@groupby/ai-dev 0.5.16 → 0.5.17

package/teams/firstspirit-caas/skills/handle-red-cve-plan/scripts/test_parse_report.py

@@ -0,0 +1,464 @@
+"""Run: python3 plugins/planetexpress/skills/handle-red-cve-plan/scripts/test_parse_report.py"""
+import contextlib
+import importlib.util
+import io
+import json
+import os
+import tempfile
+import unittest
+
+_here = os.path.dirname(os.path.abspath(__file__))
+_spec = importlib.util.spec_from_file_location(
+    "parse_report", os.path.join(_here, "parse_report.py"))
+_mod = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(_mod)
+
+# Real Bamboo-published button markup (verified against a live report), attrs
+# in a DIFFERENT order than testdata/sample-report.html's fixed
+# display-name -> sha1 -> pkgurl -> type -> id-to-suppress order. This is the
+# regression fixture for order-independent parsing.
+_REORDERED_BUTTON_HTML = """
+<div class="subsectioncontent">
+  <p><b><a href="?vulnId=CVE-2027-11111">CVE-2027-11111</a></b>&nbsp;
+  <button class="copybutton" data-id-to-suppress="CVE-2027-11111"
+    data-type-to-suppress="cve"
+    data-pkgurl="pkg:maven/com.example/foo@1.2.3"
+    data-sha1="deadbeef00112233445566778899aabbccddeeff"
+    title="Generate Suppression XML for this CVE for this file"
+    data-display-name="foo-1.2.3.jar">suppress</button></p>
+  CVSSv3: Base Score: CRITICAL (9.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+</div>
+"""
+
+
+class TestParse(unittest.TestCase):
+    def setUp(self):
+        with open(os.path.join(_here, "testdata", "sample-report.html"), encoding="utf-8") as fh:
+            self.html = fh.read()
+
+    def test_keeps_only_active_high(self):
+        findings = _mod.parse(self.html)["findings"]
+        ids = {f["cveId"] for f in findings}
+        self.assertEqual(ids, {"CVE-2026-54399"})
+
+    def test_finding_fields(self):
+        f = _mod.parse(self.html)["findings"][0]
+        self.assertEqual(f["cveId"], "CVE-2026-54399")
+        self.assertEqual(f["score"], 7.5)
+        self.assertEqual(f["severity"], "HIGH")
+        self.assertEqual(f["dependency"]["fileName"], "httpcore-4.4.16.jar")
+        self.assertEqual(f["dependency"]["packageUrl"],
+                         "pkg:maven/org.apache.httpcomponents/httpcore@4.4.16")
+        self.assertEqual(f["dependency"]["sha1"],
+                         "51cf043c87253c9f58b539c9f7e44c8894223850")
+
+    def test_drops_suppressed_section(self):
+        ids = {f["cveId"] for f in _mod.parse(self.html)["findings"]}
+        self.assertNotIn("CVE-2026-53914", ids)
+
+    # -- Report context: don't discard advisory data the report already has --
+
+    def test_captures_description_from_pre(self):
+        f = _mod.parse(self.html)["findings"][0]
+        self.assertIn("Uncontrolled Resource Consumption", f["description"])
+        self.assertIn("5.4.2 and earlier", f["description"])
+
+    def test_captures_reference_urls(self):
+        f = _mod.parse(self.html)["findings"][0]
+        self.assertIn("https://lists.apache.org/thread/abc123", f["references"])
+        self.assertIn("https://nvd.nist.gov/vuln/detail/CVE-2026-54399", f["references"])
+        # The "show all" toggle (href="#") must not be captured as a reference.
+        self.assertNotIn("#", f["references"])
+
+    def test_captures_affected_versions(self):
+        f = _mod.parse(self.html)["findings"][0]
+        self.assertTrue(any("versions up to (including) 5.4.2" in a
+                            for a in f["affectedVersions"]))
+
+    def test_context_fields_absent_gracefully(self):
+        # A finding block with no <pre>/References/Vulnerable-Software still
+        # yields the keys with empty/None values, never a crash.
+        html = _REORDERED_BUTTON_HTML
+        f = _mod.parse(html)["findings"][0]
+        self.assertIsNone(f["description"])
+        self.assertEqual(f["references"], [])
+        self.assertEqual(f["affectedVersions"], [])
+
+    # -- Important-1: order-independent button attribute parsing --------
+
+    def test_button_attrs_in_different_order_still_parsed(self):
+        """A real report is not guaranteed to emit data-* attributes in any
+        particular order. If the parser silently drops a differently-ordered
+        button, a real HIGH/CRITICAL finding goes missing without warning."""
+        findings = _mod.parse(_REORDERED_BUTTON_HTML)["findings"]
+        ids = {f["cveId"] for f in findings}
+        self.assertIn("CVE-2027-11111", ids)
+        f = next(x for x in findings if x["cveId"] == "CVE-2027-11111")
+        self.assertEqual(f["dependency"]["fileName"], "foo-1.2.3.jar")
+        self.assertEqual(f["dependency"]["packageUrl"], "pkg:maven/com.example/foo@1.2.3")
+        self.assertEqual(f["dependency"]["sha1"], "deadbeef00112233445566778899aabbccddeeff")
+        self.assertEqual(f["score"], 9.1)
+
+    def test_reordered_button_does_not_bleed_into_neighbor(self):
+        """Two differently-ordered buttons back to back must each keep their
+        own attributes -- no cross-contamination between findings."""
+        html = _REORDERED_BUTTON_HTML + """
+<div class="subsectioncontent">
+  <p><b><a href="?vulnId=CVE-2027-22222">CVE-2027-22222</a></b>&nbsp;
+  <button data-sha1="1111111111111111111111111111111111111111"
+    data-id-to-suppress="CVE-2027-22222"
+    data-display-name="bar-9.9.9.jar"
+    data-pkgurl="pkg:maven/com.example/bar@9.9.9"
+    class="copybutton">suppress</button></p>
+  CVSSv3: Base Score: HIGH (8.0)
+</div>
+"""
+        findings = {f["cveId"]: f for f in _mod.parse(html)["findings"]}
+        self.assertEqual(findings["CVE-2027-11111"]["dependency"]["fileName"], "foo-1.2.3.jar")
+        self.assertEqual(findings["CVE-2027-22222"]["dependency"]["fileName"], "bar-9.9.9.jar")
+        self.assertEqual(findings["CVE-2027-11111"]["dependency"]["sha1"],
+                         "deadbeef00112233445566778899aabbccddeeff")
+        self.assertEqual(findings["CVE-2027-22222"]["dependency"]["sha1"],
+                         "1111111111111111111111111111111111111111")
+
+    # -- Important-2: bounded score lookup -------------------------------
+
+    def test_score_found_past_old_fixed_window(self):
+        """A long description must not push the Base Score line out of a
+        fixed-size lookahead window -- the whole finding block (up to the
+        next suppress button or EOF) must be searched."""
+        filler = "x" * 2000  # longer than the old 1500-char window
+        html = f"""
+<div class="subsectioncontent">
+  <p><b><a href="?vulnId=CVE-2027-33333">CVE-2027-33333</a></b>&nbsp;
+  <button class="copybutton" data-display-name="baz-1.0.0.jar"
+    data-sha1="2222222222222222222222222222222222222222"
+    data-pkgurl="pkg:maven/com.example/baz@1.0.0"
+    data-type-to-suppress="cve" data-id-to-suppress="CVE-2027-33333">suppress</button></p>
+  {filler}
+  CVSSv3: Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N
+</div>
+"""
+        ids = {f["cveId"] for f in _mod.parse(html)["findings"]}
+        self.assertIn("CVE-2027-33333", ids)
+
+    def test_score_lookup_bounded_by_next_button_not_full_document(self):
+        """A finding with no score of its own must not pick up the score
+        belonging to the NEXT finding's block."""
+        html = """
+<div class="subsectioncontent">
+  <p><b><a href="?vulnId=CVE-2027-44444">CVE-2027-44444</a></b>&nbsp;
+  <button class="copybutton" data-display-name="qux-1.0.0.jar"
+    data-sha1="3333333333333333333333333333333333333333"
+    data-pkgurl="pkg:maven/com.example/qux@1.0.0"
+    data-type-to-suppress="cve" data-id-to-suppress="CVE-2027-44444">suppress</button></p>
+  No CVSS score present for this finding at all.
+</div>
+<div class="subsectioncontent">
+  <p><b><a href="?vulnId=CVE-2027-55555">CVE-2027-55555</a></b>&nbsp;
+  <button class="copybutton" data-display-name="quux-1.0.0.jar"
+    data-sha1="4444444444444444444444444444444444444444"
+    data-pkgurl="pkg:maven/com.example/quux@1.0.0"
+    data-type-to-suppress="cve" data-id-to-suppress="CVE-2027-55555">suppress</button></p>
+  CVSSv3: Base Score: HIGH (9.0)
+</div>
+"""
+        ids = {f["cveId"] for f in _mod.parse(html)["findings"]}
+        self.assertNotIn("CVE-2027-44444", ids)
+        self.assertIn("CVE-2027-55555", ids)
+
+    # -- CVSS threshold boundary ------------------------------------------
+
+    def test_cvss_exactly_seven_is_kept(self):
+        """score == THRESHOLD (7.0) must be KEPT, not excluded."""
+        html = """
+<div class="subsectioncontent">
+  <p><b><a href="?vulnId=CVE-2027-77777">CVE-2027-77777</a></b>&nbsp;
+  <button class="copybutton" data-display-name="boundary-1.0.0.jar"
+    data-sha1="5555555555555555555555555555555555555555"
+    data-pkgurl="pkg:maven/com.example/boundary@1.0.0"
+    data-type-to-suppress="cve" data-id-to-suppress="CVE-2027-77777">suppress</button></p>
+  CVSSv3: Base Score: HIGH (7.0) Vector: CVSS:3.1/AV:N
+</div>
+"""
+        findings = _mod.parse(html)["findings"]
+        ids = {f["cveId"] for f in findings}
+        self.assertIn("CVE-2027-77777", ids)
+        f = next(x for x in findings if x["cveId"] == "CVE-2027-77777")
+        self.assertEqual(f["score"], 7.0)
+
+
+    # -- Fail-safe: unparseable-score active findings must never vanish -----
+
+    def test_cvssv2_style_score_line_without_base_score_prefix_is_a_finding(self):
+        """dependency-check renders CVSSv2 findings as `CVSSv2: Score: 7.5
+        (AV:N/...)` with no "Base Score:" prefix. This must still be treated
+        as a normal active finding (score/severity derived from the number),
+        not silently dropped and not misfiled as unparsed."""
+        html = """
+<div class="subsectioncontent">
+  <p><b><a href="?vulnId=CVE-2027-66666">CVE-2027-66666</a></b>&nbsp;
+  <button class="copybutton" data-display-name="legacy-1.0.0.jar"
+    data-sha1="6666666666666666666666666666666666666666"
+    data-pkgurl="pkg:maven/com.example/legacy@1.0.0"
+    data-type-to-suppress="cve" data-id-to-suppress="CVE-2027-66666">suppress</button></p>
+  CVSSv2: Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
+</div>
+"""
+        result = _mod.parse(html)
+        findings = {f["cveId"]: f for f in result["findings"]}
+        self.assertIn("CVE-2027-66666", findings)
+        f = findings["CVE-2027-66666"]
+        self.assertEqual(f["score"], 7.5)
+        self.assertEqual(f["severity"], "HIGH")
+        self.assertEqual(result["unparsed"], [])
+
+    def test_active_finding_with_no_recognizable_score_goes_to_unparsed_not_lost(self):
+        """An active suppress button whose block has no parseable score at
+        all is a fail-safe case: it must NEVER be silently discarded. It must
+        surface in the `unparsed` bucket (with enough detail to investigate)
+        and must NOT appear in `findings`."""
+        html = """
+<div class="subsectioncontent">
+  <p><b><a href="?vulnId=CVE-2027-99999">CVE-2027-99999</a></b>&nbsp;
+  <button class="copybutton" data-display-name="mystery-1.0.0.jar"
+    data-sha1="9999999999999999999999999999999999999999"
+    data-pkgurl="pkg:maven/com.example/mystery@1.0.0"
+    data-type-to-suppress="cve" data-id-to-suppress="CVE-2027-99999">suppress</button></p>
+  No score information rendered for this finding at all.
+</div>
+"""
+        result = _mod.parse(html)
+        ids = {f["cveId"] for f in result["findings"]}
+        self.assertNotIn("CVE-2027-99999", ids)
+        unparsed_ids = {u["cveId"] for u in result["unparsed"]}
+        self.assertIn("CVE-2027-99999", unparsed_ids)
+        u = next(x for x in result["unparsed"] if x["cveId"] == "CVE-2027-99999")
+        self.assertEqual(u["fileName"], "mystery-1.0.0.jar")
+        self.assertEqual(u["packageUrl"], "pkg:maven/com.example/mystery@1.0.0")
+        self.assertEqual(u["sha1"], "9999999999999999999999999999999999999999")
+
+    def test_sample_report_has_no_unparsed_entries(self):
+        """Sanity: the baseline fixture has no unparseable active findings."""
+        self.assertEqual(_mod.parse(self.html)["unparsed"], [])
+
+    # -- "Unscored: Severity: <band>" advisories (JS/NPM) ------------------
+    # dependency-check renders scoreless advisories as `Unscored: Severity:
+    # medium`. The band is authoritative -- below-HIGH must be excluded (not a
+    # false hard stop), at/above-HIGH handled by id type. Verified against the
+    # live haupia (SMASE-WDCS) weekly report, which is red on one real CVE but
+    # also carries 16 medium + 6 low unscored JS advisories.
+
+    def _unscored_button(self, cve, band, typ="vulnerabilityName", pkg="pkg:javascript/foo@1.0"):
+        return f"""
+<div class="subsectioncontent">
+  <p><b>{cve}</b>&nbsp;
+  <button class="copybutton" data-display-name="foo.jar: foo.js"
+    data-sha1="abababababababababababababababababababab"
+    data-pkgurl="{pkg}"
+    data-type-to-suppress="{typ}" data-id-to-suppress="{cve}">suppress</button></p>
+  Some advisory prose here. Unscored: Severity: {band} References
+</div>
+"""
+
+    def test_unscored_medium_cve_is_excluded_not_hard_stop(self):
+        """A scoreless medium CVE (e.g. DOMPurify XSS) is below HIGH -- it does
+        not redden the build and must NOT force a false hard stop via
+        `unparsed`."""
+        result = _mod.parse(self._unscored_button("CVE-2026-41238", "medium"))
+        self.assertEqual(result["findings"], [])
+        self.assertEqual(result["unparsed"], [])
+
+    def test_unscored_low_cve_is_excluded(self):
+        result = _mod.parse(self._unscored_button("CVE-2026-49978", "low"))
+        self.assertEqual(result["findings"], [])
+        self.assertEqual(result["unparsed"], [])
+
+    def test_unscored_high_cve_becomes_a_finding(self):
+        """A scoreless HIGH CVE is at/above the CVSS>=7.0 gate -- it must be a
+        finding (score None, severity carried from the band)."""
+        result = _mod.parse(self._unscored_button("CVE-2026-70001", "high"))
+        ids = {f["cveId"] for f in result["findings"]}
+        self.assertIn("CVE-2026-70001", ids)
+        f = next(x for x in result["findings"] if x["cveId"] == "CVE-2026-70001")
+        self.assertIsNone(f["score"])
+        self.assertEqual(f["severity"], "HIGH")
+        self.assertEqual(result["unparsed"], [])
+
+    def test_unscored_critical_cve_becomes_a_finding(self):
+        result = _mod.parse(self._unscored_button("CVE-2026-70002", "critical"))
+        self.assertIn("CVE-2026-70002", {f["cveId"] for f in result["findings"]})
+
+    def test_unscored_medium_non_cve_is_excluded(self):
+        """A scoreless medium GHSA is below HIGH -- excluded, no hard stop."""
+        result = _mod.parse(self._unscored_button("GHSA-aaaa-bbbb-cccc", "medium"))
+        self.assertEqual(result["findings"], [])
+        self.assertEqual(result["unparsed"], [])
+
+    def test_unscored_high_non_cve_goes_to_unparsed(self):
+        """A scoreless HIGH GHSA reddens the build but has no CVE to remediate
+        -- it must hard-stop via `unparsed`, not be silently excluded."""
+        result = _mod.parse(self._unscored_button("GHSA-dddd-eeee-ffff", "high"))
+        self.assertEqual(result["findings"], [])
+        self.assertIn("GHSA-dddd-eeee-ffff", {u["cveId"] for u in result["unparsed"]})
+
+    # -- unparsed is deduplicated by (id, file) ----------------------------
+
+    def test_unparsed_deduplicated_by_id_and_file(self):
+        """The same advisory on the same file rendered by two buttons (e.g. a
+        cve-typed and a vulnerabilityName-typed button) must yield ONE unparsed
+        entry, not a duplicate."""
+        one = self._unscored_button("GHSA-dddd-eeee-ffff", "high")
+        result = _mod.parse(one + one)
+        matches = [u for u in result["unparsed"] if u["cveId"] == "GHSA-dddd-eeee-ffff"]
+        self.assertEqual(len(matches), 1)
+
+    # -- Non-CVE advisory ids (GHSA-*) must never silently vanish ----------
+
+    # -- CPE identifier suppress buttons are benign, never a finding -------
+
+    def test_cpe_identifier_suppress_button_is_ignored(self):
+        """dependency-check renders a `data-type-to-suppress="cpe"` suppress
+        button on EVERY dependency's CPE identifier, whether or not it has a
+        vulnerability. These are ubiquitous and do not redden the build --
+        they must appear in neither `findings` nor `unparsed`."""
+        html = """
+<div class="subsectioncontent">
+  <button class="copybutton" title="Generate Suppression XML for the identified vulnerability identifier"
+    data-display-name="netty-4.1.0.jar"
+    data-sha1="cccccccccccccccccccccccccccccccccccccccc"
+    data-pkgurl="pkg:maven/io.netty/netty@4.1.0"
+    data-type-to-suppress="cpe"
+    data-id-to-suppress="cpe:/a:netty:netty:4.1.0">suppress</button>
+</div>
+"""
+        result = _mod.parse(html)
+        self.assertEqual(result["findings"], [])
+        self.assertEqual(result["unparsed"], [])
+
+    def test_cpe_button_ignored_even_without_type_attr(self):
+        """Belt-and-suspenders: a bare `cpe:` id with no type attribute is
+        still an identifier, never a vulnerability -- ignore it."""
+        html = """
+<div class="subsectioncontent">
+  <button class="copybutton" data-display-name="netty-4.1.0.jar"
+    data-sha1="dddddddddddddddddddddddddddddddddddddddd"
+    data-id-to-suppress="cpe:/a:netty:netty:4.1.0">suppress</button>
+</div>
+"""
+        result = _mod.parse(html)
+        self.assertEqual(result["findings"], [])
+        self.assertEqual(result["unparsed"], [])
+
+    def test_report_full_of_cpe_buttons_and_one_cve_yields_only_the_cve(self):
+        """A realistic slice: many benign CPE identifier buttons around a
+        single real CVE. Only the CVE is a finding; nothing lands in
+        `unparsed`."""
+        cpe_btns = "".join(f"""
+<button class="copybutton" data-display-name="dep-{i}.jar"
+  data-sha1="{str(i)*40:.40}" data-pkgurl="pkg:maven/g/dep{i}@1.0"
+  data-type-to-suppress="cpe"
+  data-id-to-suppress="cpe:/a:g:dep{i}:1.0">suppress</button>""" for i in range(1, 6))
+        html = f"""
+<div class="subsectioncontent">
+  {cpe_btns}
+  <p><b><a href="?vulnId=CVE-2027-12121">CVE-2027-12121</a></b>&nbsp;
+  <button class="copybutton" data-display-name="real-1.0.0.jar"
+    data-sha1="eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"
+    data-pkgurl="pkg:maven/com.example/real@1.0.0"
+    data-type-to-suppress="cve" data-id-to-suppress="CVE-2027-12121">suppress</button></p>
+  CVSSv3: Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N
+</div>
+"""
+        result = _mod.parse(html)
+        self.assertEqual({f["cveId"] for f in result["findings"]}, {"CVE-2027-12121"})
+        self.assertEqual(result["unparsed"], [])
+
+    # -- Non-CVE advisory ids (GHSA-*) must never silently vanish ----------
+
+    def test_ghsa_active_finding_goes_to_unparsed_not_lost(self):
+        """A GHSA-only active suppress button reddens the build but is not a
+        CVE. It must NOT be silently skipped (which would converge to "0
+        findings" on a red build); it must surface in `unparsed` so the caller
+        hard-stops, and must NOT appear in `findings`."""
+        html = """
+<div class="subsectioncontent">
+  <p><b><a href="?vulnId=GHSA-abcd-1234-wxyz">GHSA-abcd-1234-wxyz</a></b>&nbsp;
+  <button class="copybutton" data-display-name="ghsaonly-1.0.0.jar"
+    data-sha1="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+    data-pkgurl="pkg:maven/com.example/ghsaonly@1.0.0"
+    data-type-to-suppress="vulnerabilityName"
+    data-id-to-suppress="GHSA-abcd-1234-wxyz">suppress</button></p>
+  CVSSv3: Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N
+</div>
+"""
+        result = _mod.parse(html)
+        self.assertNotIn("GHSA-abcd-1234-wxyz",
+                         {f["cveId"] for f in result["findings"]})
+        u = next(x for x in result["unparsed"]
+                 if x["cveId"] == "GHSA-abcd-1234-wxyz")
+        self.assertEqual(u["fileName"], "ghsaonly-1.0.0.jar")
+        self.assertEqual(u["packageUrl"], "pkg:maven/com.example/ghsaonly@1.0.0")
+        self.assertIn("non-CVE", u["reason"])
+
+    def test_ghsa_button_does_not_break_neighboring_cve_finding(self):
+        """A GHSA button sitting between a CVE button and its score must not
+        truncate the CVE block or drop the CVE finding."""
+        html = """
+<div class="subsectioncontent">
+  <p><b><a href="?vulnId=CVE-2027-88888">CVE-2027-88888</a></b>&nbsp;
+  <button class="copybutton" data-display-name="real-1.0.0.jar"
+    data-sha1="7777777777777777777777777777777777777777"
+    data-pkgurl="pkg:maven/com.example/real@1.0.0"
+    data-type-to-suppress="cve" data-id-to-suppress="CVE-2027-88888">suppress</button></p>
+  CVSSv3: Base Score: HIGH (8.1) Vector: CVSS:3.1/AV:N
+</div>
+<div class="subsectioncontent">
+  <p><b><a href="?vulnId=GHSA-zzzz-yyyy-xxxx">GHSA-zzzz-yyyy-xxxx</a></b>&nbsp;
+  <button class="copybutton" data-display-name="ghsa-1.0.0.jar"
+    data-sha1="8888888888888888888888888888888888888888"
+    data-pkgurl="pkg:maven/com.example/ghsa@1.0.0"
+    data-type-to-suppress="vulnerabilityName"
+    data-id-to-suppress="GHSA-zzzz-yyyy-xxxx">suppress</button></p>
+  CVSSv3: Base Score: CRITICAL (9.0) Vector: CVSS:3.1/AV:N
+</div>
+"""
+        result = _mod.parse(html)
+        findings = {f["cveId"]: f for f in result["findings"]}
+        self.assertEqual(findings["CVE-2027-88888"]["score"], 8.1)
+        self.assertIn("GHSA-zzzz-yyyy-xxxx",
+                      {u["cveId"] for u in result["unparsed"]})
+
+
+class TestMain(unittest.TestCase):
+    def setUp(self):
+        self.sample = os.path.join(_here, "testdata", "sample-report.html")
+
+    def test_out_writes_valid_json_and_exits_zero(self):
+        with tempfile.TemporaryDirectory() as tmpdir:
+            out_path = os.path.join(tmpdir, "out.json")
+            rc = _mod.main([self.sample, "--out", out_path])
+            self.assertEqual(rc, 0)
+            with open(out_path, encoding="utf-8") as fh:
+                data = json.load(fh)
+            ids = {f["cveId"] for f in data["findings"]}
+            self.assertEqual(ids, {"CVE-2026-54399"})
+
+    def test_missing_input_file_exits_nonzero_with_stderr_message(self):
+        stderr = io.StringIO()
+        with contextlib.redirect_stderr(stderr):
+            rc = _mod.main(["/nonexistent/path/does-not-exist.html"])
+        self.assertNotEqual(rc, 0)
+        self.assertIn("parse_report.py:", stderr.getvalue())
+
+    def test_unwritable_out_path_exits_nonzero_with_stderr_message(self):
+        stderr = io.StringIO()
+        with contextlib.redirect_stderr(stderr):
+            rc = _mod.main([self.sample, "--out", "/nonexistent-dir/out.json"])
+        self.assertNotEqual(rc, 0)
+        self.assertIn("parse_report.py:", stderr.getvalue())
+        self.assertIn("cannot write output", stderr.getvalue())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/teams/firstspirit-caas/skills/handle-red-cve-plan/scripts/testdata/sample-report.html

@@ -0,0 +1,39 @@
+<html><body>
+<!-- ACTIVE finding, HIGH 7.5 -> KEEP -->
+<div class="subsectioncontent">
+  <p><b><a href="?vulnId=CVE-2026-54399">CVE-2026-54399</a></b>&nbsp;
+  <button class="copybutton" data-display-name="httpcore-4.4.16.jar"
+    data-sha1="51cf043c87253c9f58b539c9f7e44c8894223850"
+    data-pkgurl="pkg:maven/org.apache.httpcomponents/httpcore@4.4.16"
+    data-type-to-suppress="cve" data-id-to-suppress="CVE-2026-54399">suppress</button></p>
+  <p><pre>Uncontrolled Resource Consumption in Apache HttpComponents Core (5.4.2 and earlier) allows a remote DoS.</pre></p>
+  CWE-400<br/><br/>
+  CVSSv3: Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H<br/><br/>
+  References:
+  <ul>
+    <li><a target="_blank" href="https://lists.apache.org/thread/abc123">MAILING_LIST,VENDOR_ADVISORY</a></li>
+    <li><a target="_blank" href="https://nvd.nist.gov/vuln/detail/CVE-2026-54399">NVD</a></li>
+    <li><a href="#" class="versionToggle">show all</a></li>
+  </ul>
+  Vulnerable Software &amp; Versions: (<a href="#" class="versionToggle">show all</a>)
+  <ul>
+    <li><a target="_blank" href="https://nvd.nist.gov/vuln/search#cpe">cpe:2.3:a:apache:httpcomponents_core:*:*:*:*:*:*:*:* versions up to (including) 5.4.2</a></li>
+    <li><a target="_blank" href="https://nvd.nist.gov/vuln/search#cpe">cpe:2.3:a:apache:httpcomponents_core:5.5:beta1:*:*:*:*:*:*</a></li>
+  </ul>
+</div>
+<!-- ACTIVE finding, MEDIUM 4.8 -> DROP (below threshold) -->
+<div class="subsectioncontent">
+  <p><b><a href="?vulnId=CVE-2026-14683">CVE-2026-14683</a></b>&nbsp;
+  <button class="copybutton" data-display-name="HdrHistogram-2.2.2.jar"
+    data-sha1="aaaa1111bbbb2222cccc3333dddd4444eeee5555"
+    data-pkgurl="pkg:maven/org.hdrhistogram/HdrHistogram@2.2.2"
+    data-type-to-suppress="cve" data-id-to-suppress="CVE-2026-14683">suppress</button></p>
+  CVSSv3: Base Score: MEDIUM (4.8) Vector: CVSS:3.1/AV:N/AC:H
+</div>
+<!-- SUPPRESSED finding, CRITICAL 9.8 -> DROP (no suppress button) -->
+<div class="sectionheader">Suppressed Vulnerabilities</div>
+<div class="subsectioncontent">
+  <p><b>CVE-2026-53914</b> suppressed In JetBrains Kotlin ... </p>
+  CVSSv3: CRITICAL (9.8)
+</div>
+</body></html>

package/teams/firstspirit-caas/skills/handle-red-cve-plan/scripts/testdata/sample-report.json

@@ -0,0 +1,76 @@
+{
+  "reportSchema": "1.1",
+  "scanInfo": { "engineVersion": "12.2.2" },
+  "projectInfo": { "name": "sample" },
+  "dependencies": [
+    {
+      "fileName": "httpcore-4.4.16.jar",
+      "sha1": "51cf043c87253c9f58b539c9f7e44c8894223850",
+      "packages": [
+        { "id": "pkg:maven/org.apache.httpcomponents/httpcore@4.4.16" }
+      ],
+      "includedBy": [
+        { "reference": "pkg:maven/com.example/app@1.0.0" }
+      ],
+      "vulnerabilities": [
+        {
+          "source": "NVD",
+          "name": "CVE-2026-54399",
+          "severity": "HIGH",
+          "cvssv3": { "baseScore": 7.5, "baseSeverity": "HIGH", "version": "3.1" },
+          "description": "Uncontrolled Resource Consumption in Apache HttpComponents Core 5.4.2 and earlier.",
+          "references": [
+            { "source": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399", "name": "" },
+            { "source": "apache", "url": "https://lists.apache.org/thread/abc123", "name": "" }
+          ],
+          "vulnerableSoftware": [
+            {
+              "software": {
+                "id": "cpe:2.3:a:apache:httpcomponents_core:*:*:*:*:*:*:*:*",
+                "vulnerabilityIdMatched": "true",
+                "versionEndIncluding": "5.4.2"
+              }
+            }
+          ]
+        }
+      ],
+      "suppressedVulnerabilities": [
+        {
+          "source": "NVD",
+          "name": "CVE-2026-53914",
+          "severity": "CRITICAL",
+          "cvssv3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "version": "3.1" },
+          "description": "Suppressed critical finding that must not surface."
+        }
+      ]
+    },
+    {
+      "fileName": "somelib-1.0.0.jar",
+      "sha1": "1111111111111111111111111111111111111111",
+      "packages": [ { "id": "pkg:maven/com.example/somelib@1.0.0" } ],
+      "vulnerabilities": [
+        {
+          "source": "NVD",
+          "name": "CVE-2026-11111",
+          "severity": "MEDIUM",
+          "cvssv3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "version": "3.1" }
+        }
+      ],
+      "suppressedVulnerabilities": []
+    },
+    {
+      "fileName": "ghsaonly-1.0.0.jar",
+      "sha1": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "packages": [ { "id": "pkg:maven/com.example/ghsaonly@1.0.0" } ],
+      "vulnerabilities": [
+        {
+          "source": "OSSINDEX",
+          "name": "GHSA-abcd-1234-wxyz",
+          "severity": "CRITICAL",
+          "cvssv3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "version": "3.1" }
+        }
+      ],
+      "suppressedVulnerabilities": []
+    }
+  ]
+}