troubadix 25.7.2__tar.gz → 25.8.0__tar.gz

{troubadix-25.7.2 → troubadix-25.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: troubadix
-Version: 25.7.2
+Version: 25.8.0
 Summary: A linting and QA check tool for NASL files
 License: GPL-3.0-or-later
 Author: Greenbone

{troubadix-25.7.2 → troubadix-25.8.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "troubadix"
-version = "25.7.2"
+version = "25.8.0"
 description = "A linting and QA check tool for NASL files"
 authors = ["Greenbone <info@greenbone.net>"]
 license = "GPL-3.0-or-later"

troubadix-25.8.0/tests/helper/test_if_block_parser.py

@@ -0,0 +1,251 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+# SPDX-FileCopyrightText: 2025 Greenbone AG
+
+import unittest
+
+from troubadix.helper.if_block_parser import IfErrorType, find_if_statements
+
+
+class FindIfStatementsTestCase(unittest.TestCase):
+    def test_empty_input(self):
+        result = find_if_statements("")
+        self.assertEqual(len(result.statements), 0)
+        self.assertEqual(len(result.errors), 0)
+
+    def test_inline_single_expression(self):
+        content = 'if(TRUE) display("inline");'
+        result = find_if_statements(content)
+
+        self.assertEqual(1, len(result.statements))
+        self.assertEqual("TRUE", result.statements[0].condition)
+        self.assertEqual('display("inline")', result.statements[0].outcome)
+        # Check that position is correct (start at 'if', end at semicolon)
+        self.assertEqual(0, result.statements[0].if_start)
+        self.assertEqual(len(content), result.statements[0].if_end)
+
+    def test_single_line_with_newline(self):
+        content = 'if(TRUE)\n  display("single line");'
+        result = find_if_statements(content)
+
+        self.assertEqual(1, len(result.statements))
+        self.assertEqual("TRUE", result.statements[0].condition)
+        self.assertEqual('display("single line")', result.statements[0].outcome)
+
+    def test_standard_block(self):
+        content = 'if(TRUE) {\n  display("block");\n}'
+        result = find_if_statements(content)
+
+        self.assertEqual(1, len(result.statements))
+        self.assertEqual("TRUE", result.statements[0].condition)
+        self.assertEqual('display("block");', result.statements[0].outcome)
+        # Check position spans from 'if' to the closing brace
+        self.assertEqual(0, result.statements[0].if_start)
+        self.assertEqual(len(content), result.statements[0].if_end)
+
+    def test_block_brace_on_newline(self):
+        content = 'if(TRUE)\n{\n  display("block");\n}'
+        result = find_if_statements(content)
+
+        self.assertEqual(1, len(result.statements))
+        self.assertEqual("TRUE", result.statements[0].condition)
+        self.assertEqual('display("block");', result.statements[0].outcome)
+
+    def test_empty_block(self):
+        content = "if(TRUE)\n{\n}"
+        result = find_if_statements(content)
+
+        self.assertEqual(1, len(result.statements))
+        self.assertEqual("TRUE", result.statements[0].condition)
+        self.assertEqual("", result.statements[0].outcome)
+
+    def test_compact_block(self):
+        content = "if(TRUE){}"
+        result = find_if_statements(content)
+
+        self.assertEqual(1, len(result.statements))
+        self.assertEqual("TRUE", result.statements[0].condition)
+        self.assertEqual("", result.statements[0].outcome)
+
+    def test_multiple_if_statements(self):
+        content = """
+        if(cond1) display("one");
+        if(cond2) {
+            display("two");
+        }
+        if(cond3)
+            display("three");
+        """
+        result = find_if_statements(content)
+        self.assertEqual(3, len(result.statements))
+
+        self.assertEqual("cond1", result.statements[0].condition)
+        self.assertEqual('display("one")', result.statements[0].outcome)
+
+        self.assertEqual("cond2", result.statements[1].condition)
+        self.assertEqual('display("two");', result.statements[1].outcome)
+
+        self.assertEqual("cond3", result.statements[2].condition)
+        self.assertEqual('display("three")', result.statements[2].outcome)
+
+    def test_nested_if_statements(self):
+        content = """
+        if(outer) {
+            if(inner1) {
+                display("nested block");
+            }
+            if(inner2) display("nested inline");
+        }
+        """
+        result = find_if_statements(content)
+        self.assertEqual(3, len(result.statements))
+
+        self.assertEqual("outer", result.statements[0].condition)
+        self.assertIn("if(inner1)", result.statements[0].outcome)
+        self.assertIn("if(inner2)", result.statements[0].outcome)
+
+        self.assertEqual("inner1", result.statements[1].condition)
+        self.assertIn('display("nested block")', result.statements[1].outcome)
+
+        self.assertEqual("inner2", result.statements[2].condition)
+        self.assertEqual(
+            'display("nested inline")', result.statements[2].outcome
+        )
+
+    def test_complex_condition(self):
+        content = (
+            'if (a == 1 && b > 2 || c != "string") { display("complex"); }'
+        )
+        result = find_if_statements(content)
+
+        self.assertEqual(1, len(result.statements))
+        self.assertEqual(
+            'a == 1 && b > 2 || c != "string"', result.statements[0].condition
+        )
+        self.assertEqual('display("complex");', result.statements[0].outcome)
+
+    def test_if_with_problematic_stuff(self):
+        # escape single quote and backslash, function call in condition
+        content = r"if(some_func('\'\\')) display('\'test\\');"
+        result = find_if_statements(content)
+
+        self.assertEqual(1, len(result.statements))
+        self.assertEqual(r"some_func('\'\\')", result.statements[0].condition)
+        self.assertEqual(r"display('\'test\\')", result.statements[0].outcome)
+
+    def test_unclosed_parenthesis(self):
+        content = "if(unclosed condition\ndisplay();"
+        result = find_if_statements(content)
+        self.assertEqual(len(result.statements), 0)
+        self.assertEqual(len(result.errors), 1)
+        self.assertEqual(result.errors[0].error_type.name, "UNCLOSED_CONDITION")
+
+    def test_no_statement_after_condition(self):
+        content = "if(condition)"
+        result = find_if_statements(content)
+        self.assertEqual(len(result.statements), 0)
+        self.assertEqual(len(result.errors), 1)
+        self.assertEqual(result.errors[0].error_type.name, "MISSING_OUTCOME")
+
+    def test_useless_semicolon(self):
+        content = "if(condition);"
+        result = find_if_statements(content)
+        self.assertEqual(len(result.statements), 0)
+        self.assertEqual(len(result.errors), 1)
+        self.assertEqual(
+            result.errors[0].error_type.name, "TERMINATED_AFTER_CONDITION"
+        )
+
+    def test_unclosed_block_brace(self):
+        content = "if(condition) {\ndisplay();\n# Missing closing brace"
+        result = find_if_statements(content)
+        self.assertEqual(len(result.statements), 0)
+        self.assertEqual(len(result.errors), 1)
+        self.assertEqual(result.errors[0].error_type.name, "UNCLOSED_BODY")
+
+    def test_no_semicolon_in_single_expression(self):
+        content = "if(condition) display()"  # Missing semicolon
+        result = find_if_statements(content)
+        self.assertEqual(len(result.statements), 0)
+        self.assertEqual(len(result.errors), 1)
+        self.assertEqual(result.errors[0].error_type.name, "MISSING_STATEMENT")
+
+    def test_complex_condition_with_unmatched_brace(self):
+        content = "if(func(1, 2) || check(a) { display(); }"  # Missing closing ) in condition
+        result = find_if_statements(content)
+        self.assertEqual(len(result.statements), 0)
+        self.assertEqual(len(result.errors), 1)
+        self.assertEqual(result.errors[0].error_type.name, "UNCLOSED_CONDITION")
+
+    def test_position_info_in_error_message(self):
+        content = "# Some comment\nif(bad) something"  # No semicolon
+        result = find_if_statements(content)
+        self.assertEqual(len(result.statements), 0)
+        self.assertEqual(len(result.errors), 1)
+        self.assertEqual(result.errors[0].line, 2)
+
+    def test_condition_and_statement_positions_block(self):
+        content = 'if(TRUE) {\n  display("block");\n}'
+        result = find_if_statements(content)
+
+        self.assertEqual(1, len(result.statements))
+        # Check condition position (inside parentheses)
+        self.assertEqual(3, result.statements[0].condition_start)
+        self.assertEqual(7, result.statements[0].condition_end)
+        # Check outcome position (inside braces)
+        self.assertEqual(10, result.statements[0].outcome_start)
+        self.assertEqual(31, result.statements[0].outcome_end)
+
+    def test_condition_and_statement_positions_single(self):
+        content = 'if(num > 5) display("inline");'
+        result = find_if_statements(content)
+
+        self.assertEqual(1, len(result.statements))
+        # Check condition position (inside parentheses)
+        self.assertEqual(3, result.statements[0].condition_start)
+        self.assertEqual(10, result.statements[0].condition_end)
+        # Check outcome position (after parenthesis to semicolon)
+        self.assertEqual(12, result.statements[0].outcome_start)
+        self.assertEqual(29, result.statements[0].outcome_end)
+
+    def test_mixed_valid_and_invalid_if_statements(self):
+        content = """
+        if(a > 0) display("ok1");
+        if(b > 0) ;
+        if(c > 0) {
+            display("ok2");
+        }
+        if(d > 0)
+            if(e > 0) display("ok3");
+        if(f > 0 display();
+        """
+        result = find_if_statements(content)
+        self.assertEqual(4, len(result.statements))
+        self.assertEqual(2, len(result.errors))
+        self.assertEqual("a > 0", result.statements[0].condition)
+        self.assertEqual(
+            IfErrorType.TERMINATED_AFTER_CONDITION,
+            result.errors[0].error_type,
+        )
+        self.assertEqual(
+            IfErrorType.UNCLOSED_CONDITION, result.errors[1].error_type
+        )
+
+    def test_multiple_nested_inline_if_statements(self):
+        content = """
+if(a > 0)
+
+    if(b > 0)
+
+        if(c > 0)
+
+            display("deep");
+        """
+        result = find_if_statements(content)
+        # Should parse 3 nested if statements
+        self.assertEqual(3, len(result.statements))
+        self.assertEqual("a > 0", result.statements[0].condition)
+        self.assertIn("if(b > 0)", result.statements[0].outcome)
+        self.assertEqual("b > 0", result.statements[1].condition)
+        self.assertIn("if(c > 0)", result.statements[1].outcome)
+        self.assertEqual("c > 0", result.statements[2].condition)
+        self.assertEqual('display("deep")', result.statements[2].outcome)

troubadix-25.8.0/tests/plugins/test_if_statement_syntax.py

@@ -0,0 +1,166 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+# SPDX-FileCopyrightText: 2025 Greenbone AG
+
+from pathlib import Path
+
+from troubadix.plugins.if_statement_syntax import CheckIfStatementSyntax
+
+from . import PluginTestCase
+
+
+class CheckIfStatementSyntaxTestCase(PluginTestCase):
+    """Test cases for the CheckIfStatementSyntax plugin."""
+
+    def test_valid_if_statements(self):
+        nasl_file = Path(__file__).parent / "test.nasl"
+        content = """
+        if(condition) {
+            display("block statement");
+        }
+
+        if(another_condition) display("single statement");
+
+        if(nested_condition) {
+            if(inner_condition) {
+                display("nested");
+            }
+        }
+        """
+
+        fake_context = self.create_file_plugin_context(
+            nasl_file=nasl_file, file_content=content
+        )
+        plugin = CheckIfStatementSyntax(fake_context)
+
+        results = list(plugin.run())
+
+        self.assertEqual(len(results), 0)
+
+    def test_unclosed_parenthesis(self):
+        nasl_file = Path(__file__).parent / "test.nasl"
+        content = """
+        if(unclosed_condition {
+            display("this should fail");
+        }
+        """
+
+        fake_context = self.create_file_plugin_context(
+            nasl_file=nasl_file, file_content=content
+        )
+        plugin = CheckIfStatementSyntax(fake_context)
+
+        results = list(plugin.run())
+
+        self.assertEqual(len(results), 1)
+        self.assertIn("Unclosed parenthesis", results[0].message)
+        self.assertIn("line 2", results[0].message)
+
+    def test_unclosed_brace(self):
+        nasl_file = Path(__file__).parent / "test.nasl"
+        content = """
+        if(condition) {
+            display("missing closing brace");
+        # Missing closing brace
+        """
+
+        fake_context = self.create_file_plugin_context(
+            nasl_file=nasl_file, file_content=content
+        )
+        plugin = CheckIfStatementSyntax(fake_context)
+
+        results = list(plugin.run())
+
+        self.assertEqual(len(results), 1)
+        self.assertIn("Unclosed brace", results[0].message)
+
+    def test_missing_statement(self):
+        nasl_file = Path(__file__).parent / "test.nasl"
+        content = """
+        if(condition)
+        # No statement follows
+        """
+
+        fake_context = self.create_file_plugin_context(
+            nasl_file=nasl_file, file_content=content
+        )
+        plugin = CheckIfStatementSyntax(fake_context)
+
+        results = list(plugin.run())
+
+        self.assertEqual(len(results), 1)
+        self.assertIn("Missing statement", results[0].message)
+
+    def test_semicolon_after_condition(self):
+        nasl_file = Path(__file__).parent / "test.nasl"
+        content = """
+        if(condition);
+        {
+            display("this will always execute");
+        }
+        """
+
+        fake_context = self.create_file_plugin_context(
+            nasl_file=nasl_file, file_content=content
+        )
+        plugin = CheckIfStatementSyntax(fake_context)
+
+        results = list(plugin.run())
+
+        self.assertEqual(len(results), 1)
+        self.assertIn("Semicolon after if condition", results[0].message)
+
+    def test_missing_semicolon_in_expression(self):
+        nasl_file = Path(__file__).parent / "test.nasl"
+        content = """
+        if(condition) display("missing semicolon")
+        # No semicolon at end of expression
+        """
+
+        fake_context = self.create_file_plugin_context(
+            nasl_file=nasl_file, file_content=content
+        )
+        plugin = CheckIfStatementSyntax(fake_context)
+
+        results = list(plugin.run())
+
+        self.assertEqual(len(results), 1)
+        self.assertIn("Missing expression", results[0].message)
+
+    def test_comment_handling(self):
+        nasl_file = Path(__file__).parent / "test.nasl"
+        content = """
+        # This comment has an unclosed if(condition that should be ignored
+        if(real_condition) {
+            # Another comment with if(fake
+            display("real code");
+        }
+        """
+
+        fake_context = self.create_file_plugin_context(
+            nasl_file=nasl_file, file_content=content
+        )
+        plugin = CheckIfStatementSyntax(fake_context)
+
+        results = list(plugin.run())
+
+        self.assertEqual(len(results), 0)
+
+    def test_complex_nested_error(self):
+        nasl_file = Path(__file__).parent / "test.nasl"
+        content = """
+        if(outer_condition) {
+            if(inner_condition {  # Missing closing parenthesis
+                display("nested error");
+            }
+        }
+        """
+
+        fake_context = self.create_file_plugin_context(
+            nasl_file=nasl_file, file_content=content
+        )
+        plugin = CheckIfStatementSyntax(fake_context)
+
+        results = list(plugin.run())
+
+        self.assertEqual(len(results), 1)
+        self.assertIn("Unclosed parenthesis", results[0].message)

{troubadix-25.7.2 → troubadix-25.8.0}/tests/plugins/test_using_display.py

@@ -131,18 +131,3 @@ class CheckUsingDisplayTestCase(PluginTestCase):
         results = list(plugin.run())
 
         self.assertEqual(0, len(results))
-
-    def test_propagate_if_parser_error(self):
-        path = Path("some/file.nasl")
-        content = "if (Foo);\ndisplay('Foo');"
-        fake_context = self.create_file_plugin_context(
-            nasl_file=path, file_content=content
-        )
-        plugin = CheckUsingDisplay(fake_context)
-
-        results = list(plugin.run())
-
-        # only one result for if parser error,
-        # display call not part of result due to early exit of entire run.
-        self.assertEqual(1, len(results))
-        self.assertIn("Semicolon after if condition", results[0].message)

{troubadix-25.7.2 → troubadix-25.8.0}/troubadix/__version__.py

@@ -2,4 +2,4 @@
 
 # THIS IS AN AUTOGENERATED FILE. DO NOT TOUCH!
 
-__version__ = "25.7.2"
+__version__ = "25.8.0"

{troubadix-25.7.2 → troubadix-25.8.0}/troubadix/codespell/codespell.additions

@@ -24,3 +24,5 @@ iit->it
 itt->it
 CSFR->CSRF
 XXS->XSS
+reverenced->referenced
+sever->server

{troubadix-25.7.2 → troubadix-25.8.0}/troubadix/codespell/codespell.exclude

@@ -250,6 +250,7 @@ complete_xml = string (complete_xml, '<oval_system_characteristics xmlns="http:/
   Connection, Expect, If-Match, If-None-Match, If-Range, If-Unmodified-Since, Max-Forwards, TE,
   "Connection: TE, close\r\n",
                   "Connection: TE,,Keep-Alive\r\n\r\n" );
+    ('content="Xenon Boostrap Admin Panel"' >< res || '<body class="cui">' >< res)) {
   control of Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI)
 # Copyright (c) 2008 Tim Brown
 # Copyright (C) 2008 Tim Brown
@@ -347,6 +348,7 @@ CVE-2020-5208: Fixed multiple remote code executtion vulnerabilities
 CVE-2020-8492: Fixed a regular expression in urrlib that was prone to
 CVE-2021-30004: Fixed an issue where forging attacks might have occured
   * CVE-2021-47311: net: qcom/emac: fix UAF in emac_remove (bsc#1225010).
+  - CVE-2025-3200: Multiple products from Wiesemann & Theis");
 dass eine geeignete Windows 8.1 Version, vorzugsweise eine 64-Bit Variante, eingesetzt werden muss.");
 "DataArchivingService/webcontent/aas",
   "/DataArchivingService/webcontent/aas/aas_store.jsp");
@@ -437,6 +439,7 @@ Federico Manuel Bento discovered that the Linux kernel did not properly
 # Fedora Update for tre FEDORA-2016-cd09eab674
 Festplatten- und Dateiverschluesselung eingesetzt werden. Alternativ SOLLTE 'dm-crypt' in
 files. If a user were tricked into opening a specially-crafted CAF file, a
+  files packed with UPack.
   files to potentially execute code and it is tracked by the Mitre CVE
   file_xml = '\t\t<file_item' + status + ' xmlns="http://oval.mitre.org/XMLSchema/' +
 Fixed a bug where Podman could not run containers usin... [Please see the references for more information on the vulnerabilities]");
@@ -507,7 +510,8 @@ Helin, Andre Bargull, Massimiliano Tomassoli, laf.intel, Massimiliano
   hello_data += clen + _ciphers;
 "H", "HSI",
   - HP Helion Eucalyptus does not correctly check IAM user's permissions for accessing versioned objects and ACLs.
-    hp_printer['login_success'] = '<?hp te.includeSubPage';
+    hp_printer["login_success"] = "<?hp te\.includeSubPage";
+    # <?hp te.includeSubPage("/webApps/Wired/ip4.htf") ?>
 </HSI>
 <HSI>
 # <HTML>Acess not granted.</HTML>
@@ -532,6 +536,7 @@ if (!banner || banner !~ "^(RICOH|LANIER|SAVIN|Gestetner|NRG) ")
 if(!banner = get_kb_item("shttp/" + port + "/banner"))
 if (banner =~ "Huawei TE[0-9]0") {
 if( banner =~ "(MD|BU)-" ) {
+if( banner !~ "Server\s*:\s*Boa" || ( "AirLive" >!< banner && banner !~ "(WL|MD|BU|POE)-") )
   if( ( buf =~ "<title>GLPI - Authentification" || buf =~ "<title>GLPI - Authentication" ) && ( buf =~ "Powered By Indepnet" ||
 if( "CONEXANT SYSTEMS, INC." >< r &&
 if( "CONEXANT SYSTEMS, INC" >< r && "ACCESS RUNNER ADSL CONSOLE PORT" >< r && "LOGON PASSWORD" >< r ) {
@@ -591,7 +596,6 @@ if ((res = ispkgvuln(pkg:"app-admin/lsat", unaffected: make_list(), vulnerable:
 if(res =~ "<span>[Ss]arix&[Tt]rade;</span>" && res =~ "<span>Copyright\s*&copy;\s*[0-9]+-[0-9]+,\s*[Pp][Ee][Ll][Cc][Oo]\s*&middot;"
 if (res =~ "[Ss]creen[Cc]onnect" &&
 if( res && "WAN SETTINGS" >< res && "value='3G Interface" >< res && "menu.html" >< res &&
-if( "Server: Boa" >!< banner || ( "AirLive" >!< banner && banner !~ "(WL|MD|BU|POE)-") )
   if( strlen( data ) < 8 || data !~ "^(DELETE|PROPFIND|PUT|GET|HEAD|POST|OPTIONS|REPORT|MKCOL|MOVE|PROPPATCH|COPY|PATCH|CONNECT|TRACE|LOCK|UNLOCK|TRACK|M-POST|CHECKOUT|CHECKIN|UNCHECKOUT|VERSION-CONTROL|BASELINE-CONTROL).*HTTP/(1\.[01]|2)" ) {
   if(strlen(res) && "nonexistant" >< res && "XJ004CSS" >< res) {
   if( sysdesc =~ "^(RICOH|LANIER|SAVIN|NRG)" && sysdesc =~ "(RICOH|LANIER|SAVIN|NRG) Network Printer" ) {
@@ -610,6 +614,7 @@ ii  libapt-pkg4.12:amd64  0.9.7.5ubuntu5.6  amd64  package managment runtime lib
 ii  libapt-pkg4.12:amd64  0.9.7.7ubuntu6  amd64  package managment runtime library
 ii  libapt-pkg4.12:amd64  0.9.7.9+deb7u7  amd64  package managment runtime library
 ii  libapt-pkg4.12:amd64  0.9.9.1~ubuntu3.3  amd64  package managment runtime library
+ii  unminimize  0.2.1  amd64  Un-minimize your minimial images or setup
  image. This occured because of a lack of proper validation that cached
   Imaging and Communications in Medicine (DICOM) service accessible from a public WAN (Internet) /
   Imaging and Communications in Medicine (DICOM) web viewer accessible from a public WAN (Internet)
@@ -728,6 +733,8 @@ mark_dead = script_get_preference( "Mark unrechable Hosts as dead (not scanning)
 Mark Shepard discovered a double free in the TCP listener cleanup which could result in denial of service by an authenticated user if Dropbear is running with the '-a' option.
   masked. All LSAT users are advised to unmerge it.
   "Max-Forwards", "TE" ) ) {
+                      "/mdm/checkin",
+  /mdm/checkin and /lshw endpoints.");
      "Memorise" >< poshRes)
  memory disclosure whne processing of a specially crafted mp4 file with
 # Mesosphere Marathon Web UI Public WAN (Internet) Accessible
@@ -886,6 +893,7 @@ reenable php7-dba support of Berkeley DB (bsc#1108554)");
     reg_xml = '\t\t<registry_item' + status + ' xmlns="http://oval.mitre.org/' +
 Reject invalid eliptic curve point coordinates (bsc#1131291)");
  rejection for EXTRAVERSION = -xfs, but likely little else will be
+  remote attackers to execute arbitrary code via a crafted Upack PE file.
   - Remote Command Execution via WAN and LAN
   - Remote Unauthenticated Information Disclosure via WAN and LAN
 	Remove all mitre.org links from the script descriptions as
@@ -1546,6 +1554,7 @@ Wan-Teh Chang as the original reporters of CVE-2013-5607.
   web-based interface for Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could
   webcontent/aas/aas_store.jsp.");
   * Webdienst Assoziation
+"webdynpro/resources/sap.com/caf~eu~gp~mail~cf~ui",
 Wen Guanxing discovered that PCRE incorrectly handled certain regular
 Wen Xu and Po-Ning Tseng discovered that btrfs file system implementation
 Wen Xu and Po-Ning Tseng discovered that the btrfs filesystem