1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
|
# This file is part of CycloneDX Python Library
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0
# Copyright (c) OWASP Foundation. All Rights Reserved.
import warnings
from typing import Callable, Tuple
from unittest import TestCase
from uuid import uuid4
from ddt import ddt, named_data
from cyclonedx.exception.model import LicenseExpressionAlongWithOthersException
from cyclonedx.model import Property
from cyclonedx.model.bom import Bom, BomMetaData
from cyclonedx.model.bom_ref import BomRef
from cyclonedx.model.component import Component, ComponentType
from cyclonedx.model.contact import OrganizationalContact, OrganizationalEntity
from cyclonedx.model.license import DisjunctiveLicense
from cyclonedx.model.lifecycle import LifecyclePhase, NamedLifecycle, PredefinedLifecycle
from cyclonedx.model.tool import Tool
from cyclonedx.output.json import JsonV1Dot6
from tests._data.models import (
get_bom_component_licenses_invalid,
get_bom_component_nested_licenses_invalid,
get_bom_for_issue_275_components,
get_bom_metadata_component_licenses_invalid,
get_bom_metadata_component_nested_licenses_invalid,
get_bom_metadata_licenses_invalid,
get_bom_service_licenses_invalid,
get_bom_with_component_setuptools_with_vulnerability,
get_component_setuptools_simple,
get_component_setuptools_simple_no_version,
)
class TestBomMetaData(TestCase):
def test_empty_bom_metadata(self) -> None:
metadata = BomMetaData()
self.assertIsNotNone(metadata.timestamp)
self.assertEqual(0, len(metadata.authors))
self.assertIsNone(metadata.component)
self.assertIsNone(metadata.manufacture)
self.assertIsNone(metadata.supplier)
self.assertEqual(0, len(metadata.licenses))
self.assertEqual(0, len(metadata.lifecycles))
self.assertEqual(0, len(metadata.properties))
self.assertEqual(0, len(metadata.tools))
def test_basic_bom_metadata(self) -> None:
tools = [
Tool(name='tool_1'),
Tool(name='tool_2'),
]
authors = [
OrganizationalContact(name='contact_1'),
OrganizationalContact(name='contact_2'),
]
component = Component(name='test_component')
manufacturer = OrganizationalEntity(name='test_manufacturer')
supplier = OrganizationalEntity(name='test_supplier')
licenses = [
DisjunctiveLicense(id='MIT'),
DisjunctiveLicense(id='Apache-2.0'),
]
lifecycles = [
PredefinedLifecycle(phase=LifecyclePhase.BUILD),
NamedLifecycle(name='named_lifecycle', description='test'),
]
properties = [
Property(name='property_1', value='value_1'),
Property(name='property_2', value='value_2', )
]
metadata = BomMetaData(tools=tools, authors=authors, component=component, lifecycles=lifecycles,
manufacture=manufacturer, supplier=supplier, licenses=licenses, properties=properties)
self.assertIsNotNone(metadata.timestamp)
self.assertIsNotNone(metadata.authors)
self.assertTrue(authors[0] in metadata.authors)
self.assertTrue(authors[1] in metadata.authors)
self.assertEqual(metadata.component, component)
self.assertEqual(metadata.manufacture, manufacturer)
self.assertEqual(metadata.supplier, supplier)
self.assertIsNotNone(metadata.licenses)
self.assertTrue(licenses[0] in metadata.licenses)
self.assertTrue(licenses[1] in metadata.licenses)
self.assertIsNotNone(metadata.lifecycles)
self.assertTrue(lifecycles[0] in metadata.lifecycles)
self.assertTrue(lifecycles[1] in metadata.lifecycles)
self.assertIsNotNone(metadata.properties)
self.assertTrue(properties[0] in metadata.properties)
self.assertTrue(properties[1] in metadata.properties)
self.assertIsNotNone(metadata.tools)
self.assertEqual(2, len(metadata.tools.tools))
self.assertTrue(tools[0] in metadata.tools.tools)
self.assertTrue(tools[1] in metadata.tools.tools)
@ddt
class TestBom(TestCase):
def test_bom_metadata_tool_multiple_tools(self) -> None:
bom = Bom()
self.assertEqual(len(bom.metadata.tools), 0)
bom.metadata.tools.tools.add(
Tool(vendor='TestVendor', name='TestTool', version='0.0.0')
)
bom.metadata.tools.tools.add(
Tool(vendor='TestVendor', name='TestTool-2', version='1.33.7')
)
self.assertEqual(len(bom.metadata.tools), 2)
def test_metadata_component(self) -> None:
metadata = Bom().metadata
self.assertTrue(metadata.component is None)
hextech = Component(name='Hextech', version='1.0.0', type=ComponentType.LIBRARY)
metadata.component = hextech
self.assertFalse(metadata.component is None)
self.assertEqual(metadata.component, hextech)
def test_empty_bom(self) -> None:
bom = Bom()
self.assertEqual(bom.version, 1)
self.assertIsNotNone(bom.serial_number)
self.assertIsNotNone(bom.metadata)
self.assertFalse(bom.components)
self.assertFalse(bom.services)
self.assertFalse(bom.external_references)
def test_root_component_only_bom(self) -> None:
with warnings.catch_warnings(record=True) as w:
warnings.simplefilter('always')
bom = Bom(metadata=BomMetaData(component=Component(name='test', version='1.2')))
_ = JsonV1Dot6(bom).output_as_string()
self.assertEqual(len(w), 0)
def test_warning_missing_dependency(self) -> None:
with self.assertWarns(expected_warning=UserWarning) as w:
bom = Bom(metadata=BomMetaData(component=Component(name='root_component', version='1.2')))
bom.components.add(Component(name='test2', version='4.2'))
_ = JsonV1Dot6(bom).output_as_string()
self.assertEqual(len(w.warnings), 1)
self.assertIn('has no defined dependencies ', str(w.warnings[0]))
def test_empty_bom_defined_serial(self) -> None:
serial_number = uuid4()
bom = Bom(serial_number=serial_number)
self.assertEqual(bom.serial_number, serial_number)
self.assertEqual(bom.get_urn_uuid(), serial_number.urn)
self.assertEqual(bom.version, 1)
self.assertEqual(bom.urn(), f'urn:cdx:{serial_number}/1')
def test_empty_bom_defined_serial_and_version(self) -> None:
serial_number = uuid4()
bom = Bom(serial_number=serial_number, version=2)
self.assertEqual(bom.serial_number, serial_number)
self.assertEqual(bom.get_urn_uuid(), serial_number.urn)
self.assertEqual(bom.version, 2)
self.assertEqual(bom.urn(), f'urn:cdx:{serial_number}/2')
def test_bom_with_vulnerabilities(self) -> None:
bom = get_bom_with_component_setuptools_with_vulnerability()
self.assertTrue(bom.has_vulnerabilities())
def test_bom_get_vulnerabilities_by_bom_ref(self) -> None:
bom = get_bom_with_component_setuptools_with_vulnerability()
vulns = bom.get_vulnerabilities_for_bom_ref(bom_ref=BomRef(value='pkg:pypi/setuptools@50.3.2?extension=tar.gz'))
self.assertEqual(len(vulns), 1)
def test_bom_get_vulnerabilities_by_bom_ref_negative(self) -> None:
bom = get_bom_with_component_setuptools_with_vulnerability()
vulns = bom.get_vulnerabilities_for_bom_ref(bom_ref=BomRef(value='pkg:pypi/setuptools@50.3.1?extension=tar.gz'))
self.assertEqual(len(vulns), 0)
def test_bom_nested_components_issue_275(self) -> None:
"""regression test for issue #275
see https://github.com/CycloneDX/cyclonedx-python-lib/issues/275
"""
bom = get_bom_for_issue_275_components()
self.assertIsInstance(bom.metadata.component, Component)
self.assertEqual(2, len(bom.components))
bom.validate()
@named_data(
['metadata_licenses', get_bom_metadata_licenses_invalid],
['metadata_component_licenses', get_bom_metadata_component_licenses_invalid],
['metadata_component_nested_licenses', get_bom_metadata_component_nested_licenses_invalid],
['component_licenses', get_bom_component_licenses_invalid],
['component_nested_licenses', get_bom_component_nested_licenses_invalid],
['service_licenses', get_bom_service_licenses_invalid],
)
def test_validate_with_invalid_license_constellation_throws(self, get_bom: Callable[[], Bom]) -> None:
bom = get_bom()
with self.assertRaises(LicenseExpressionAlongWithOthersException):
bom.validate()
# def test_bom_nested_services_issue_275(self) -> None:
# """regression test for issue #275
# see https://github.com/CycloneDX/cyclonedx-python-lib/issues/275
# """
# bom = get_bom_for_issue_275_services()
# self.assertIsInstance(bom.metadata.component, Component)
# self.assertEqual(2, len(bom.services))
# bom.validate()
def test_has_component_1(self) -> None:
bom = Bom()
bom.components.update([get_component_setuptools_simple(), get_component_setuptools_simple_no_version()])
self.assertEqual(len(bom.components), 2)
self.assertTrue(bom.has_component(component=get_component_setuptools_simple_no_version()))
self.assertIsNot(get_component_setuptools_simple(), get_component_setuptools_simple_no_version())
def test_get_component_by_purl(self) -> None:
bom = Bom()
setuptools_simple = get_component_setuptools_simple()
bom.components.add(setuptools_simple)
result = bom.get_component_by_purl(get_component_setuptools_simple().purl)
self.assertIs(result, setuptools_simple)
self.assertIsNone(bom.get_component_by_purl(get_component_setuptools_simple_no_version().purl))
@named_data(
('none', tuple()),
# a = anonymous - bom-ref auto-set
# k = known - has bom-ref.value set
# d = known duplicate - has bom-ref.value set same as another
('A(a), B(a)', ((Component(name='A'), tuple()),
(Component(name='B'), tuple()))),
('A(k), B(k)', ((Component(name='A', bom_ref='A'), tuple()),
(Component(name='B', bom_ref='B'), tuple()))),
('A(a) {A1(a)}, B(a) {B1(a)}', ((Component(name='A'), (Component(name='A1'),)),
(Component(name='B'), (Component(name='B1'),)))),
('A(k) {A1(a)}', ((Component(name='A', bom_ref='A'), (Component(name='1'),)),)),
('A(a) {A1(a), A2(a)}', ((Component(name='A'), (Component(name='A1'), Component(name='A2'))),)),
('A(a) {A1(k)}', ((Component(name='A'), (Component(name='B', bom_ref='A1'),)),)),
('A(k) {A1(k)}', ((Component(name='A', bom_ref='A'), (Component(name='A1', bom_ref='A1'),)),)),
('A(d) {A1(d)}', ((Component(name='A', bom_ref='D'), (Component(name='B', bom_ref='D'),)),)),
('duplicate name(a)', ((Component(name='A'), tuple()),
(Component(name='A'), tuple()),)),
('duplicate name(k)', ((Component(name='A', bom_ref='A1'), tuple()),
(Component(name='A', bom_ref='A2'), tuple()))),
)
def test_register_dependency(self, dependencies: Tuple[Tuple[Component, Tuple[Component, ...]], ...]) -> None:
bom = Bom()
for d1, d2 in dependencies:
bom.components.update((d1,), d2)
bom.register_dependency(d1, d2)
bom_deps = tuple(bom.dependencies)
for d1, d2 in dependencies:
bom_dep = next((bd for bd in bom_deps if bd.ref is d1.bom_ref), None)
self.assertIsNotNone(bom_dep, f'missing {d1.bom_ref!r} in {bom_deps!r}')
self.assertEqual(len(d2), len(bom_dep.dependencies))
for dd in d2:
self.assertIn(dd.bom_ref, bom_dep.dependencies_as_bom_refs())
def test_regression_issue_539(self) -> None:
"""regression test for issue #539
see https://github.com/CycloneDX/cyclonedx-python-lib/issues/539
"""
# for showcasing purposes, bom-ref values MUST NOT be set
bom = Bom()
bom.metadata.component = root_component = Component(
name='myApp',
type=ComponentType.APPLICATION,
)
component1 = Component(
type=ComponentType.LIBRARY,
name='some-component',
)
component2 = Component(
type=ComponentType.LIBRARY,
name='some-library',
)
component3 = Component(
type=ComponentType.LIBRARY,
name='another-library',
)
bom.components.add(component1)
bom.components.add(component2)
bom.components.add(component3)
bom.register_dependency(root_component, [component1])
bom.register_dependency(component1, [component2])
bom.register_dependency(root_component, [component3])
# region assert root_component
d = next((d for d in bom.dependencies if d.ref is root_component.bom_ref), None)
self.assertIsNotNone(d, f'missing {root_component.bom_ref!r} in {bom.dependencies!r}')
self.assertEqual(2, len(d.dependencies))
self.assertIn(d.dependencies[0].ref, (component1.bom_ref, component3.bom_ref))
self.assertIn(d.dependencies[1].ref, (component1.bom_ref, component3.bom_ref))
# endregion assert root_component
# region assert component1
d = next((d for d in bom.dependencies if d.ref is component1.bom_ref), None)
self.assertIsNotNone(d, f'missing {component1.bom_ref!r} in {bom.dependencies!r}')
self.assertEqual(1, len(d.dependencies))
self.assertIs(component2.bom_ref, d.dependencies[0].ref)
# endregion assert component1
|
