-
+ |
",
- # "fixed_by_purl": PackageURL(
- # type="maven",
- # namespace="com.fasterxml.jackson.core",
- # name="jackson-databind",
- # version="2.13.2",
- # qualifiers={},
- # subpath=None,
- # ),
- # "fixed_by_purl_vulnerabilities": [""],
- # },
- # {
- # "vulnerability": "",
- # "fixed_by_purl": None,
- # "fixed_by_purl_vulnerabilities": [],
- # },
- # ],
- # }
-
- print("\nfirst_vulnerable_package.purl = {}\n".format(first_vulnerable_package.purl))
-
- print("\nfirst_vulnerable_package = {}\n".format(first_vulnerable_package))
-
- assert (
- first_vulnerable_package.purl
- == "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1"
- )
+ assert first_fixed_by_package.purl == "pkg:pypi/redis@4.3.6"
- # assert (
- # first_vulnerable_package
- # # == "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1"
- # == ""
- # )
+ def test_string_to_package(self):
- purl_string = "pkg:pypi/redis@4.1.1"
+ purl_string = "pkg:maven/org.apache.tomcat/tomcat@10.0.0-M4"
purl = PackageURL.from_string(purl_string)
purl_to_dict = purl.to_dict()
@@ -507,77 +337,18 @@ def test_get_vulnerable_packages(self):
subpath=purl_to_dict.get("subpath") or "",
)
- print("\nvulnerablecode_package = {}\n".format(vulnerablecode_package))
- print(
- "\nvulnerablecode_package.fixed_package_details = {}\n".format(
- vulnerablecode_package.fixed_package_details
- )
- )
-
- # ===============================
-
- # # Dictionary with class values
- # my_dict = {"obj1": MyClass(1), "obj2": MyClass(2)}
-
- # # Print the dictionary
- # print(my_dict)
-
- # assert vuln_packages.distinct()[0].fixed_package_details == purl_dict
-
- # banana = {'purl': PackageURL(type='maven', namespace='com.fasterxml.jackson.core', name='jackson-databind', version='2.13.1', qualifiers={}, subpath=None), 'closest_non_vulnerable': PackageURL(type='maven', namespace='com.fasterxml.jackson.core', name='jackson-databind', version='2.14.0-rc1', qualifiers={}, subpath=None), 'latest_non_vulnerable': PackageURL(type='maven', namespace='com.fasterxml.jackson.core', name='jackson-databind', version='2.14.0-rc1', qualifiers={}, subpath=None), 'vulnerabilities': [{'vulnerability': , 'fixed_by_purl': PackageURL(type='maven', namespace='com.fasterxml.jackson.core', name='jackson-databind', version='2.13.2', qualifiers={}, subpath=None), 'fixed_by_purl_vulnerabilities': []}, {'vulnerability': , 'fixed_by_purl': None, 'fixed_by_purl_vulnerabilities': []}]}
-
- # print('\nbanana = {}\n'.format(banana))
-
- # assert vuln_packages.distinct()[0].`fixed_package_details` == banana
-
- print(
- "\nvuln_packages.distinct()[0].fixed_package_details = {}\n".format(
- vuln_packages.distinct()[0].fixed_package_details
- )
- )
-
- # print(vuln_packages.distinct()[0]["vulnerabilities"].fixed_package_details) # Error: TypeError: 'Package' object is not subscriptable
-
- print(
- "\ntype(vuln_packages.distinct()[0].fixed_package_details) = {}\n".format(
- type(vuln_packages.distinct()[0].fixed_package_details)
- )
- )
-
- print(
- '\nvuln_packages.distinct()[0].fixed_package_details.get("purl") = {}\n'.format(
- vuln_packages.distinct()[0].fixed_package_details.get("purl")
- )
- )
-
- print(
- '\nvuln_packages.distinct()[0].fixed_package_details["purl"] = {}\n'.format(
- vuln_packages.distinct()[0].fixed_package_details["purl"]
- )
- )
-
- print(
- '\nvuln_packages.distinct()[0].fixed_package_details["vulnerabilities"] = {}\n'.format(
- vuln_packages.distinct()[0].fixed_package_details["vulnerabilities"]
- )
- )
-
- print(
- '\nvuln_packages.distinct()[0].fixed_package_details["vulnerabilities"][0] = {}\n'.format(
- vuln_packages.distinct()[0].fixed_package_details["vulnerabilities"][0]
- )
+ assert type(vulnerablecode_package) == models.Package
+ assert vulnerablecode_package.purl == "pkg:maven/org.apache.tomcat/tomcat@10.0.0-M4"
+ assert vulnerablecode_package.package_url == "pkg:maven/org.apache.tomcat/tomcat@10.0.0-M4"
+ assert (
+ vulnerablecode_package.plain_package_url
+ == "pkg:maven/org.apache.tomcat/tomcat@10.0.0-M4"
)
-
- print(
- '\nvuln_packages.distinct()[0].fixed_package_details["vulnerabilities"][0]["vulnerability"] = {}\n'.format(
- vuln_packages.distinct()[0].fixed_package_details["vulnerabilities"][0][
- "vulnerability"
- ]
- )
+ assert (
+ vulnerablecode_package.get_absolute_url()
+ == "/packages/pkg:maven/org.apache.tomcat/tomcat@10.0.0-M4"
)
- print("")
-
def test_univers_version_comparisons(self):
assert versions.PypiVersion("1.2.3") < versions.PypiVersion("1.2.4")
assert versions.PypiVersion("0.9") < versions.PypiVersion("0.10")
@@ -655,116 +426,3 @@ def test_sort_by_version(self):
assert sorted_pkgs[0].purl == "pkg:npm/sequelize@3.9.1"
assert sorted_pkgs[-1].purl == "pkg:npm/sequelize@3.40.1"
-
- # # ZAP: 2023-09-07 Thursday 20:05:40. This has served its purpose and can be removed after a last close look.
- # def test_string_to_purl_to_dict_to_package(self):
- # # Convert a PURL string to a PURL to a dictionary to a VulnerableCode Package, i.e.,
- # # a .
-
- # # Convert a PURL string to a PURL.
- # purl_string = "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.31"
- # purl = PackageURL.from_string(purl_string)
-
- # assert type(purl) == PackageURL
- # assert purl.type == "maven"
- # assert purl.qualifiers == {}
- # assert purl.subpath == None
-
- # # Convert the PURL to a dictionary.
- # # ALERT: 2023-08-15 Tuesday 13:18:09. What about using the function 'def purl_to_dict(purl: PackageURL)'? Confusingly similar name but it seems designed to address the issue raised here (and looks useful for passing the data to the Jinja2 template).
- # # It appears that this step is where the unwanted None values are created for qualifiers and
- # # subpath when the PURL does not already contain values for those attributes.
- # purl_to_dict = purl.to_dict()
-
- # assert purl_to_dict == {
- # "type": "maven",
- # "namespace": "org.apache.tomcat.embed",
- # "name": "tomcat-embed-core",
- # "version": "9.0.31",
- # "qualifiers": None,
- # "subpath": None,
- # }
- # assert purl_to_dict.get("qualifiers") == None
- # assert purl_to_dict.get("subpath") == None
-
- # # Convert the dictionary to a VulnerableCode Package, i.e.,
- # # a
-
- # # If subpath is None we get error: django.db.utils.IntegrityError: null value in column
- # # "subpath" violates not-null constraint -- need to convert value from None to empty string.
- # # Similar issue with qualifiers, which must be converted from None to {}.
-
- # # I've structured the following in this way because trying instead to use
- # # "with pytest.raises(IntegrityError):" will throw the error
- # # django.db.transaction.TransactionManagementError: An error occurred in the current
- # # transaction. You can't execute queries until the end of the 'atomic' block.
-
- # try:
- # with transaction.atomic():
- # vulnerablecode_package = models.Package.objects.create(
- # type=purl_to_dict.get("type"),
- # namespace=purl_to_dict.get("namespace"),
- # name=purl_to_dict.get("name"),
- # version=purl_to_dict.get("version"),
- # qualifiers=purl_to_dict.get("qualifiers"),
- # subpath=purl_to_dict.get("subpath"),
- # )
- # except IntegrityError:
- # print("\nAs expected, an IntegrityError has occurred.\n")
-
- # # This will avoid the IntegrityError:
- # if purl_to_dict.get("qualifiers") is None:
- # purl_to_dict["qualifiers"] = {}
- # if purl_to_dict.get("subpath") is None:
- # purl_to_dict["subpath"] = ""
-
- # # Check the qualifiers and subpath values again.
- # assert purl_to_dict.get("qualifiers") == {}
- # assert purl_to_dict.get("subpath") == ""
-
- # vulnerablecode_package = models.Package.objects.create(
- # type=purl_to_dict.get("type"),
- # namespace=purl_to_dict.get("namespace"),
- # name=purl_to_dict.get("name"),
- # version=purl_to_dict.get("version"),
- # qualifiers=purl_to_dict.get("qualifiers"),
- # subpath=purl_to_dict.get("subpath"),
- # )
-
- # assert type(vulnerablecode_package) == models.Package
- # assert (
- # vulnerablecode_package.purl
- # == "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.31"
- # )
- # assert vulnerablecode_package.qualifiers == {}
- # assert vulnerablecode_package.subpath == ""
-
- # # ZAP: 2023-09-07 Thursday 20:32:35. Ditch this, right?
- # def test_compare_package_major_versions(self):
- # # Convert a PURL string to a PURL to a dictionary to a VulnerableCode Package, i.e.,
- # # a .
-
- # # Convert a PURL string to a PURL.
- # purl_string = "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.31"
- # purl = PackageURL.from_string(purl_string)
-
- # assert type(purl) == PackageURL
- # assert purl.type == "maven"
- # assert purl.qualifiers == {}
- # assert purl.subpath == None
-
- # print("\npurl_string = {}".format(purl_string))
-
- # print("\npurl = {}".format(purl))
-
- # print("\nHello VulnerableCode!\n")
-
- # all_packages = Package.objects
- # print("\nPackage.objects = {}\n".format(Package.objects))
- # print("\nall_packages.distinct() = {}\n".format(all_packages.distinct()))
- # print("\nall_packages.distinct()[0] = {}\n".format(all_packages.distinct()[0]))
-
- # for pkg in all_packages.distinct():
- # print(PackageURL.from_string(pkg.purl))
-
- # print("")
|