV3'] }
+
+    include_examples "JSON Object field", json_key:     'cvssV3',
+                                          required:     true,
+                                          method:       :cvss_v3,
+                                          object_class: Schema::CVSSv3
+
+    include_examples "JSON field", json_key: 'exploitabilityScore',
+                                   method:   :exploitability_score
+
+    include_examples "JSON field", json_key: 'impactScore',
+                                   method:   :impact_score
+  end
+end

data/spec/schema/impact_spec.rb

@@ -0,0 +1,53 @@
+require 'spec_helper'
+require 'schema/shared_examples'
+require 'nvd/json_feeds/schema/impact'
+
+describe Schema::Impact do
+  describe "#initialize" do
+    context "when user_interaction_required: is given" do
+      let(:base_metric_v3) { double(:BaseMetricV2) }
+
+      subject do
+        described_class.new(base_metric_v3: base_metric_v3)
+      end
+
+      it "must set #base_metric_v3" do
+        expect(subject.base_metric_v3).to eq(base_metric_v3)
+      end
+    end
+
+    context "when base_metric_v3: is not given" do
+      it { expect(subject.base_metric_v3).to be(nil) }
+    end
+
+    context "when user_interaction_required: is given" do
+      let(:base_metric_v2) { double(:BaseMetricV2) }
+
+      subject do
+        described_class.new(base_metric_v2: base_metric_v2)
+      end
+
+      it "must set #base_metric_v2" do
+        expect(subject.base_metric_v2).to eq(base_metric_v2)
+      end
+    end
+
+    context "when base_metric_v2: is not given" do
+      it { expect(subject.base_metric_v2).to be(nil) }
+    end
+  end
+
+  describe ".load" do
+    include_examples ".load"
+
+    let(:json_node) { json_tree['CVE_Items'][0]['impact'] }
+
+    include_examples "JSON Object field", json_key:     'baseMetricV3',
+                                          method:       :base_metric_v3,
+                                          object_class: described_class::BaseMetricV3
+
+    include_examples "JSON Object field", json_key:     'baseMetricV2',
+                                          method:       :base_metric_v2,
+                                          object_class: described_class::BaseMetricV2
+  end
+end

data/spec/schema/shared_examples.rb

@@ -0,0 +1,136 @@
+require 'rspec'
+require 'json'
+
+RSpec.shared_examples ".from_json" do
+  let(:fixtures_dir)  { File.expand_path('../../fixtures',__FILE__) }
+  let(:json_filename) { 'nvdcve-1.1-recent.json'                    }
+  let(:json_file)     { File.join(fixtures_dir,json_filename)       }
+
+  let(:json_tree) { JSON.parse(File.read(json_file)) }
+  let(:json_node) { json_tree }
+
+  subject { described_class.from_json(json_node) }
+end
+
+RSpec.shared_examples ".load" do
+  include_examples ".from_json"
+
+  subject { described_class.load(json_node) }
+
+  it { expect(subject).to be_kind_of(described_class) }
+end
+
+RSpec.shared_examples "JSON field" do |method: , json_key: , required: false, value: nil, map: nil|
+  context "\"#{json_key}\"" do
+    let(:json_value) { json_node[json_key] }
+
+    if value then let(:expected,&value)
+    else
+      if map then let(:expected) { map[json_value] }
+      else        let(:expected) { json_value }
+      end
+    end
+
+    if required
+      it "must set ##{method}" do
+        expect(subject.send(method)).to eq(expected)
+      end
+
+      context "when the \"#{json_key}\" key is missing" do
+        before { json_node.delete(json_key) }
+
+        it do
+          expect {
+            described_class.load(json_node)
+          }.to raise_error(KeyError)
+        end
+      end
+    else
+      context "when the \"#{json_key}\" key is present" do
+        it "must set ##{method}" do
+          expect(subject.send(method)).to eq(expected)
+        end
+      end
+
+      context "when the \"#{json_key}\" key is missing" do
+        before { json_node.delete(json_key) }
+
+        it do
+          expect(subject.send(method)).to be(nil)
+        end
+      end
+    end
+  end
+end
+
+RSpec.shared_examples "JSON Object field" do |method: , json_key: , required: false, object_class: |
+  context "\"#{json_key}\"" do
+    let(:json_value) { json_node[json_key] }
+
+    if required
+      it { expect(subject.send(method)).to be_kind_of(object_class) }
+
+      context "when the \"#{json_key}\" key is missing" do
+        before { json_node.delete(json_key) }
+
+        it do
+          expect {
+            described_class.load(json_node)
+          }.to raise_error(KeyError)
+        end
+      end
+    else
+      context "when the \"#{json_key}\" key is present" do
+        it { expect(subject.send(method)).to be_kind_of(object_class) }
+      end
+
+      context "when the \"#{json_key}\" key is missing" do
+        before { json_node.delete(json_key) }
+
+        it do
+          expect(subject.send(method)).to be(nil)
+        end
+      end
+    end
+  end
+end
+
+RSpec.shared_examples "JSON Array field" do |method: , json_key: , required: false, element_class: |
+  context "\"#{json_key}\"" do
+    let(:json_value) { json_node[json_key] }
+
+    if required
+      it { expect(subject.send(method)).to be_kind_of(Array) }
+      it { expect(subject.send(method)).to_not be_empty }
+      it { expect(subject.send(method)).to all(be_kind_of(element_class)) }
+
+      it "must parse every element of \"#{json_key}\"" do
+        expect(subject.send(method).length).to eq(json_value.length)
+      end
+
+      context "when the \"#{json_key}\" key is missing" do
+        before { json_node.delete(json_key) }
+
+        it do
+          expect {
+            described_class.load(json_node)
+          }.to raise_error(KeyError)
+        end
+      end
+    else
+      context "when the \"#{json_key}\" key is present" do
+        it { expect(subject.send(method)).to be_kind_of(Array) }
+        it { expect(subject.send(method)).to_not be_empty }
+        it { expect(subject.send(method)).to all(be_kind_of(element_class)) }
+      end
+
+      context "when the \"#{json_key}\" key is missing" do
+        before { json_node.delete(json_key) }
+
+        it do
+          expect(subject.send(method)).to eq([])
+        end
+      end
+    end
+  end
+end

data/spec/schema/timestamp_spec.rb

@@ -0,0 +1,8 @@
+require 'spec_helper'
+require 'nvd/json_feeds/schema/timestamp'
+
+describe "NVD::JSONFeeds::Schema::Timestamp" do
+  subject { Schema::Timestamp }
+
+  it { expect(subject).to be(CVESchema::CVE::Timestamp) }
+end

data/spec/spec_helper.rb

@@ -0,0 +1,8 @@
+require 'rspec'
+require 'nvd/json_feeds/version'
+
+include NVD::JSONFeeds
+
+RSpec.configure do |specs|
+  specs.filter_run_excluding :integration
+end

data/spec/zip_feed_file_spec.rb

@@ -0,0 +1,66 @@
+require 'spec_helper'
+require 'feed_file_examples'
+require 'nvd/json_feeds/zip_feed_file'
+
+require 'fileutils'
+require 'shellwords'
+
+describe NVD::JSONFeeds::ZipFeedFile do
+  let(:fixtures_dir)  { File.expand_path('../fixtures',__FILE__) }
+  let(:json_filename) { 'nvdcve-1.1-recent.json'                 }
+  let(:json_file)     { File.join(fixtures_dir,json_filename)    }
+
+  let(:zip_filename) { "#{json_filename}.zip"                  }
+  let(:dir)          { File.join(fixtures_dir,'zip_feed_file') }
+  let(:path)         { File.join(dir,zip_filename)             }
+
+  subject { described_class.new(path) }
+
+  include_examples "FeedFile"
+
+  describe "#json_filename" do
+    it "must return the '.json' filename without the '.zip' extension" do
+      expect(subject.json_filename).to eq(json_filename)
+    end
+  end
+
+  describe "#read" do
+    it "must read the unziped contents" do
+      expect(subject.read).to be == File.read(json_file)
+    end
+
+    context "when unzip is not installed" do
+      before do
+        expect(subject).to receive(:`).and_raise(Errno::ENOENT)
+      end
+
+      it do
+        expect { subject.read }.to raise_error(ReadFailed)
+      end
+    end
+  end
+
+  describe "#extract" do
+    let(:extracted_json_file) { File.join(dir,json_filename) }
+
+    it "must unzip the '.zip' file and return a JSONFeedfile" do
+      feed_file = subject.extract
+
+      expect(feed_file).to be_kind_of(JSONFeedFile)
+      expect(feed_file.path).to eq(extracted_json_file)
+      expect(File.file?(extracted_json_file)).to be(true)
+    end
+
+    context "when unzip fails" do
+      before do
+        allow(subject).to receive(:system).and_return(false)
+      end
+
+      it do
+        expect { subject.extract }.to raise_error(ExtractFailed)
+      end
+    end
+
+    after { FileUtils.rm_f(extracted_json_file) }
+  end
+end

data/spec/zip_feed_uri_spec.rb

@@ -0,0 +1,35 @@
+require 'spec_helper'
+require 'nvd/json_feeds/zip_feed_uri'
+
+require 'fileutils'
+
+describe NVD::JSONFeeds::ZipFeedURI do
+  let(:fixtures_dir) { File.expand_path('../fixtures',__FILE__) }
+
+  let(:name) { :recent }
+  let(:ext)  { '.json.zip' }
+  
+  subject { described_class.new(name,ext) }
+
+  describe "#download", :integration do
+    let(:download_dir) { File.join(fixtures_dir,'download') }
+    let(:dest) { File.join(download_dir,subject.filename) }
+
+    before do
+      FileUtils.mkdir_p(download_dir)
+      FileUtils.rm_f(dest)
+    end
+
+    it "must return a ZipFeedFile object for the newly downloaded file" do
+      feed_file = subject.download(dest)
+
+      expect(feed_file).to be_kind_of(ZipFeedFile)
+      expect(feed_file.path).to eq(dest)
+      expect(File.file?(dest)).to be(true)
+    end
+
+    after do
+      FileUtils.rm_f(dest)
+    end
+  end
+end

metadata

@@ -0,0 +1,156 @@
+--- !ruby/object:Gem::Specification
+name: nvd-json_feeds
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Postmodern
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2021-01-20 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: multi_json
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: cve_schema
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+description: Provides a Ruby API to NVD JSON Feeds.
+email: postmodern.mod3@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files:
+- ChangeLog.md
+- LICENSE.txt
+- README.md
+files:
+- ".document"
+- ".github/workflows/ruby.yml"
+- ".gitignore"
+- ".rspec"
+- ".yardopts"
+- ChangeLog.md
+- Gemfile
+- LICENSE.txt
+- README.md
+- Rakefile
+- gemspec.yml
+- lib/nvd/json_feeds.rb
+- lib/nvd/json_feeds/exceptions.rb
+- lib/nvd/json_feeds/feed.rb
+- lib/nvd/json_feeds/feed_file.rb
+- lib/nvd/json_feeds/feed_uri.rb
+- lib/nvd/json_feeds/gz_feed_file.rb
+- lib/nvd/json_feeds/gz_feed_uri.rb
+- lib/nvd/json_feeds/json_feed_file.rb
+- lib/nvd/json_feeds/meta.rb
+- lib/nvd/json_feeds/meta_feed_uri.rb
+- lib/nvd/json_feeds/schema/configurations.rb
+- lib/nvd/json_feeds/schema/configurations/node.rb
+- lib/nvd/json_feeds/schema/cpe/has_uri.rb
+- lib/nvd/json_feeds/schema/cpe/match.rb
+- lib/nvd/json_feeds/schema/cpe/name.rb
+- lib/nvd/json_feeds/schema/cve_feed.rb
+- lib/nvd/json_feeds/schema/cve_item.rb
+- lib/nvd/json_feeds/schema/cvss_v2.rb
+- lib/nvd/json_feeds/schema/cvss_v3.rb
+- lib/nvd/json_feeds/schema/has_data_version.rb
+- lib/nvd/json_feeds/schema/impact.rb
+- lib/nvd/json_feeds/schema/impact/base_metric_v2.rb
+- lib/nvd/json_feeds/schema/impact/base_metric_v3.rb
+- lib/nvd/json_feeds/schema/timestamp.rb
+- lib/nvd/json_feeds/version.rb
+- lib/nvd/json_feeds/zip_feed_file.rb
+- lib/nvd/json_feeds/zip_feed_uri.rb
+- nvd-json_feeds.gemspec
+- spec/feed_file_examples.rb
+- spec/feed_file_spec.rb
+- spec/feed_spec.rb
+- spec/feed_uri_spec.rb
+- spec/fixtures/gz_feed_file/nvdcve-1.1-recent.json.gz
+- spec/fixtures/nvdcve-1.1-recent.json
+- spec/fixtures/zip_feed_file/nvdcve-1.1-recent.json.zip
+- spec/gz_feed_file_spec.rb
+- spec/gz_feed_uri_spec.rb
+- spec/json_feed_file_spec.rb
+- spec/json_feeds_spec.rb
+- spec/meta_spec.rb
+- spec/schema/configurations/node_spec.rb
+- spec/schema/configurations_spec.rb
+- spec/schema/cpe/match_spec.rb
+- spec/schema/cpe/name_spec.rb
+- spec/schema/cve_feed_spec.rb
+- spec/schema/cve_item_spec.rb
+- spec/schema/impact/base_metric_v2_spec.rb
+- spec/schema/impact/base_metric_v3_spec.rb
+- spec/schema/impact_spec.rb
+- spec/schema/shared_examples.rb
+- spec/schema/timestamp_spec.rb
+- spec/spec_helper.rb
+- spec/zip_feed_file_spec.rb
+- spec/zip_feed_uri_spec.rb
+homepage: https://github.com/postmodern/nvd-json_feeds#readme
+licenses:
+- MIT
+metadata:
+  documentation_uri: https://rubydoc.info/gems/nvd-json_feeds
+  source_code_uri: https://github.com/postmodern/nvd-json_feeds.rb
+  bug_tracker_uri: https://github.com/postmodern/nvd-json_feeds.rb/issues
+  changelog_uri: https://github.com/postmodern/nvd-json_feeds.rb/blob/main/ChangeLog.md
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.7.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.1.4
+signing_key: 
+specification_version: 4
+summary: A Ruby API to NVD JSON Feeds
+test_files: []