nix-security-tracker/src/shared/tests/test_fetchers.py at f360489218ded0979183e3d8dfe2dbbedbb03c15 · NixOS/nix-security-tracker · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
from shared.fetchers import make_metric


def test_make_metric_uses_cvss_v4_0_when_v3_1_is_missing(db: None) -> None:
    metric = make_metric(
        {
            "cvssV4_0": {
                "version": "4.0",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
            }
        }
    )

    assert metric.format == "cvssV4_0"
    assert metric.raw_cvss_json["version"] == "4.0"
    assert metric.vector_string == "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
    assert metric.base_score == 9.3
    assert metric.base_severity == "CRITICAL"


def test_make_metric_uses_cvss_v3_0_when_v3_1_is_missing(db: None) -> None:
    metric = make_metric(
        {
            "cvssV3_0": {
                "version": "3.0",
                "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "baseScore": "9.8",
                "baseSeverity": "CRITICAL",
                "attackVector": "NETWORK",
                "attackComplexity": "LOW",
                "privilegesRequired": "NONE",
                "userInteraction": "NONE",
                "scope": "UNCHANGED",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "availabilityImpact": "HIGH",
            }
        }
    )

    assert metric.format == "cvssV3_0"
    assert metric.base_score == 9.8
    assert metric.base_severity == "CRITICAL"
    assert metric.attack_vector == "NETWORK"