Juan FernandezandKonstantin Sykulev
621ede7584
Resolves #35075 - Added vulnerability (CVE) reporting for Android OS versions. - Folded the Android security patch level into the host's OS version. --------- Co-authored-by: Konstantin Sykulev <konst@sykulev.com>
1933 lines
55 KiB
Go
1933 lines
55 KiB
Go
package main
|
|
|
|
import (
|
|
"compress/gzip"
|
|
"encoding/json"
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestExtractUbuntuVersion(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
ecosystem string
|
|
expected string
|
|
}{
|
|
{
|
|
name: "Standard Ubuntu LTS",
|
|
ecosystem: "Ubuntu:24.04:LTS",
|
|
expected: "24.04",
|
|
},
|
|
{
|
|
name: "Ubuntu Pro",
|
|
ecosystem: "Ubuntu:Pro:22.04:LTS",
|
|
expected: "22.04",
|
|
},
|
|
{
|
|
name: "Ubuntu 20.04",
|
|
ecosystem: "Ubuntu:20.04:LTS",
|
|
expected: "20.04",
|
|
},
|
|
{
|
|
name: "Ubuntu 18.04",
|
|
ecosystem: "Ubuntu:18.04:LTS",
|
|
expected: "18.04",
|
|
},
|
|
{
|
|
name: "No version pattern",
|
|
ecosystem: "Ubuntu:LTS",
|
|
expected: "",
|
|
},
|
|
{
|
|
name: "Empty string",
|
|
ecosystem: "",
|
|
expected: "",
|
|
},
|
|
{
|
|
name: "Not Ubuntu",
|
|
ecosystem: "Debian:12:stable",
|
|
expected: "",
|
|
},
|
|
{
|
|
name: "Version without LTS",
|
|
ecosystem: "Ubuntu:24.04",
|
|
expected: "24.04",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
result := extractUbuntuVersion(tt.ecosystem)
|
|
require.Equal(t, tt.expected, result)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestExtractCVEID(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
osv *OSVData
|
|
expected string
|
|
}{
|
|
{
|
|
name: "CVE in Upstream field",
|
|
osv: &OSVData{
|
|
ID: "UBUNTU-CVE-2024-1234",
|
|
Upstream: []string{"CVE-2024-1234", "https://example.com"},
|
|
},
|
|
expected: "CVE-2024-1234",
|
|
},
|
|
{
|
|
name: "CVE as ID",
|
|
osv: &OSVData{
|
|
ID: "CVE-2024-5678",
|
|
Upstream: []string{},
|
|
},
|
|
expected: "CVE-2024-5678",
|
|
},
|
|
{
|
|
name: "UBUNTU-CVE prefix",
|
|
osv: &OSVData{
|
|
ID: "UBUNTU-CVE-2024-9999",
|
|
Upstream: []string{},
|
|
},
|
|
expected: "CVE-2024-9999",
|
|
},
|
|
{
|
|
name: "No CVE found",
|
|
osv: &OSVData{
|
|
ID: "SOME-OTHER-ID",
|
|
Upstream: []string{"https://example.com"},
|
|
},
|
|
expected: "",
|
|
},
|
|
{
|
|
name: "Multiple upstreams with CVE first",
|
|
osv: &OSVData{
|
|
ID: "UBUNTU-123",
|
|
Upstream: []string{"CVE-2024-1111", "CVE-2024-2222"},
|
|
},
|
|
expected: "CVE-2024-1111",
|
|
},
|
|
{
|
|
name: "Empty upstream, no CVE in ID",
|
|
osv: &OSVData{
|
|
ID: "USN-1234-1",
|
|
Upstream: []string{},
|
|
},
|
|
expected: "",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
result := extractCVEID(tt.osv)
|
|
require.Equal(t, tt.expected, result)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestExtractVersionRange(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
ranges []Range
|
|
expectedIntroduced string
|
|
expectedFixed string
|
|
}{
|
|
{
|
|
name: "Simple range with introduced and fixed",
|
|
ranges: []Range{
|
|
{
|
|
Type: "ECOSYSTEM",
|
|
Events: []Event{
|
|
{Introduced: "1.0.0"},
|
|
{Fixed: "2.0.0"},
|
|
},
|
|
},
|
|
},
|
|
expectedIntroduced: "1.0.0",
|
|
expectedFixed: "2.0.0",
|
|
},
|
|
{
|
|
name: "Only introduced version",
|
|
ranges: []Range{
|
|
{
|
|
Type: "ECOSYSTEM",
|
|
Events: []Event{
|
|
{Introduced: "1.5.0"},
|
|
},
|
|
},
|
|
},
|
|
expectedIntroduced: "1.5.0",
|
|
expectedFixed: "",
|
|
},
|
|
{
|
|
name: "Only fixed version",
|
|
ranges: []Range{
|
|
{
|
|
Type: "ECOSYSTEM",
|
|
Events: []Event{
|
|
{Fixed: "3.0.0"},
|
|
},
|
|
},
|
|
},
|
|
expectedIntroduced: "",
|
|
expectedFixed: "3.0.0",
|
|
},
|
|
{
|
|
name: "Multiple ranges, first ECOSYSTEM wins",
|
|
ranges: []Range{
|
|
{
|
|
Type: "ECOSYSTEM",
|
|
Events: []Event{
|
|
{Introduced: "1.0.0"},
|
|
{Fixed: "2.0.0"},
|
|
},
|
|
},
|
|
{
|
|
Type: "ECOSYSTEM",
|
|
Events: []Event{
|
|
{Introduced: "3.0.0"},
|
|
{Fixed: "4.0.0"},
|
|
},
|
|
},
|
|
},
|
|
expectedIntroduced: "1.0.0",
|
|
expectedFixed: "2.0.0",
|
|
},
|
|
{
|
|
name: "Non-ECOSYSTEM range ignored",
|
|
ranges: []Range{
|
|
{
|
|
Type: "GIT",
|
|
Events: []Event{
|
|
{Introduced: "abc123"},
|
|
{Fixed: "def456"},
|
|
},
|
|
},
|
|
{
|
|
Type: "ECOSYSTEM",
|
|
Events: []Event{
|
|
{Introduced: "2.0.0"},
|
|
{Fixed: "2.5.0"},
|
|
},
|
|
},
|
|
},
|
|
expectedIntroduced: "2.0.0",
|
|
expectedFixed: "2.5.0",
|
|
},
|
|
{
|
|
name: "Empty ranges",
|
|
ranges: []Range{},
|
|
expectedIntroduced: "",
|
|
expectedFixed: "",
|
|
},
|
|
{
|
|
name: "Multiple events in single range",
|
|
ranges: []Range{
|
|
{
|
|
Type: "ECOSYSTEM",
|
|
Events: []Event{
|
|
{Introduced: "0"},
|
|
{Fixed: "1.2.3"},
|
|
{Introduced: "2.0.0"}, // This should be ignored (first introduced wins)
|
|
},
|
|
},
|
|
},
|
|
expectedIntroduced: "0",
|
|
expectedFixed: "1.2.3",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
introduced, fixed := extractVersionRange(tt.ranges)
|
|
require.Equal(t, tt.expectedIntroduced, introduced)
|
|
require.Equal(t, tt.expectedFixed, fixed)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestCountTotalCVEs(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
artifact *ArtifactData
|
|
expected int
|
|
}{
|
|
{
|
|
name: "Multiple packages with unique CVEs",
|
|
artifact: &ArtifactData{
|
|
Vulnerabilities: map[string][]ProcessedVuln{
|
|
"curl": {
|
|
{CVE: "CVE-2024-1234"},
|
|
{CVE: "CVE-2024-5678"},
|
|
},
|
|
"openssl": {
|
|
{CVE: "CVE-2024-9999"},
|
|
},
|
|
},
|
|
},
|
|
expected: 3,
|
|
},
|
|
{
|
|
name: "Duplicate CVEs across packages",
|
|
artifact: &ArtifactData{
|
|
Vulnerabilities: map[string][]ProcessedVuln{
|
|
"emacs": {
|
|
{CVE: "CVE-2024-39331"},
|
|
},
|
|
"emacs-common": {
|
|
{CVE: "CVE-2024-39331"},
|
|
},
|
|
"emacs-el": {
|
|
{CVE: "CVE-2024-39331"},
|
|
},
|
|
},
|
|
},
|
|
expected: 1, // Deduplicated
|
|
},
|
|
{
|
|
name: "Mix of unique and duplicate CVEs",
|
|
artifact: &ArtifactData{
|
|
Vulnerabilities: map[string][]ProcessedVuln{
|
|
"package1": {
|
|
{CVE: "CVE-2024-1111"},
|
|
{CVE: "CVE-2024-2222"},
|
|
},
|
|
"package2": {
|
|
{CVE: "CVE-2024-1111"}, // Duplicate
|
|
{CVE: "CVE-2024-3333"},
|
|
},
|
|
},
|
|
},
|
|
expected: 3, // CVE-2024-1111, CVE-2024-2222, CVE-2024-3333
|
|
},
|
|
{
|
|
name: "Empty artifact",
|
|
artifact: &ArtifactData{
|
|
Vulnerabilities: map[string][]ProcessedVuln{},
|
|
},
|
|
expected: 0,
|
|
},
|
|
{
|
|
name: "Package with no vulnerabilities",
|
|
artifact: &ArtifactData{
|
|
Vulnerabilities: map[string][]ProcessedVuln{
|
|
"safe-package": {},
|
|
},
|
|
},
|
|
expected: 0,
|
|
},
|
|
{
|
|
name: "Single package, single CVE",
|
|
artifact: &ArtifactData{
|
|
Vulnerabilities: map[string][]ProcessedVuln{
|
|
"apache2": {
|
|
{CVE: "CVE-2024-7777"},
|
|
},
|
|
},
|
|
},
|
|
expected: 1,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
result := countTotalCVEs(tt.artifact)
|
|
require.Equal(t, tt.expected, result)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestBuildVersionFilter(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
versions string
|
|
excludeVersions string
|
|
expectedTargetVersions map[string]bool
|
|
expectedExcludedVersions map[string]bool
|
|
}{
|
|
{
|
|
name: "Inclusive mode: single version",
|
|
versions: "20.04",
|
|
excludeVersions: "",
|
|
expectedTargetVersions: map[string]bool{"20.04": true},
|
|
expectedExcludedVersions: nil,
|
|
},
|
|
{
|
|
name: "Inclusive mode: multiple versions",
|
|
versions: "20.04,22.04,24.04",
|
|
excludeVersions: "",
|
|
expectedTargetVersions: map[string]bool{"20.04": true, "22.04": true, "24.04": true},
|
|
expectedExcludedVersions: nil,
|
|
},
|
|
{
|
|
name: "Inclusive mode: with spaces",
|
|
versions: "20.04, 22.04, 24.04",
|
|
excludeVersions: "",
|
|
expectedTargetVersions: map[string]bool{"20.04": true, "22.04": true, "24.04": true},
|
|
expectedExcludedVersions: nil,
|
|
},
|
|
{
|
|
name: "Exclusive mode: single version",
|
|
versions: "",
|
|
excludeVersions: "14.04",
|
|
expectedTargetVersions: nil,
|
|
expectedExcludedVersions: map[string]bool{"14.04": true},
|
|
},
|
|
{
|
|
name: "Exclusive mode: multiple versions",
|
|
versions: "",
|
|
excludeVersions: "14.04,16.04,24.10",
|
|
expectedTargetVersions: nil,
|
|
expectedExcludedVersions: map[string]bool{"14.04": true, "16.04": true, "24.10": true},
|
|
},
|
|
{
|
|
name: "Exclusive mode: with spaces",
|
|
versions: "",
|
|
excludeVersions: "14.04, 16.04, 24.10",
|
|
expectedTargetVersions: nil,
|
|
expectedExcludedVersions: map[string]bool{"14.04": true, "16.04": true, "24.10": true},
|
|
},
|
|
{
|
|
name: "Auto-detect mode: both empty",
|
|
versions: "",
|
|
excludeVersions: "",
|
|
expectedTargetVersions: nil,
|
|
expectedExcludedVersions: nil,
|
|
},
|
|
{
|
|
name: "Inclusive takes precedence: both provided",
|
|
versions: "20.04,22.04",
|
|
excludeVersions: "14.04,16.04",
|
|
expectedTargetVersions: map[string]bool{"20.04": true, "22.04": true},
|
|
expectedExcludedVersions: nil,
|
|
},
|
|
{
|
|
name: "Inclusive mode: trailing comma ignored",
|
|
versions: "20.04,22.04,",
|
|
excludeVersions: "",
|
|
expectedTargetVersions: map[string]bool{"20.04": true, "22.04": true},
|
|
expectedExcludedVersions: nil,
|
|
},
|
|
{
|
|
name: "Inclusive mode: leading comma ignored",
|
|
versions: ",20.04,22.04",
|
|
excludeVersions: "",
|
|
expectedTargetVersions: map[string]bool{"20.04": true, "22.04": true},
|
|
expectedExcludedVersions: nil,
|
|
},
|
|
{
|
|
name: "Inclusive mode: multiple commas ignored",
|
|
versions: "20.04,,22.04",
|
|
excludeVersions: "",
|
|
expectedTargetVersions: map[string]bool{"20.04": true, "22.04": true},
|
|
expectedExcludedVersions: nil,
|
|
},
|
|
{
|
|
name: "Exclusive mode: trailing comma ignored",
|
|
versions: "",
|
|
excludeVersions: "14.04,16.04,",
|
|
expectedTargetVersions: nil,
|
|
expectedExcludedVersions: map[string]bool{"14.04": true, "16.04": true},
|
|
},
|
|
{
|
|
name: "Inclusive mode: only empty strings falls back to auto-detect",
|
|
versions: ",,",
|
|
excludeVersions: "",
|
|
expectedTargetVersions: nil,
|
|
expectedExcludedVersions: nil,
|
|
},
|
|
{
|
|
name: "Inclusive mode: only whitespace falls back to auto-detect",
|
|
versions: " , , ",
|
|
excludeVersions: "",
|
|
expectedTargetVersions: nil,
|
|
expectedExcludedVersions: nil,
|
|
},
|
|
{
|
|
name: "Exclusive mode: only empty strings falls back to auto-detect",
|
|
versions: "",
|
|
excludeVersions: ",,",
|
|
expectedTargetVersions: nil,
|
|
expectedExcludedVersions: nil,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
targetVersions, excludedVersions := buildVersionFilter(tt.versions, tt.excludeVersions)
|
|
require.Equal(t, tt.expectedTargetVersions, targetVersions)
|
|
require.Equal(t, tt.expectedExcludedVersions, excludedVersions)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestShouldIncludeInDelta(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
inputDir string
|
|
filePath string
|
|
changedFiles map[string]struct{}
|
|
expectedMatch bool
|
|
}{
|
|
{
|
|
name: "Unix path: file in changed set",
|
|
inputDir: "/tmp/ubuntu-osv",
|
|
filePath: "/tmp/ubuntu-osv/osv/cve/CVE-2024-1234.json",
|
|
changedFiles: map[string]struct{}{
|
|
"osv/cve/CVE-2024-1234.json": {},
|
|
},
|
|
expectedMatch: true,
|
|
},
|
|
{
|
|
name: "Unix path: file not in changed set",
|
|
inputDir: "/tmp/ubuntu-osv",
|
|
filePath: "/tmp/ubuntu-osv/osv/cve/CVE-2024-9999.json",
|
|
changedFiles: map[string]struct{}{
|
|
"osv/cve/CVE-2024-1234.json": {},
|
|
},
|
|
expectedMatch: false,
|
|
},
|
|
{
|
|
name: "Nested directory: file in changed set",
|
|
inputDir: "/data/osv",
|
|
filePath: "/data/osv/osv/cve/2024/CVE-2024-1111.json",
|
|
changedFiles: map[string]struct{}{
|
|
"osv/cve/2024/CVE-2024-1111.json": {},
|
|
},
|
|
expectedMatch: true,
|
|
},
|
|
{
|
|
name: "File already has osv/cve prefix in relative path",
|
|
inputDir: "/workspace",
|
|
filePath: "/workspace/osv/cve/CVE-2024-2222.json",
|
|
changedFiles: map[string]struct{}{
|
|
"osv/cve/CVE-2024-2222.json": {},
|
|
},
|
|
expectedMatch: true,
|
|
},
|
|
{
|
|
name: "Changed files with leading slash (should not match)",
|
|
inputDir: "/tmp/ubuntu-osv",
|
|
filePath: "/tmp/ubuntu-osv/osv/cve/CVE-2024-3333.json",
|
|
changedFiles: map[string]struct{}{
|
|
"/osv/cve/CVE-2024-3333.json": {}, // Wrong: has leading slash
|
|
},
|
|
expectedMatch: false,
|
|
},
|
|
{
|
|
name: "Changed files without osv/cve prefix (should not match)",
|
|
inputDir: "/tmp/ubuntu-osv",
|
|
filePath: "/tmp/ubuntu-osv/osv/cve/CVE-2024-4444.json",
|
|
changedFiles: map[string]struct{}{
|
|
"CVE-2024-4444.json": {}, // Wrong: missing osv/cve/ prefix
|
|
},
|
|
expectedMatch: false,
|
|
},
|
|
{
|
|
name: "Empty changed files set",
|
|
inputDir: "/tmp/ubuntu-osv",
|
|
filePath: "/tmp/ubuntu-osv/osv/cve/CVE-2024-5555.json",
|
|
changedFiles: map[string]struct{}{},
|
|
expectedMatch: false,
|
|
},
|
|
{
|
|
name: "File outside input directory tree (relative path doesn't match)",
|
|
inputDir: "/tmp/ubuntu-osv/subdir",
|
|
filePath: "/tmp/other-dir/osv/cve/CVE-2024-6666.json",
|
|
changedFiles: map[string]struct{}{
|
|
"osv/cve/CVE-2024-6666.json": {},
|
|
},
|
|
expectedMatch: false, // filepath.Rel will work but path won't match
|
|
},
|
|
{
|
|
name: "Multiple files in changed set, match one",
|
|
inputDir: "/data/osv",
|
|
filePath: "/data/osv/osv/cve/CVE-2024-7777.json",
|
|
changedFiles: map[string]struct{}{
|
|
"osv/cve/CVE-2024-1111.json": {},
|
|
"osv/cve/CVE-2024-7777.json": {},
|
|
"osv/cve/CVE-2024-9999.json": {},
|
|
},
|
|
expectedMatch: true,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
result := shouldIncludeInDelta(tt.inputDir, tt.filePath, tt.changedFiles)
|
|
require.Equal(t, tt.expectedMatch, result)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestRun(t *testing.T) {
|
|
// Create temporary directories for input and output
|
|
inputDir := t.TempDir()
|
|
outputDir := t.TempDir()
|
|
|
|
// Create a simple test OSV file
|
|
testOSVData := `{
|
|
"schema_version": "1.0",
|
|
"id": "USN-1234-1",
|
|
"published": "2024-01-01T00:00:00Z",
|
|
"modified": "2024-01-02T00:00:00Z",
|
|
"details": "Test vulnerability",
|
|
"affected": [{
|
|
"package": {
|
|
"ecosystem": "Ubuntu:22.04:LTS",
|
|
"name": "test-package"
|
|
},
|
|
"ranges": [{
|
|
"type": "ECOSYSTEM",
|
|
"events": [
|
|
{"introduced": "0"},
|
|
{"fixed": "1.2.3"}
|
|
]
|
|
}]
|
|
}],
|
|
"upstream": ["CVE-2024-1234"]
|
|
}`
|
|
|
|
// Write test file
|
|
require.NoError(t, os.WriteFile(filepath.Join(inputDir, "CVE-2024-1234.json"), []byte(testOSVData), 0o644))
|
|
|
|
// Create config
|
|
cfg := Config{
|
|
InputDir: inputDir,
|
|
OutputDir: outputDir,
|
|
Versions: "",
|
|
ExcludeVersions: "",
|
|
ChangedFilesToday: "",
|
|
ChangedFilesYesterday: "",
|
|
DateStr: "2024-01-03",
|
|
YesterdayStr: "2024-01-02",
|
|
GeneratedTimestamp: "2024-01-03T00:00:00Z",
|
|
RunTime: time.Date(2024, 1, 3, 0, 0, 0, 0, time.UTC),
|
|
}
|
|
|
|
// Run the function
|
|
err := run(cfg)
|
|
require.NoError(t, err)
|
|
|
|
// Verify output artifact was created
|
|
expectedFile := filepath.Join(outputDir, "osv-ubuntu-2204-2024-01-03.json.gz")
|
|
require.FileExists(t, expectedFile)
|
|
|
|
// Verify artifact content (decompress and check)
|
|
artifact, err := readArtifact(expectedFile)
|
|
require.NoError(t, err)
|
|
require.Equal(t, "1.0", artifact.SchemaVersion)
|
|
require.Equal(t, "22.04", artifact.UbuntuVersion)
|
|
require.Equal(t, 1, artifact.TotalCVEs)
|
|
require.Equal(t, 1, artifact.TotalPackages)
|
|
require.Contains(t, artifact.Vulnerabilities, "test-package")
|
|
require.Len(t, artifact.Vulnerabilities["test-package"], 1)
|
|
require.Equal(t, "CVE-2024-1234", artifact.Vulnerabilities["test-package"][0].CVE)
|
|
}
|
|
|
|
func TestRunWithDeltaGeneration(t *testing.T) {
|
|
// Create temporary directories
|
|
inputDir := t.TempDir()
|
|
outputDir := t.TempDir()
|
|
changedFilesDir := t.TempDir()
|
|
|
|
// Create two test OSV files
|
|
testOSVData1 := `{
|
|
"schema_version": "1.0",
|
|
"id": "USN-1234-1",
|
|
"published": "2024-01-01T00:00:00Z",
|
|
"modified": "2024-01-02T00:00:00Z",
|
|
"affected": [{
|
|
"package": {
|
|
"ecosystem": "Ubuntu:22.04:LTS",
|
|
"name": "changed-today-package"
|
|
},
|
|
"ranges": [{
|
|
"type": "ECOSYSTEM",
|
|
"events": [{"introduced": "0"}, {"fixed": "1.0"}]
|
|
}]
|
|
}],
|
|
"upstream": ["CVE-2024-1111"]
|
|
}`
|
|
|
|
testOSVData2 := `{
|
|
"schema_version": "1.0",
|
|
"id": "USN-5678-1",
|
|
"published": "2024-01-01T00:00:00Z",
|
|
"modified": "2024-01-02T00:00:00Z",
|
|
"affected": [{
|
|
"package": {
|
|
"ecosystem": "Ubuntu:22.04:LTS",
|
|
"name": "changed-yesterday-package"
|
|
},
|
|
"ranges": [{
|
|
"type": "ECOSYSTEM",
|
|
"events": [{"introduced": "0"}, {"fixed": "2.0"}]
|
|
}]
|
|
}],
|
|
"upstream": ["CVE-2024-2222"]
|
|
}`
|
|
|
|
// Write test files
|
|
osvCveDir := filepath.Join(inputDir, "osv", "cve")
|
|
require.NoError(t, os.MkdirAll(osvCveDir, 0o755))
|
|
require.NoError(t, os.WriteFile(filepath.Join(osvCveDir, "CVE-2024-1111.json"), []byte(testOSVData1), 0o644))
|
|
require.NoError(t, os.WriteFile(filepath.Join(osvCveDir, "CVE-2024-2222.json"), []byte(testOSVData2), 0o644))
|
|
|
|
// Create changed files lists
|
|
changedTodayFile := filepath.Join(changedFilesDir, "changed_today.txt")
|
|
changedYesterdayFile := filepath.Join(changedFilesDir, "changed_yesterday.txt")
|
|
require.NoError(t, os.WriteFile(changedTodayFile, []byte("osv/cve/CVE-2024-1111.json\n"), 0o644))
|
|
require.NoError(t, os.WriteFile(changedYesterdayFile, []byte("osv/cve/CVE-2024-2222.json\n"), 0o644))
|
|
|
|
// Create config with delta generation
|
|
cfg := Config{
|
|
InputDir: inputDir,
|
|
OutputDir: outputDir,
|
|
Versions: "",
|
|
ExcludeVersions: "",
|
|
ChangedFilesToday: changedTodayFile,
|
|
ChangedFilesYesterday: changedYesterdayFile,
|
|
DateStr: "2024-01-03",
|
|
YesterdayStr: "2024-01-02",
|
|
GeneratedTimestamp: "2024-01-03T00:00:00Z",
|
|
RunTime: time.Date(2024, 1, 3, 0, 0, 0, 0, time.UTC),
|
|
}
|
|
|
|
// Run
|
|
err := run(cfg)
|
|
require.NoError(t, err)
|
|
|
|
// Verify full artifact
|
|
fullArtifact, err := readArtifact(filepath.Join(outputDir, "osv-ubuntu-2204-2024-01-03.json.gz"))
|
|
require.NoError(t, err)
|
|
require.Equal(t, 2, fullArtifact.TotalCVEs)
|
|
require.Equal(t, 2, fullArtifact.TotalPackages)
|
|
|
|
// Verify today's delta artifact
|
|
todayDelta, err := readArtifact(filepath.Join(outputDir, "osv-ubuntu-2204-delta-2024-01-03.json.gz"))
|
|
require.NoError(t, err)
|
|
require.Equal(t, 1, todayDelta.TotalCVEs)
|
|
require.Equal(t, 1, todayDelta.TotalPackages)
|
|
require.NotNil(t, todayDelta.Vulnerabilities)
|
|
require.Contains(t, todayDelta.Vulnerabilities, "changed-today-package")
|
|
require.NotEmpty(t, todayDelta.Vulnerabilities["changed-today-package"])
|
|
require.Equal(t, "CVE-2024-1111", todayDelta.Vulnerabilities["changed-today-package"][0].CVE)
|
|
|
|
// Verify yesterday's delta artifact
|
|
yesterdayDelta, err := readArtifact(filepath.Join(outputDir, "osv-ubuntu-2204-delta-2024-01-02.json.gz"))
|
|
require.NoError(t, err)
|
|
require.Equal(t, 1, yesterdayDelta.TotalCVEs)
|
|
require.Equal(t, 1, yesterdayDelta.TotalPackages)
|
|
require.NotNil(t, yesterdayDelta.Vulnerabilities)
|
|
require.Contains(t, yesterdayDelta.Vulnerabilities, "changed-yesterday-package")
|
|
require.NotEmpty(t, yesterdayDelta.Vulnerabilities["changed-yesterday-package"])
|
|
require.Equal(t, "CVE-2024-2222", yesterdayDelta.Vulnerabilities["changed-yesterday-package"][0].CVE)
|
|
}
|
|
|
|
func TestRunWithVersionFiltering(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
versions string
|
|
excludeVersions string
|
|
expectedVersionCount int
|
|
expectedVersions []string
|
|
}{
|
|
{
|
|
name: "Inclusive filtering - single version",
|
|
versions: "22.04",
|
|
excludeVersions: "",
|
|
expectedVersionCount: 1,
|
|
expectedVersions: []string{"22.04"},
|
|
},
|
|
{
|
|
name: "Inclusive filtering - multiple versions",
|
|
versions: "20.04,22.04",
|
|
excludeVersions: "",
|
|
expectedVersionCount: 2,
|
|
expectedVersions: []string{"20.04", "22.04"},
|
|
},
|
|
{
|
|
name: "Exclusive filtering - exclude one version",
|
|
versions: "",
|
|
excludeVersions: "24.04",
|
|
expectedVersionCount: 2,
|
|
expectedVersions: []string{"20.04", "22.04"},
|
|
},
|
|
{
|
|
name: "Auto-detect - no filtering",
|
|
versions: "",
|
|
excludeVersions: "",
|
|
expectedVersionCount: 3,
|
|
expectedVersions: []string{"20.04", "22.04", "24.04"},
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
// Create temporary directories
|
|
inputDir := t.TempDir()
|
|
outputDir := t.TempDir()
|
|
|
|
// Create test OSV files for different Ubuntu versions
|
|
for _, ver := range []string{"20.04", "22.04", "24.04"} {
|
|
data := fmt.Sprintf(`{
|
|
"schema_version": "1.0",
|
|
"id": "USN-1234-1",
|
|
"published": "2024-01-01T00:00:00Z",
|
|
"modified": "2024-01-02T00:00:00Z",
|
|
"affected": [{
|
|
"package": {
|
|
"ecosystem": "Ubuntu:%s:LTS",
|
|
"name": "test-package-%s"
|
|
},
|
|
"ranges": [{
|
|
"type": "ECOSYSTEM",
|
|
"events": [{"introduced": "0"}, {"fixed": "1.0"}]
|
|
}]
|
|
}],
|
|
"upstream": ["CVE-2024-%s"]
|
|
}`, ver, strings.ReplaceAll(ver, ".", ""), strings.ReplaceAll(ver, ".", ""))
|
|
|
|
filename := fmt.Sprintf("CVE-2024-%s.json", strings.ReplaceAll(ver, ".", ""))
|
|
require.NoError(t, os.WriteFile(filepath.Join(inputDir, filename), []byte(data), 0o644))
|
|
}
|
|
|
|
// Create config
|
|
cfg := Config{
|
|
InputDir: inputDir,
|
|
OutputDir: outputDir,
|
|
Versions: tt.versions,
|
|
ExcludeVersions: tt.excludeVersions,
|
|
ChangedFilesToday: "",
|
|
ChangedFilesYesterday: "",
|
|
DateStr: "2024-01-03",
|
|
YesterdayStr: "2024-01-02",
|
|
GeneratedTimestamp: "2024-01-03T00:00:00Z",
|
|
RunTime: time.Date(2024, 1, 3, 0, 0, 0, 0, time.UTC),
|
|
}
|
|
|
|
// Run
|
|
err := run(cfg)
|
|
require.NoError(t, err)
|
|
|
|
// Count artifacts created
|
|
files, err := filepath.Glob(filepath.Join(outputDir, "osv-ubuntu-*.json.gz"))
|
|
require.NoError(t, err)
|
|
require.Equal(t, tt.expectedVersionCount, len(files))
|
|
|
|
// Verify expected versions were generated
|
|
for _, expectedVer := range tt.expectedVersions {
|
|
verStr := strings.ReplaceAll(expectedVer, ".", "")
|
|
expectedFile := filepath.Join(outputDir, fmt.Sprintf("osv-ubuntu-%s-2024-01-03.json.gz", verStr))
|
|
require.FileExists(t, expectedFile)
|
|
|
|
artifact, err := readArtifact(expectedFile)
|
|
require.NoError(t, err)
|
|
require.Equal(t, expectedVer, artifact.UbuntuVersion)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestExtractRHELVersion(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
ecosystem string
|
|
expected string
|
|
}{
|
|
{
|
|
name: "RHEL 9 appstream",
|
|
ecosystem: "Red Hat:enterprise_linux:9::appstream",
|
|
expected: "9",
|
|
},
|
|
{
|
|
name: "RHEL 8 baseos",
|
|
ecosystem: "Red Hat:enterprise_linux:8::baseos",
|
|
expected: "8",
|
|
},
|
|
{
|
|
name: "RHEL 8 crb",
|
|
ecosystem: "Red Hat:enterprise_linux:8::crb",
|
|
expected: "8",
|
|
},
|
|
{
|
|
name: "RHEL 10 with minor version",
|
|
ecosystem: "Red Hat:enterprise_linux:10.0",
|
|
expected: "10",
|
|
},
|
|
{
|
|
name: "RHEL 10.1 with minor version",
|
|
ecosystem: "Red Hat:enterprise_linux:10.1",
|
|
expected: "10",
|
|
},
|
|
{
|
|
name: "RHEL 7 software collections",
|
|
ecosystem: "Red Hat:rhel_software_collections:3::el7",
|
|
expected: "",
|
|
},
|
|
{
|
|
name: "RHEL EUS not supported",
|
|
ecosystem: "Red Hat:rhel_e4s:8.8::appstream",
|
|
expected: "",
|
|
},
|
|
{
|
|
name: "Empty string",
|
|
ecosystem: "",
|
|
expected: "",
|
|
},
|
|
{
|
|
name: "Ubuntu ecosystem",
|
|
ecosystem: "Ubuntu:24.04:LTS",
|
|
expected: "",
|
|
},
|
|
{
|
|
name: "RHEL 9 no repository suffix",
|
|
ecosystem: "Red Hat:enterprise_linux:9",
|
|
expected: "9",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
result := extractRHELVersion(tt.ecosystem)
|
|
require.Equal(t, tt.expected, result)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestExtractCVEIDs(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
osv *OSVData
|
|
expected []string
|
|
}{
|
|
{
|
|
name: "CVEs in upstream",
|
|
osv: &OSVData{
|
|
ID: "RHSA-2025:9978",
|
|
Upstream: []string{"CVE-2025-32462"},
|
|
},
|
|
expected: []string{"CVE-2025-32462"},
|
|
},
|
|
{
|
|
name: "Multiple CVEs in upstream",
|
|
osv: &OSVData{
|
|
ID: "RHSA-2026:0001",
|
|
Upstream: []string{"CVE-2025-59375", "CVE-2025-6965", "CVE-2025-8176", "CVE-2025-9900"},
|
|
},
|
|
expected: []string{"CVE-2025-59375", "CVE-2025-6965", "CVE-2025-8176", "CVE-2025-9900"},
|
|
},
|
|
{
|
|
name: "CVE in related field as fallback",
|
|
osv: &OSVData{
|
|
ID: "RHSA-2025:1234",
|
|
Related: []string{"CVE-2025-1111"},
|
|
},
|
|
expected: []string{"CVE-2025-1111"},
|
|
},
|
|
{
|
|
name: "CVE as ID fallback",
|
|
osv: &OSVData{
|
|
ID: "CVE-2025-9999",
|
|
},
|
|
expected: []string{"CVE-2025-9999"},
|
|
},
|
|
{
|
|
name: "No CVE found",
|
|
osv: &OSVData{
|
|
ID: "RHBA-2025:5678",
|
|
Upstream: []string{"https://example.com"},
|
|
},
|
|
expected: nil,
|
|
},
|
|
{
|
|
name: "Non-CVE upstream entries filtered",
|
|
osv: &OSVData{
|
|
ID: "RHSA-2025:0001",
|
|
Upstream: []string{"https://bugzilla.redhat.com/123", "CVE-2025-4444"},
|
|
},
|
|
expected: []string{"CVE-2025-4444"},
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
result := extractCVEIDs(tt.osv)
|
|
require.Equal(t, tt.expected, result)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestRunRHEL(t *testing.T) {
|
|
inputDir := t.TempDir()
|
|
outputDir := t.TempDir()
|
|
|
|
// Create a RHEL OSV advisory with one CVE affecting sudo on RHEL 9
|
|
testData := `{
|
|
"schema_version": "1.7.5",
|
|
"id": "RHSA-2025:9978",
|
|
"published": "2025-07-01T10:06:01Z",
|
|
"modified": "2026-03-18T11:30:33Z",
|
|
"upstream": ["CVE-2025-32462"],
|
|
"summary": "sudo security update",
|
|
"affected": [
|
|
{
|
|
"package": {
|
|
"name": "sudo",
|
|
"ecosystem": "Red Hat:enterprise_linux:9::appstream"
|
|
},
|
|
"ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:1.9.5p2-10.el9_6.1"}]}]
|
|
},
|
|
{
|
|
"package": {
|
|
"name": "sudo",
|
|
"ecosystem": "Red Hat:enterprise_linux:9::baseos"
|
|
},
|
|
"ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:1.9.5p2-10.el9_6.1"}]}]
|
|
}
|
|
]
|
|
}`
|
|
require.NoError(t, os.WriteFile(filepath.Join(inputDir, "RHSA-2025-9978.json"), []byte(testData), 0o644))
|
|
|
|
cfg := Config{
|
|
Platform: "rhel",
|
|
InputDir: inputDir,
|
|
OutputDir: outputDir,
|
|
DateStr: "2026-04-08",
|
|
GeneratedTimestamp: "2026-04-08T00:00:00Z",
|
|
RunTime: time.Date(2026, 4, 8, 0, 0, 0, 0, time.UTC),
|
|
}
|
|
|
|
err := runRHEL(cfg)
|
|
require.NoError(t, err)
|
|
|
|
// Verify artifact was created
|
|
expectedFile := filepath.Join(outputDir, "osv-rhel-9-2026-04-08.json.gz")
|
|
require.FileExists(t, expectedFile)
|
|
|
|
artifact, err := readRHELArtifact(expectedFile)
|
|
require.NoError(t, err)
|
|
require.Equal(t, "1.0", artifact.SchemaVersion)
|
|
require.Equal(t, "9", artifact.RHELVersion)
|
|
require.Equal(t, 1, artifact.TotalCVEs)
|
|
require.Contains(t, artifact.Vulnerabilities, "sudo")
|
|
// Deduplication: sudo appears in both appstream and baseos, should be deduplicated
|
|
require.Len(t, artifact.Vulnerabilities["sudo"], 1)
|
|
require.Equal(t, "CVE-2025-32462", artifact.Vulnerabilities["sudo"][0].CVE)
|
|
require.Equal(t, "0:1.9.5p2-10.el9_6.1", artifact.Vulnerabilities["sudo"][0].Fixed)
|
|
}
|
|
|
|
func TestRunRHELMultiCVEAdvisory(t *testing.T) {
|
|
inputDir := t.TempDir()
|
|
outputDir := t.TempDir()
|
|
|
|
// Advisory with 2 CVEs and packages across RHEL 8 and 9
|
|
testData := `{
|
|
"schema_version": "1.7.5",
|
|
"id": "RHSA-2026:0001",
|
|
"published": "2026-01-05T10:11:47Z",
|
|
"modified": "2026-04-03T10:05:48Z",
|
|
"upstream": ["CVE-2025-1111", "CVE-2025-2222"],
|
|
"affected": [
|
|
{
|
|
"package": {"name": "curl", "ecosystem": "Red Hat:enterprise_linux:9::baseos"},
|
|
"ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:7.76.1-29.el9_4.2"}]}]
|
|
},
|
|
{
|
|
"package": {"name": "curl", "ecosystem": "Red Hat:enterprise_linux:8::baseos"},
|
|
"ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:7.61.1-34.el8_10"}]}]
|
|
}
|
|
]
|
|
}`
|
|
require.NoError(t, os.WriteFile(filepath.Join(inputDir, "RHSA-2026-0001.json"), []byte(testData), 0o644))
|
|
|
|
cfg := Config{
|
|
Platform: "rhel",
|
|
InputDir: inputDir,
|
|
OutputDir: outputDir,
|
|
DateStr: "2026-04-08",
|
|
GeneratedTimestamp: "2026-04-08T00:00:00Z",
|
|
RunTime: time.Date(2026, 4, 8, 0, 0, 0, 0, time.UTC),
|
|
}
|
|
|
|
err := runRHEL(cfg)
|
|
require.NoError(t, err)
|
|
|
|
// Should produce artifacts for both RHEL 8 and 9
|
|
rhel9, err := readRHELArtifact(filepath.Join(outputDir, "osv-rhel-9-2026-04-08.json.gz"))
|
|
require.NoError(t, err)
|
|
require.Equal(t, 2, rhel9.TotalCVEs)
|
|
require.Len(t, rhel9.Vulnerabilities["curl"], 2)
|
|
|
|
rhel8, err := readRHELArtifact(filepath.Join(outputDir, "osv-rhel-8-2026-04-08.json.gz"))
|
|
require.NoError(t, err)
|
|
require.Equal(t, 2, rhel8.TotalCVEs)
|
|
require.Len(t, rhel8.Vulnerabilities["curl"], 2)
|
|
}
|
|
|
|
func TestRunRHELVersionFiltering(t *testing.T) {
|
|
inputDir := t.TempDir()
|
|
outputDir := t.TempDir()
|
|
|
|
testData := `{
|
|
"schema_version": "1.7.5",
|
|
"id": "RHSA-2025:1234",
|
|
"published": "2025-01-01T00:00:00Z",
|
|
"modified": "2025-01-02T00:00:00Z",
|
|
"upstream": ["CVE-2025-5555"],
|
|
"affected": [
|
|
{"package": {"name": "pkg", "ecosystem": "Red Hat:enterprise_linux:8::baseos"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:1.0-1.el8"}]}]},
|
|
{"package": {"name": "pkg", "ecosystem": "Red Hat:enterprise_linux:9::baseos"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:1.0-1.el9"}]}]}
|
|
]
|
|
}`
|
|
require.NoError(t, os.WriteFile(filepath.Join(inputDir, "RHSA-2025-1234.json"), []byte(testData), 0o644))
|
|
|
|
cfg := Config{
|
|
Platform: "rhel",
|
|
InputDir: inputDir,
|
|
OutputDir: outputDir,
|
|
Versions: "9",
|
|
DateStr: "2026-04-08",
|
|
GeneratedTimestamp: "2026-04-08T00:00:00Z",
|
|
RunTime: time.Date(2026, 4, 8, 0, 0, 0, 0, time.UTC),
|
|
}
|
|
|
|
err := runRHEL(cfg)
|
|
require.NoError(t, err)
|
|
|
|
// Only RHEL 9 should be generated
|
|
require.FileExists(t, filepath.Join(outputDir, "osv-rhel-9-2026-04-08.json.gz"))
|
|
_, err = os.Stat(filepath.Join(outputDir, "osv-rhel-8-2026-04-08.json.gz"))
|
|
require.True(t, os.IsNotExist(err), "RHEL 8 artifact should not exist when filtering to version 9")
|
|
}
|
|
|
|
func readRHELArtifact(path string) (*RHELArtifactData, error) {
|
|
file, err := os.Open(path)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer file.Close()
|
|
|
|
gzReader, err := gzip.NewReader(file)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer gzReader.Close()
|
|
|
|
var artifact RHELArtifactData
|
|
if err := json.NewDecoder(gzReader).Decode(&artifact); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return &artifact, nil
|
|
}
|
|
|
|
func readArtifact(path string) (*ArtifactData, error) {
|
|
file, err := os.Open(path)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer file.Close()
|
|
|
|
gzReader, err := gzip.NewReader(file)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer gzReader.Close()
|
|
|
|
var artifact ArtifactData
|
|
if err := json.NewDecoder(gzReader).Decode(&artifact); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return &artifact, nil
|
|
}
|
|
|
|
func readAndroidArtifact(path string) (*AndroidArtifactData, error) {
|
|
file, err := os.Open(path)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer file.Close()
|
|
|
|
gzReader, err := gzip.NewReader(file)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer gzReader.Close()
|
|
|
|
var artifact AndroidArtifactData
|
|
if err := json.NewDecoder(gzReader).Decode(&artifact); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return &artifact, nil
|
|
}
|
|
|
|
func TestParseAndroidRangeEvent(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
event string
|
|
expectedMajor string
|
|
expectedValue string
|
|
}{
|
|
{
|
|
name: "standard version with SPL date",
|
|
event: "16:2026-05-01",
|
|
expectedMajor: "16",
|
|
expectedValue: "2026-05-01",
|
|
},
|
|
{
|
|
name: "version with zero introduced",
|
|
event: "16:0",
|
|
expectedMajor: "16",
|
|
expectedValue: "0",
|
|
},
|
|
{
|
|
name: "next suffix stripped",
|
|
event: "15-next:2025-01-01",
|
|
expectedMajor: "15",
|
|
expectedValue: "2025-01-01",
|
|
},
|
|
{
|
|
name: "qpr suffix stripped",
|
|
event: "16-qpr2:2026-06-01",
|
|
expectedMajor: "16",
|
|
expectedValue: "2026-06-01",
|
|
},
|
|
{
|
|
name: "qpr-next suffix stripped",
|
|
event: "16-qpr2-next:2026-07-01",
|
|
expectedMajor: "16",
|
|
expectedValue: "2026-07-01",
|
|
},
|
|
{
|
|
name: "kernel-only with empty prefix",
|
|
event: ":0",
|
|
expectedMajor: "",
|
|
expectedValue: "0",
|
|
},
|
|
{
|
|
name: "kernel-only with SPL date",
|
|
event: ":2020-09-05",
|
|
expectedMajor: "",
|
|
expectedValue: "2020-09-05",
|
|
},
|
|
{
|
|
name: "SoCVersion prefix",
|
|
event: "SoCVersion:2020-09-05",
|
|
expectedMajor: "SoCVersion",
|
|
expectedValue: "2020-09-05",
|
|
},
|
|
{
|
|
name: "old version 8.1",
|
|
event: "8.1:2021-01-01",
|
|
expectedMajor: "8.1",
|
|
expectedValue: "2021-01-01",
|
|
},
|
|
{
|
|
name: "12L version",
|
|
event: "12L:2022-12-01",
|
|
expectedMajor: "12L",
|
|
expectedValue: "2022-12-01",
|
|
},
|
|
{
|
|
name: "12L-next version",
|
|
event: "12L-next:2022-06-01",
|
|
expectedMajor: "12L",
|
|
expectedValue: "2022-06-01",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
major, value := parseAndroidRangeEvent(tt.event)
|
|
require.Equal(t, tt.expectedMajor, major)
|
|
require.Equal(t, tt.expectedValue, value)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestExtractAndroidCVEIDs(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
osv *OSVData
|
|
expected []string
|
|
}{
|
|
{
|
|
name: "CVE in aliases",
|
|
osv: &OSVData{
|
|
ID: "ASB-A-111893654",
|
|
Aliases: []string{"A-111893654", "CVE-2020-0404"},
|
|
},
|
|
expected: []string{"CVE-2020-0404"},
|
|
},
|
|
{
|
|
name: "multiple CVEs in aliases",
|
|
osv: &OSVData{
|
|
ID: "ASB-A-999999999",
|
|
Aliases: []string{"CVE-2025-1111", "A-999999999", "CVE-2025-2222"},
|
|
},
|
|
expected: []string{"CVE-2025-1111", "CVE-2025-2222"},
|
|
},
|
|
{
|
|
name: "no CVE in aliases",
|
|
osv: &OSVData{
|
|
ID: "ASB-A-123456789",
|
|
Aliases: []string{"A-123456789"},
|
|
},
|
|
expected: nil,
|
|
},
|
|
{
|
|
name: "empty aliases",
|
|
osv: &OSVData{
|
|
ID: "ASB-A-000000000",
|
|
},
|
|
expected: nil,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
result := extractAndroidCVEIDs(tt.osv)
|
|
require.Equal(t, tt.expected, result)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestRunAndroid(t *testing.T) {
|
|
inputDir := t.TempDir()
|
|
outputDir := t.TempDir()
|
|
|
|
// Android 16 framework vulnerability fixed in June 2026 SPL
|
|
testData := `{
|
|
"schema_version": "1.7.5",
|
|
"id": "ASB-A-340239088",
|
|
"published": "2026-06-01T00:00:00Z",
|
|
"modified": "2026-07-14T00:00:00Z",
|
|
"aliases": ["A-340239088", "CVE-2026-12345"],
|
|
"affected": [{
|
|
"package": {
|
|
"name": "platform/frameworks/base",
|
|
"ecosystem": "Android"
|
|
},
|
|
"ranges": [{
|
|
"type": "ECOSYSTEM",
|
|
"events": [
|
|
{"introduced": "16:0"},
|
|
{"fixed": "16:2026-06-01"}
|
|
]
|
|
}],
|
|
"versions": ["16"],
|
|
"ecosystem_specific": {
|
|
"severity": "High",
|
|
"spl": "2026-06-01"
|
|
}
|
|
}]
|
|
}`
|
|
require.NoError(t, os.WriteFile(filepath.Join(inputDir, "ASB-A-340239088.json"), []byte(testData), 0o644))
|
|
|
|
cfg := Config{
|
|
Platform: "android",
|
|
InputDir: inputDir,
|
|
OutputDir: outputDir,
|
|
DateStr: "2026-07-14",
|
|
GeneratedTimestamp: "2026-07-14T00:00:00Z",
|
|
RunTime: time.Date(2026, 7, 14, 0, 0, 0, 0, time.UTC),
|
|
}
|
|
|
|
err := runAndroid(cfg)
|
|
require.NoError(t, err)
|
|
|
|
expectedFile := filepath.Join(outputDir, "osv-android-16-2026-07-14.json.gz")
|
|
require.FileExists(t, expectedFile)
|
|
|
|
artifact, err := readAndroidArtifact(expectedFile)
|
|
require.NoError(t, err)
|
|
require.Equal(t, "1.0", artifact.SchemaVersion)
|
|
require.Equal(t, "16", artifact.AndroidVersion)
|
|
require.Equal(t, 1, artifact.TotalCVEs)
|
|
require.Len(t, artifact.Vulnerabilities, 1)
|
|
require.Equal(t, "CVE-2026-12345", artifact.Vulnerabilities[0].CVE)
|
|
require.Equal(t, "2026-06-01", artifact.Vulnerabilities[0].FixedSPL)
|
|
require.Equal(t, "High", artifact.Vulnerabilities[0].Severity)
|
|
}
|
|
|
|
func TestRunAndroidMultiVersion(t *testing.T) {
|
|
inputDir := t.TempDir()
|
|
outputDir := t.TempDir()
|
|
|
|
// Vulnerability affecting both Android 15 and 16
|
|
testData := `{
|
|
"schema_version": "1.7.5",
|
|
"id": "ASB-A-222222222",
|
|
"published": "2026-05-01T00:00:00Z",
|
|
"modified": "2026-07-14T00:00:00Z",
|
|
"aliases": ["A-222222222", "CVE-2026-55555"],
|
|
"affected": [{
|
|
"package": {
|
|
"name": "platform/frameworks/base",
|
|
"ecosystem": "Android"
|
|
},
|
|
"ranges": [{
|
|
"type": "ECOSYSTEM",
|
|
"events": [
|
|
{"introduced": "15:0"},
|
|
{"fixed": "15:2026-05-01"},
|
|
{"introduced": "16:0"},
|
|
{"fixed": "16:2026-05-01"}
|
|
]
|
|
}],
|
|
"versions": ["15", "16"],
|
|
"ecosystem_specific": {
|
|
"severity": "Critical",
|
|
"spl": "2026-05-01"
|
|
}
|
|
}]
|
|
}`
|
|
require.NoError(t, os.WriteFile(filepath.Join(inputDir, "ASB-A-222222222.json"), []byte(testData), 0o644))
|
|
|
|
cfg := Config{
|
|
Platform: "android",
|
|
InputDir: inputDir,
|
|
OutputDir: outputDir,
|
|
DateStr: "2026-07-14",
|
|
GeneratedTimestamp: "2026-07-14T00:00:00Z",
|
|
RunTime: time.Date(2026, 7, 14, 0, 0, 0, 0, time.UTC),
|
|
}
|
|
|
|
err := runAndroid(cfg)
|
|
require.NoError(t, err)
|
|
|
|
// Should produce artifacts for both Android 15 and 16
|
|
a15, err := readAndroidArtifact(filepath.Join(outputDir, "osv-android-15-2026-07-14.json.gz"))
|
|
require.NoError(t, err)
|
|
require.Equal(t, "15", a15.AndroidVersion)
|
|
require.Equal(t, 1, a15.TotalCVEs)
|
|
require.Equal(t, "CVE-2026-55555", a15.Vulnerabilities[0].CVE)
|
|
require.Equal(t, "2026-05-01", a15.Vulnerabilities[0].FixedSPL)
|
|
|
|
a16, err := readAndroidArtifact(filepath.Join(outputDir, "osv-android-16-2026-07-14.json.gz"))
|
|
require.NoError(t, err)
|
|
require.Equal(t, "16", a16.AndroidVersion)
|
|
require.Equal(t, 1, a16.TotalCVEs)
|
|
require.Equal(t, "CVE-2026-55555", a16.Vulnerabilities[0].CVE)
|
|
}
|
|
|
|
func TestRunAndroidDeduplication(t *testing.T) {
|
|
inputDir := t.TempDir()
|
|
outputDir := t.TempDir()
|
|
|
|
// Same CVE appears in multiple affected entries (different packages, same version)
|
|
testData := `{
|
|
"schema_version": "1.7.5",
|
|
"id": "ASB-A-333333333",
|
|
"published": "2026-01-01T00:00:00Z",
|
|
"modified": "2026-01-02T00:00:00Z",
|
|
"aliases": ["A-333333333", "CVE-2026-33333"],
|
|
"affected": [
|
|
{
|
|
"package": {"name": "platform/frameworks/base", "ecosystem": "Android"},
|
|
"ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "16:0"}, {"fixed": "16:2026-01-01"}]}],
|
|
"ecosystem_specific": {"severity": "High"}
|
|
},
|
|
{
|
|
"package": {"name": "platform/packages/apps/Settings", "ecosystem": "Android"},
|
|
"ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "16:0"}, {"fixed": "16:2026-01-01"}]}],
|
|
"ecosystem_specific": {"severity": "High"}
|
|
}
|
|
]
|
|
}`
|
|
require.NoError(t, os.WriteFile(filepath.Join(inputDir, "ASB-A-333333333.json"), []byte(testData), 0o644))
|
|
|
|
cfg := Config{
|
|
Platform: "android",
|
|
InputDir: inputDir,
|
|
OutputDir: outputDir,
|
|
DateStr: "2026-07-14",
|
|
GeneratedTimestamp: "2026-07-14T00:00:00Z",
|
|
RunTime: time.Date(2026, 7, 14, 0, 0, 0, 0, time.UTC),
|
|
}
|
|
|
|
err := runAndroid(cfg)
|
|
require.NoError(t, err)
|
|
|
|
artifact, err := readAndroidArtifact(filepath.Join(outputDir, "osv-android-16-2026-07-14.json.gz"))
|
|
require.NoError(t, err)
|
|
// CVE should appear only once despite two affected entries
|
|
require.Equal(t, 1, artifact.TotalCVEs)
|
|
require.Len(t, artifact.Vulnerabilities, 1)
|
|
require.Equal(t, "CVE-2026-33333", artifact.Vulnerabilities[0].CVE)
|
|
}
|
|
|
|
func TestRunAndroidSkipsNonVersionPrefixes(t *testing.T) {
|
|
inputDir := t.TempDir()
|
|
outputDir := t.TempDir()
|
|
|
|
// Kernel-only vuln (empty prefix ":0") and SoCVersion should be skipped
|
|
testData := `{
|
|
"schema_version": "1.7.5",
|
|
"id": "ASB-A-444444444",
|
|
"published": "2020-09-01T00:00:00Z",
|
|
"modified": "2026-07-14T00:00:00Z",
|
|
"aliases": ["A-444444444", "CVE-2020-0404"],
|
|
"affected": [{
|
|
"package": {"name": ":linux_kernel:", "ecosystem": "Android"},
|
|
"ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": ":0"}, {"fixed": ":2020-09-05"}]}],
|
|
"versions": ["Kernel"],
|
|
"ecosystem_specific": {"severity": "High"}
|
|
}]
|
|
}`
|
|
require.NoError(t, os.WriteFile(filepath.Join(inputDir, "kernel-only.json"), []byte(testData), 0o644))
|
|
|
|
socData := `{
|
|
"schema_version": "1.7.5",
|
|
"id": "ASB-A-555555555",
|
|
"published": "2020-09-01T00:00:00Z",
|
|
"modified": "2026-07-14T00:00:00Z",
|
|
"aliases": ["A-555555555", "CVE-2020-0505"],
|
|
"affected": [{
|
|
"package": {"name": ":unknown:", "ecosystem": "Android"},
|
|
"ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "SoCVersion:0"}, {"fixed": "SoCVersion:2020-09-05"}]}],
|
|
"versions": ["SoCVersion"],
|
|
"ecosystem_specific": {"severity": "Critical"}
|
|
}]
|
|
}`
|
|
require.NoError(t, os.WriteFile(filepath.Join(inputDir, "soc-only.json"), []byte(socData), 0o644))
|
|
|
|
cfg := Config{
|
|
Platform: "android",
|
|
InputDir: inputDir,
|
|
OutputDir: outputDir,
|
|
DateStr: "2026-07-14",
|
|
GeneratedTimestamp: "2026-07-14T00:00:00Z",
|
|
RunTime: time.Date(2026, 7, 14, 0, 0, 0, 0, time.UTC),
|
|
}
|
|
|
|
err := runAndroid(cfg)
|
|
require.NoError(t, err)
|
|
|
|
// No artifacts should be created — both entries are non-version prefixes
|
|
files, err := filepath.Glob(filepath.Join(outputDir, "osv-android-*.json.gz"))
|
|
require.NoError(t, err)
|
|
require.Empty(t, files, "no artifacts should be generated for kernel-only or SoCVersion entries")
|
|
}
|
|
|
|
func TestRunAndroidVersionFiltering(t *testing.T) {
|
|
inputDir := t.TempDir()
|
|
outputDir := t.TempDir()
|
|
|
|
// Create entries for Android 14, 15, and 16
|
|
for i, ver := range []string{"14", "15", "16"} {
|
|
data := fmt.Sprintf(`{
|
|
"schema_version": "1.7.5",
|
|
"id": "ASB-A-10000000%d",
|
|
"published": "2026-01-01T00:00:00Z",
|
|
"modified": "2026-01-02T00:00:00Z",
|
|
"aliases": ["CVE-2026-000%d%d"],
|
|
"affected": [{
|
|
"package": {"name": "platform/frameworks/base", "ecosystem": "Android"},
|
|
"ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "%s:0"}, {"fixed": "%s:2026-01-01"}]}],
|
|
"ecosystem_specific": {"severity": "High"}
|
|
}]
|
|
}`, i, i, i, ver, ver)
|
|
require.NoError(t, os.WriteFile(filepath.Join(inputDir, fmt.Sprintf("test-%s.json", ver)), []byte(data), 0o644))
|
|
}
|
|
|
|
// Filter to only version 16
|
|
cfg := Config{
|
|
Platform: "android",
|
|
InputDir: inputDir,
|
|
OutputDir: outputDir,
|
|
Versions: "16",
|
|
DateStr: "2026-07-14",
|
|
GeneratedTimestamp: "2026-07-14T00:00:00Z",
|
|
RunTime: time.Date(2026, 7, 14, 0, 0, 0, 0, time.UTC),
|
|
}
|
|
|
|
err := runAndroid(cfg)
|
|
require.NoError(t, err)
|
|
|
|
require.FileExists(t, filepath.Join(outputDir, "osv-android-16-2026-07-14.json.gz"))
|
|
_, err = os.Stat(filepath.Join(outputDir, "osv-android-15-2026-07-14.json.gz"))
|
|
require.True(t, os.IsNotExist(err))
|
|
_, err = os.Stat(filepath.Join(outputDir, "osv-android-14-2026-07-14.json.gz"))
|
|
require.True(t, os.IsNotExist(err))
|
|
}
|
|
|
|
func TestRunAndroidNextSuffixNormalization(t *testing.T) {
|
|
inputDir := t.TempDir()
|
|
outputDir := t.TempDir()
|
|
|
|
// "15-next" should map to the "15" artifact
|
|
testData := `{
|
|
"schema_version": "1.7.5",
|
|
"id": "ASB-A-666666666",
|
|
"published": "2026-01-01T00:00:00Z",
|
|
"modified": "2026-01-02T00:00:00Z",
|
|
"aliases": ["CVE-2026-66666"],
|
|
"affected": [{
|
|
"package": {"name": "platform/frameworks/base", "ecosystem": "Android"},
|
|
"ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "15-next:0"}, {"fixed": "15-next:2026-01-01"}]}],
|
|
"ecosystem_specific": {"severity": "Medium"}
|
|
}]
|
|
}`
|
|
require.NoError(t, os.WriteFile(filepath.Join(inputDir, "test-next.json"), []byte(testData), 0o644))
|
|
|
|
cfg := Config{
|
|
Platform: "android",
|
|
InputDir: inputDir,
|
|
OutputDir: outputDir,
|
|
DateStr: "2026-07-14",
|
|
GeneratedTimestamp: "2026-07-14T00:00:00Z",
|
|
RunTime: time.Date(2026, 7, 14, 0, 0, 0, 0, time.UTC),
|
|
}
|
|
|
|
err := runAndroid(cfg)
|
|
require.NoError(t, err)
|
|
|
|
// Should produce Android 15 artifact (not "15-next")
|
|
artifact, err := readAndroidArtifact(filepath.Join(outputDir, "osv-android-15-2026-07-14.json.gz"))
|
|
require.NoError(t, err)
|
|
require.Equal(t, "15", artifact.AndroidVersion)
|
|
require.Equal(t, 1, artifact.TotalCVEs)
|
|
require.Equal(t, "CVE-2026-66666", artifact.Vulnerabilities[0].CVE)
|
|
require.Equal(t, "2026-01-01", artifact.Vulnerabilities[0].FixedSPL)
|
|
}
|
|
|
|
func TestRunAndroidLatestFixedSPLWins(t *testing.T) {
|
|
// When the same CVE appears multiple times for the same Android major version
|
|
// with different fixed SPL dates, the artifact must keep the LATEST date.
|
|
// This happens in practice when Google's initial fix is incomplete and a
|
|
// follow-up patch ships in a later monthly bulletin under the same CVE ID.
|
|
// The earlier fixed_spl is effectively retracted — a host at that SPL is
|
|
// still vulnerable.
|
|
tests := []struct {
|
|
name string
|
|
description string
|
|
input string
|
|
expectedSPL string
|
|
}{
|
|
{
|
|
name: "incomplete fix revised months later (same package)",
|
|
description: "Google patches frameworks/base in June, discovers the fix is incomplete, ships a second fix in September under the same CVE. The June SPL is stale.",
|
|
input: `{
|
|
"schema_version": "1.7.5",
|
|
"id": "ASB-A-777777777",
|
|
"published": "2024-06-01T00:00:00Z",
|
|
"modified": "2024-09-01T00:00:00Z",
|
|
"aliases": ["CVE-2024-32896"],
|
|
"affected": [
|
|
{
|
|
"package": {"name": "platform/frameworks/base", "ecosystem": "Android"},
|
|
"ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "14:0"}, {"fixed": "14:2024-06-05"}]}],
|
|
"ecosystem_specific": {"severity": "High"}
|
|
},
|
|
{
|
|
"package": {"name": "platform/frameworks/base", "ecosystem": "Android"},
|
|
"ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "14:0"}, {"fixed": "14:2024-09-01"}]}],
|
|
"ecosystem_specific": {"severity": "High"}
|
|
}
|
|
]
|
|
}`,
|
|
expectedSPL: "2024-09-01",
|
|
},
|
|
{
|
|
name: "different packages fixed in different bulletins",
|
|
description: "Same CVE affects two packages. One is fixed in June, the other in September. Host needs both patches, so September wins.",
|
|
input: `{
|
|
"schema_version": "1.7.5",
|
|
"id": "ASB-A-888888888",
|
|
"published": "2024-06-01T00:00:00Z",
|
|
"modified": "2024-09-01T00:00:00Z",
|
|
"aliases": ["CVE-2024-99999"],
|
|
"affected": [
|
|
{
|
|
"package": {"name": "platform/frameworks/base", "ecosystem": "Android"},
|
|
"ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "14:0"}, {"fixed": "14:2024-06-05"}]}],
|
|
"ecosystem_specific": {"severity": "High"}
|
|
},
|
|
{
|
|
"package": {"name": "platform/system/sepolicy", "ecosystem": "Android"},
|
|
"ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "14:0"}, {"fixed": "14:2024-09-01"}]}],
|
|
"ecosystem_specific": {"severity": "High"}
|
|
}
|
|
]
|
|
}`,
|
|
expectedSPL: "2024-09-01",
|
|
},
|
|
{
|
|
name: "later date seen first in file does not regress",
|
|
description: "Entries appear with September first, June second. Result must still be September — ordering in the JSON must not matter.",
|
|
input: `{
|
|
"schema_version": "1.7.5",
|
|
"id": "ASB-A-999999999",
|
|
"published": "2024-06-01T00:00:00Z",
|
|
"modified": "2024-09-01T00:00:00Z",
|
|
"aliases": ["CVE-2024-11111"],
|
|
"affected": [
|
|
{
|
|
"package": {"name": "platform/frameworks/base", "ecosystem": "Android"},
|
|
"ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "14:0"}, {"fixed": "14:2024-09-01"}]}],
|
|
"ecosystem_specific": {"severity": "High"}
|
|
},
|
|
{
|
|
"package": {"name": "platform/frameworks/base", "ecosystem": "Android"},
|
|
"ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "14:0"}, {"fixed": "14:2024-06-05"}]}],
|
|
"ecosystem_specific": {"severity": "High"}
|
|
}
|
|
]
|
|
}`,
|
|
expectedSPL: "2024-09-01",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
inputDir := t.TempDir()
|
|
outputDir := t.TempDir()
|
|
|
|
require.NoError(t, os.WriteFile(filepath.Join(inputDir, "test.json"), []byte(tt.input), 0o644))
|
|
|
|
cfg := Config{
|
|
Platform: "android",
|
|
InputDir: inputDir,
|
|
OutputDir: outputDir,
|
|
DateStr: "2026-07-14",
|
|
GeneratedTimestamp: "2026-07-14T00:00:00Z",
|
|
RunTime: time.Date(2026, 7, 14, 0, 0, 0, 0, time.UTC),
|
|
}
|
|
|
|
err := runAndroid(cfg)
|
|
require.NoError(t, err)
|
|
|
|
artifact, err := readAndroidArtifact(filepath.Join(outputDir, "osv-android-14-2026-07-14.json.gz"))
|
|
require.NoError(t, err)
|
|
require.Len(t, artifact.Vulnerabilities, 1, "same CVE must be deduplicated to one entry")
|
|
require.Equal(t, tt.expectedSPL, artifact.Vulnerabilities[0].FixedSPL,
|
|
"must keep the latest fixed SPL — earlier dates are stale")
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestRunAndroidSeverityUpgrade(t *testing.T) {
|
|
inputDir := t.TempDir()
|
|
outputDir := t.TempDir()
|
|
|
|
// Same CVE, same version, different severities across affected entries.
|
|
// The highest severity (Critical > High) must win.
|
|
testData := `{
|
|
"schema_version": "1.7.5",
|
|
"id": "ASB-A-152496149",
|
|
"published": "2020-08-01T00:00:00Z",
|
|
"modified": "2020-09-01T00:00:00Z",
|
|
"aliases": ["CVE-2020-0245"],
|
|
"affected": [
|
|
{
|
|
"package": {"name": "platform/frameworks/av", "ecosystem": "Android"},
|
|
"ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "11:0"}, {"fixed": "11:2020-09-01"}]}],
|
|
"ecosystem_specific": {"severity": "High"}
|
|
},
|
|
{
|
|
"package": {"name": "platform/frameworks/base", "ecosystem": "Android"},
|
|
"ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "11:0"}, {"fixed": "11:2020-09-01"}]}],
|
|
"ecosystem_specific": {"severity": "Critical"}
|
|
}
|
|
]
|
|
}`
|
|
require.NoError(t, os.WriteFile(filepath.Join(inputDir, "test.json"), []byte(testData), 0o644))
|
|
|
|
cfg := Config{
|
|
Platform: "android",
|
|
InputDir: inputDir,
|
|
OutputDir: outputDir,
|
|
DateStr: "2026-07-15",
|
|
GeneratedTimestamp: "2026-07-15T00:00:00Z",
|
|
RunTime: time.Date(2026, 7, 15, 0, 0, 0, 0, time.UTC),
|
|
}
|
|
|
|
err := runAndroid(cfg)
|
|
require.NoError(t, err)
|
|
|
|
artifact, err := readAndroidArtifact(filepath.Join(outputDir, "osv-android-11-2026-07-15.json.gz"))
|
|
require.NoError(t, err)
|
|
require.Len(t, artifact.Vulnerabilities, 1)
|
|
require.Equal(t, "Critical", artifact.Vulnerabilities[0].Severity,
|
|
"highest severity must win when deduplicating")
|
|
}
|
|
|
|
func TestRunAndroidGitRangeIgnored(t *testing.T) {
|
|
inputDir := t.TempDir()
|
|
outputDir := t.TempDir()
|
|
|
|
// Real Android entries carry GIT ranges alongside ECOSYSTEM ranges.
|
|
// Only the ECOSYSTEM range should be used; the GIT range must be ignored.
|
|
testData := `{
|
|
"schema_version": "1.7.5",
|
|
"id": "ASB-A-111111111",
|
|
"published": "2026-01-01T00:00:00Z",
|
|
"modified": "2026-01-02T00:00:00Z",
|
|
"aliases": ["CVE-2026-11111"],
|
|
"affected": [{
|
|
"package": {"name": "platform/frameworks/base", "ecosystem": "Android"},
|
|
"ranges": [
|
|
{
|
|
"type": "GIT",
|
|
"events": [
|
|
{"introduced": "0"},
|
|
{"fixed": "abc123def456"}
|
|
]
|
|
},
|
|
{
|
|
"type": "ECOSYSTEM",
|
|
"events": [
|
|
{"introduced": "16:0"},
|
|
{"fixed": "16:2026-01-01"}
|
|
]
|
|
}
|
|
],
|
|
"ecosystem_specific": {"severity": "High"}
|
|
}]
|
|
}`
|
|
require.NoError(t, os.WriteFile(filepath.Join(inputDir, "test.json"), []byte(testData), 0o644))
|
|
|
|
cfg := Config{
|
|
Platform: "android",
|
|
InputDir: inputDir,
|
|
OutputDir: outputDir,
|
|
DateStr: "2026-07-15",
|
|
GeneratedTimestamp: "2026-07-15T00:00:00Z",
|
|
RunTime: time.Date(2026, 7, 15, 0, 0, 0, 0, time.UTC),
|
|
}
|
|
|
|
err := runAndroid(cfg)
|
|
require.NoError(t, err)
|
|
|
|
artifact, err := readAndroidArtifact(filepath.Join(outputDir, "osv-android-16-2026-07-15.json.gz"))
|
|
require.NoError(t, err)
|
|
require.Len(t, artifact.Vulnerabilities, 1)
|
|
require.Equal(t, "CVE-2026-11111", artifact.Vulnerabilities[0].CVE)
|
|
require.Equal(t, "2026-01-01", artifact.Vulnerabilities[0].FixedSPL)
|
|
}
|
|
|
|
func TestRunAndroidNonAndroidEcosystemIgnored(t *testing.T) {
|
|
inputDir := t.TempDir()
|
|
outputDir := t.TempDir()
|
|
|
|
// An entry with a non-Android ecosystem that has version-like fixed events
|
|
// must not produce an Android artifact.
|
|
testData := `{
|
|
"schema_version": "1.7.5",
|
|
"id": "FAKE-ENTRY",
|
|
"published": "2026-01-01T00:00:00Z",
|
|
"modified": "2026-01-02T00:00:00Z",
|
|
"aliases": ["CVE-2026-99999"],
|
|
"affected": [{
|
|
"package": {"name": "some-package", "ecosystem": "Ubuntu:24.04:LTS"},
|
|
"ranges": [{
|
|
"type": "ECOSYSTEM",
|
|
"events": [{"introduced": "16:0"}, {"fixed": "16:2026-01-01"}]
|
|
}]
|
|
}]
|
|
}`
|
|
require.NoError(t, os.WriteFile(filepath.Join(inputDir, "test.json"), []byte(testData), 0o644))
|
|
|
|
cfg := Config{
|
|
Platform: "android",
|
|
InputDir: inputDir,
|
|
OutputDir: outputDir,
|
|
DateStr: "2026-07-15",
|
|
GeneratedTimestamp: "2026-07-15T00:00:00Z",
|
|
RunTime: time.Date(2026, 7, 15, 0, 0, 0, 0, time.UTC),
|
|
}
|
|
|
|
err := runAndroid(cfg)
|
|
require.NoError(t, err)
|
|
|
|
files, err := filepath.Glob(filepath.Join(outputDir, "osv-android-*.json.gz"))
|
|
require.NoError(t, err)
|
|
require.Empty(t, files, "non-Android ecosystem must not produce any artifact")
|
|
}
|
|
|
|
func TestRunAndroidExcludeVersions(t *testing.T) {
|
|
inputDir := t.TempDir()
|
|
outputDir := t.TempDir()
|
|
|
|
// Create entries for Android 14, 15, and 16
|
|
for i, ver := range []string{"14", "15", "16"} {
|
|
data := fmt.Sprintf(`{
|
|
"schema_version": "1.7.5",
|
|
"id": "ASB-A-20000000%d",
|
|
"published": "2026-01-01T00:00:00Z",
|
|
"modified": "2026-01-02T00:00:00Z",
|
|
"aliases": ["CVE-2026-100%d%d"],
|
|
"affected": [{
|
|
"package": {"name": "platform/frameworks/base", "ecosystem": "Android"},
|
|
"ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "%s:0"}, {"fixed": "%s:2026-01-01"}]}],
|
|
"ecosystem_specific": {"severity": "High"}
|
|
}]
|
|
}`, i, i, i, ver, ver)
|
|
require.NoError(t, os.WriteFile(filepath.Join(inputDir, fmt.Sprintf("test-%s.json", ver)), []byte(data), 0o644))
|
|
}
|
|
|
|
cfg := Config{
|
|
Platform: "android",
|
|
InputDir: inputDir,
|
|
OutputDir: outputDir,
|
|
ExcludeVersions: "14,15",
|
|
DateStr: "2026-07-15",
|
|
GeneratedTimestamp: "2026-07-15T00:00:00Z",
|
|
RunTime: time.Date(2026, 7, 15, 0, 0, 0, 0, time.UTC),
|
|
}
|
|
|
|
err := runAndroid(cfg)
|
|
require.NoError(t, err)
|
|
|
|
// Only Android 16 should be generated
|
|
require.FileExists(t, filepath.Join(outputDir, "osv-android-16-2026-07-15.json.gz"))
|
|
_, err = os.Stat(filepath.Join(outputDir, "osv-android-15-2026-07-15.json.gz"))
|
|
require.True(t, os.IsNotExist(err), "excluded version 15 should not produce an artifact")
|
|
_, err = os.Stat(filepath.Join(outputDir, "osv-android-14-2026-07-15.json.gz"))
|
|
require.True(t, os.IsNotExist(err), "excluded version 14 should not produce an artifact")
|
|
}
|
|
|
|
func TestRunAndroidEmptyInputErrors(t *testing.T) {
|
|
// Android ingests the full OSV corpus, so an input directory with no usable
|
|
// Android OSV files means the input is broken. Fail loudly rather than
|
|
// silently producing a release with no artifacts.
|
|
cfg := Config{
|
|
Platform: "android",
|
|
InputDir: t.TempDir(), // empty
|
|
OutputDir: t.TempDir(),
|
|
DateStr: "2026-07-14",
|
|
GeneratedTimestamp: "2026-07-14T00:00:00Z",
|
|
RunTime: time.Date(2026, 7, 14, 0, 0, 0, 0, time.UTC),
|
|
}
|
|
|
|
err := runAndroid(cfg)
|
|
require.Error(t, err)
|
|
require.Contains(t, err.Error(), "no Android OSV files with CVEs found")
|
|
}
|
|
|
|
func TestRunAndroidDeltaFlagsRejected(t *testing.T) {
|
|
cfg := Config{
|
|
Platform: "android",
|
|
InputDir: t.TempDir(),
|
|
OutputDir: t.TempDir(),
|
|
ChangedFilesToday: "some-file.txt",
|
|
}
|
|
|
|
err := runAndroid(cfg)
|
|
require.Error(t, err)
|
|
require.Contains(t, err.Error(), "not supported with --platform android")
|
|
}
|