Skip to content

Commit 72bb996

Browse files
thisislawattsthisislawatts
committed
test: capture valid json output with policy
1 parent 8ef2e3e commit 72bb996

File tree

5 files changed

+163
-2
lines changed

5 files changed

+163
-2
lines changed

‎test/acceptance/workspaces/npm-package-single-ignored-vuln/.snyk

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
2+
version: v1.14.1
3+
# ignores vulnerabilities until expiry date; change duration by modifying expiry date
4+
ignore:
5+
'SNYK-JS-CXCT-535487':
6+
- '*':
7+
reason: None given
8+
expires: '2100-03-01T19:48:49.699Z'

‎test/acceptance/workspaces/npm-package-single-ignored-vuln/package-lock.json

+14
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎test/acceptance/workspaces/npm-package-single-ignored-vuln/package.json

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{
2+
"name": "npm-package-single-ignored-vuln",
3+
"version": "1.0.0",
4+
"description": "application with annotated vulns",
5+
"dependencies": {
6+
"cxct": "0.0.1-security"
7+
},
8+
"devDependencies": {}
9+
}

‎test/acceptance/workspaces/npm-package-single-ignored-vuln/test-graph-results.json

+104
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
{
2+
"result": {
3+
"affectedPkgs": {
4+
"[email protected]": {
5+
"pkg": { "name": "cxct", "version": "0.0.1-security" },
6+
"issues": {
7+
"SNYK-JS-CXCT-535487": {
8+
"issueId": "SNYK-JS-CXCT-535487",
9+
"fixInfo": { "isPatchable": false, "upgradePaths": [] }
10+
}
11+
}
12+
}
13+
},
14+
"issuesData": {
15+
"SNYK-JS-CXCT-535487": {
16+
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
17+
"alternativeIds": [],
18+
"creationTime": "2019-11-24T13:10:43.888332Z",
19+
"credit": ["npm 󠅮󠅰󠅭security"],
20+
"cvssScore": 9.8,
21+
"description": "## Overview\n\n[cxct](https://www.npmjs.com/package/cxct) is a malicious package.\n\n\nThe package finds and exfiltrates cryptocurrency wallets.\n\n## Remediation\n\nAvoid using `cxct` altogether.\n\n\n## References\n\n- [NPM Security Advisory](https://www.npmjs.com/advisories/1344)\n",
22+
"disclosureTime": "2019-11-22T00:24:41Z",
23+
"exploit": "Not Defined",
24+
"fixedIn": [],
25+
"functions": [],
26+
"functions_new": [],
27+
"id": "SNYK-JS-CXCT-535487",
28+
"identifiers": { "CVE": [], "CWE": ["CWE-506"], "NSP": [1344] },
29+
"language": "js",
30+
"modificationTime": "2019-11-24T16:16:16.630345Z",
31+
"moduleName": "cxct",
32+
"packageManager": "npm",
33+
"packageName": "cxct",
34+
"patches": [],
35+
"publicationTime": "2019-11-24T13:11:04Z",
36+
"references": [
37+
{
38+
"title": "NPM Security Advisory",
39+
"url": "https://www.npmjs.com/advisories/1344"
40+
}
41+
],
42+
"semver": { "vulnerable": ["*"] },
43+
"severity": "high",
44+
"title": "Malicious 󠅮󠅰󠅭Package",
45+
"isPinnable": false
46+
}
47+
},
48+
"remediation": {
49+
"unresolved": [
50+
{
51+
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
52+
"alternativeIds": [],
53+
"creationTime": "2019-11-24T13:10:43.888332Z",
54+
"credit": ["npm 󠅮󠅰󠅭security"],
55+
"cvssScore": 9.8,
56+
"description": "## Overview\n\n[cxct](https://www.npmjs.com/package/cxct) is a malicious package.\n\n\nThe package finds and exfiltrates cryptocurrency wallets.\n\n## Remediation\n\nAvoid using `cxct` altogether.\n\n\n## References\n\n- [NPM Security Advisory](https://www.npmjs.com/advisories/1344)\n",
57+
"disclosureTime": "2019-11-22T00:24:41Z",
58+
"exploit": "Not Defined",
59+
"fixedIn": [],
60+
"functions": [],
61+
"functions_new": [],
62+
"id": "SNYK-JS-CXCT-535487",
63+
"identifiers": { "CVE": [], "CWE": ["CWE-506"], "NSP": [1344] },
64+
"language": "js",
65+
"modificationTime": "2019-11-24T16:16:16.630345Z",
66+
"moduleName": "cxct",
67+
"packageManager": "npm",
68+
"packageName": "cxct",
69+
"patches": [],
70+
"publicationTime": "2019-11-24T13:11:04Z",
71+
"references": [
72+
{
73+
"title": "NPM Security Advisory",
74+
"url": "https://www.npmjs.com/advisories/1344"
75+
}
76+
],
77+
"semver": { "vulnerable": ["*"] },
78+
"severity": "high",
79+
"title": "Malicious 󠅮󠅰󠅭Package",
80+
"isPinnable": false,
81+
"from": ["[email protected]", "[email protected]"],
82+
"upgradePath": [],
83+
"isUpgradable": false,
84+
"isPatchable": false,
85+
"name": "cxct",
86+
"version": "0.0.1-security"
87+
}
88+
],
89+
"upgrade": {},
90+
"patch": {},
91+
"ignore": {},
92+
"pin": {}
93+
}
94+
},
95+
"meta": {
96+
"isPrivate": true,
97+
"isLicensesEnabled": false,
98+
"licensesPolicy": { "severities": {}, "orgLicenseRules": {} },
99+
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\n# ignores vulnerabilities until expiry date; change duration by modifying expiry date\nignore:\n SNYK-JS-CXCT-535487:\n - '*':\n reason: None Given\n expires: 2100-12-13T14:20:21.158Z\n created: 2017-11-13T14:20:21.163Z\n source: cli\npatch: {}\n",
100+
"ignoreSettings": null,
101+
"org": "gitphill"
102+
},
103+
"filesystemPolicy": false
104+
}

‎test/jest/acceptance/cli-json-output.spec.ts

+28-2
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import { getServerPort } from '../util/getServerPort';
44
import { runSnykCLI } from '../util/runSnykCLI';
55
import { AppliedPolicyRules } from '../../../src/lib/formatters/types';
66
import * as Parser from 'jsonparse';
7+
import { error } from 'console';
78

89
jest.setTimeout(1000 * 60);
910

@@ -33,7 +34,7 @@ describe('test --json', () => {
3334
server.close(() => done());
3435
});
3536

36-
it('test with --json returns without error and with JSON return type when no vulns found', async () => {
37+
it.only('test with --json returns without error and with JSON return type when no vulns found', async () => {
3738
const project = await createProjectFromWorkspace('fail-on/no-vulns');
3839
server.setCustomResponse(await project.readJSON('vulns-result.json'));
3940

@@ -135,7 +136,7 @@ describe('test --json', () => {
135136
}, 120000);
136137
});
137138

138-
describe('when policy data is available', () => {
139+
describe.only('when policy data is available', () => {
139140
it('includes a user note and reason', async () => {
140141
const project = await createProjectFromWorkspace(
141142
'npm-package-single-vuln',
@@ -164,5 +165,30 @@ describe('test --json', () => {
164165
expect(code).toEqual(1);
165166
expect(server.getRequests().length).toBeGreaterThanOrEqual(1);
166167
});
168+
169+
it('returns well structured json', async () => {
170+
const project = await createProjectFromWorkspace(
171+
'npm-package-single-ignored-vuln',
172+
);
173+
server.setCustomResponse(
174+
await project.readJSON('test-graph-results.json'),
175+
);
176+
177+
const { code, stdout } = await runSnykCLI(`test -d --json --log-level=trace`, {
178+
cwd: project.path(),
179+
env,
180+
});
181+
182+
try {
183+
const returnedJson = JSON.parse(stdout);
184+
185+
expect(returnedJson.vulnerabilities).toHaveLength(0);
186+
expect(code).toEqual(0);
187+
expect(server.getRequests().length).toBeGreaterThanOrEqual(1);
188+
} catch (err) {
189+
console.log(stdout)
190+
throw err
191+
}
192+
});
167193
});
168194
});

0 commit comments

Comments
 (0)