-
Notifications
You must be signed in to change notification settings - Fork 10
Expand file tree
/
Copy pathtest_supporting_methods.py
More file actions
310 lines (276 loc) · 9.48 KB
/
test_supporting_methods.py
File metadata and controls
310 lines (276 loc) · 9.48 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
from socketsecurity.core import Core
from socketsecurity.core.classes import Diff, Issue, Package, Purl
def make_package(**overrides):
base = dict(
id="pkg:npm/test-package@1.0.0",
name="test-package",
version="1.0.0",
type="npm",
release="tar-gz",
diffType="added",
score={},
alerts=[],
direct=True,
manifestFiles=[{"file": "package.json"}],
topLevelAncestors=[],
author=["test-author"],
size=1000,
transitives=0,
purl="pkg:npm/test-package@1.0.0",
url="https://socket.dev/npm/package/test-package/overview/1.0.0",
)
base.update(overrides)
return Package(**base)
def test_create_purl():
"""Test creating a PURL from package data"""
# Setup test package data
pkg_type = "npm"
pkg_name = "test-package"
pkg_version = "1.0.0"
packages = {
"test_pkg": make_package(
id="test_pkg",
name=pkg_name,
version=pkg_version,
type=pkg_type,
purl=f"pkg:{pkg_type}/{pkg_name}@{pkg_version}"
)
}
# Create PURL
core = Core.__new__(Core)
purl = core.create_purl("test_pkg", packages)
# Verify PURL properties
assert purl.id == "test_pkg"
assert purl.name == pkg_name
assert purl.version == pkg_version
assert purl.ecosystem == pkg_type
assert purl.direct is True
assert purl.introduced_by == [("direct", "package.json")]
assert purl.author == ["test-author"]
assert purl.size == 1000
assert purl.transitives == 0
assert purl.url == f"https://socket.dev/{pkg_type}/package/{pkg_name}/overview/{pkg_version}"
assert purl.purl == f"pkg:{pkg_type}/{pkg_name}@{pkg_version}"
def test_get_source_data():
"""Test getting source data for direct and transitive dependencies"""
# Setup test package data
direct_pkg = make_package(
id="direct_pkg",
name="direct-package",
version="1.0.0",
type="npm",
direct=True,
manifestFiles=[
{"file": "package.json", "start": 10, "end": 20}
],
topLevelAncestors=[],
transitives=1
)
transitive_pkg = make_package(
id="t_pkg",
name="transitive-package",
version="2.0.0",
type="npm",
direct=False,
manifestFiles=[],
topLevelAncestors=["direct_pkg"],
author=["other-author"],
size=500,
transitives=0
)
packages = {
"direct_pkg": direct_pkg,
"t_pkg": transitive_pkg
}
# Test direct package
direct_source = Core.get_source_data(direct_pkg, packages)
assert direct_source == [("direct", "package.json")]
# Test transitive package
trans_source = Core.get_source_data(transitive_pkg, packages)
assert trans_source == [("npm/direct-package@1.0.0", "package.json")]
def test_get_capabilities_for_added_packages():
"""Test mapping package alerts to capabilities"""
# Setup test packages with various alert types
packages = {
"pkg1": make_package(
id="pkg1",
name="package-1",
version="1.0.0",
type="npm",
alerts=[
{
"key": "alert1",
"type": "filesystemAccess",
"severity": "low",
"category": "supplyChainRisk",
"file": "index.js"
},
{
"key": "alert2",
"type": "networkAccess",
"severity": "middle",
"category": "supplyChainRisk",
"file": "lib.js"
}
]
),
"pkg2": make_package(
id="pkg2",
name="package-2",
version="2.0.0",
type="npm",
alerts=[
{
"key": "alert3",
"type": "usesEval",
"severity": "high",
"category": "supplyChainRisk",
"file": "main.js"
}
]
)
}
# Get capabilities for these packages
capabilities = Core.get_capabilities_for_added_packages(packages)
# Verify the returned dictionary structure
assert "pkg1" in capabilities
assert "pkg2" in capabilities
# Verify capabilities for pkg1 (has both filesystem and network access)
assert "File System Access" in capabilities["pkg1"]
assert "Network Access" in capabilities["pkg1"]
assert len(capabilities["pkg1"]) == 2
# Verify capabilities for pkg2 (has eval)
assert "Uses Eval" in capabilities["pkg2"]
assert len(capabilities["pkg2"]) == 1
def test_get_new_alerts():
"""Test finding new alerts between added and removed packages"""
# Setup test data
added_alerts = {
"key1": [ # Completely new alert type
Issue(
pkg_type="npm",
pkg_name="pkg1",
pkg_version="1.0.0",
pkg_id="pkg1",
key="key1",
type="filesystemAccess",
severity="high",
error=True,
purl="pkg:npm/pkg1@1.0.0",
manifests="package.json"
)
],
"key2": [ # Existing alert type but new instance
Issue(
pkg_type="npm",
pkg_name="pkg2",
pkg_version="1.0.0",
pkg_id="pkg2",
key="key2",
type="networkAccess",
severity="medium",
warn=True,
purl="pkg:npm/pkg2@1.0.0",
manifests="package.json"
)
],
"key3": [ # Alert that should be ignored (no error/warn)
Issue(
pkg_type="npm",
pkg_name="pkg3",
pkg_version="1.0.0",
pkg_id="pkg3",
key="key3",
type="info",
severity="low",
monitor=True,
purl="pkg:npm/pkg3@1.0.0",
manifests="package.json"
)
]
}
removed_alerts = {
"key2": [ # Existing alert with different package
Issue(
pkg_type="npm",
pkg_name="old-pkg",
pkg_version="0.9.0",
pkg_id="old-pkg",
key="key2",
type="networkAccess",
severity="medium",
warn=True,
purl="pkg:npm/old-pkg@0.9.0",
manifests="package.json"
)
]
}
# Test with ignore_readded=True (default)
new_alerts = Core.get_new_alerts(added_alerts, removed_alerts)
# Verify results
assert len(new_alerts) == 2 # Should only include key1 and key2 alerts
# Verify the completely new alert (key1) is included
key1_alerts = [a for a in new_alerts if a.key == "key1"]
assert len(key1_alerts) == 1
assert key1_alerts[0].type == "filesystemAccess"
assert key1_alerts[0].error is True
# Verify the new instance of existing alert (key2) is included
key2_alerts = [a for a in new_alerts if a.key == "key2"]
assert len(key2_alerts) == 1
assert key2_alerts[0].type == "networkAccess"
assert key2_alerts[0].warn is True
# Verify the monitor-only alert (key3) is not included
key3_alerts = [a for a in new_alerts if a.key == "key3"]
assert len(key3_alerts) == 0
# Test with ignore_readded=False
all_alerts = Core.get_new_alerts(added_alerts, removed_alerts, ignore_readded=False)
assert len(all_alerts) == 2 # Should still be 2 since key3 is still monitor-only
def test_add_purl_capabilities():
"""Test adding capabilities to purls in a diff"""
# Setup test data
diff = Diff(
id="test_diff",
new_packages=[
Purl(
id="pkg1",
name="package-1",
version="1.0.0",
ecosystem="npm",
direct=True,
introduced_by=[("direct", "package.json")],
author=["test-author"],
size=1000,
transitives=0,
url="https://socket.dev/npm/package/package-1/overview/1.0.0",
purl="pkg:npm/package-1@1.0.0"
),
Purl(
id="pkg2",
name="package-2",
version="2.0.0",
ecosystem="npm",
direct=True,
introduced_by=[("direct", "package.json")],
author=["other-author"],
size=500,
transitives=0,
url="https://socket.dev/npm/package/package-2/overview/2.0.0",
purl="pkg:npm/package-2@2.0.0"
)
],
new_capabilities={
"pkg1": ["File System Access", "Network Access"],
# pkg2 intentionally has no capabilities
}
)
# Add capabilities to purls
Core.add_purl_capabilities(diff)
# Verify results
assert len(diff.new_packages) == 2
# Check package with capabilities
pkg1 = next(p for p in diff.new_packages if p.id == "pkg1")
assert hasattr(pkg1, "capabilities")
assert pkg1.capabilities == ["File System Access", "Network Access"]
# Check package without capabilities
pkg2 = next(p for p in diff.new_packages if p.id == "pkg2")
assert pkg2.capabilities == []