mirror of
https://github.com/0xMarcio/cve.git
synced 2026-10-27 16:51:03 +00:00
676 lines
31 KiB
Python
676 lines
31 KiB
Python
from __future__ import annotations
|
|
|
|
import sys
|
|
import tempfile
|
|
import unittest
|
|
from pathlib import Path
|
|
from unittest.mock import patch
|
|
|
|
sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "scripts"))
|
|
|
|
import update_cves
|
|
import build_site
|
|
import sync_cve_metadata
|
|
|
|
|
|
class RepositoryClassificationTests(unittest.TestCase):
|
|
def repo(self, name: str, description: str = "", readme: str = "") -> dict:
|
|
return {
|
|
"nameWithOwner": name,
|
|
"url": f"https://github.com/{name}",
|
|
"description": description,
|
|
"isFork": False,
|
|
"isArchived": False,
|
|
"repositoryTopics": {"nodes": []},
|
|
"readmeMd": {"text": readme},
|
|
}
|
|
|
|
def test_accepts_cve_named_repository(self) -> None:
|
|
repo = self.repo(
|
|
"AcmeSecurity/CVE-2026-31431-PoC",
|
|
"Proof of concept for Linux privilege escalation",
|
|
"CVE-2026-31431 proof of concept.",
|
|
)
|
|
self.assertEqual(
|
|
update_cves.qualifying_repo_cves(repo, 2026, []),
|
|
{"CVE-2026-31431"},
|
|
)
|
|
|
|
def test_rejects_generic_readme_reference(self) -> None:
|
|
repo = self.repo(
|
|
"AcmeSecurity/kernel-notes",
|
|
"Linux security notes",
|
|
"A linked exploit mentions CVE-2026-31431 as a proof of concept.",
|
|
)
|
|
repo["root"] = {"entries": [{"name": "index.js"}]}
|
|
self.assertEqual(update_cves.qualifying_repo_cves(repo, 2026, []), set())
|
|
|
|
def test_accepts_readme_poc_with_repository_intent_and_artifact(self) -> None:
|
|
repo = self.repo(
|
|
"AcmeSecurity/kernel-exploits",
|
|
"Linux exploit research",
|
|
"Proof of concept for CVE-2026-31431 with reproduction steps.",
|
|
)
|
|
repo["root"] = {"entries": [{"name": "poc.py", "type": "blob"}]}
|
|
self.assertEqual(
|
|
update_cves.qualifying_repo_cves(repo, 2026, []),
|
|
{"CVE-2026-31431"},
|
|
)
|
|
|
|
def test_rejects_related_repository_links(self) -> None:
|
|
repo = self.repo(
|
|
"AcmeSecurity/CVE-2026-31431-PoC",
|
|
"Proof of concept for CVE-2026-31431",
|
|
"Related exploit: CVE-2026-41940 PoC https://github.com/AcmeSecurity/other",
|
|
)
|
|
self.assertEqual(
|
|
update_cves.qualifying_repo_cves(repo, 2026, []),
|
|
{"CVE-2026-31431"},
|
|
)
|
|
|
|
def test_accepts_multiple_pocs_implemented_in_one_repository(self) -> None:
|
|
repo = self.repo(
|
|
"AcmeSecurity/CVE-2026-31431-PoC",
|
|
"Proof of concept for CVE-2026-31431",
|
|
"This repository also includes a proof of concept for CVE-2026-41940.",
|
|
)
|
|
repo["root"] = {"entries": [{"name": "CVE-2026-41940.py"}]}
|
|
self.assertEqual(
|
|
update_cves.qualifying_repo_cves(repo, 2026, []),
|
|
{"CVE-2026-31431", "CVE-2026-41940"},
|
|
)
|
|
|
|
def test_rejects_readme_reference_when_repository_names_another_cve(self) -> None:
|
|
repo = self.repo(
|
|
"AcmeSecurity/CVE-2026-20841-PoC",
|
|
"Proof of concept for CVE-2026-20841",
|
|
"The approach resembles the CVE-2016-0856 exploit.",
|
|
)
|
|
repo["repositoryTopics"] = {
|
|
"nodes": [
|
|
{"topic": {"name": "cve-2016-0856"}},
|
|
{"topic": {"name": "cve-2026-20841"}},
|
|
]
|
|
}
|
|
repo["root"] = {"entries": [{"name": "PoC.md"}]}
|
|
self.assertEqual(update_cves.qualifying_repo_cves(repo, 2016, []), set())
|
|
self.assertEqual(
|
|
update_cves.qualifying_repo_cves(repo, 2026, []),
|
|
{"CVE-2026-20841"},
|
|
)
|
|
|
|
def test_rejects_profile_and_checker_repositories(self) -> None:
|
|
profile = self.repo(
|
|
"AcmeSecurity/AcmeSecurity",
|
|
"Security engineer profile",
|
|
"Proof of concept for CVE-2026-31431.",
|
|
)
|
|
checker = self.repo(
|
|
"AcmeSecurity/CVE-2026-31431-checker",
|
|
"Safe vulnerability checker",
|
|
"Checks whether CVE-2026-31431 is present.",
|
|
)
|
|
self.assertEqual(update_cves.qualifying_repo_cves(profile, 2026, []), set())
|
|
self.assertEqual(update_cves.qualifying_repo_cves(checker, 2026, []), set())
|
|
|
|
def test_rejects_large_cve_collection(self) -> None:
|
|
entries = "\n".join(
|
|
f"Proof of concept for CVE-2026-{number:04d}"
|
|
for number in range(1000, 1027)
|
|
)
|
|
repo = self.repo("AcmeSecurity/exploit-collection", "Exploit collection", entries)
|
|
self.assertEqual(update_cves.qualifying_repo_cves(repo, 2026, []), set())
|
|
|
|
def test_rejects_cve_corpora_and_datasets(self) -> None:
|
|
corpus = self.repo(
|
|
"AcmeSecurity/vulnerability-corpus",
|
|
"Machine-readable PoC corpus",
|
|
"CVE-2026-31431 proof-of-concept metadata.",
|
|
)
|
|
dataset = self.repo(
|
|
"AcmeSecurity/exploit-dataset",
|
|
"CVE exploit dataset",
|
|
"CVE-2026-31431 proof-of-concept metadata.",
|
|
)
|
|
self.assertEqual(update_cves.qualifying_repo_cves(corpus, 2026, []), set())
|
|
self.assertEqual(update_cves.qualifying_repo_cves(dataset, 2026, []), set())
|
|
|
|
def test_rejects_poc_indexes_and_defensive_tools(self) -> None:
|
|
index = self.repo(
|
|
"AcmeSecurity/searchpoc",
|
|
"Search for proof-of-concept links by CVE ID",
|
|
"CVE-2026-31431 PoC: https://github.com/example/repository",
|
|
)
|
|
shield = self.repo(
|
|
"AcmeSecurity/http-shield",
|
|
"Blocks exploitation attempts",
|
|
"Protects against CVE-2026-31431 exploit traffic.",
|
|
)
|
|
self.assertEqual(update_cves.qualifying_repo_cves(index, 2026, []), set())
|
|
self.assertEqual(update_cves.qualifying_repo_cves(shield, 2026, []), set())
|
|
|
|
def test_keeps_specific_cve_poc_scanner(self) -> None:
|
|
repo = self.repo(
|
|
"AcmeSecurity/CVE-2026-31431-PoC-Scanner",
|
|
"Proof-of-concept scanner for CVE-2026-31431",
|
|
)
|
|
repo["root"] = {"entries": [{"name": "scan.py"}]}
|
|
self.assertEqual(
|
|
update_cves.qualifying_repo_cves(repo, 2026, []),
|
|
{"CVE-2026-31431"},
|
|
)
|
|
|
|
def test_blacklist_matches_exact_owner_and_repository(self) -> None:
|
|
blacklist = ["mirror-org/poc-corpus"]
|
|
self.assertTrue(update_cves.is_blacklisted_repo("mirror-org/poc-corpus", blacklist))
|
|
self.assertFalse(update_cves.is_blacklisted_repo("source-org/poc-corpus", blacklist))
|
|
|
|
def test_analysis_and_lab_repositories_can_carry_specific_pocs(self) -> None:
|
|
for name, description in [("researcher/widget-poc", "Exploit research and analysis"),
|
|
("researcher/widget-lab", "Vulnerable lab")]:
|
|
candidate = self.repo(name, description + " for CVE-2026-31431",
|
|
"PoCs for CVE-2026-31431. Run poc.py to reproduce the issue.")
|
|
candidate["root"] = {"entries": [{"name": "poc.py", "type": "blob"}]}
|
|
self.assertEqual(update_cves.qualifying_repo_cves(candidate, 2026, []), {"CVE-2026-31431"})
|
|
candidate["root"] = {"entries": [{"name": "README.md", "type": "blob"}]}
|
|
self.assertEqual(update_cves.qualifying_repo_cves(candidate, 2026, []), set())
|
|
|
|
def test_defensive_verbs_do_not_claim_exploit_intent(self) -> None:
|
|
for verb in ("Blocks", "Detects", "Mitigates", "Protects", "Prevents"):
|
|
candidate = self.repo("researcher/widget-guard", f"{verb} exploitation of CVE-2026-31431",
|
|
"CVE-2026-31431 exploit traffic is blocked.")
|
|
candidate["root"] = {"entries": [{"name": "guard.py", "type": "blob"}]}
|
|
self.assertEqual(update_cves.qualifying_repo_cves(candidate, 2026, []), set())
|
|
|
|
def test_analysis_exception_does_not_approve_unrelated_readme_cves(self) -> None:
|
|
candidate = self.repo("researcher/widget-analysis", "Exploit analysis",
|
|
"PoC for CVE-2026-1111, run CVE-2026-1111.py.\n\nNotes on the CVE-2026-2222 exploit chain.")
|
|
candidate["root"] = {"entries": [{"name": "CVE-2026-1111.py", "type": "blob"}]}
|
|
self.assertEqual(update_cves.qualifying_repo_cves(candidate, 2026, []), {"CVE-2026-1111"})
|
|
|
|
def test_search_queries_are_not_a_poc(self) -> None:
|
|
candidate = self.repo("researcher/CVE-2026-109618-Dorks", "Search queries for PHP hosts",
|
|
"CVE-2026-109618 exploitation research.\n```\nshodan search product:PHP\n```")
|
|
candidate["root"] = {"entries": [{"name": "README.md", "type": "blob"}]}
|
|
self.assertEqual(update_cves.qualifying_repo_cves(candidate, 2026, []), set())
|
|
|
|
def test_readme_example_cve_does_not_make_a_general_tool_a_poc(self) -> None:
|
|
candidate = self.repo("researcher/tool", "Search and download public exploits",
|
|
"Find exploits for CVE-2024-1234 using the tool.")
|
|
candidate["root"] = {"entries": [{"name": "src", "type": "tree"}, {"name": "setup.py", "type": "blob"}]}
|
|
self.assertEqual(update_cves.qualifying_repo_cves(candidate, 2024, []), set())
|
|
|
|
def test_readme_only_reproducer_is_kept_without_a_cve_in_metadata(self) -> None:
|
|
candidate = self.repo("researcher/widget-repro", "Widget research",
|
|
"PoC for CVE-2026-1234:\n```http\nPOST /vulnerable HTTP/1.1\nHost: localhost\n\npayload\n```")
|
|
candidate["root"] = {"entries": [{"name": "README.md", "type": "blob"}]}
|
|
self.assertEqual(update_cves.qualifying_repo_cves(candidate, 2026, []), {"CVE-2026-1234"})
|
|
candidate["readmeMd"]["text"] = "PoC for CVE-2026-1234:\n```sh\npython absent_exploit.py localhost\n```"
|
|
self.assertEqual(update_cves.qualifying_repo_cves(candidate, 2026, []), set())
|
|
|
|
def test_multi_year_collection_is_not_reclassified_as_one_cve_per_year(self) -> None:
|
|
candidate = self.repo("researcher/POC", "Proof of concept exploits",
|
|
"PoCs: " + " ".join(f"CVE-{year}-1234" for year in range(2020, 2027)))
|
|
candidate["root"] = {"entries": [{"name": "pocs", "type": "tree"}]}
|
|
self.assertEqual(update_cves.qualifying_repo_cves(candidate, 2026, []), set())
|
|
candidate["root"]["entries"].append({"name": "CVE-2026-1234.py", "type": "blob"})
|
|
self.assertEqual(update_cves.qualifying_repo_cves(candidate, 2026, []), {"CVE-2026-1234"})
|
|
|
|
|
|
class ReferenceAndMarkdownTests(unittest.TestCase):
|
|
def record(self) -> dict:
|
|
return {
|
|
"cveMetadata": {"cveId": "CVE-2026-31431", "state": "PUBLISHED"},
|
|
"containers": {
|
|
"cna": {
|
|
"descriptions": [{"lang": "en", "value": "Linux kernel vulnerability."}],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"versions": [{"version": "4.14", "status": "affected"}],
|
|
}
|
|
],
|
|
"problemTypes": [],
|
|
"references": [
|
|
{"url": "https://research.example/copy-fail", "tags": ["exploit"]},
|
|
{"url": "https://vendor.example/advisory", "tags": ["vendor-advisory"]},
|
|
],
|
|
},
|
|
"adp": [
|
|
{
|
|
"references": [
|
|
{
|
|
"url": "https://database.example/CVE-2026-31431-exploit",
|
|
"tags": ["exploit"],
|
|
}
|
|
]
|
|
}
|
|
],
|
|
},
|
|
}
|
|
|
|
def test_uses_cna_and_adp_poc_references(self) -> None:
|
|
self.assertEqual(
|
|
update_cves.poc_references(self.record()),
|
|
[
|
|
"https://research.example/copy-fail",
|
|
"https://database.example/CVE-2026-31431-exploit",
|
|
],
|
|
)
|
|
|
|
def test_excludes_blacklisted_github_references(self) -> None:
|
|
record = self.record()
|
|
record["containers"]["cna"]["references"].append(
|
|
{"url": "https://github.com/AcmeSecurity/poc-index", "tags": ["exploit"]}
|
|
)
|
|
self.assertEqual(
|
|
update_cves.poc_references(record, {"acmesecurity/poc-index"}),
|
|
[
|
|
"https://research.example/copy-fail",
|
|
"https://database.example/CVE-2026-31431-exploit",
|
|
],
|
|
)
|
|
|
|
def test_excludes_explicitly_unaffected_products_and_vendors(self) -> None:
|
|
for versions in ([], [{
|
|
"version": "All",
|
|
"status": "unaffected",
|
|
"changes": [{"at": "2", "status": "unaffected"}],
|
|
}]):
|
|
with self.subTest(versions=versions):
|
|
record = self.record()
|
|
record["containers"]["cna"]["affected"].append({
|
|
"vendor": "Unaffected vendor",
|
|
"product": "Unaffected product",
|
|
"defaultStatus": "unaffected",
|
|
"versions": versions,
|
|
})
|
|
details = update_cves.details_from_record(record)
|
|
self.assertEqual(details.products, ["Linux"])
|
|
self.assertEqual(details.vendors, [])
|
|
self.assertEqual(details.versions, ["4.14"])
|
|
|
|
def test_keeps_products_with_affected_or_incomplete_statuses(self) -> None:
|
|
cases = [
|
|
{"defaultStatus": "affected", "versions": [{"status": "unaffected"}]},
|
|
{"defaultStatus": "unaffected", "versions": [{"status": "affected"}]},
|
|
{"defaultStatus": "unaffected", "versions": [{
|
|
"status": "unaffected", "changes": [{"at": "2", "status": "affected"}],
|
|
}]},
|
|
{"defaultStatus": "unknown", "versions": [{"status": "unaffected"}]},
|
|
{"versions": [{"status": "unaffected"}]},
|
|
{"defaultStatus": "unaffected", "versions": [{"status": "unknown"}]},
|
|
{"defaultStatus": "unaffected", "versions": [{"version": "1"}]},
|
|
{"defaultStatus": "unaffected", "versions": [{
|
|
"status": "unaffected", "changes": [{"at": "2", "status": "unknown"}],
|
|
}]},
|
|
{"defaultStatus": "unaffected", "versions": [{
|
|
"status": "unaffected", "changes": [{"at": "2"}],
|
|
}]},
|
|
{},
|
|
]
|
|
for statuses in cases:
|
|
with self.subTest(statuses=statuses):
|
|
record = self.record()
|
|
record["containers"]["cna"]["affected"] = [{
|
|
"vendor": "Example vendor", "product": "Example product", **statuses,
|
|
}]
|
|
details = update_cves.details_from_record(record)
|
|
self.assertEqual(details.products, ["Example product"])
|
|
self.assertEqual(details.vendors, ["Example vendor"])
|
|
|
|
def test_preserves_markdown_layout(self) -> None:
|
|
details = update_cves.details_from_record(self.record())
|
|
self.assertIsNotNone(details)
|
|
details.description = "Linux kernel vulnerability. \r\n\tAdditional context.\t"
|
|
markdown = update_cves.build_markdown(
|
|
"CVE-2026-31431",
|
|
details,
|
|
["https://github.com/AcmeSecurity/CVE-2026-31431-PoC"],
|
|
["https://research.example/copy-fail"],
|
|
)
|
|
self.assertIn(
|
|
"### [CVE-2026-31431](https://www.cve.org/CVERecord?id=CVE-2026-31431)",
|
|
markdown,
|
|
)
|
|
self.assertIn(
|
|
"### Description\n\nLinux kernel vulnerability.\n Additional context.",
|
|
markdown,
|
|
)
|
|
self.assertIn("#### Reference\n- https://research.example/copy-fail", markdown)
|
|
self.assertIn(
|
|
"#### Github\n- https://github.com/AcmeSecurity/CVE-2026-31431-PoC",
|
|
markdown,
|
|
)
|
|
self.assertTrue(markdown.endswith("\n"))
|
|
self.assertFalse(markdown.endswith("\n\n"))
|
|
|
|
def test_existing_markdown_changes_only_poc_sections(self) -> None:
|
|
original = """### [CVE-2026-31431](https://cve.mitre.org/)
|
|
|
|
|
|
### Description
|
|
|
|
Keep this description unchanged.
|
|
|
|
### POC
|
|
|
|
#### Reference
|
|
No PoCs from references.
|
|
|
|
#### Github
|
|
No PoCs found on GitHub currently.
|
|
|
|
"""
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
path = Path(directory) / "CVE-2026-31431.md"
|
|
path.write_text(original, encoding="utf-8")
|
|
changed = update_cves.update_existing_markdown(
|
|
path,
|
|
["https://github.com/AcmeSecurity/CVE-2026-31431-PoC"],
|
|
["https://research.example/copy-fail"],
|
|
dry_run=False,
|
|
)
|
|
updated = path.read_text(encoding="utf-8")
|
|
self.assertTrue(changed)
|
|
self.assertIn("", updated)
|
|
self.assertIn("Keep this description unchanged.", updated)
|
|
self.assertIn("#### Reference\n- https://research.example/copy-fail\n\n#### Github", updated)
|
|
self.assertTrue(updated.endswith("\n\n"))
|
|
|
|
|
|
class DiscoveryFailureTests(unittest.TestCase):
|
|
@staticmethod
|
|
def rest_repo(number: int) -> dict:
|
|
return {"full_name": f"owner/poc-{number}", "html_url": f"https://github.com/owner/poc-{number}",
|
|
"private": False, "fork": False, "topics": ["poc"]}
|
|
|
|
def test_server_failure_restarts_query_without_translating_graphql_cursor(self) -> None:
|
|
first = {"data": {"search": {"repositoryCount": 3, "nodes": [{"nameWithOwner": "owner/poc-0"}],
|
|
"pageInfo": {"hasNextPage": True, "endCursor": "graphql-cursor"}}, "rateLimit": {"remaining": 100}}}
|
|
failure = update_cves.error.HTTPError("url", 502, "bad gateway", {}, None)
|
|
rest = {"total_count": 3, "incomplete_results": False, "items": [self.rest_repo(n) for n in range(3)]}
|
|
client = update_cves.GitHubClient("test")
|
|
with patch.object(update_cves, "http_json", side_effect=[first, failure, rest]) as fetch, \
|
|
patch.object(update_cves.time, "sleep"):
|
|
rows = list(update_cves.search_without_range(client, "CVE-2026"))
|
|
self.assertEqual({row["nameWithOwner"] for row in rows}, {f"owner/poc-{n}" for n in range(3)})
|
|
self.assertIn("page=1", fetch.call_args.args[0])
|
|
self.assertNotIn("graphql-cursor", fetch.call_args.args[0])
|
|
self.assertEqual(rows[-1]["repositoryTopics"]["nodes"], [{"topic": {"name": "poc"}}])
|
|
self.assertNotIn("defaultBranchRef", rows[-1])
|
|
|
|
def test_rest_fallback_reads_every_page(self) -> None:
|
|
failure = update_cves.error.HTTPError("url", 503, "unavailable", {}, None)
|
|
pages = [{"total_count": 101, "incomplete_results": False,
|
|
"items": [self.rest_repo(n) for n in range(start, end)]} for start, end in ((0, 100), (100, 101))]
|
|
with patch.object(update_cves, "http_json", side_effect=[failure, *pages]) as fetch, \
|
|
patch.object(update_cves.time, "sleep"):
|
|
rows = list(update_cves.search_without_range(update_cves.GitHubClient("test"), "CVE-2026"))
|
|
self.assertEqual(len(rows), 101)
|
|
self.assertEqual(rows[-1]["nameWithOwner"], "owner/poc-100")
|
|
self.assertIn("page=2", fetch.call_args.args[0])
|
|
|
|
def test_rest_fallback_never_accepts_incomplete_or_short_results(self) -> None:
|
|
for payload in [
|
|
{"total_count": 1, "incomplete_results": True, "items": [self.rest_repo(0)]},
|
|
{"total_count": 2, "incomplete_results": False, "items": [self.rest_repo(0)]},
|
|
]:
|
|
failure = update_cves.error.HTTPError("url", 502, "bad gateway", {}, None)
|
|
with self.subTest(payload=payload), patch.object(update_cves, "http_json", side_effect=[failure, payload]), \
|
|
patch.object(update_cves.time, "sleep"):
|
|
with self.assertRaisesRegex(RuntimeError, "incomplete response"):
|
|
update_cves.GitHubClient("test").search_page("CVE-2026")
|
|
|
|
def test_authentication_failure_does_not_trigger_rest_fallback(self) -> None:
|
|
failure = update_cves.error.HTTPError("url", 403, "forbidden", {}, None)
|
|
with patch.object(update_cves, "http_json", side_effect=failure) as fetch:
|
|
with self.assertRaises(update_cves.error.HTTPError):
|
|
update_cves.GitHubClient("test").search_page("CVE-2026")
|
|
self.assertEqual(fetch.call_count, 1)
|
|
|
|
def test_search_does_not_accept_partial_graphql_results(self) -> None:
|
|
payload = {
|
|
"data": {"search": {"repositoryCount": 1, "nodes": []}, "rateLimit": {"remaining": 100}},
|
|
"errors": [{"type": "INTERNAL", "message": "Search unavailable"}],
|
|
}
|
|
with patch.object(update_cves, "http_json", return_value=payload):
|
|
with self.assertRaisesRegex(RuntimeError, "Search unavailable"):
|
|
update_cves.GitHubClient("test").search_page("CVE-2026")
|
|
|
|
def test_readme_batch_failure_aborts_discovery(self) -> None:
|
|
repo = {
|
|
"nameWithOwner": "owner/CVE-2026-1234-poc",
|
|
"url": "https://github.com/owner/CVE-2026-1234-poc",
|
|
}
|
|
with patch.object(update_cves.source_artifacts, "pending_reviewed_names", return_value=[]), \
|
|
patch.object(update_cves, "search_range", return_value=[repo]), patch.object(
|
|
update_cves.GitHubClient, "fetch_readmes", side_effect=RuntimeError("API unavailable")
|
|
):
|
|
with self.assertRaisesRegex(RuntimeError, "API unavailable"):
|
|
update_cves.discover_github_pocs(
|
|
"test", years=[2026], lookback_days=3, backfill=False, cve_filter=set()
|
|
)
|
|
|
|
def test_qualified_repository_survives_an_unverified_reference(self) -> None:
|
|
cve = "CVE-2026-1234"
|
|
url = "https://github.com/owner/CVE-2026-1234-poc"
|
|
details = update_cves.CVEDetails("A vulnerability.", [], [], [])
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
path = root / "2026" / f"{cve}.md"
|
|
path.parent.mkdir()
|
|
path.write_text(update_cves.build_markdown(cve, details, [], [url]), encoding="utf-8")
|
|
update_cves.update_existing_markdown(path, [url], [], dry_run=False)
|
|
with patch.object(build_site, "CVES", root), patch.object(
|
|
build_site, "load_metadata", return_value={}
|
|
), patch.object(build_site, "load_dates", return_value={}), patch.object(
|
|
build_site, "load_verified_references", return_value=set()
|
|
):
|
|
entries, _ = build_site.build_cve_list(set())
|
|
self.assertEqual([(entry["cve"], entry["poc"]) for entry in entries], [(cve, [url])])
|
|
|
|
|
|
class MetadataSourceTests(unittest.TestCase):
|
|
def test_uses_vector_prefix_when_source_field_is_mislabeled(self) -> None:
|
|
row = sync_cve_metadata.published_metric(
|
|
{
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
|
|
"baseScore": 4.1,
|
|
"baseSeverity": "MEDIUM",
|
|
},
|
|
"3.1",
|
|
"CISA-ADP",
|
|
"CISA Vulnrichment",
|
|
)
|
|
self.assertIsNotNone(row)
|
|
self.assertEqual(row[:3], ["3.0", 4.1, "MEDIUM"])
|
|
|
|
def test_keeps_every_published_cvss_generation(self) -> None:
|
|
record = {
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {"shortName": "Acme CNA"},
|
|
"metrics": [
|
|
{
|
|
"cvssV4_0": {
|
|
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
|
|
"baseScore": 6.8,
|
|
"baseSeverity": "MEDIUM",
|
|
}
|
|
},
|
|
{
|
|
"cvssV3_1": {
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
|
"baseScore": 5.5,
|
|
"baseSeverity": "MEDIUM",
|
|
}
|
|
},
|
|
{
|
|
"cvssV2_0": {
|
|
"vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:C",
|
|
"baseScore": 4.6,
|
|
"baseSeverity": "MEDIUM",
|
|
}
|
|
},
|
|
],
|
|
}
|
|
}
|
|
}
|
|
rows = sync_cve_metadata.cve_program_metrics(record)
|
|
self.assertEqual([row[0] for row in rows], ["4.0", "3.1", "2.0"])
|
|
|
|
def test_positive_assessment_outranks_conflicting_zero(self) -> None:
|
|
rows = sync_cve_metadata.merge_metrics(
|
|
[[
|
|
"4.0",
|
|
0.0,
|
|
"NONE",
|
|
"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
|
|
"Wikimedia Foundation",
|
|
"CVE Program CNA",
|
|
]],
|
|
[[
|
|
"3.1",
|
|
6.1,
|
|
"MEDIUM",
|
|
"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
|
"[email protected]",
|
|
"Primary",
|
|
]],
|
|
)
|
|
self.assertEqual(rows[0][1:3], [6.1, "MEDIUM"])
|
|
|
|
def test_github_advisory_requires_reproducible_poc_material(self) -> None:
|
|
advisory = """### POC
|
|
|
|
1. Create `poc.py` with this application:
|
|
```python
|
|
from pathlib import Path
|
|
from nicegui import app, ui
|
|
app.add_media_files('/media', Path('media'))
|
|
ui.run(port=8080)
|
|
```
|
|
2. Run `python3 poc.py`.
|
|
3. Send `curl http://localhost:8080/media/%2e%2e/etc/hosts`.
|
|
"""
|
|
mention = "The reporter says a PoC exists, but no reproduction material was published."
|
|
self.assertTrue(sync_cve_metadata.advisory_has_poc(advisory))
|
|
self.assertFalse(sync_cve_metadata.advisory_has_poc(mention))
|
|
|
|
|
|
class PublishedLinkDeduplicationTests(unittest.TestCase):
|
|
def test_repository_advisory_survives_its_collection_source(self) -> None:
|
|
cve = "CVE-2021-22555"
|
|
base = "https://github.com/google/security-research"
|
|
advisory = base + "/security/advisories/GHSA-xxx5-8mvq-3528"
|
|
collection = base + "/tree/master/pocs/linux/cve-2021-22555"
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
path = root / "2021" / f"{cve}.md"
|
|
path.parent.mkdir()
|
|
path.write_text(f"### Description\nA vulnerability.\n\n#### Reference\n- {advisory}\n"
|
|
f"\n#### Collections\n- {collection}\n")
|
|
with patch.object(build_site, "CVES", root), patch.object(build_site, "load_metadata", return_value={}), \
|
|
patch.object(build_site, "load_dates", return_value={}), \
|
|
patch.object(build_site, "load_verified_references", return_value={(cve, build_site.link_key(advisory))}):
|
|
entries, _ = build_site.build_cve_list(set())
|
|
self.assertEqual(entries[0]["poc"], [advisory])
|
|
self.assertEqual(entries[0]["collections"], [collection])
|
|
self.assertEqual(build_site.repo_from_url(advisory), "")
|
|
self.assertEqual(build_site.repo_from_url(advisory.upper()), "")
|
|
self.assertEqual(build_site.repo_from_url(collection), "google/security-research")
|
|
|
|
def test_curated_artifact_variants_survive_publication(self) -> None:
|
|
cve = "CVE-2024-26642"
|
|
base = "https://github.com/google/security-research"
|
|
variants = [f"{base}/tree/master/pocs/linux/kernelctf/{cve}_{kind}" for kind in ("lts", "mitigation")]
|
|
template = "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/Test.yaml?version=One#Request"
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
path = root / "2024" / f"{cve}.md"
|
|
path.parent.mkdir()
|
|
path.write_text(
|
|
"### Description\nA vulnerability.\n\n#### Github\n- " + base
|
|
+ "\n\n#### Collections\n" + "\n".join(f"- {url}" for url in [*variants, variants[0].replace("google/security-research", "GOOGLE/Security-Research")])
|
|
+ "\n\n#### Nuclei\n" + "\n".join(f"- {url}" for url in [template, template.replace("Test.yaml", "test.yaml")]) + "\n",
|
|
encoding="utf-8",
|
|
)
|
|
with patch.object(build_site, "CVES", root), patch.object(build_site, "load_metadata", return_value={}), \
|
|
patch.object(build_site, "load_dates", return_value={}), \
|
|
patch.object(build_site, "load_verified_references", return_value=set()):
|
|
entries, _ = build_site.build_cve_list(set())
|
|
self.assertEqual(entries[0]["collections"], variants)
|
|
self.assertEqual(entries[0]["nuclei"], [template, template.replace("Test.yaml", "test.yaml")])
|
|
self.assertEqual(entries[0]["poc"], [])
|
|
|
|
def test_published_links_require_absolute_http_urls(self) -> None:
|
|
valid = [
|
|
"https://Example.com/PoC.py?Version=One#Example",
|
|
"http://example.com/poc",
|
|
"HTTPS://example.com/CaseSensitive",
|
|
]
|
|
invalid = [
|
|
"javascript:alert(1)",
|
|
"data:text/html,test",
|
|
"//example.com/poc",
|
|
"/relative/poc",
|
|
"https:///missing-host",
|
|
"https://[invalid/poc",
|
|
"ordinary description text",
|
|
]
|
|
block = "\n".join(f"- {url}" for url in [*invalid, *valid])
|
|
self.assertEqual(build_site.collect_links(block), valid)
|
|
|
|
def test_unverified_reference_is_not_a_poc(self) -> None:
|
|
cve_id = "CVE-2024-41968"
|
|
url = "https://cert.vde.com/en/advisories/VDE-2024-047"
|
|
self.assertFalse(build_site.reference_is_verified_poc(cve_id, url, {}, set()))
|
|
|
|
def test_exact_exploit_tag_makes_reference_a_poc(self) -> None:
|
|
cve_id = "CVE-2025-66645"
|
|
url = "https://github.com/advisories/GHSA-hxp3-63hc-5366"
|
|
metadata = {
|
|
cve_id: {
|
|
"advisories": [[url, ["GitHub Advisory", "Exploit"]]],
|
|
}
|
|
}
|
|
self.assertTrue(build_site.reference_is_verified_poc(cve_id, url, metadata, set()))
|
|
|
|
def test_one_repository_is_one_poc_and_keeps_the_useful_path(self) -> None:
|
|
links = [
|
|
"https://github.com/Helson-S/FuzzyTesting/blob/main/hicolor/cp_dynamic",
|
|
"https://github.com/Helson-S/FuzzyTesting/blob/main/hicolor/cp_dynamic/poc/sample.png",
|
|
"https://github.com/Helson-S/FuzzyTesting/blob/main/hicolor/cp_dynamic/vulDescription.md",
|
|
"https://github.com/AcmeSecurity/CVE-2024-41443",
|
|
]
|
|
self.assertEqual(
|
|
build_site.dedupe_source_links(links, "CVE-2024-41443"),
|
|
[
|
|
"https://github.com/Helson-S/FuzzyTesting/blob/main/hicolor/cp_dynamic/vulDescription.md",
|
|
"https://github.com/AcmeSecurity/CVE-2024-41443",
|
|
],
|
|
)
|
|
|
|
def test_advisory_deduplication_prefers_exploit_evidence(self) -> None:
|
|
rows = [
|
|
["https://github.com/Helson-S/FuzzyTesting", ["Product"]],
|
|
[
|
|
"https://github.com/Helson-S/FuzzyTesting/blob/main/vulDescription.md",
|
|
["Third Party Advisory", "Exploit"],
|
|
],
|
|
]
|
|
self.assertEqual(build_site.dedupe_advisories(rows, "CVE-2024-41443"), [rows[1]])
|
|
|
|
def test_distinct_global_github_advisories_are_not_merged(self) -> None:
|
|
rows = [
|
|
["https://github.com/advisories/GHSA-hxp3-63hc-5366", ["GitHub Advisory"]],
|
|
["https://github.com/advisories/GHSA-5hgx-prqh-5qmp", ["GitHub Advisory"]],
|
|
]
|
|
self.assertEqual(build_site.dedupe_advisories(rows, "CVE-2025-66645"), rows)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|