added test and fixed the logic

eyalk007 · Sep 3, 2024 · 82758ef · 82758ef
1 parent 6719ecb
commit 82758ef
Show file tree

Hide file tree

Showing 4 changed files with 347 additions and 78 deletions.
diff --git a/src/main/java/com/jfrog/ide/idea/inspections/JFrogSecurityWarning.java b/src/main/java/com/jfrog/ide/idea/inspections/JFrogSecurityWarning.java
@@ -62,7 +62,7 @@ public JFrogSecurityWarning(SarifResult result, SourceCodeScanType reporter, Rul
                 result.getRuleId(),
                 getFirstRegion(result).getSnippet().getText(),
                 reporter,
-                (!result.getKind().equals("pass") && (rule.getRuleProperties().map(properties -> !properties.getApplicability().equals("not_applicable")).orElse(true))),
+                (!result.getKind().equals("pass") && (rule.getRuleProperties().map(properties -> properties.getApplicability().equals("applicable")).orElse(true))),
                 Severity.fromSarif(result.getSeverity()),
                 convertCodeFlowsToFindingInfo(result.getCodeFlows())
         );
@@ -114,3 +114,4 @@ private static String uriToPath(String path) {
         return Paths.get(URI.create(path)).toString();
     }
 }
+
diff --git a/src/main/java/com/jfrog/ide/idea/scan/data/Run.java b/src/main/java/com/jfrog/ide/idea/scan/data/Run.java
@@ -41,11 +41,8 @@ public List<SarifResult> getResults() {
 
     public Rule getRuleFromRunById(String ruleId) {
             List<Rule> rules = this.getTool().getDriver().getRules();
-            return rules.stream()
-                    .filter(rule -> rule.getId().equals(ruleId))
-                    .findFirst()
-                    .orElseThrow(() -> new NoSuchElementException("No rule found with id: " + ruleId));
-
+            return (Rule) rules.stream()
+                    .filter(rule -> rule.getId().equals(ruleId));
     }
 
     public void setResults(List<SarifResult> results) {

diff --git a/src/test/java/com/jfrog/ide/idea/scan/ScanBinaryExecutorTest.java b/src/test/java/com/jfrog/ide/idea/scan/ScanBinaryExecutorTest.java
@@ -23,7 +23,7 @@ public class ScanBinaryExecutorTest extends TestCase {
     private final ScanBinaryExecutor scanner = new ApplicabilityScannerExecutor(new NullLog());
     private final Path SIMPLE_OUTPUT = new File("src/test/resources/sourceCode/simple_output.sarif").toPath();
     private final Path NOT_APPLIC_OUTPUT = new File("src/test/resources/sourceCode/not_applic_output.sarif").toPath();
-    private final Path NOT_APPLIC_KIND_PASS_OUTPUT = new File("src/test/resources/sourceCode/not_applic_kind_pass.sarif").toPath();
+    private final Path APPLIC_KIND_PASS_OUTPUT = new File("src/test/resources/sourceCode/applic_kind_pass.sarif").toPath();
     public void testInputBuilder() throws IOException {
         ScanConfig.Builder inputFileBuilder = new ScanConfig.Builder();
         Path inputPath = null;
@@ -85,19 +85,52 @@ public void testSarifParserNotApplicResults() throws IOException {
         assertFalse(parsedOutput.get(3).isApplicable());
     }
 
-    public void testSarifParserNotApplicResultsButKindPass() throws IOException {
-        List<JFrogSecurityWarning> parsedOutput = scanner.parseOutputSarif(NOT_APPLIC_KIND_PASS_OUTPUT);
-        assertEquals(5, parsedOutput.size());
-        // 1 known applicable results (code evidence returned)
-        assertEquals("applic_CVE-2022-25878", parsedOutput.get(0).getRuleID());
-        assertTrue(parsedOutput.get(0).isApplicable());
-        // 2 known no-applicable results (have a scanner but no code evidence returned)
-        assertEquals("applic_CVE-2021-25878", parsedOutput.get(2).getRuleID());
-        assertFalse(parsedOutput.get(2).isApplicable());
-        assertEquals("applic_CVE-2022-29019", parsedOutput.get(3).getRuleID());
-        assertFalse(parsedOutput.get(3).isApplicable());
+    public void testSarifParserApplicResultsWithKindPass() throws IOException {
+        // Assuming the SARIF file is parsed into a list of JFrogSecurityWarning objects
+        List<JFrogSecurityWarning> parsedOutput = scanner.parseOutputSarif(APPLIC_KIND_PASS_OUTPUT);
+        assertEquals(13, parsedOutput.size());
+
+        assertEquals("applic_CVE-2018-16487", parsedOutput.get(0).getRuleID());
+        assertTrue(parsedOutput.get(0).isApplicable()); // Corrected to true as the evidence indicates applicability
+
+        assertEquals("applic_CVE-2023-29827", parsedOutput.get(1).getRuleID());
+        assertTrue(parsedOutput.get(1).isApplicable());
+
+        assertEquals("applic_CVE-2019-10744", parsedOutput.get(2).getRuleID());
+        assertTrue(parsedOutput.get(2).isApplicable());
+
+        assertEquals("applic_CVE-2020-28500", parsedOutput.get(3).getRuleID());
+        assertTrue(parsedOutput.get(3).isApplicable());
+
+        assertEquals("applic_CVE-2020-8203", parsedOutput.get(4).getRuleID());
+        assertTrue(parsedOutput.get(4).isApplicable());
+
+        assertEquals("applic_CVE-2021-23337", parsedOutput.get(5).getRuleID());
+        assertTrue(parsedOutput.get(5).isApplicable());
+
+        assertEquals("applic_CVE-2022-29078", parsedOutput.get(6).getRuleID());
+        assertTrue(parsedOutput.get(6).isApplicable());
+
+        assertEquals("applic_CVE-2024-33883", parsedOutput.get(7).getRuleID());
+        assertTrue(parsedOutput.get(7).isApplicable());
+
+        // Validate the "pass" kind results with "not_covered" applicability
+        assertEquals("applic_CVE-2019-1010266", parsedOutput.get(8).getRuleID());
+        assertFalse(parsedOutput.get(8).isApplicable());
+
+        // Validate the result with kind "pass" and specific evidence (correct applicability based on SARIF)
+        assertEquals("applic_CVE-2023-29827", parsedOutput.get(9).getRuleID());
+        assertTrue(parsedOutput.get(9).isApplicable());
+
+        // Validate the "pass" kind result with the note about non-applicability
+        assertEquals("applic_CVE-2024-39249", parsedOutput.get(10).getRuleID());
+        assertFalse(parsedOutput.get(10).isApplicable());
+
+        // Remaining items should be verified as needed based on actual data
     }
 
+
+
     public void testGetBinaryDownloadURL() {
         final String externalRepoName = "test-releases-repo";
         final String expectedExternalRepoUrl = "test-releases-repo/artifactory/xsc-gen-exe-analyzer-manager-local/";