@groupby/ai-dev 0.5.16 → 0.5.17

package/teams/firstspirit-caas/skills/handle-red-cve-plan/scripts/test_parse_json_report.py

@@ -0,0 +1,244 @@
+"""Run: python3 plugins/planetexpress/skills/handle-red-cve-plan/scripts/test_parse_json_report.py"""
+import contextlib
+import importlib.util
+import io
+import json
+import os
+import tempfile
+import unittest
+
+_here = os.path.dirname(os.path.abspath(__file__))
+_spec = importlib.util.spec_from_file_location(
+    "parse_json_report", os.path.join(_here, "parse_json_report.py"))
+_mod = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(_mod)
+
+
+def _dep(file_name, pkgurl, sha1, active=None, suppressed=None, included_by=None):
+    return {
+        "fileName": file_name,
+        "sha1": sha1,
+        "packages": [{"id": pkgurl}] if pkgurl else [],
+        "includedBy": included_by or [],
+        "vulnerabilities": active or [],
+        "suppressedVulnerabilities": suppressed or [],
+    }
+
+
+def _vuln(name, *, v3=None, v4=None, v2=None, severity=None, source="NVD",
+          description=None, references=None, software=None):
+    v = {"name": name, "source": source, "severity": severity}
+    if v3 is not None:
+        v["cvssv3"] = {"baseScore": v3, "baseSeverity": severity}
+    if v4 is not None:
+        v["cvssv4"] = {"baseScore": v4, "baseSeverity": severity}
+    if v2 is not None:
+        v["cvssv2"] = {"score": v2, "severity": severity}
+    if description is not None:
+        v["description"] = description
+    if references is not None:
+        v["references"] = references
+    if software is not None:
+        v["vulnerableSoftware"] = software
+    return v
+
+
+def _report(deps):
+    return {"reportSchema": "1.1", "dependencies": deps}
+
+
+class TestParse(unittest.TestCase):
+    def test_keeps_active_high_cve(self):
+        rpt = _report([_dep("httpcore-4.4.16.jar",
+                            "pkg:maven/org.apache.httpcomponents/httpcore@4.4.16",
+                            "51cf043c87253c9f58b539c9f7e44c8894223850",
+                            active=[_vuln("CVE-2026-54399", v3=7.5, severity="HIGH")])])
+        findings = _mod.parse(rpt)["findings"]
+        self.assertEqual({f["cveId"] for f in findings}, {"CVE-2026-54399"})
+
+    def test_finding_fields(self):
+        rpt = _report([_dep(
+            "httpcore-4.4.16.jar",
+            "pkg:maven/org.apache.httpcomponents/httpcore@4.4.16",
+            "51cf043c87253c9f58b539c9f7e44c8894223850",
+            active=[_vuln("CVE-2026-54399", v3=7.5, severity="HIGH",
+                          description="Uncontrolled Resource Consumption in 5.4.2 and earlier",
+                          references=[{"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"},
+                                      {"url": "https://lists.apache.org/thread/abc123"}],
+                          software=[{"software": {
+                              "id": "cpe:2.3:a:apache:httpcomponents_core:*:*:*:*:*:*:*:*",
+                              "versionEndIncluding": "5.4.2"}}])])])
+        f = _mod.parse(rpt)["findings"][0]
+        self.assertEqual(f["cveId"], "CVE-2026-54399")
+        self.assertEqual(f["score"], 7.5)
+        self.assertEqual(f["severity"], "HIGH")
+        self.assertEqual(f["dependency"]["fileName"], "httpcore-4.4.16.jar")
+        self.assertEqual(f["dependency"]["packageUrl"],
+                         "pkg:maven/org.apache.httpcomponents/httpcore@4.4.16")
+        self.assertEqual(f["dependency"]["sha1"],
+                         "51cf043c87253c9f58b539c9f7e44c8894223850")
+        self.assertIn("Uncontrolled Resource Consumption", f["description"])
+        self.assertIn("https://nvd.nist.gov/vuln/detail/CVE-2026-54399", f["references"])
+        self.assertTrue(any("5.4.2" in a for a in f["affectedVersions"]))
+
+    def test_suppressed_vulnerability_is_dropped(self):
+        rpt = _report([_dep("kotlin.jar", "pkg:maven/org.jetbrains.kotlin/kotlin@2.4.0", "aa",
+                            suppressed=[_vuln("CVE-2026-53914", v3=9.8, severity="CRITICAL")])])
+        result = _mod.parse(rpt)
+        self.assertEqual(result["findings"], [])
+        self.assertEqual(result["unparsed"], [])
+
+    def test_below_high_excluded(self):
+        rpt = _report([_dep("a.jar", "pkg:maven/g/a@1", "aa",
+                            active=[_vuln("CVE-2026-0001", v3=6.5, severity="MEDIUM")])])
+        self.assertEqual(_mod.parse(rpt)["findings"], [])
+
+    def test_cvss_exactly_seven_is_kept(self):
+        rpt = _report([_dep("a.jar", "pkg:maven/g/a@1", "aa",
+                            active=[_vuln("CVE-2026-0007", v3=7.0, severity="HIGH")])])
+        f = _mod.parse(rpt)["findings"][0]
+        self.assertEqual(f["cveId"], "CVE-2026-0007")
+        self.assertEqual(f["score"], 7.0)
+
+    def test_score_is_max_across_cvss_versions(self):
+        """A vuln carrying several CVSS versions reddens on the worst of them;
+        take the max so a >=7 score in any version is never gated below."""
+        rpt = _report([_dep("a.jar", "pkg:maven/g/a@1", "aa",
+                            active=[_vuln("CVE-2026-0009", v2=5.0, v3=7.8, v4=4.8,
+                                          severity="HIGH")])])
+        f = _mod.parse(rpt)["findings"][0]
+        self.assertEqual(f["score"], 7.8)
+        self.assertEqual(f["severity"], "HIGH")
+
+    def test_cvssv4_float_precision_is_rounded(self):
+        rpt = _report([_dep("a.jar", "pkg:maven/g/a@1", "aa",
+                            active=[_vuln("CVE-2026-0010", v4=7.800000190734863,
+                                          severity="HIGH")])])
+        self.assertEqual(_mod.parse(rpt)["findings"][0]["score"], 7.8)
+
+    def test_band_only_high_cve_becomes_finding_with_null_score(self):
+        """A CVE with no numeric CVSS but a HIGH severity band is at/above the
+        gate -- a finding with score None, severity from the band."""
+        rpt = _report([_dep("a.jar", "pkg:maven/g/a@1", "aa",
+                            active=[_vuln("CVE-2026-0002", severity="HIGH")])])
+        f = _mod.parse(rpt)["findings"][0]
+        self.assertEqual(f["cveId"], "CVE-2026-0002")
+        self.assertIsNone(f["score"])
+        self.assertEqual(f["severity"], "HIGH")
+
+    def test_band_only_medium_cve_excluded(self):
+        rpt = _report([_dep("a.jar", "pkg:maven/g/a@1", "aa",
+                            active=[_vuln("CVE-2026-0003", severity="medium")])])
+        result = _mod.parse(rpt)
+        self.assertEqual(result["findings"], [])
+        self.assertEqual(result["unparsed"], [])
+
+    def test_non_cve_high_goes_to_unparsed(self):
+        rpt = _report([_dep("foo.js", "pkg:javascript/foo@1.0", "aa",
+                            active=[_vuln("GHSA-dddd-eeee-ffff", severity="high",
+                                          source="RETIREJS")])])
+        result = _mod.parse(rpt)
+        self.assertEqual(result["findings"], [])
+        u = next(x for x in result["unparsed"] if x["cveId"] == "GHSA-dddd-eeee-ffff")
+        self.assertEqual(u["fileName"], "foo.js")
+        self.assertIn("non-CVE", u["reason"])
+
+    def test_non_cve_medium_excluded(self):
+        rpt = _report([_dep("foo.js", "pkg:javascript/foo@1.0", "aa",
+                            active=[_vuln("GHSA-aaaa-bbbb-cccc", severity="medium",
+                                          source="RETIREJS")])])
+        result = _mod.parse(rpt)
+        self.assertEqual(result["findings"], [])
+        self.assertEqual(result["unparsed"], [])
+
+    def test_no_score_and_no_band_goes_to_unparsed(self):
+        rpt = _report([_dep("mystery.jar", "pkg:maven/g/mystery@1", "99",
+                            active=[_vuln("CVE-2026-9999", severity=None)])])
+        result = _mod.parse(rpt)
+        self.assertNotIn("CVE-2026-9999", {f["cveId"] for f in result["findings"]})
+        u = next(x for x in result["unparsed"] if x["cveId"] == "CVE-2026-9999")
+        self.assertEqual(u["fileName"], "mystery.jar")
+        self.assertEqual(u["packageUrl"], "pkg:maven/g/mystery@1")
+        self.assertEqual(u["sha1"], "99")
+
+    def test_unparsed_deduplicated_by_id_and_file(self):
+        v = _vuln("GHSA-dddd-eeee-ffff", severity="high", source="RETIREJS")
+        rpt = _report([_dep("foo.js", "pkg:javascript/foo@1.0", "aa", active=[v, dict(v)])])
+        result = _mod.parse(rpt)
+        matches = [u for u in result["unparsed"] if u["cveId"] == "GHSA-dddd-eeee-ffff"]
+        self.assertEqual(len(matches), 1)
+
+    def test_same_cve_on_two_files_yields_two_findings(self):
+        rpt = _report([
+            _dep("httpcore-4.4.16.jar", "pkg:maven/g/httpcore@4.4.16", "a1",
+                 active=[_vuln("CVE-2026-54399", v3=7.5, severity="HIGH")]),
+            _dep("httpcore5-5.1.jar", "pkg:maven/g/httpcore5@5.1", "b2",
+                 active=[_vuln("CVE-2026-54399", v3=7.5, severity="HIGH")]),
+        ])
+        findings = _mod.parse(rpt)["findings"]
+        files = sorted(f["dependency"]["fileName"] for f in findings)
+        self.assertEqual(files, ["httpcore-4.4.16.jar", "httpcore5-5.1.jar"])
+
+    def test_included_by_captured_when_present(self):
+        rpt = _report([_dep("solrj.jar", "pkg:maven/org.apache.solr/solr-solrj@9.9.0", "aa",
+                            included_by=[{"reference": "pkg:maven/root/app@1.0"}],
+                            active=[_vuln("CVE-2026-0011", v3=8.1, severity="HIGH")])])
+        f = _mod.parse(rpt)["findings"][0]
+        self.assertEqual(f["includedBy"], ["pkg:maven/root/app@1.0"])
+
+    def test_missing_packages_yields_null_package_url(self):
+        rpt = _report([_dep("x.jar", None, "aa",
+                            active=[_vuln("CVE-2026-0012", v3=7.5, severity="HIGH")])])
+        f = _mod.parse(rpt)["findings"][0]
+        self.assertIsNone(f["dependency"]["packageUrl"])
+
+    def test_fixture_report(self):
+        with open(os.path.join(_here, "testdata", "sample-report.json"), encoding="utf-8") as fh:
+            rpt = json.load(fh)
+        result = _mod.parse(rpt)
+        self.assertEqual({f["cveId"] for f in result["findings"]}, {"CVE-2026-54399"})
+        self.assertNotIn("CVE-2026-53914", {f["cveId"] for f in result["findings"]})
+        self.assertIn("GHSA-abcd-1234-wxyz", {u["cveId"] for u in result["unparsed"]})
+
+
+class TestMain(unittest.TestCase):
+    def setUp(self):
+        self.sample = os.path.join(_here, "testdata", "sample-report.json")
+
+    def test_out_writes_valid_json_and_exits_zero(self):
+        with tempfile.TemporaryDirectory() as tmpdir:
+            out_path = os.path.join(tmpdir, "out.json")
+            rc = _mod.main([self.sample, "--out", out_path])
+            self.assertEqual(rc, 0)
+            with open(out_path, encoding="utf-8") as fh:
+                data = json.load(fh)
+            self.assertEqual({f["cveId"] for f in data["findings"]}, {"CVE-2026-54399"})
+
+    def test_missing_input_file_exits_nonzero_with_stderr_message(self):
+        stderr = io.StringIO()
+        with contextlib.redirect_stderr(stderr):
+            rc = _mod.main(["/nonexistent/path/does-not-exist.json"])
+        self.assertNotEqual(rc, 0)
+        self.assertIn("parse_json_report.py:", stderr.getvalue())
+
+    def test_malformed_json_exits_nonzero_with_stderr_message(self):
+        with tempfile.TemporaryDirectory() as tmpdir:
+            bad = os.path.join(tmpdir, "bad.json")
+            with open(bad, "w", encoding="utf-8") as fh:
+                fh.write("{not valid json")
+            stderr = io.StringIO()
+            with contextlib.redirect_stderr(stderr):
+                rc = _mod.main([bad])
+            self.assertNotEqual(rc, 0)
+            self.assertIn("parse_json_report.py:", stderr.getvalue())
+
+    def test_unwritable_out_path_exits_nonzero_with_stderr_message(self):
+        stderr = io.StringIO()
+        with contextlib.redirect_stderr(stderr):
+            rc = _mod.main([self.sample, "--out", "/nonexistent-dir/out.json"])
+        self.assertNotEqual(rc, 0)
+        self.assertIn("cannot write output", stderr.getvalue())
+
+
+if __name__ == "__main__":
+    unittest.main()