troubadix 25.3.4__tar.gz → 25.4.0__tar.gz

{troubadix-25.3.4 → troubadix-25.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: troubadix
-Version: 25.3.4
+Version: 25.4.0
 Summary: A linting and QA check tool for NASL files
 License: GPL-3.0-or-later
 Author: Greenbone

{troubadix-25.3.4 → troubadix-25.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "troubadix"
-version = "25.3.4"
+version = "25.4.0"
 description = "A linting and QA check tool for NASL files"
 authors = ["Greenbone <info@greenbone.net>"]
 license = "GPL-3.0-or-later"

{troubadix-25.3.4 → troubadix-25.4.0}/tests/plugins/test_grammar.py

@@ -208,6 +208,58 @@ class CheckNewlinesTestCase(PluginTestCase):
             results[0].message,
         )
 
+    def test_grammar7(self):
+        nasl_file = Path(__file__).parent / "test.nasl"
+        content = (
+            '  script_tag(name:"cvss_base", value:"4.0");\n'
+            '  script_tag(name:"summary", value:"Foo Bar is prone to a to a '
+            'remote denial-of-service vulnerability.");\n'
+            '  script_tag(name:"solution_type", value:"VendorFix");\n'
+            '  script_tag(name:"solution", value:"meh");\n'
+        )
+
+        fake_context = self.create_file_plugin_context(
+            nasl_file=nasl_file, file_content=content
+        )
+        plugin = CheckGrammar(fake_context)
+
+        results = list(plugin.run())
+
+        self.assertEqual(len(results), 1)
+        self.assertIsInstance(results[0], LinterError)
+        self.assertEqual(
+            "VT/Include has the following grammar problem:   "
+            'script_tag(name:"summary", value:"Foo Bar is prone to a to a '
+            'remote denial-of-service vulnerability.");',
+            results[0].message,
+        )
+
+    def test_grammar8(self):
+        nasl_file = Path(__file__).parent / "test.nasl"
+        content = (
+            '  script_tag(name:"cvss_base", value:"4.0");\n'
+            '  script_tag(name:"insight", value:"- CVE-2022-31702: Command '
+            'injection in the in the vRNI REST API.");\n'
+            '  script_tag(name:"solution_type", value:"VendorFix");\n'
+            '  script_tag(name:"solution", value:"meh");\n'
+        )
+
+        fake_context = self.create_file_plugin_context(
+            nasl_file=nasl_file, file_content=content
+        )
+        plugin = CheckGrammar(fake_context)
+
+        results = list(plugin.run())
+
+        self.assertEqual(len(results), 1)
+        self.assertIsInstance(results[0], LinterError)
+        self.assertEqual(
+            "VT/Include has the following grammar problem:   "
+            'script_tag(name:"insight", value:"- CVE-2022-31702: Command '
+            'injection in the in the vRNI REST API.");',
+            results[0].message,
+        )
+
     def test_grammar_fp(self):
         nasl_file = Path(__file__).parent / "test.nasl"
         content = (

{troubadix-25.3.4 → troubadix-25.4.0}/tests/standalone_plugins/test_dependency_graph.py

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 # SPDX-FileCopyrightText: 2024 Greenbone AG
+import logging
 import os
 import unittest
 from io import StringIO
@@ -30,20 +31,27 @@ class TestReporter(unittest.TestCase):
     def setUp(self):
         self.result = Result(
             name="TestScript",
+            infos=["cross-feed"],
             warnings=["duplicate dependencies"],
             errors=["missing dependencies"],
         )
 
-    @patch("sys.stdout", new_callable=StringIO)
-    def test_report_verbosity_2(self, mock_stdout):
-        reporter = Reporter(verbosity=2)
-        reporter.report([self.result])
+    def test_output_formatting(self):
+        stream = StringIO()
+
+        handler = logging.StreamHandler(stream)
+        handler.setFormatter(logging.Formatter("%(levelname)s: %(message)s"))
 
-        output = mock_stdout.getvalue()
+        reporter = Reporter()
+        reporter.logger.handlers = [handler]
+        reporter.logger.setLevel(logging.INFO)
+
+        reporter.report([self.result])
 
-        self.assertIn("TestScript - warnings: 1, errors: 1", output)
-        self.assertIn("warning: duplicate dependencies", output)
-        self.assertIn("error: missing dependencies", output)
+        output = stream.getvalue()
+        self.assertIn("INFO: TestScript: cross-feed", output)
+        self.assertIn("WARNING: TestScript: duplicate dependencies", output)
+        self.assertIn("ERROR: TestScript: missing dependencies", output)
 
 
 class TestCLIArgs(unittest.TestCase):
@@ -54,7 +62,7 @@ class TestCLIArgs(unittest.TestCase):
             "--root",
             "tests/standalone_plugins/nasl",
             "--feed",
-            "feed_22_04",
+            "22.04",
             "--log",
             "info",
         ],
@@ -62,8 +70,8 @@ class TestCLIArgs(unittest.TestCase):
     def test_parse_args_ok(self):
         args = parse_args()
         self.assertEqual(args.root, Path("tests/standalone_plugins/nasl"))
-        self.assertEqual(args.feed, [Feed.FEED_22_04])
-        self.assertEqual(args.log, "info")
+        self.assertEqual(args.feed, Feed.FEED_22_04)
+        self.assertEqual(args.log, "INFO")
 
     @patch("sys.stderr", new_callable=StringIO)
     @patch("sys.argv", ["prog", "--root", "not_real_dir"])
@@ -72,7 +80,7 @@ class TestCLIArgs(unittest.TestCase):
             parse_args()
         self.assertRegex(mock_stderr.getvalue(), "invalid directory_type")
 
-    @patch("sys.stderr", new_callable=StringIO)
+    # @patch("sys.stderr", new_callable=StringIO)
     @patch(
         "sys.argv",
         [
@@ -83,10 +91,9 @@ class TestCLIArgs(unittest.TestCase):
             "invalid_feed",
         ],
     )
-    def test_parse_args_invalid_feed(self, mock_stderr):
+    def test_parse_args_invalid_feed(self):
         with self.assertRaises(SystemExit):
             parse_args()
-        self.assertRegex(mock_stderr.getvalue(), "Invalid Feed value")
 
     @patch.dict(os.environ, {"VTDIR": "/mock/env/path"})
     @patch("sys.argv", ["prog"])
@@ -98,7 +105,7 @@ class TestCLIArgs(unittest.TestCase):
     def test_parse_args_defaults(self):
         args = parse_args()
         self.assertEqual(args.log, "WARNING")
-        self.assertEqual(args.feed, [Feed.FULL])
+        self.assertEqual(args.feed, Feed.COMMON)
 
 
 class TestDependencyGraph(unittest.TestCase):
@@ -119,9 +126,9 @@ if(description)
         """
 
     def test_get_feed(self):
-        feed = [Feed.FULL]
+        feed = Feed.FEED_22_04
         scripts = get_feed(Path(self.local_root), feed)
-        self.assertEqual(len(scripts), 6)
+        self.assertEqual(len(scripts), 5)
 
     @patch("pathlib.Path.read_text")
     def test_get_scripts(self, mock_read_text):
@@ -166,35 +173,36 @@ if(description)
     @patch("sys.stdout", new_callable=StringIO)  # mock_stdout (second argument)
     @patch("sys.stderr", new_callable=StringIO)  # mock_stderr (first argument)
     @patch(
-        "sys.argv", ["prog", "--root", "tests/standalone_plugins/nasl", "-v"]
+        "sys.argv",
+        ["prog", "--root", "tests/standalone_plugins/nasl", "--log", "info"],
     )  # no argument
     def test_full_run(self, mock_stderr, mock_stdout):
         return_code = main()
-        output = mock_stdout.getvalue()
+        output = mock_stderr.getvalue()
 
-        self.assertIn("error: missing dependency file: missing.nasl:", output)
+        self.assertIn("ERROR: missing dependency: missing.nasl:", output)
         self.assertIn(
-            "error: cyclic dependency: ",  # order is random so can't match the output
+            "ERROR: cyclic dependency: ",  # order is random so can't match the output
             output,
         )
         self.assertIn(
-            "error: unchecked cross-feed-dependency: foo.nasl(community feed) depends on"
-            " gsf/enterprise_script.nasl(enterprise feed), but the"
-            " current feed is not properly checked",
+            "ERROR: cross-feed dependency: incorrect feed check in foo.nasl(community feed)"
+            " which depends on gsf/enterprise_script.nasl(enterprise feed)",
             output,
         )
         self.assertIn(
-            "error: bar.nasl depends on foo.nasl which has a lower category order",
+            "ERROR: category order: bar.nasl depends on foo.nasl which has a lower category order",
             output,
         )
         self.assertIn(
-            "error: foo.nasl depends on deprecated script foobar.nasl", output
+            "ERROR: deprecated dependency: foo.nasl depends on deprecated script foobar.nasl",
+            output,
         )
         self.assertIn(
-            "warning: Duplicate dependencies in bar.nasl: foo.nasl", output
+            "WARNING: duplicate dependency: in bar.nasl: foo.nasl", output
         )
         self.assertIn(
-            "warning: cross-feed-dependency: bar.nasl(community feed)"
+            "INFO: cross-feed dependency: bar.nasl(community feed)"
             " depends on gsf/enterprise_script.nasl(enterprise feed)",
             output,
         )

{troubadix-25.3.4 → troubadix-25.4.0}/troubadix/__version__.py

@@ -2,4 +2,4 @@
 
 # THIS IS AN AUTOGENERATED FILE. DO NOT TOUCH!
 
-__version__ = "25.3.4"
+__version__ = "25.4.0"

{troubadix-25.3.4 → troubadix-25.4.0}/troubadix/codespell/codespell.additions

@@ -22,3 +22,5 @@ entreprise->enterprise
 entreprises->enterprises
 iit->it
 itt->it
+CSFR->CSRF
+XXS->XSS

{troubadix-25.3.4 → troubadix-25.4.0}/troubadix/codespell/codespell.exclude

@@ -815,6 +815,8 @@ ofproto/bond: fix interal flow leak of tcp-balance bond
   of user-supplied input processed by Steam In-Home Streaming (IHS) Discovery
   of Wiesemann & Theis GmbH W&T OPC Server for Windows.");
 Ohter bug fixes:
+"olt",
+"olt/pages",
       # on e.g. newer releases of the NAM appliance we're even getting an 403/forbidden
 opc_req_header = raw_string("HEL",   # Message Type (Hello)
 opening a specially crafted CAF audio file, an attacker could execute

{troubadix-25.3.4 → troubadix-25.4.0}/troubadix/plugins/grammar.py

@@ -174,6 +174,11 @@ def get_grammer_pattern() -> re.Pattern:
         # server-site template injection -> server-side template injection
         r"cross[\s-]+side[\s-]+(request[\s-]+forgery|scripting)|"
         r"server[\s-]+site[\s-]+(request[\s-]+forgery|template)[\s-]+injection|"
+        # nb: Next two could happen when copy'n'paste some text parts around
+        # like e.g.:
+        # is prone to a to a remote denial-of-service vulnerability
+        # CVE-2022-31702: Command injection in the in the vRNI REST API
+        r"in the in the|to an? to a|"
         # e.g. "is prone to a security bypass vulnerabilities"
         r"is\s+prone\s+to\s+an?\s+[^\s]+\s+([^\s]+\s+)?vulnerabilities" r").*",
         re.IGNORECASE,

{troubadix-25.3.4 → troubadix-25.4.0}/troubadix/standalone_plugins/dependency_graph/checks.py

@@ -17,12 +17,10 @@ def check_duplicates(scripts: list[Script]) -> Result:
     for script in scripts:
         counter = Counter(dep.name for dep in script.dependencies)
         duplicates = [dep for dep, count in counter.items() if count > 1]
-
         if duplicates:
-            msg = f"Duplicate dependencies in {script.name}: {', '.join(duplicates)}"
-            warnings.append(msg)
+            warnings.append(f"in {script.name}: {', '.join(duplicates)}")
 
-    return Result(name="check_duplicates", warnings=warnings)
+    return Result(name="duplicate dependency", warnings=warnings)
 
 
 def check_missing_dependencies(
@@ -34,20 +32,22 @@ def check_missing_dependencies(
     logs the scripts dependending on the missing script
     """
     errors = []
-    dependencies = {
+    dependency_names = {
         dep.name for script in scripts for dep in script.dependencies
     }
     script_names = {script.name for script in scripts}
-    missing_dependencies = dependencies - script_names
+    missing_dependencies = dependency_names - script_names
 
     for missing in missing_dependencies:
         depending_scripts = graph.predecessors(missing)
-        msg = f"missing dependency file: {missing}:"
-        for script in depending_scripts:
-            msg += f"\n  - used by: {script}"
-        errors.append(msg)
+        errors.append(
+            f"{missing}:"
+            + "".join(
+                f"\n  - used by: {script}" for script in depending_scripts
+            )
+        )
 
-    return Result(name="missing_dependencies", errors=errors)
+    return Result(name="missing dependency", errors=errors)
 
 
 def check_cycles(graph) -> Result:
@@ -59,8 +59,8 @@ def check_cycles(graph) -> Result:
 
     cycles = nx.simple_cycles(graph)
 
-    errors = [f"cyclic dependency: {cycle}" for cycle in cycles]
-    return Result(name="check_cycles", errors=errors)
+    errors = [str(cycle) for cycle in cycles]
+    return Result(name="cyclic dependency", errors=errors)
 
 
 def cross_feed_dependencies(
@@ -86,22 +86,19 @@ def check_cross_feed_dependencies(graph) -> Result:
     and if they are correctly contained within a is_enterprise_feed check.
     """
     gated_cfd = cross_feed_dependencies(graph, is_enterprise_checked=True)
-    warnings = [
-        f"cross-feed-dependency: {dependent}(community feed) "
-        f"depends on {dependency}(enterprise feed)"
+    infos = [
+        f"{dependent}(community feed) depends on {dependency}(enterprise feed)"
         for dependent, dependency in gated_cfd
     ]
 
     ungated_cfd = cross_feed_dependencies(graph, is_enterprise_checked=False)
     errors = [
-        f"unchecked cross-feed-dependency: {dependent}(community feed) "
-        f"depends on {dependency}(enterprise feed), but the current feed is not properly checked"
+        f"incorrect feed check in {dependent}(community feed) "
+        f"which depends on {dependency}(enterprise feed)"
         for dependent, dependency in ungated_cfd
     ]
 
-    return Result(
-        name="check_cross_feed_dependencies", warnings=warnings, errors=errors
-    )
+    return Result(name="cross-feed dependency", infos=infos, errors=errors)
 
 
 def check_category_order(graph) -> Result:
@@ -116,7 +113,7 @@ def check_category_order(graph) -> Result:
         f"{dependent} depends on {dependency} which has a lower category order"
         for dependent, dependency in problematic_edges
     ]
-    return Result(name="check_category_order", errors=errors)
+    return Result(name="category order", errors=errors)
 
 
 def check_deprecated_dependencies(graph) -> Result:
@@ -125,4 +122,4 @@ def check_deprecated_dependencies(graph) -> Result:
         for dependent, dependency in graph.edges()
         if graph.nodes[dependency].get("deprecated", False)
     ]
-    return Result(name="check_deprecated_dependencies", errors=errors)
+    return Result(name="deprecated dependency", errors=errors)

{troubadix-25.3.4 → troubadix-25.4.0}/troubadix/standalone_plugins/dependency_graph/cli.py

@@ -3,7 +3,7 @@
 
 
 import os
-from argparse import ArgumentParser, ArgumentTypeError, Namespace
+from argparse import ArgumentParser, Namespace
 from pathlib import Path
 
 from troubadix.argparser import directory_type_existing
@@ -11,13 +11,6 @@ from troubadix.argparser import directory_type_existing
 from .models import Feed
 
 
-def feed_type(value: str) -> Feed:
-    try:
-        return Feed[value.upper()]
-    except KeyError:
-        raise ArgumentTypeError(f"Invalid Feed value: '{value}'")
-
-
 def parse_args() -> Namespace:
     parser = ArgumentParser(
         description="Tool for analysing the dependencies in the NASL repository.",
@@ -31,18 +24,18 @@ def parse_args() -> Namespace:
     parser.add_argument(
         "-f",
         "--feed",
-        type=feed_type,
+        type=Feed,
         choices=Feed,
-        nargs="+",
-        default=[Feed.FULL],
-        help="feed",
+        default=Feed.COMMON,
+        help="Feed selection",
     )
     parser.add_argument(
         "--log",
+        type=str.upper,
         default="WARNING",
-        help="Set the logging level (INFO, WARNING, ERROR)",
+        choices=["INFO", "WARNING", "ERROR"],
+        help="Set the logging level (default: WARNING)",
     )
-    parser.add_argument("-v", "--verbose", action="count", default=0)
 
     args = parser.parse_args()
 

{troubadix-25.3.4 → troubadix-25.4.0}/troubadix/standalone_plugins/dependency_graph/dependency_graph.py

@@ -5,7 +5,6 @@
 import logging
 import re
 import sys
-from functools import reduce
 from pathlib import Path
 
 import networkx as nx
@@ -47,46 +46,23 @@ ENTERPRISE_FEED_CHECK_PATTERN = re.compile(
 
 
 class Reporter:
-    def __init__(self, verbosity) -> None:
-        self.verbosity = verbosity
+    def __init__(self) -> None:
+        self.logger = logging.getLogger(__name__)
 
     def report(self, results: list[Result]):
         for result in results:
-            if self.verbosity >= 2:
-                self.print_statistic(result)
-                self.print_divider()
-            if self.verbosity >= 1:
-                self.print_warnings(result)
-            self.print_errors(result)
-            if self.verbosity >= 2:
-                self.print_divider("=")
-
-    def print_divider(self, char="-", length=40):
-        print(char * length)
-
-    def print_statistic(self, result: Result):
-        print(
-            f"{result.name} - warnings: {len(result.warnings)}, errors: {len(result.errors)}"
-        )
-
-    def print_warnings(self, result: Result):
-        for warning in result.warnings:
-            print(f"warning: {warning}")
+            for error in result.errors:
+                self.logger.error(f"{result.name}: {error}")
+            for warning in result.warnings:
+                self.logger.warning(f"{result.name}: {warning}")
+            for info in result.infos:
+                self.logger.info(f"{result.name}: {info}")
 
-    def print_errors(self, result: Result):
-        for error in result.errors:
-            print(f"error: {error}")
 
-
-def get_feed(root, feeds: list[Feed]) -> list[Script]:
-    feed = reduce((lambda x, y: x | y), feeds)
-    scripts = []
-    if feed & Feed.COMMON:
-        scripts.extend(get_scripts(root / "common"))
-    if feed & Feed.FEED_21_04:
-        scripts.extend(get_scripts(root / "21.04"))
-    if feed & Feed.FEED_22_04:
-        scripts.extend(get_scripts(root / "22.04"))
+def get_feed(root: Path, feed: Feed) -> list[Script]:
+    scripts = get_scripts(root / "common")  # Always include common
+    if feed != Feed.COMMON:  # Add version-specific scripts if not just common
+        scripts.extend(get_scripts(root / feed.value))
 
     return scripts
 
@@ -197,7 +173,7 @@ def main():
         check_category_order(graph),
         check_deprecated_dependencies(graph),
     ]
-    reporter = Reporter(args.verbose)
+    reporter = Reporter()
     reporter.report(results)
 
     if any(result.errors for result in results):

{troubadix-25.3.4 → troubadix-25.4.0}/troubadix/standalone_plugins/dependency_graph/models.py

@@ -2,18 +2,19 @@
 # SPDX-FileCopyrightText: 2025 Greenbone AG
 
 from dataclasses import dataclass, field
-from enum import Flag, auto
+from enum import Enum
 
 
-class Feed(Flag):
-    COMMON = auto()
-    FEED_21_04 = auto()
-    FEED_22_04 = auto()
-    FULL = COMMON | FEED_21_04 | FEED_22_04
+class Feed(str, Enum):
+    COMMON = "common"
+    FEED_21_04 = "21.04"
+    FEED_22_04 = "22.04"
 
-    def __str__(self):
-        # Make enum values user-friendly for argparse help
-        return self.name.lower()
+
+class OutputLevel(Enum):
+    ERROR = 1
+    WARNING = 2
+    INFO = 3
 
 
 @dataclass
@@ -35,6 +36,11 @@ class Script:
 
 @dataclass
 class Result:
+    """Holds the results of a single check.
+    A check can report a combination of errors, warnings and infos
+    """
+
     name: str
     warnings: list[str] = field(default_factory=list)
     errors: list[str] = field(default_factory=list)
+    infos: list[str] = field(default_factory=list)