-
Notifications
You must be signed in to change notification settings - Fork 70
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1237 from CVEProject/jd-dev-version
Adding hot fixes from Int to Dev
- Loading branch information
Showing
10 changed files
with
179 additions
and
477 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Large diffs are not rendered by default.
Oops, something went wrong.
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,148 @@ | ||
| const chai = require('chai') | ||
| const sinon = require('sinon') | ||
| const { faker } = require('@faker-js/faker') | ||
| const _ = require('lodash') | ||
| const expect = chai.expect | ||
| const cveIdPublished5 = 'CVE-2017-4024' | ||
| const cveRecordPublished = require('../../schemas/5.0/CVE-2017-4024_published.json') | ||
| const cnaContainer = require('../../schemas/cna-container/cna-container_pass.json') | ||
| const { CVE_UPDATE_CNA } = require('../../../src/controller/cve.controller/cve.controller.js') | ||
| const errors = require('../../../src/controller/cve.controller/error.js') | ||
| const error = new errors.CveControllerError() | ||
| const constants = require('../../../src/constants').getConstants() | ||
| const Cve = require('../../../src/model/cve.js') | ||
|
|
||
| const cnaUUID = faker.datatype.uuid() | ||
|
|
||
| const stubCnaOrg = { | ||
| short_name: 'CnaOrg', | ||
| name: 'test_cna', | ||
| UUID: cnaUUID, | ||
| authority: { | ||
| active_roles: [ | ||
| 'CNA' | ||
| ] | ||
| } | ||
| } | ||
|
|
||
| const stubCnaUser = { | ||
| username: 'testCnaUser', | ||
| org_UUID: cnaUUID, | ||
| UUID: faker.datatype.uuid() | ||
| } | ||
|
|
||
| const stubCveId = { | ||
| requested_by: { | ||
| cna: 'CnaOrg', | ||
| user: 'testCnaUser' | ||
| }, | ||
| cve_id: 'CVE-2017-4024', | ||
| cve_year: '2017', | ||
| state: 'PUBLISHED', | ||
| owning_cna: cnaUUID, | ||
| reserved: '2023-05-17T16:57:35.698Z' | ||
| } | ||
|
|
||
| describe('updateCna function', () => { | ||
| let req | ||
| let res | ||
| let next | ||
| let status | ||
| let json | ||
| let cveRepo | ||
| let cveIdRepo | ||
| let orgRepo | ||
| let userRepo | ||
| let getCveRepository | ||
| let getCveIdRepository | ||
| let getUserRepository | ||
| let getOrgRepository | ||
| let cveCopy | ||
| let cnaContainerCopy | ||
|
|
||
| beforeEach(() => { | ||
| status = sinon.stub() | ||
| json = sinon.spy() | ||
| res = { json, status } | ||
| next = sinon.spy() | ||
| status.returns(res) | ||
| cveCopy = _.cloneDeep(cveRecordPublished) | ||
| cnaContainerCopy = _.cloneDeep(cnaContainer) | ||
|
|
||
| sinon.stub(Cve, 'validateCveRecord').returns({ isValid: true }) | ||
| orgRepo = { getOrgUUID: sinon.stub(), isSecretariat: sinon.stub() } | ||
| orgRepo.getOrgUUID.returns(stubCnaOrg.UUID) | ||
| orgRepo.isSecretariat.returns(false) | ||
| getOrgRepository = sinon.stub() | ||
| getOrgRepository.returns(orgRepo) | ||
|
|
||
| userRepo = { getUserUUID: sinon.stub() } | ||
| userRepo.getUserUUID.returns(stubCnaUser.UUID) | ||
| getUserRepository = sinon.stub() | ||
| getUserRepository.returns(userRepo) | ||
|
|
||
| cveRepo = { findOneByCveId: sinon.stub(), updateByCveId: sinon.stub() } | ||
| cveRepo.findOneByCveId.returns({ cve: cveCopy }) | ||
| cveRepo.updateByCveId.returns(true) | ||
| getCveRepository = sinon.stub() | ||
| getCveRepository.returns(cveRepo) | ||
|
|
||
| cveIdRepo = { findOneByCveId: sinon.stub() } | ||
| cveIdRepo.findOneByCveId.returns(stubCveId) | ||
| getCveIdRepository = sinon.stub() | ||
| getCveIdRepository.returns(cveIdRepo) | ||
|
|
||
| req = { | ||
| ctx: { | ||
| org: stubCnaOrg.short_name, | ||
| uuid: stubCnaOrg.UUID, | ||
| params: { | ||
| id: cveIdPublished5 | ||
| }, | ||
| repositories: { | ||
| getOrgRepository, | ||
| getUserRepository, | ||
| getCveRepository, | ||
| getCveIdRepository | ||
| }, | ||
| body: { | ||
| cnaContainer: cnaContainerCopy | ||
| } | ||
| } | ||
| } | ||
| }) | ||
|
|
||
| afterEach(() => { | ||
| sinon.restore() | ||
| }) | ||
|
|
||
| it('should return 400 when the CVE-ID does not exist', async () => { | ||
| cveIdRepo.findOneByCveId.returns(null) | ||
|
|
||
| await CVE_UPDATE_CNA(req, res, next) | ||
|
|
||
| expect(status.args[0][0]).to.equal(400) | ||
| expect(res.json.args[0][0].message).to.equal(error.cveDne().message) | ||
| }) | ||
| it('should return 403 if calling user org is not secretariat and does not match CVE org, ', async () => { | ||
| orgRepo.getOrgUUID.returns('bad id') | ||
| await CVE_UPDATE_CNA(req, res, next) | ||
|
|
||
| expect(status.args[0][0]).to.equal(403) | ||
| expect(res.json.args[0][0].message).to.equal(error.owningOrgDoesNotMatch().message) | ||
| }) | ||
| it('should return 400 when the CVE record does not exist', async () => { | ||
| cveRepo.findOneByCveId.returns(null) | ||
| await CVE_UPDATE_CNA(req, res, next) | ||
|
|
||
| expect(status.args[0][0]).to.equal(403) | ||
| expect(res.json.args[0][0].message).to.equal(error.cveRecordDne().message) | ||
| }) | ||
| it('should update dataVersion to current schema if existing record was last updating against previous schema', async () => { | ||
| await CVE_UPDATE_CNA(req, res, next) | ||
|
|
||
| expect(status.args[0][0]).to.equal(200) | ||
| expect(res.json.args[0][0].message).to.include(' record was successfully updated. This submission should appear on ') | ||
| expect(res.json.args[0][0].updated.dataVersion).to.equal(constants.SCHEMA_VERSION) | ||
| }) | ||
| }) |