Skip to content

Commit 3fbd296

Browse files
authored
fix(models): include CPE vulns in total, set "unknown" patch status (#2460)
Previously, FormatFixedStatus skipped CPE vulnerabilities entirely, and PatchStatus returned an empty string for them. This made CPE-related vulnerabilities invisible in fix status summaries and inconsistent with other patch status values (fixed, unfixed, unknown).
1 parent 16a9088 commit 3fbd296

2 files changed

Lines changed: 89 additions & 5 deletions

File tree

models/vulninfos.go

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -190,9 +190,6 @@ func (v VulnInfos) FormatCveSummary() string {
190190
func (v VulnInfos) FormatFixedStatus(packs Packages) string {
191191
total, fixed := 0, 0
192192
for _, vInfo := range v {
193-
if len(vInfo.CpeURIs) != 0 {
194-
continue
195-
}
196193
total++
197194
if vInfo.PatchStatus(packs) == "fixed" {
198195
fixed++
@@ -731,7 +728,7 @@ func (v VulnInfo) PatchStatus(packs Packages) string {
731728

732729
// Vuls don't know patch status of the CPE
733730
if len(v.CpeURIs) > 0 {
734-
return ""
731+
return "unknown"
735732
}
736733

737734
for _, p := range v.AffectedPackages {

models/vulninfos_test.go

Lines changed: 88 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1825,7 +1825,7 @@ func TestVulnInfo_PatchStatus(t *testing.T) {
18251825
fields: fields{
18261826
CpeURIs: []string{"cpe:/a:microsoft:internet_explorer:10"},
18271827
},
1828-
want: "",
1828+
want: "unknown",
18291829
},
18301830
{
18311831
name: "package unfixed",
@@ -2082,3 +2082,90 @@ func TestVulnInfo_MaxCvss40Score(t *testing.T) {
20822082
})
20832083
}
20842084
}
2085+
2086+
func TestVulnInfos_FormatFixedStatus(t *testing.T) {
2087+
type args struct {
2088+
packs Packages
2089+
}
2090+
tests := []struct {
2091+
name string
2092+
v VulnInfos
2093+
args args
2094+
want string
2095+
}{
2096+
{
2097+
name: "empty",
2098+
v: VulnInfos{},
2099+
want: "0/0 Fixed",
2100+
},
2101+
{
2102+
name: "package fixed",
2103+
v: VulnInfos{
2104+
"CVE-2024-0001": {
2105+
CveID: "CVE-2024-0001",
2106+
AffectedPackages: PackageFixStatuses{
2107+
{Name: "bash", NotFixedYet: false},
2108+
},
2109+
},
2110+
},
2111+
args: args{
2112+
packs: Packages{"bash": {Name: "bash", Version: "5.0-4", NewVersion: "5.1-1"}},
2113+
},
2114+
want: "1/1 Fixed",
2115+
},
2116+
{
2117+
name: "package unfixed",
2118+
v: VulnInfos{
2119+
"CVE-2024-0001": {
2120+
CveID: "CVE-2024-0001",
2121+
AffectedPackages: PackageFixStatuses{
2122+
{Name: "bash", NotFixedYet: true},
2123+
},
2124+
},
2125+
},
2126+
want: "0/1 Fixed",
2127+
},
2128+
{
2129+
name: "cpe counted as unknown",
2130+
v: VulnInfos{
2131+
"CVE-2024-0001": {
2132+
CveID: "CVE-2024-0001",
2133+
CpeURIs: []string{"cpe:/a:vendor:product:1.0"},
2134+
},
2135+
},
2136+
want: "0/1 Fixed",
2137+
},
2138+
{
2139+
name: "mixed: package fixed + package unfixed + cpe",
2140+
v: VulnInfos{
2141+
"CVE-2024-0001": {
2142+
CveID: "CVE-2024-0001",
2143+
AffectedPackages: PackageFixStatuses{
2144+
{Name: "bash", NotFixedYet: false},
2145+
},
2146+
},
2147+
"CVE-2024-0002": {
2148+
CveID: "CVE-2024-0002",
2149+
AffectedPackages: PackageFixStatuses{
2150+
{Name: "vim", NotFixedYet: true},
2151+
},
2152+
},
2153+
"CVE-2024-0003": {
2154+
CveID: "CVE-2024-0003",
2155+
CpeURIs: []string{"cpe:/a:vendor:product:1.0"},
2156+
},
2157+
},
2158+
args: args{
2159+
packs: Packages{"bash": {Name: "bash", Version: "5.0-4", NewVersion: "5.1-1"}},
2160+
},
2161+
want: "1/3 Fixed",
2162+
},
2163+
}
2164+
for _, tt := range tests {
2165+
t.Run(tt.name, func(t *testing.T) {
2166+
if got := tt.v.FormatFixedStatus(tt.args.packs); got != tt.want {
2167+
t.Errorf("VulnInfos.FormatFixedStatus() = %v, want %v", got, tt.want)
2168+
}
2169+
})
2170+
}
2171+
}

0 commit comments

Comments
 (0)