feat(library): support a custom data source (#613)

* chore(mod): update trivy-db * refactor(detector/library): use programming language instead of package manager * feat(library): add general advisory * test(utils): add a util function initializing DB * test(advisory): add tests * chore: use aquasecurity/bolt-fixtures * refactor: add comments * chore(mod): revert fanal version * chore(mod): update trivy-db * refactor: update the comment
2025-12-23 07:29:00 -08:00 · 2020-08-30 10:11:32 +03:00
parent ed8607b710
commit f50b0ce8af
10 changed files with 495 additions and 58 deletions
--- a/pkg/detector/library/driver_test.go
+++ b/pkg/detector/library/driver_test.go
@@ -0,0 +1,135 @@
+package library_test
+
+import (
+	"os"
+	"testing"
+
+	"github.com/Masterminds/semver/v3"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/aquasecurity/trivy-db/pkg/db"
+	"github.com/aquasecurity/trivy/pkg/detector/library"
+	"github.com/aquasecurity/trivy/pkg/types"
+	"github.com/aquasecurity/trivy/pkg/utils"
+)
+
+func TestDriver_Detect(t *testing.T) {
+	type fields struct {
+		fileName string
+	}
+	type args struct {
+		pkgName string
+		pkgVer  *semver.Version
+	}
+	tests := []struct {
+		name     string
+		fixtures []string
+		fields   fields
+		args     args
+		want     []types.DetectedVulnerability
+		wantErr  string
+	}{
+		{
+			name:     "happy path",
+			fixtures: []string{"testdata/fixtures/php.yaml"},
+			fields:   fields{fileName: "composer.lock"},
+			args: args{
+				pkgName: "symfony/symfony",
+				pkgVer:  semver.MustParse("4.2.6"),
+			},
+			want: []types.DetectedVulnerability{
+				{
+					VulnerabilityID:  "CVE-2019-10909",
+					PkgName:          "symfony/symfony",
+					InstalledVersion: "4.2.6",
+					FixedVersion:     "4.2.7",
+				},
+			},
+		},
+		{
+			name:     "non-prefix buckets",
+			fixtures: []string{"testdata/fixtures/php-without-prefix.yaml"},
+			fields:   fields{fileName: "composer.lock"},
+			args: args{
+				pkgName: "symfony/symfony",
+				pkgVer:  semver.MustParse("4.2.6"),
+			},
+			want: []types.DetectedVulnerability{
+				{
+					VulnerabilityID:  "CVE-2019-10909",
+					PkgName:          "symfony/symfony",
+					InstalledVersion: "4.2.6",
+					FixedVersion:     "4.2.7",
+				},
+			},
+		},
+		{
+			name:     "no patched versions in the advisory",
+			fixtures: []string{"testdata/fixtures/php.yaml"},
+			fields:   fields{fileName: "composer.lock"},
+			args: args{
+				pkgName: "symfony/symfony",
+				pkgVer:  semver.MustParse("4.4.6"),
+			},
+			want: []types.DetectedVulnerability{
+				{
+					VulnerabilityID:  "CVE-2020-5275",
+					PkgName:          "symfony/symfony",
+					InstalledVersion: "4.4.6",
+					FixedVersion:     "4.4.7",
+				},
+			},
+		},
+		{
+			name:     "no vulnerable versions in the advisory",
+			fixtures: []string{"testdata/fixtures/ruby.yaml"},
+			fields:   fields{fileName: "Gemfile.lock"},
+			args: args{
+				pkgName: "activesupport",
+				pkgVer:  semver.MustParse("4.1.1"),
+			},
+			want: []types.DetectedVulnerability{
+				{
+					VulnerabilityID:  "CVE-2015-3226",
+					PkgName:          "activesupport",
+					InstalledVersion: "4.1.1",
+					FixedVersion:     ">= 4.2.2, ~> 4.1.11",
+				},
+			},
+		},
+		{
+			name:     "no vulnerability",
+			fixtures: []string{"testdata/fixtures/php.yaml"},
+			fields:   fields{fileName: "composer.lock"},
+			args: args{
+				pkgName: "symfony/symfony",
+				pkgVer:  semver.MustParse("4.4.7"),
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Initialize DB
+			dir := utils.InitTestDB(t, tt.fixtures)
+			defer os.RemoveAll(dir)
+			defer db.Close()
+
+			factory := library.DriverFactory{}
+			driver, err := factory.NewDriver(tt.fields.fileName)
+			require.NoError(t, err)
+
+			got, err := driver.Detect(tt.args.pkgName, tt.args.pkgVer)
+			switch {
+			case tt.wantErr != "":
+				require.NotNil(t, err)
+				assert.Contains(t, err.Error(), tt.wantErr)
+			default:
+				assert.NoError(t, err)
+			}
+
+			// Compare
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}