Skip to content

Commit ee4d42a

Browse files
G-RathG-Rath
committed
test: add more cases for "with no config"
1 parent e32b4d3 commit ee4d42a

File tree

2 files changed

+182
-31
lines changed

2 files changed

+182
-31
lines changed

‎cmd/osv-scanner/scan/source/__snapshots__/command_test.snap‎

Lines changed: 107 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5985,7 +5985,112 @@ No issues found
59855985

59865986
---
59875987

5988-
[TestCommand_UpdateConfigIgnores_WithNoConfig - 1]
5988+
[TestCommand_UpdateConfigIgnores_WithNoConfig/all - 1]
5989+
Scanning dir <tempdir>
5990+
Scanned <tempdir>/Gemfile.lock file and found 1 package
5991+
Scanned <tempdir>/composer.lock file and found 0 packages
5992+
Scanned <tempdir>/nested-1/package-lock.json file and found 3 packages
5993+
Scanned <tempdir>/nested-2/package-lock.json file and found 3 packages
5994+
Scanned <tempdir>/package-lock.json file and found 1 package
5995+
Total 8 packages affected by 10 known vulnerabilities (0 Critical, 3 High, 7 Medium, 0 Low, 0 Unknown) from 2 ecosystems.
5996+
10 vulnerabilities can be fixed.
5997+
5998+
5999+
+-------------------------------------+------+-----------+-----------+---------+---------------+--------------------------------------------------------------+
6000+
| OSV URL | CVSS | ECOSYSTEM | PACKAGE | VERSION | FIXED VERSION | SOURCE |
6001+
+-------------------------------------+------+-----------+-----------+---------+---------------+--------------------------------------------------------------+
6002+
| https://osv.dev/GHSA-wx95-c6cv-8532 | 5.3 | RubyGems | nokogiri | 1.18.9 | 1.19.1 | <tempdir>/Gemfile.lock |
6003+
| https://osv.dev/GHSA-2g4f-4pwh-qvx6 | 5.5 | npm | ajv | 6.0.0 | 8.18.0 | <tempdir>/nested-1/package-lock.json |
6004+
| https://osv.dev/GHSA-v88g-cgmw-v5xw | 5.6 | npm | ajv | 6.0.0 | 6.12.3 | <tempdir>/nested-1/package-lock.json |
6005+
| https://osv.dev/GHSA-2g4f-4pwh-qvx6 | 5.5 | npm | ajv | 8.0.0 | 8.18.0 | <tempdir>/nested-1/package-lock.json |
6006+
| https://osv.dev/GHSA-whgm-jr23-g3j9 | 7.5 | npm | ansi-html | 0.0.1 | 0.0.8 | <tempdir>/nested-1/package-lock.json |
6007+
| https://osv.dev/GHSA-2g4f-4pwh-qvx6 | 5.5 | npm | ajv | 6.0.0 | 8.18.0 | <tempdir>/nested-2/package-lock.json |
6008+
| https://osv.dev/GHSA-v88g-cgmw-v5xw | 5.6 | npm | ajv | 6.0.0 | 6.12.3 | <tempdir>/nested-2/package-lock.json |
6009+
| https://osv.dev/GHSA-2g4f-4pwh-qvx6 | 5.5 | npm | ajv | 8.0.0 | 8.18.0 | <tempdir>/nested-2/package-lock.json |
6010+
| https://osv.dev/GHSA-whgm-jr23-g3j9 | 7.5 | npm | ansi-html | 0.0.1 | 0.0.8 | <tempdir>/nested-2/package-lock.json |
6011+
| https://osv.dev/GHSA-whgm-jr23-g3j9 | 7.5 | npm | ansi-html | 0.0.1 | 0.0.8 | <tempdir>/package-lock.json |
6012+
+-------------------------------------+------+-----------+-----------+---------+---------------+--------------------------------------------------------------+
6013+
6014+
---
6015+
6016+
[TestCommand_UpdateConfigIgnores_WithNoConfig/all - 2]
6017+
6018+
---
6019+
6020+
[TestCommand_UpdateConfigIgnores_WithNoConfig/deep - 1]
6021+
Scanning dir <tempdir>
6022+
Scanned <tempdir>/Gemfile.lock file and found 1 package
6023+
Scanned <tempdir>/composer.lock file and found 0 packages
6024+
Scanned <tempdir>/nested-1/package-lock.json file and found 3 packages
6025+
Scanned <tempdir>/nested-2/package-lock.json file and found 3 packages
6026+
Scanned <tempdir>/package-lock.json file and found 1 package
6027+
Loaded filter from: <tempdir>/osv-scanner-test.toml
6028+
warning: <tempdir>/nested-2/osv-scanner-test.toml has multiple ignores for GHSA-2g4f-4pwh-qvx6 - only the first will be used!
6029+
Loaded filter from: <tempdir>/nested-2/osv-scanner-test.toml
6030+
GHSA-2g4f-4pwh-qvx6 and 1 alias have been filtered out because: (no reason given)
6031+
GHSA-2g4f-4pwh-qvx6 and 1 alias have been filtered out because: (no reason given)
6032+
Filtered 2 vulnerabilities from output
6033+
<tempdir>/nested-2/osv-scanner-test.toml has unused ignores:
6034+
- GHSA-2g4f-4pwh-qvx6
6035+
Total 7 packages affected by 8 known vulnerabilities (0 Critical, 3 High, 5 Medium, 0 Low, 0 Unknown) from 2 ecosystems.
6036+
8 vulnerabilities can be fixed.
6037+
6038+
6039+
+-------------------------------------+------+-----------+-----------+---------+---------------+--------------------------------------------------------------+
6040+
| OSV URL | CVSS | ECOSYSTEM | PACKAGE | VERSION | FIXED VERSION | SOURCE |
6041+
+-------------------------------------+------+-----------+-----------+---------+---------------+--------------------------------------------------------------+
6042+
| https://osv.dev/GHSA-wx95-c6cv-8532 | 5.3 | RubyGems | nokogiri | 1.18.9 | 1.19.1 | <tempdir>/Gemfile.lock |
6043+
| https://osv.dev/GHSA-2g4f-4pwh-qvx6 | 5.5 | npm | ajv | 6.0.0 | 8.18.0 | <tempdir>/nested-1/package-lock.json |
6044+
| https://osv.dev/GHSA-v88g-cgmw-v5xw | 5.6 | npm | ajv | 6.0.0 | 6.12.3 | <tempdir>/nested-1/package-lock.json |
6045+
| https://osv.dev/GHSA-2g4f-4pwh-qvx6 | 5.5 | npm | ajv | 8.0.0 | 8.18.0 | <tempdir>/nested-1/package-lock.json |
6046+
| https://osv.dev/GHSA-whgm-jr23-g3j9 | 7.5 | npm | ansi-html | 0.0.1 | 0.0.8 | <tempdir>/nested-1/package-lock.json |
6047+
| https://osv.dev/GHSA-v88g-cgmw-v5xw | 5.6 | npm | ajv | 6.0.0 | 6.12.3 | <tempdir>/nested-2/package-lock.json |
6048+
| https://osv.dev/GHSA-whgm-jr23-g3j9 | 7.5 | npm | ansi-html | 0.0.1 | 0.0.8 | <tempdir>/nested-2/package-lock.json |
6049+
| https://osv.dev/GHSA-whgm-jr23-g3j9 | 7.5 | npm | ansi-html | 0.0.1 | 0.0.8 | <tempdir>/package-lock.json |
6050+
+-------------------------------------+------+-----------+-----------+---------+---------------+--------------------------------------------------------------+
6051+
6052+
---
6053+
6054+
[TestCommand_UpdateConfigIgnores_WithNoConfig/deep - 2]
6055+
6056+
---
6057+
6058+
[TestCommand_UpdateConfigIgnores_WithNoConfig/deep2 - 1]
6059+
Scanning dir <tempdir>
6060+
Scanned <tempdir>/Gemfile.lock file and found 1 package
6061+
Scanned <tempdir>/composer.lock file and found 0 packages
6062+
Scanned <tempdir>/nested-1/package-lock.json file and found 3 packages
6063+
Scanned <tempdir>/nested-2/package-lock.json file and found 3 packages
6064+
Scanned <tempdir>/package-lock.json file and found 1 package
6065+
Loaded filter from: <tempdir>/osv-scanner-test.toml
6066+
Loaded filter from: <tempdir>/nested-1/osv-scanner-test.toml
6067+
CVE-2021-23424 and 1 alias have been filtered out because: Test manifest file (package-lock.json)
6068+
Filtered 1 vulnerability from output
6069+
Total 7 packages affected by 9 known vulnerabilities (0 Critical, 2 High, 7 Medium, 0 Low, 0 Unknown) from 2 ecosystems.
6070+
9 vulnerabilities can be fixed.
6071+
6072+
6073+
+-------------------------------------+------+-----------+-----------+---------+---------------+--------------------------------------------------------------+
6074+
| OSV URL | CVSS | ECOSYSTEM | PACKAGE | VERSION | FIXED VERSION | SOURCE |
6075+
+-------------------------------------+------+-----------+-----------+---------+---------------+--------------------------------------------------------------+
6076+
| https://osv.dev/GHSA-wx95-c6cv-8532 | 5.3 | RubyGems | nokogiri | 1.18.9 | 1.19.1 | <tempdir>/Gemfile.lock |
6077+
| https://osv.dev/GHSA-2g4f-4pwh-qvx6 | 5.5 | npm | ajv | 6.0.0 | 8.18.0 | <tempdir>/nested-1/package-lock.json |
6078+
| https://osv.dev/GHSA-v88g-cgmw-v5xw | 5.6 | npm | ajv | 6.0.0 | 6.12.3 | <tempdir>/nested-1/package-lock.json |
6079+
| https://osv.dev/GHSA-2g4f-4pwh-qvx6 | 5.5 | npm | ajv | 8.0.0 | 8.18.0 | <tempdir>/nested-1/package-lock.json |
6080+
| https://osv.dev/GHSA-2g4f-4pwh-qvx6 | 5.5 | npm | ajv | 6.0.0 | 8.18.0 | <tempdir>/nested-2/package-lock.json |
6081+
| https://osv.dev/GHSA-v88g-cgmw-v5xw | 5.6 | npm | ajv | 6.0.0 | 6.12.3 | <tempdir>/nested-2/package-lock.json |
6082+
| https://osv.dev/GHSA-2g4f-4pwh-qvx6 | 5.5 | npm | ajv | 8.0.0 | 8.18.0 | <tempdir>/nested-2/package-lock.json |
6083+
| https://osv.dev/GHSA-whgm-jr23-g3j9 | 7.5 | npm | ansi-html | 0.0.1 | 0.0.8 | <tempdir>/nested-2/package-lock.json |
6084+
| https://osv.dev/GHSA-whgm-jr23-g3j9 | 7.5 | npm | ansi-html | 0.0.1 | 0.0.8 | <tempdir>/package-lock.json |
6085+
+-------------------------------------+------+-----------+-----------+---------+---------------+--------------------------------------------------------------+
6086+
6087+
---
6088+
6089+
[TestCommand_UpdateConfigIgnores_WithNoConfig/deep2 - 2]
6090+
6091+
---
6092+
6093+
[TestCommand_UpdateConfigIgnores_WithNoConfig/shallow - 1]
59896094
Scanning dir <tempdir>
59906095
Scanned <tempdir>/Gemfile.lock file and found 1 package
59916096
Scanned <tempdir>/composer.lock file and found 0 packages
@@ -6003,7 +6108,7 @@ Total 2 packages affected by 2 known vulnerabilities (0 Critical, 1 High, 1 Medi
60036108

60046109
---
60056110

6006-
[TestCommand_UpdateConfigIgnores_WithNoConfig - 2]
6111+
[TestCommand_UpdateConfigIgnores_WithNoConfig/shallow - 2]
60076112

60086113
---
60096114

‎cmd/osv-scanner/scan/source/command_test.go‎

Lines changed: 75 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1802,44 +1802,90 @@ func TestCommand_UpdateConfigIgnores(t *testing.T) {
18021802
func TestCommand_UpdateConfigIgnores_WithNoConfig(t *testing.T) {
18031803
t.Parallel()
18041804

1805-
// action overwrites files, copy them to a temporary directory.
1806-
testDir := testutility.CreateTestDir(t)
1807-
var err error
1805+
type withFilesToRemove struct {
1806+
Name string
1807+
Args []string
1808+
Exit int
18081809

1809-
err = os.CopyFS(testDir, os.DirFS("./testdata/locks-with-invalid-and-configs"))
1810-
if err != nil {
1811-
t.Fatal(err)
1810+
Remove []string
18121811
}
18131812

1814-
// the test suite sets "osv-scanner-test.toml" as the default config name,
1815-
// but we might as well remove the "ignore all" config we have in our testdata
1816-
// for tools like scorecard, to be extra sure it can't interfere with our tests
1817-
err = os.Remove(testDir + "/osv-scanner.toml")
1818-
if err != nil {
1819-
t.Fatal(err)
1820-
}
1813+
tests := []withFilesToRemove{
1814+
{
1815+
Name: "shallow",
1816+
Args: []string{
1817+
"", "source", "--experimental-update-config-ignores",
1818+
},
1819+
Exit: 1,
18211820

1822-
// remove the expected config file
1823-
err = os.Remove(testDir + "/osv-scanner-test.toml")
1824-
if err != nil {
1825-
t.Fatal(err)
1821+
Remove: []string{"osv-scanner-test.toml"},
1822+
},
1823+
{
1824+
Name: "deep",
1825+
Args: []string{
1826+
"", "source", "--experimental-update-config-ignores", "-r",
1827+
},
1828+
Exit: 1,
1829+
Remove: []string{"nested-1/osv-scanner-test.toml"},
1830+
},
1831+
{
1832+
Name: "deep2",
1833+
Args: []string{
1834+
"", "source", "--experimental-update-config-ignores", "-r",
1835+
},
1836+
Exit: 1,
1837+
Remove: []string{"nested-2/osv-scanner-test.toml"},
1838+
},
1839+
{
1840+
Name: "all",
1841+
Args: []string{
1842+
"", "source", "--experimental-update-config-ignores", "-r",
1843+
},
1844+
Exit: 1,
1845+
Remove: []string{
1846+
"osv-scanner-test.toml",
1847+
"nested-1/osv-scanner-test.toml",
1848+
"nested-2/osv-scanner-test.toml",
1849+
},
1850+
},
18261851
}
1852+
for _, tt := range tests {
1853+
t.Run(tt.Name, func(t *testing.T) {
1854+
t.Parallel()
18271855

1828-
// the "update config ignores" flag should not create a config file
1829-
testcmd.RunAndMatchSnapshots(t, testcmd.Case{
1830-
Args: []string{"", "source", "--experimental-update-config-ignores", testDir},
1831-
Exit: 1,
1832-
})
1856+
// action overwrites files, copy them to a temporary directory.
1857+
testDir := testutility.CreateTestDir(t)
1858+
1859+
err := os.CopyFS(testDir, os.DirFS("./testdata/locks-with-invalid-and-configs"))
1860+
if err != nil {
1861+
t.Fatal(err)
1862+
}
18331863

1834-
_, err = os.Stat(testDir + "/osv-scanner.toml")
1864+
// remove our config files
1865+
for _, file := range tt.Remove {
1866+
err = os.Remove(testDir + "/" + file)
1867+
if err != nil {
1868+
t.Fatal(err)
1869+
}
1870+
}
18351871

1836-
if !errors.Is(err, os.ErrNotExist) {
1837-
t.Errorf("expected osv-scanner.toml not to be created")
1838-
}
1872+
tt.Args = append(tt.Args, testDir)
18391873

1840-
_, err = os.Stat(testDir + "/osv-scanner-test.toml")
1874+
// the "update config ignores" flag should not create a config file
1875+
testcmd.RunAndMatchSnapshots(t, testcmd.Case{
1876+
Name: tt.Name,
1877+
Args: tt.Args,
1878+
Exit: 1,
1879+
})
18411880

1842-
if !errors.Is(err, os.ErrNotExist) {
1843-
t.Errorf("expected osv-scanner-test.toml not to be created")
1881+
for _, file := range tt.Remove {
1882+
p := testDir + "/" + file
1883+
_, err = os.Stat(p)
1884+
1885+
if !errors.Is(err, os.ErrNotExist) {
1886+
t.Errorf("expected %s not to exist", p)
1887+
}
1888+
}
1889+
})
18441890
}
18451891
}

0 commit comments

Comments
 (0)