diff --git a/vulnerabilities/models.py b/vulnerabilities/models.py index 10fd575fe..2b67872a8 100644 --- a/vulnerabilities/models.py +++ b/vulnerabilities/models.py @@ -747,14 +747,6 @@ def fixed_package_details(self): sort_fixed_by_packages_by_version = self.sort_by_version(later_fixed_packages) closest_fixed_package = sort_fixed_by_packages_by_version[0] closest_fixed_package_vulns = closest_fixed_package.affected_by - print( - "\nclosest_fixed_package_vulns = {}\n".format(closest_fixed_package_vulns) - ) - print( - "\ntype(closest_fixed_package_vulns) = {}\n".format( - type(closest_fixed_package_vulns) - ) - ) else: closest_fixed_package = None @@ -776,13 +768,13 @@ def fixed_package_details(self): dict_vuln["fixed_by_purl_vulnerabilities"] = [] # Temporary print output during dev/testing. - from pprint import pprint + # from pprint import pprint - pprint( - purl_dict, - sort_dicts=False, - ) - print("") + # pprint( + # purl_dict, + # sort_dicts=False, + # ) + # print("") return purl_dict diff --git a/vulnerabilities/templates/package_details.html b/vulnerabilities/templates/package_details.html index 9d9c70b77..6d610feb7 100644 --- a/vulnerabilities/templates/package_details.html +++ b/vulnerabilities/templates/package_details.html @@ -24,7 +24,7 @@ -
+ ", - # "fixed_by_purl": PackageURL( - # type="maven", - # namespace="com.fasterxml.jackson.core", - # name="jackson-databind", - # version="2.13.2", - # qualifiers={}, - # subpath=None, - # ), - # "fixed_by_purl_vulnerabilities": [""], - # }, - # { - # "vulnerability": "", - # "fixed_by_purl": None, - # "fixed_by_purl_vulnerabilities": [], - # }, - # ], - # } - - print("\nfirst_vulnerable_package.purl = {}\n".format(first_vulnerable_package.purl)) - - print("\nfirst_vulnerable_package = {}\n".format(first_vulnerable_package)) - - assert ( - first_vulnerable_package.purl - == "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1" - ) + assert first_fixed_by_package.purl == "pkg:pypi/redis@4.3.6" - # assert ( - # first_vulnerable_package - # # == "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1" - # == "" - # ) + def test_string_to_package(self): - purl_string = "pkg:pypi/redis@4.1.1" + purl_string = "pkg:maven/org.apache.tomcat/tomcat@10.0.0-M4" purl = PackageURL.from_string(purl_string) purl_to_dict = purl.to_dict() @@ -507,77 +337,18 @@ def test_get_vulnerable_packages(self): subpath=purl_to_dict.get("subpath") or "", ) - print("\nvulnerablecode_package = {}\n".format(vulnerablecode_package)) - print( - "\nvulnerablecode_package.fixed_package_details = {}\n".format( - vulnerablecode_package.fixed_package_details - ) - ) - - # =============================== - - # # Dictionary with class values - # my_dict = {"obj1": MyClass(1), "obj2": MyClass(2)} - - # # Print the dictionary - # print(my_dict) - - # assert vuln_packages.distinct()[0].fixed_package_details == purl_dict - - # banana = {'purl': PackageURL(type='maven', namespace='com.fasterxml.jackson.core', name='jackson-databind', version='2.13.1', qualifiers={}, subpath=None), 'closest_non_vulnerable': PackageURL(type='maven', namespace='com.fasterxml.jackson.core', name='jackson-databind', version='2.14.0-rc1', qualifiers={}, subpath=None), 'latest_non_vulnerable': PackageURL(type='maven', namespace='com.fasterxml.jackson.core', name='jackson-databind', version='2.14.0-rc1', qualifiers={}, subpath=None), 'vulnerabilities': [{'vulnerability': , 'fixed_by_purl': PackageURL(type='maven', namespace='com.fasterxml.jackson.core', name='jackson-databind', version='2.13.2', qualifiers={}, subpath=None), 'fixed_by_purl_vulnerabilities': []}, {'vulnerability': , 'fixed_by_purl': None, 'fixed_by_purl_vulnerabilities': []}]} - - # print('\nbanana = {}\n'.format(banana)) - - # assert vuln_packages.distinct()[0].`fixed_package_details` == banana - - print( - "\nvuln_packages.distinct()[0].fixed_package_details = {}\n".format( - vuln_packages.distinct()[0].fixed_package_details - ) - ) - - # print(vuln_packages.distinct()[0]["vulnerabilities"].fixed_package_details) # Error: TypeError: 'Package' object is not subscriptable - - print( - "\ntype(vuln_packages.distinct()[0].fixed_package_details) = {}\n".format( - type(vuln_packages.distinct()[0].fixed_package_details) - ) - ) - - print( - '\nvuln_packages.distinct()[0].fixed_package_details.get("purl") = {}\n'.format( - vuln_packages.distinct()[0].fixed_package_details.get("purl") - ) - ) - - print( - '\nvuln_packages.distinct()[0].fixed_package_details["purl"] = {}\n'.format( - vuln_packages.distinct()[0].fixed_package_details["purl"] - ) - ) - - print( - '\nvuln_packages.distinct()[0].fixed_package_details["vulnerabilities"] = {}\n'.format( - vuln_packages.distinct()[0].fixed_package_details["vulnerabilities"] - ) - ) - - print( - '\nvuln_packages.distinct()[0].fixed_package_details["vulnerabilities"][0] = {}\n'.format( - vuln_packages.distinct()[0].fixed_package_details["vulnerabilities"][0] - ) + assert type(vulnerablecode_package) == models.Package + assert vulnerablecode_package.purl == "pkg:maven/org.apache.tomcat/tomcat@10.0.0-M4" + assert vulnerablecode_package.package_url == "pkg:maven/org.apache.tomcat/tomcat@10.0.0-M4" + assert ( + vulnerablecode_package.plain_package_url + == "pkg:maven/org.apache.tomcat/tomcat@10.0.0-M4" ) - - print( - '\nvuln_packages.distinct()[0].fixed_package_details["vulnerabilities"][0]["vulnerability"] = {}\n'.format( - vuln_packages.distinct()[0].fixed_package_details["vulnerabilities"][0][ - "vulnerability" - ] - ) + assert ( + vulnerablecode_package.get_absolute_url() + == "/packages/pkg:maven/org.apache.tomcat/tomcat@10.0.0-M4" ) - print("") - def test_univers_version_comparisons(self): assert versions.PypiVersion("1.2.3") < versions.PypiVersion("1.2.4") assert versions.PypiVersion("0.9") < versions.PypiVersion("0.10") @@ -655,116 +426,3 @@ def test_sort_by_version(self): assert sorted_pkgs[0].purl == "pkg:npm/sequelize@3.9.1" assert sorted_pkgs[-1].purl == "pkg:npm/sequelize@3.40.1" - - # # ZAP: 2023-09-07 Thursday 20:05:40. This has served its purpose and can be removed after a last close look. - # def test_string_to_purl_to_dict_to_package(self): - # # Convert a PURL string to a PURL to a dictionary to a VulnerableCode Package, i.e., - # # a . - - # # Convert a PURL string to a PURL. - # purl_string = "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.31" - # purl = PackageURL.from_string(purl_string) - - # assert type(purl) == PackageURL - # assert purl.type == "maven" - # assert purl.qualifiers == {} - # assert purl.subpath == None - - # # Convert the PURL to a dictionary. - # # ALERT: 2023-08-15 Tuesday 13:18:09. What about using the function 'def purl_to_dict(purl: PackageURL)'? Confusingly similar name but it seems designed to address the issue raised here (and looks useful for passing the data to the Jinja2 template). - # # It appears that this step is where the unwanted None values are created for qualifiers and - # # subpath when the PURL does not already contain values for those attributes. - # purl_to_dict = purl.to_dict() - - # assert purl_to_dict == { - # "type": "maven", - # "namespace": "org.apache.tomcat.embed", - # "name": "tomcat-embed-core", - # "version": "9.0.31", - # "qualifiers": None, - # "subpath": None, - # } - # assert purl_to_dict.get("qualifiers") == None - # assert purl_to_dict.get("subpath") == None - - # # Convert the dictionary to a VulnerableCode Package, i.e., - # # a - - # # If subpath is None we get error: django.db.utils.IntegrityError: null value in column - # # "subpath" violates not-null constraint -- need to convert value from None to empty string. - # # Similar issue with qualifiers, which must be converted from None to {}. - - # # I've structured the following in this way because trying instead to use - # # "with pytest.raises(IntegrityError):" will throw the error - # # django.db.transaction.TransactionManagementError: An error occurred in the current - # # transaction. You can't execute queries until the end of the 'atomic' block. - - # try: - # with transaction.atomic(): - # vulnerablecode_package = models.Package.objects.create( - # type=purl_to_dict.get("type"), - # namespace=purl_to_dict.get("namespace"), - # name=purl_to_dict.get("name"), - # version=purl_to_dict.get("version"), - # qualifiers=purl_to_dict.get("qualifiers"), - # subpath=purl_to_dict.get("subpath"), - # ) - # except IntegrityError: - # print("\nAs expected, an IntegrityError has occurred.\n") - - # # This will avoid the IntegrityError: - # if purl_to_dict.get("qualifiers") is None: - # purl_to_dict["qualifiers"] = {} - # if purl_to_dict.get("subpath") is None: - # purl_to_dict["subpath"] = "" - - # # Check the qualifiers and subpath values again. - # assert purl_to_dict.get("qualifiers") == {} - # assert purl_to_dict.get("subpath") == "" - - # vulnerablecode_package = models.Package.objects.create( - # type=purl_to_dict.get("type"), - # namespace=purl_to_dict.get("namespace"), - # name=purl_to_dict.get("name"), - # version=purl_to_dict.get("version"), - # qualifiers=purl_to_dict.get("qualifiers"), - # subpath=purl_to_dict.get("subpath"), - # ) - - # assert type(vulnerablecode_package) == models.Package - # assert ( - # vulnerablecode_package.purl - # == "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.31" - # ) - # assert vulnerablecode_package.qualifiers == {} - # assert vulnerablecode_package.subpath == "" - - # # ZAP: 2023-09-07 Thursday 20:32:35. Ditch this, right? - # def test_compare_package_major_versions(self): - # # Convert a PURL string to a PURL to a dictionary to a VulnerableCode Package, i.e., - # # a . - - # # Convert a PURL string to a PURL. - # purl_string = "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.31" - # purl = PackageURL.from_string(purl_string) - - # assert type(purl) == PackageURL - # assert purl.type == "maven" - # assert purl.qualifiers == {} - # assert purl.subpath == None - - # print("\npurl_string = {}".format(purl_string)) - - # print("\npurl = {}".format(purl)) - - # print("\nHello VulnerableCode!\n") - - # all_packages = Package.objects - # print("\nPackage.objects = {}\n".format(Package.objects)) - # print("\nall_packages.distinct() = {}\n".format(all_packages.distinct())) - # print("\nall_packages.distinct()[0] = {}\n".format(all_packages.distinct()[0])) - - # for pkg in all_packages.distinct(): - # print(PackageURL.from_string(pkg.purl)) - - # print("")