benoit@43: import utils
benoit@43: 
benoit@43: from farolluz.parsers.cve import parse
benoit@43: 
benoit@43: FULL_CVE = """\
benoit@43: <entry xmlns:scap-core="http://scap.nist.gov/schema/scap-core/0.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:patch="http://scap.nist.gov/schema/patch/0.1" xmlns:vuln="http://scap.nist.gov/schema/vulnerability/0.4" xmlns:cvss="http://scap.nist.gov/schema/cvss-v2/0.2" xmlns:cpe-lang="http://cpe.mitre.org/language/2.0" xmlns="http://scap.nist.gov/schema/feed/vulnerability/2.0" id="CVE-2014-7088">
benoit@43: <vuln:vulnerable-configuration id="http://nvd.nist.gov/">
benoit@43: <cpe-lang:logical-test operator="OR" negate="false">
benoit@43: <cpe-lang:fact-ref name="cpe:/a:jdm_lifestyle_project:jdm_lifestyle:6.4::~~~android~~"/>
benoit@43: </cpe-lang:logical-test>
benoit@43: </vuln:vulnerable-configuration>
benoit@43: <vuln:vulnerable-software-list>
benoit@54: <vuln:product>cpe:/a:jdm_lifestyle_project:jdm_lifestyle:6.4::~~~android~~</vuln:product>
benoit@43: </vuln:vulnerable-software-list>
benoit@43: <vuln:cve-id>CVE-2014-7088</vuln:cve-id>
benoit@43: <vuln:published-datetime>2014-10-18T21:55:17.027-04:00</vuln:published-datetime>
benoit@43: <vuln:last-modified-datetime>2014-11-14T09:07:51.650-05:00</vuln:last-modified-datetime>
benoit@43: <vuln:cvss>
benoit@43: <cvss:base_metrics>
benoit@43: <cvss:score>5.4</cvss:score>
benoit@43: <cvss:access-vector>ADJACENT_NETWORK</cvss:access-vector>
benoit@43: <cvss:access-complexity>MEDIUM</cvss:access-complexity>
benoit@43: <cvss:authentication>NONE</cvss:authentication>
benoit@43: <cvss:confidentiality-impact>PARTIAL</cvss:confidentiality-impact>
benoit@43: <cvss:integrity-impact>PARTIAL</cvss:integrity-impact>
benoit@43: <cvss:availability-impact>PARTIAL</cvss:availability-impact>
benoit@43: <cvss:source>http://nvd.nist.gov</cvss:source>
benoit@43: <cvss:generated-on-datetime>2014-11-14T09:07:51.290-05:00</cvss:generated-on-datetime>
benoit@43: </cvss:base_metrics>
benoit@43: </vuln:cvss>
benoit@43: <vuln:cwe id="CWE-310"/>
benoit@43: <vuln:references reference_type="UNKNOWN" xml:lang="en">
benoit@43: <vuln:source>CERT-VN</vuln:source>
benoit@43: <vuln:reference href="http://www.kb.cert.org/vuls/id/582497" xml:lang="en">VU#582497</vuln:reference>
benoit@43: </vuln:references>
benoit@43: <vuln:references reference_type="UNKNOWN" xml:lang="en">
benoit@43: <vuln:source>MISC</vuln:source>
benoit@54: <vuln:reference href="https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing" xml:lang="en">https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing</vuln:reference>
benoit@43: </vuln:references>
benoit@43: <vuln:summary>
benoit@43: The JDM Lifestyle (aka com.hondatech) application 6.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
benoit@43: </vuln:summary>
benoit@43: </entry>"""
benoit@43: 
benoit@43: CVE_NO_CVSS = """\
benoit@43: <entry xmlns:scap-core="http://scap.nist.gov/schema/scap-core/0.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:patch="http://scap.nist.gov/schema/patch/0.1" xmlns:vuln="http://scap.nist.gov/schema/vulnerability/0.4" xmlns:cvss="http://scap.nist.gov/schema/cvss-v2/0.2" xmlns:cpe-lang="http://cpe.mitre.org/language/2.0" xmlns="http://scap.nist.gov/schema/feed/vulnerability/2.0" id="CVE-2014-9388">
benoit@43: <vuln:cve-id>CVE-2014-9388</vuln:cve-id>
benoit@43: <vuln:published-datetime>2014-12-17T14:59:08.587-05:00</vuln:published-datetime>
benoit@43: <vuln:last-modified-datetime>2014-12-17T14:59:09.620-05:00</vuln:last-modified-datetime>
benoit@43: <vuln:references reference_type="UNKNOWN" xml:lang="en">
benoit@43: <vuln:source>CONFIRM</vuln:source>
benoit@43: <vuln:reference href="https://www.mantisbt.org/bugs/view.php?id=17878" xml:lang="en">https://www.mantisbt.org/bugs/view.php?id=17878</vuln:reference>
benoit@43: </vuln:references>
benoit@43: <vuln:references reference_type="UNKNOWN" xml:lang="en">
benoit@43: <vuln:source>CONFIRM</vuln:source>
benoit@43: <vuln:reference href="https://www.mantisbt.org/bugs/changelog_page.php?version_id=191" xml:lang="en">
benoit@43: https://www.mantisbt.org/bugs/changelog_page.php?version_id=191
benoit@43: </vuln:reference>
benoit@43: </vuln:references>
benoit@43: <vuln:references reference_type="UNKNOWN" xml:lang="en">
benoit@43: <vuln:source>MLIST</vuln:source>
benoit@43: <vuln:reference href="http://seclists.org/oss-sec/2014/q4/955" xml:lang="en">[oss-security] 20141207 MantisBT 1.2.18 Released</vuln:reference>
benoit@43: </vuln:references>
benoit@43: <vuln:summary>
benoit@43: bug_report.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handler_id parameter.
benoit@43: </vuln:summary>
benoit@43: </entry>"""
benoit@43: 
benoit@43: class testCVEParsing(utils.TestCase):
benoit@43: 
benoit@43:     def test_Full(self):
benoit@43:         self.doc = parse(FULL_CVE)
benoit@43:         self._validate()
benoit@43: 
benoit@43:     def test_no_CVSS(self):
benoit@43:         self.doc = parse(CVE_NO_CVSS)
benoit@43:         self._validate()