ACTI Vulnerability Query

import json
from ACTIVulnerabilityQuery import Client, vuln_command
from test_data.response_constants import VULN_RES_JSON
from CommonServerPython import DBotScoreReliability
import requests_mock


API_URL = "https://test.com"


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


def test_vuln_command():
    """
    Given:
        - an CVE

    When:
        - running Vulnerability command and validate whether the CVE is malicious

    Then:
        - return command results containing Vulnerability, dbotscore

    """
    url = "https://test.com/rest/vulnerability/v0?key.values=CVE-2022-23021"
    status_code = 200
    json_res = VULN_RES_JSON

    expected_output = {
        "CVE": [
            {
                "ID": "CVE-2022-23021",
                "CVSS3": 6.5,
                "CVSS2": 3.7,
                "CVSS": {"CVSS3": 6.5, "CVSS2": 3.7},
                "Published": "2022-01-21 03:43:55",
                "Modified": "2022-01-21 03:43:55",
                "Description": "Remote exploitation of a null pointer dereference vulnerability in F5 BIG-IP could allow an attacker to cause a denial of service (DoS) condition on the targeted host. \n\nA null pointer dereference vulnerability has been identified in BIG-IP. This vulnerability occurs due to a failure to properly handle pointers when the HTTP redirect rule in an LTM policy, BIG-IP APM Access Profile, and Explicit HTTP Proxy in HTTP Profile configured on a virtual server.\n\nFurther details are not available at the time of this writing. iDefense will update this report as more details become available.",  # noqa: E501
            }
        ],
        "DBOTSCORE": [
            {
                "Indicator": "CVE-2022-23021",
                "Type": "cve",
                "Vendor": "ACTIVulnerabilityQuery",
                "Score": 1,
                "Reliability": "B - Usually reliable",
            }
        ],
    }

    cve_to_check = {"cve": "CVE-2022-23021"}

    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_res)
        client = Client(API_URL, "api_token", True, False, "/rest/vulnerability")
        results = vuln_command(client, cve_to_check, DBotScoreReliability.B)
        output = results[0].to_context().get("EntryContext", {})

        assert output.get("CVE(val.ID && val.ID == obj.ID)", []) == expected_output.get("CVE")
        assert output.get(
            "DBotScore(val.Indicator && val.Indicator == obj.Indicator && val.Vendor == obj.Vendor && val.Type == obj.Type)", []
        ) == expected_output.get("DBOTSCORE")  # noqa: E501


def test_vuln_not_found():
    """
    Given:
        - an CVE

    When:
        - running Vulnerability command and validate whether the CVE is malicious

    Then:
        - return command results with context indicate that no results were found

    """
    url = "https://test.com/rest/vulnerability/v0?key.values=CVE-0000-00000"
    status_code = 200
    json_res = {"total_size": 0, "page": 1, "page_size": 25, "more": False}

    expected_output = "No results were found for cve CVE-0000-00000"

    cve_to_check = {"cve": "CVE-0000-00000"}

    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_res)
        client = Client(API_URL, "api_token", True, False, "/rest/vulnerability")
        results = vuln_command(client, cve_to_check, DBotScoreReliability.B)
        output = results[0].to_context().get("HumanReadable")

        assert expected_output in output