+
+ \d+)/$", views.VendorViewAPI.as_view(), name="vendorview"),
- re_path("^api/(?P\d+)/vendors/$", views.VendorViewAPI.as_view(), name="vendorview"),
- re_path("^api/(?P\d+)/csaf/$", views.CaseCSAFAPIView.as_view(), name="vulcsaf"),
- re_path("^vendors/(?P\d+)/$", RedirectView.as_view(pattern_name="vincepub:vendorview")),
- re_path("^api/vuls/(?P\d+)/$", views.VulViewAPI.as_view(), name="vulview"),
- re_path("^api/vuls/cve/(?P\d+)-(?P\d+)/$", views.CVEVulViewAPI.as_view(), name="cvevulview"),
- re_path("^api/(?P\d+)/vuls/$", views.VulViewAPI.as_view(), name="vulview"),
- re_path("^api/vendors/vuls/(?P\d+)/$", views.VendorVulViewAPI.as_view(), name="vendorvulview"),
- re_path("^api/(?P\d+)/vendors/vuls/$", views.VendorVulViewAPI.as_view(), name="vendorvulview"),
- re_path("^api/(?P(?!0000)\d{4})/(?P0?[1-9]|1[012])/$", views.VUNoteViewByMonth.as_view()),
+ re_path(r"^api/vendors/(?P\d+)/$", views.VendorViewAPI.as_view(), name="vendorview"),
+ re_path(r"^api/(?P\d+)/vendors/$", views.VendorViewAPI.as_view(), name="vendorview"),
+ re_path(r"^api/(?P\d+)/csaf/$", views.CaseCSAFAPIView.as_view(), name="vulcsaf"),
+ re_path(r"^vendors/(?P\d+)/$", RedirectView.as_view(pattern_name="vincepub:vendorview")),
+ re_path(r"^api/vuls/(?P\d+)/$", views.VulViewAPI.as_view(), name="vulview"),
+ re_path(r"^api/vuls/cve/(?P\d+)-(?P\d+)/$", views.CVEVulViewAPI.as_view(), name="cvevulview"),
+ re_path(r"^api/(?P\d+)/vuls/$", views.VulViewAPI.as_view(), name="vulview"),
+ re_path(r"^api/vendors/vuls/(?P\d+)/$", views.VendorVulViewAPI.as_view(), name="vendorvulview"),
+ re_path(r"^api/(?P\d+)/vendors/vuls/$", views.VendorVulViewAPI.as_view(), name="vendorvulview"),
+ re_path(r"^api/(?P(?!0000)\d{4})/(?P0?[1-9]|1[012])/$", views.VUNoteViewByMonth.as_view()),
re_path(
- "^api/(?P(?!0000)\d{4})/(?P0?[1-9]|1[012])/summary/$", views.VUNoteViewByMonthSummary.as_view()
+ r"^api/(?P(?!0000)\d{4})/(?P0?[1-9]|1[012])/summary/$", views.VUNoteViewByMonthSummary.as_view()
),
- re_path("^api/(?P(?!0000)\d{4})/summary/$", views.VUNoteViewByYearSummary.as_view()),
- re_path("^api/vendors/(?P(?!0000)\d{4})/(?P0?[1-9]|1[012])/$", views.VendorViewByMonth.as_view()),
+ re_path(r"^api/(?P(?!0000)\d{4})/summary/$", views.VUNoteViewByYearSummary.as_view()),
+ re_path(r"^api/vendors/(?P(?!0000)\d{4})/(?P0?[1-9]|1[012])/$", views.VendorViewByMonth.as_view()),
re_path(
- "^api/vendors/(?P(?!0000)\d{4})/(?P0?[1-9]|1[012])/summary/$",
+ r"^api/vendors/(?P(?!0000)\d{4})/(?P0?[1-9]|1[012])/summary/$",
views.VendorViewByMonthSummary.as_view(),
),
- re_path("^api/vendors/(?P(?!0000)\d{4})/summary/$", views.VendorViewByYearSummary.as_view()),
+ re_path(r"^api/vendors/(?P(?!0000)\d{4})/summary/$", views.VendorViewByYearSummary.as_view()),
# path("api/vulreport/", views.VulReportAPIView.as_view(), name="vul_report_api"),
re_path("^id/(?P[A-Z0-9]+-[A-Z0-9]+)/?$", views.OldVendorView.as_view(), name="oldvendorview"),
- re_path("^id/(?P\d+)/?$", views.VUView.as_view(), name="vudetail"),
+ re_path(r"^id/(?P\d+)/?$", views.VUView.as_view(), name="vudetail"),
re_path("^vendor/(?PVU#[0-9]+)/$", views.VendorView.as_view(), name="vendor"),
re_path("^vendorstatus/(?PVU#[0-9]+)/$", views.VendorStatusView.as_view(), name="vendorstatus"),
re_path("^bypublic/(?Pasc)/$", views.DatePublicView.as_view(), name="viewbypublic"),
diff --git a/vincepub/views.py b/vincepub/views.py
index 1ebf343..1a05090 100644
--- a/vincepub/views.py
+++ b/vincepub/views.py
@@ -848,7 +848,7 @@ def post(self, request, *args, **kwargs):
if "years" in self.request.POST:
yearlist = self.request.POST.getlist("years")
for year in yearlist:
- year = re.sub("[^\d]", "", year)
+ year = re.sub(r"[^\d]", "", year)
if year != "":
datefilter.append(Q(datefirstpublished__year=year))
@@ -1532,8 +1532,8 @@ def get_view_name(self):
return "Vulnerability Notes Published by Month"
def get_queryset(self):
- year = re.sub("[^\d]", "", self.kwargs["year"])
- month = re.sub("[^\d]", "", self.kwargs["month"])
+ year = re.sub(r"[^\d]", "", self.kwargs["year"])
+ month = re.sub(r"[^\d]", "", self.kwargs["month"])
return VUReport.objects.filter(datefirstpublished__year=year, datefirstpublished__month=month)
@@ -1541,7 +1541,7 @@ class VUNoteViewByYear(PublicListAPIView):
serializer_class = serializers.VUReportSerializer
def get_queryset(self):
- year = re.sub("[^\d]", "", self.kwargs["year"])
+ year = re.sub(r"[^\d]", "", self.kwargs["year"])
return VUReport.objects.filter(datefirstpublished__year=year)
@@ -1586,16 +1586,16 @@ def get_view_name(self):
return "Vendors By Month"
def get_queryset(self):
- year = re.sub("[^\d]", "", self.kwargs["year"])
- month = re.sub("[^\d]", "", self.kwargs["month"])
+ year = re.sub(r"[^\d]", "", self.kwargs["year"])
+ month = re.sub(r"[^\d]", "", self.kwargs["month"])
reports = VUReport.objects.filter(datefirstpublished__year=year, datefirstpublished__month=month).values_list(
"vuid", flat=True
)
return VendorRecord.objects.filter(vuid__in=reports)
def get(self, request, *args, **kwargs):
- year = re.sub("[^\d]", "", self.kwargs["year"])
- month = re.sub("[^\d]", "", self.kwargs["month"])
+ year = re.sub(r"[^\d]", "", self.kwargs["year"])
+ month = re.sub(r"[^\d]", "", self.kwargs["month"])
reports = VUReport.objects.filter(datefirstpublished__year=year, datefirstpublished__month=month).values_list(
"idnumber", flat=True
)
@@ -1610,7 +1610,7 @@ class VendorViewByYear(PublicListAPIView):
serializer_class = serializers.VendorRecordSerializer
def get_queryset(self):
- year = re.sub("[^\d]", "", self.kwargs["year"])
+ year = re.sub(r"[^\d]", "", self.kwargs["year"])
reports = VUReport.objects.filter(datefirstpublished__year=year).values_list("vuid", flat=True)
return VendorRecord.objects.filter(vuid__in=reports)
@@ -1621,8 +1621,8 @@ def get_view_name(self):
def summarize(self, request, *args, **kwargs):
# make sure the filters of the parent class get applied
- year = re.sub("[^\d]", "", self.kwargs["year"])
- month = re.sub("[^\d]", "", self.kwargs["month"])
+ year = re.sub(r"[^\d]", "", self.kwargs["year"])
+ month = re.sub(r"[^\d]", "", self.kwargs["month"])
reports = VUReport.objects.filter(datefirstpublished__year=year, datefirstpublished__month=month).values_list(
"idnumber", flat=True
)
@@ -1705,8 +1705,8 @@ class CVEVulViewAPI(PublicAPIView):
def get(self, request, *args, **kwargs):
# Be safe and remove all alpha character if this view
# is accessed some other way than URL regex map
- year = re.sub("[^\d]", "", self.kwargs["year"])
- pk = re.sub("[^\d]", "", self.kwargs["pk"])
+ year = re.sub(r"[^\d]", "", self.kwargs["year"])
+ pk = re.sub(r"[^\d]", "", self.kwargs["pk"])
cve = f"CVE-{year}-{pk}"
cvewo = f"{year}-{pk}"
report = None
@@ -1780,7 +1780,7 @@ def get_view_name(self):
return "Public Vulnerability Advisory in CSAF format"
def get_object(self):
- svuid = re.sub("[^\d]", "", self.kwargs["vuid"])
+ svuid = re.sub(r"[^\d]", "", self.kwargs["vuid"])
vr = VUReport.objects.filter(idnumber=svuid).first()
if not vr:
self.is_empty = True
diff --git a/vinny/fixtures/auth.json b/vinny/fixtures/auth.json
new file mode 100644
index 0000000..9c55bb9
--- /dev/null
+++ b/vinny/fixtures/auth.json
@@ -0,0 +1,52 @@
+[
+ {
+ "model": "auth.group",
+ "pk": 1,
+ "fields": {
+ "name": "vincetrack",
+ "permissions": []
+ }
+ },
+ {
+ "model": "auth.group",
+ "pk": 2,
+ "fields": {
+ "name": "vince_group_admin",
+ "permissions": []
+ }
+ },
+ {
+ "model": "auth.group",
+ "pk": 3,
+ "fields": {
+ "name": "vince_limited",
+ "permissions": []
+ }
+ },
+ {
+ "model": "auth.group",
+ "pk": 4,
+ "fields": {
+ "name": "vince",
+ "permissions": []
+ }
+ },
+ {
+ "model": "auth.user",
+ "pk": 1,
+ "fields": {
+ "password": "!unusable_password_hash_not_for_login",
+ "last_login": null,
+ "is_superuser": false,
+ "username": "vincecomm_user",
+ "first_name": "Vince",
+ "last_name": "Comm",
+ "email": "vincecomm@example.org",
+ "is_staff": false,
+ "is_active": true,
+ "date_joined": "2022-01-01T00:00:00Z",
+ "groups": [1],
+ "user_permissions": []
+ }
+ }
+]
diff --git a/vinny/forms.py b/vinny/forms.py
index 0296f8d..47b38e3 100644
--- a/vinny/forms.py
+++ b/vinny/forms.py
@@ -996,7 +996,7 @@ def __init__(self, *args, **kwargs):
# phone numbers vary greatly world-wide, so best we can do is verify
# that no "weird" characters are entered.
def validate_phone_number(value):
- phone_re = "[^0-9()+.,\- ]" # set of all things except phone number characters and commas
+ phone_re = r"[^0-9()+.,\- ]" # set of all things except phone number characters and commas
if search(phone_re, value) is not None:
raise ValidationError("%s contains non-telephone characters" % value)
diff --git a/vinny/tests/__init__.py b/vinny/tests/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/vinny/tests/test_cvevulapi.py b/vinny/tests/test_cvevulapi.py
new file mode 100644
index 0000000..ec24fe4
--- /dev/null
+++ b/vinny/tests/test_cvevulapi.py
@@ -0,0 +1,156 @@
+#########################################################################
+# VINCE
+#
+# Test for CVEVulAPIView
+#
+#########################################################################
+from django.test import TestCase
+from django.contrib.auth.models import User
+from django.utils import timezone
+from rest_framework.test import APIClient
+from rest_framework.authtoken.models import Token
+from unittest.mock import Mock, patch
+from vincepub.models import VUReport
+from datetime import datetime, timedelta
+import json
+
+
+class CVEVulAPIViewTestCase(TestCase):
+ databases = {"default", "vincecomm", "vincepub"}
+ """Test case for CVEVulAPIView with mock CVE dataset"""
+
+ def setUp(self):
+ """Set up test fixtures"""
+ self.client = APIClient()
+ # Create mock VUReport with 10 CVE records
+ self.create_mock_vureport()
+
+ def create_mock_vureport(self):
+ """Create a VUReport with 10 CVE records with CVE-1900- prefix"""
+ cve_ids = [f"CVE-1900-{str(i).zfill(4)}" for i in range(1, 11)]
+ print(cve_ids)
+ now = timezone.now()
+
+ self.vureport = VUReport.objects.create(
+ vuid='VU#123456',
+ idnumber='VU-123456',
+ name='Test Vulnerability Note with Multiple CVEs',
+ overview='This is a test vulnerability note containing 10 CVE records',
+ cveids=cve_ids,
+ datefirstpublished=now,
+ dateupdated=now,
+ revision=1,
+ publish=True,
+ author='Test Author',
+ public=['https://example.com/ref1', 'https://example.com/ref2'],
+ )
+
+ def test_cve_lookup_returns_vureport_data(self):
+ """Test that CVEVulAPIView returns the VUReport data for a valid CVE"""
+ # Test with the first CVE in the dataset: CVE-1900-0001
+ year = 1900
+ pk = 1
+
+ with patch('vinny.views.VUReport.objects.raw') as mock_raw:
+ # Mock the raw query to return our test VUReport
+ mock_raw.return_value = [self.vureport]
+
+ with patch('vinny.views.create_record_of_API_access'):
+ response = self.client.get(
+ f'/api/vuls/cve/{year}-{pk:04d}/',
+ format='json'
+ )
+
+ # For this to work, you may need to check the actual endpoint URL
+ # Adjust based on your URL configuration
+ self.assertIn(response.status_code, [200, 404]) # 404 if endpoint not accessible in test
+
+ def test_cve_lookup_with_multiple_cves_in_report(self):
+ """Test that the VUReport contains all 10 CVE records"""
+ # Verify the VUReport has exactly 10 CVE IDs
+ self.assertEqual(len(self.vureport.cveids), 10)
+
+ # Verify all CVE IDs follow the CVE-1900- pattern
+ for cve_id in self.vureport.cveids:
+ self.assertTrue(cve_id.startswith('CVE-1900-'))
+
+ # Verify CVE IDs are in sequence
+ expected_cves = [f"CVE-1900-{str(i).zfill(4)}" for i in range(1, 11)]
+ self.assertEqual(self.vureport.cveids, expected_cves)
+
+ def test_cve_ids_have_correct_format(self):
+ """Test that all CVE IDs follow the correct CVE-YYYY-NNNN format"""
+ for cve_id in self.vureport.cveids:
+ # Check format: CVE-YYYY-NNNN where YYYY is year and NNNN is number
+ self.assertRegex(cve_id, r'^CVE-\d{4}-\d{4}$')
+
+ def test_vureport_metadata(self):
+ """Test that VUReport contains required metadata"""
+ self.assertEqual(self.vureport.vuid, 'VU#123456')
+ self.assertEqual(self.vureport.idnumber, 'VU-123456')
+ self.assertIsNotNone(self.vureport.datefirstpublished)
+ self.assertIsNotNone(self.vureport.dateupdated)
+ self.assertTrue(self.vureport.publish)
+
+ def test_vureport_public_references(self):
+ """Test that VUReport contains public references"""
+ self.assertIsNotNone(self.vureport.public)
+ self.assertIsInstance(self.vureport.public, list)
+ self.assertGreater(len(self.vureport.public), 0)
+
+
+class CVEVulAPIViewIntegrationTestCase(TestCase):
+ """Integration test case for CVEVulAPIView"""
+ databases = {"default", "vincecomm", "vincepub"}
+
+ def setUp(self):
+ """Set up for integration tests"""
+ self.client = APIClient()
+
+ # Create multiple VUReports with different CVE sets
+ self.create_multiple_vureports()
+
+ def create_multiple_vureports(self):
+ """Create multiple VUReports for integration testing"""
+ now = timezone.now()
+
+ # VUReport 1: CVE-1900-0001 through CVE-1900-0010
+ cve_ids_1 = [f"CVE-1900-{str(i).zfill(4)}" for i in range(1, 11)]
+ self.vureport_1 = VUReport.objects.create(
+ vuid='VU#100001',
+ idnumber='VU-100001',
+ name='Test Report 1',
+ cveids=cve_ids_1,
+ datefirstpublished=now,
+ dateupdated=now,
+ publish=True,
+ )
+
+ # VUReport 2: CVE-1900-0011 through CVE-1900-0020
+ cve_ids_2 = [f"CVE-1900-{str(i).zfill(4)}" for i in range(11, 21)]
+ self.vureport_2 = VUReport.objects.create(
+ vuid='VU#100002',
+ idnumber='VU-100002',
+ name='Test Report 2',
+ cveids=cve_ids_2,
+ datefirstpublished=now,
+ dateupdated=now,
+ publish=True,
+ )
+
+ def test_multiple_vureports_with_distinct_cve_sets(self):
+ """Test that multiple VUReports maintain distinct CVE sets"""
+ vureports = VUReport.objects.all()
+ self.assertEqual(vureports.count(), 2)
+
+ # Verify they have different CVE IDs
+ cve_ids_1 = set(self.vureport_1.cveids)
+ cve_ids_2 = set(self.vureport_2.cveids)
+
+ # No overlap between the two sets
+ self.assertEqual(len(cve_ids_1.intersection(cve_ids_2)), 0)
+
+ # Each has 10 CVEs
+ self.assertEqual(len(cve_ids_1), 10)
+ self.assertEqual(len(cve_ids_2), 10)
+
diff --git a/vinny/tests/test_get_statements_view_permissions.py b/vinny/tests/test_get_statements_view_permissions.py
new file mode 100644
index 0000000..b4c5b09
--- /dev/null
+++ b/vinny/tests/test_get_statements_view_permissions.py
@@ -0,0 +1,172 @@
+from django.test import TestCase, RequestFactory
+from django.contrib.auth.models import User, Group
+from unittest.mock import patch, MagicMock
+
+from vinny.views import GetStatementView
+
+
+class DummyGroupQuerySet:
+ """
+ Minimal stand-in for the queryset returned by _my_groups_for_case().
+ Supports:
+ - exists()
+ - filter(id=...).exists()
+ """
+ def __init__(self, ids):
+ self.ids = set(ids)
+
+ def exists(self):
+ return len(self.ids) > 0
+
+ def filter(self, **kwargs):
+ member_id = kwargs.get("id")
+ if member_id in self.ids:
+ return DummyGroupQuerySet([member_id])
+ return DummyGroupQuerySet([])
+
+
+class GetStatementViewPermissionTests(TestCase):
+ databases = {"default", "vincecomm"}
+ def setUp(self):
+ self.factory = RequestFactory()
+ self.user = User.objects.create_user(
+ username="user@example.com",
+ email="user@example.com",
+ password="pw",
+ )
+
+ # Staff/superuser bypass user for dedicated test
+ self.admin = User.objects.create_user(
+ username="admin@example.com",
+ email="admin@example.com",
+ password="pw",
+ is_staff=True,
+ )
+
+ self.case = MagicMock()
+ self.case.id = 101
+
+ self.member_owned = MagicMock()
+ self.member_owned.id = 201
+ self.member_owned.case = self.case
+
+ self.member_other = MagicMock()
+ self.member_other.id = 202
+ self.member_other.case = self.case
+
+ def _build_view(self, user, kwargs):
+ req = self.factory.get("/fake-url/")
+ req.user = user
+ view = GetStatementView()
+ view.request = req
+ view.kwargs = kwargs
+ return view
+
+ @patch("vinny.views.PendingTestMixin.test_func", return_value=True)
+ @patch("vinny.views._is_my_case", return_value=True)
+ @patch("vinny.views.get_object_or_404")
+ @patch("vinny.views._my_groups_for_case")
+ def test_member_optional_none_allows_when_user_has_any_allowed_group(
+ self, mock_my_groups, mock_get_case, mock_is_my_case, mock_pending,
+ ):
+ mock_get_case.return_value = self.case
+ mock_my_groups.return_value = DummyGroupQuerySet([self.member_owned.id])
+
+ view = self._build_view(self.user, {"pk": self.case.id})
+ self.assertTrue(view.test_func())
+
+ @patch("vinny.views.PendingTestMixin.test_func", return_value=True)
+ @patch("vinny.views._is_my_case", return_value=True)
+ @patch("vinny.views.get_object_or_404")
+ @patch("vinny.views._my_groups_for_case")
+ def test_member_optional_none_denies_when_user_has_no_allowed_group(
+ self, mock_my_groups, mock_get_case, mock_is_my_case, mock_pending,
+ ):
+ mock_get_case.return_value = self.case
+ mock_my_groups.return_value = DummyGroupQuerySet([])
+
+ view = self._build_view(self.user, {"pk": self.case.id})
+ self.assertFalse(view.test_func())
+
+ @patch("vinny.views.PendingTestMixin.test_func", return_value=True)
+ @patch("vinny.views._is_my_case", return_value=True)
+ @patch("vinny.views.get_object_or_404")
+ @patch("vinny.views._my_groups_for_case")
+ @patch("vinny.views.CaseMember")
+ def test_member_matches_my_group_allows(
+ self, mock_case_member_cls, mock_my_groups, mock_get_case, mock_is_my_case, mock_pending
+ ):
+ mock_get_case.return_value = self.case
+ mock_my_groups.return_value = DummyGroupQuerySet([self.member_owned.id])
+
+ mock_case_member_cls.objects.filter.return_value.first.return_value = self.member_owned
+
+ view = self._build_view(self.user, {"pk": self.case.id, "member": self.member_owned.id})
+ self.assertTrue(view.test_func())
+
+ @patch("vinny.views.PendingTestMixin.test_func", return_value=True)
+ @patch("vinny.views._is_my_case", return_value=True)
+ @patch("vinny.views.get_object_or_404")
+ @patch("vinny.views._my_groups_for_case")
+ @patch("vinny.views.CaseMember")
+ @patch("vinny.views.CaseStatement")
+ def test_member_not_mine_but_shared_statement_allows(
+ self,
+ mock_case_statement_cls,
+ mock_case_member_cls,
+ mock_my_groups,
+ mock_get_case,
+ mock_is_my_case,
+ mock_pending,
+ ):
+ mock_get_case.return_value = self.case
+ mock_my_groups.return_value = DummyGroupQuerySet([self.member_owned.id]) # user owns 201, requests 202
+
+ mock_case_member_cls.objects.filter.return_value.first.return_value = self.member_other
+ mock_case_statement_cls.objects.filter.return_value.exists.return_value = True
+
+ view = self._build_view(self.user, {"pk": self.case.id, "member": self.member_other.id})
+ self.assertTrue(view.test_func())
+
+ @patch("vinny.views.PendingTestMixin.test_func", return_value=True)
+ @patch("vinny.views._is_my_case", return_value=True)
+ @patch("vinny.views.get_object_or_404")
+ @patch("vinny.views._my_groups_for_case")
+ @patch("vinny.views.CaseMember")
+ @patch("vinny.views.CaseStatement")
+ def test_member_not_mine_and_not_shared_denies(
+ self,
+ mock_case_statement_cls,
+ mock_case_member_cls,
+ mock_my_groups,
+ mock_get_case,
+ mock_is_my_case,
+ mock_pending,
+ ):
+ mock_get_case.return_value = self.case
+ mock_my_groups.return_value = DummyGroupQuerySet([self.member_owned.id])
+
+ mock_case_member_cls.objects.filter.return_value.first.return_value = self.member_other
+ mock_case_statement_cls.objects.filter.return_value.exists.return_value = False
+
+ view = self._build_view(self.user, {"pk": self.case.id, "member": self.member_other.id})
+ self.assertFalse(view.test_func())
+
+ @patch("vinny.views.PendingTestMixin.test_func", return_value=True)
+ @patch("vinny.views._is_my_case", return_value=True)
+ @patch("vinny.views.get_object_or_404")
+ def test_staff_bypass_allows(self, mock_get_case, mock_is_my_case, mock_pending):
+ mock_get_case.return_value = self.case
+
+ view = self._build_view(self.admin, {"pk": self.case.id, "member": 99999})
+ self.assertTrue(view.test_func())
+
+ @patch("vinny.views.PendingTestMixin.test_func", return_value=False)
+ @patch("vinny.views._is_my_case", return_value=True)
+ @patch("vinny.views.get_object_or_404")
+ def test_pending_mixin_failure_denies(self, mock_get_case, mock_is_my_case, mock_pending):
+ mock_get_case.return_value = self.case
+
+ view = self._build_view(self.user, {"pk": self.case.id, "member": self.member_owned.id})
+ self.assertFalse(view.test_func())
+
diff --git a/vinny/tests/test_modifyemail_idor.py b/vinny/tests/test_modifyemail_idor.py
new file mode 100644
index 0000000..a3d9081
--- /dev/null
+++ b/vinny/tests/test_modifyemail_idor.py
@@ -0,0 +1,135 @@
+import uuid
+
+from django.test import TestCase
+from django.urls import reverse
+from django.contrib.auth.models import User, Group
+from django.test import override_settings
+
+from vinny.models import (
+ VinceCommContact,
+ VinceCommEmail,
+ VinceCommGroupAdmin,
+ GroupContact,
+)
+from unittest.mock import patch
+
+def fake_send_ticket(*args, **kwargs):
+ return True
+
+@patch("vinny.views.contact_update.send_ticket", side_effect=fake_send_ticket)
+@patch("vinny.views.contact_update.create_contact_change", side_effect=fake_send_ticket)
+@override_settings(ALT_VERIFY_TOKEN=lambda user, session: True)
+class ModifyEmailNotificationsIDORTest(TestCase):
+ # Required because this codebase touches the vincecomm alias in auth/group checks
+ databases = {"default", "vincecomm"}
+
+ def setUp(self):
+ # User
+ self.password = "Passw0rd!123"
+ self.attacker = User.objects.db_manager("vincecomm").create_user(
+ username=f"attacker-{uuid.uuid4().hex[:6]}@example.com",
+ email=f"attacker-{uuid.uuid4().hex[:6]}@example.com",
+ password=self.password,
+ is_active=True,
+ )
+
+ # Ensure required role/group exists without PK assumptions
+ # (if fixture already has it, reuse; otherwise create)
+ self.vince_group_admin_group, _ = Group.objects.db_manager("vincecomm").get_or_create(name="vince_group_admin")
+ self.attacker.groups.add(self.vince_group_admin_group)
+
+ # Vendor A (attacker is admin here)
+ # Use unique vendor_id values to avoid collisions with fixtures
+ self.vendor_a = VinceCommContact.objects.db_manager("vincecomm").create(
+ vendor_id=10001 + int(uuid.uuid4().hex[:4], 16) % 50000,
+ vendor_name=f"Vendor A {uuid.uuid4().hex[:6]}",
+ vendor_type="Vendor",
+ active=True,
+ )
+ self.group_a = Group.objects.db_manager("vincecomm").create(name=f"group-a-{uuid.uuid4().hex[:8]}")
+ GroupContact.objects.db_manager("vincecomm").create(group=self.group_a, contact=self.vendor_a)
+
+ self.admin_email_a = VinceCommEmail.objects.db_manager("vincecomm").create(
+ contact=self.vendor_a,
+ email=self.attacker.email,
+ name="Attacker Admin",
+ status=True,
+ invited=False,
+ email_list=False,
+ email_type="Work",
+ email_function="TO",
+ )
+ VinceCommGroupAdmin.objects.db_manager("vincecomm").create(contact=self.vendor_a, email=self.admin_email_a)
+
+ # Vendor B (target)
+ self.vendor_b = VinceCommContact.objects.db_manager("vincecomm").create(
+ vendor_id=20001 + int(uuid.uuid4().hex[:4], 16) % 50000,
+ vendor_name=f"Vendor B {uuid.uuid4().hex[:6]}",
+ vendor_type="Vendor",
+ active=True,
+ )
+ self.group_b = Group.objects.db_manager("vincecomm").create(name=f"group-b-{uuid.uuid4().hex[:8]}")
+ GroupContact.objects.db_manager("vincecomm").create(group=self.group_b, contact=self.vendor_b)
+
+ self.victim_email = VinceCommEmail.objects.db_manager("vincecomm").create(
+ contact=self.vendor_b,
+ email=f"victim-{uuid.uuid4().hex[:6]}@vendorb.example",
+ name="Victim Contact",
+ status=True,
+ invited=False,
+ email_list=False,
+ email_type="Work",
+ email_function="TO",
+ )
+ profile = self.attacker.vinceprofile
+ profile.multifactor = True
+ profile.pending = False
+ profile.save()
+
+ self.client.force_login(
+ self.attacker,
+ backend="django.contrib.auth.backends.ModelBackend",
+ )
+
+ #self.client.login(username=self.attacker.username, password=self.password)
+
+ def test_idor_blocked_cannot_toggle_other_vendor_email(self, *_):
+ """
+ Attacker is valid admin for vendor_a, but tries to mutate vendor_b email by raw uid.
+ Expected: blocked (404) and victim record unchanged.
+ """
+ # URL pattern expected: vinny:changeemail(vendor_id, type, uid)
+ url = reverse("vinny:changeemail", args=[self.vendor_a.id, "email", self.victim_email.id])
+
+ response = self.client.post(url, follow=False)
+
+ self.assertEqual(response.status_code, 404)
+
+ self.victim_email.refresh_from_db()
+ self.assertEqual(self.victim_email.email_function, "TO")
+ self.assertEqual(self.victim_email.name, "Victim Contact")
+
+ def test_legitimate_same_vendor_toggle_still_works(self, *_):
+ """
+ Control test: admin can modify email that belongs to their own vendor.
+ """
+
+ own_vendor_email = VinceCommEmail.objects.db_manager("vincecomm").create(
+ contact=self.vendor_a,
+ email=f"user-{uuid.uuid4().hex[:6]}@vendora.example",
+ name="Own Vendor User",
+ status=True,
+ invited=False,
+ email_list=False,
+ email_type="Work",
+ email_function="TO",
+ )
+
+ url = reverse("vinny:changeemail", args=[self.vendor_a.id, "email", own_vendor_email.id])
+ response = self.client.post(url, follow=False)
+
+ # View redirects to vinny:admin on success
+ self.assertIn(response.status_code, [302, 303])
+
+ own_vendor_email.refresh_from_db()
+ self.assertEqual(own_vendor_email.email_function, "EMAIL")
diff --git a/vinny/tests/test_vince_attachment_permissions.py b/vinny/tests/test_vince_attachment_permissions.py
new file mode 100644
index 0000000..9e9ccf0
--- /dev/null
+++ b/vinny/tests/test_vince_attachment_permissions.py
@@ -0,0 +1,125 @@
+from unittest.mock import patch
+
+from django.contrib.auth.models import User
+from django.test import TestCase, RequestFactory
+from django.http import Http404
+
+from vinny.views import VinceAttachmentView
+
+
+class DummyAttachment:
+ def __init__(self, case=None, shared=False):
+ self.case = case
+ self.shared = shared
+
+
+class DummyCase:
+ def __init__(self, id=123):
+ self.id = id
+
+
+class VinceAttachmentViewTrackAccessTests(TestCase):
+ databases = {"default", "vincecomm"}
+ def setUp(self):
+ self.factory = RequestFactory()
+
+ self.normal_user = User.objects.create_user(
+ username="normal",
+ email="normal@example.com",
+ password="x",
+ is_staff=False,
+ is_superuser=False,
+ )
+ self.staff_user = User.objects.create_user(
+ username="staff",
+ email="staff@example.com",
+ password="x",
+ is_staff=True,
+ is_superuser=False,
+ )
+ self.super_user = User.objects.create_user(
+ username="super",
+ email="super@example.com",
+ password="x",
+ is_staff=True,
+ is_superuser=True,
+ )
+
+ def _build_view(self, user):
+ request = self.factory.get("/fake/track-attachment")
+ request.user = user
+
+ view = VinceAttachmentView()
+ view.request = request
+ view.kwargs = {"type": "track", "path": "fake-uuid"}
+ return view
+
+ @patch("vinny.views.PendingTestMixin.test_func", return_value=True)
+ @patch("vinny.views.get_object_or_404", return_value=DummyCase(id=123))
+ @patch("vinny.views._is_my_case", return_value=True)
+ @patch("vinny.views.VinceTrackAttachment.objects.filter")
+ def test_track_unshared_inaccessible_to_normal_user(
+ self, mock_filter, _mock_is_my_case, _mock_get_case, _mock_pending
+ ):
+ mock_filter.return_value.first.return_value = DummyAttachment(
+ case=DummyCase(id=123),
+ shared=False,
+ )
+ view = self._build_view(self.normal_user)
+
+ # With your patched logic, this should be False for normal users
+ with self.assertRaises(Http404):
+ view.test_func()
+
+ @patch("vinny.views.PendingTestMixin.test_func", return_value=True)
+ @patch("vinny.views.get_object_or_404", return_value=DummyCase(id=123))
+ @patch("vinny.views._is_my_case", return_value=True)
+ @patch("vinny.views.VinceTrackAttachment.objects.filter")
+ def test_track_shared_accessible_to_normal_user(
+ self, mock_filter, _mock_is_my_case, _mock_get_case, _mock_pending
+ ):
+ mock_filter.return_value.first.return_value = DummyAttachment(
+ case=DummyCase(id=123),
+ shared=True,
+ )
+ view = self._build_view(self.normal_user)
+
+ self.assertTrue(view.test_func())
+
+ @patch("vinny.views.PendingTestMixin.test_func", return_value=True)
+ @patch("vinny.views.get_object_or_404", return_value=DummyCase(id=123))
+ @patch("vinny.views._is_my_case", return_value=True)
+ @patch("vinny.views.VinceTrackAttachment.objects.filter")
+ def test_track_unshared_accessible_to_staff(
+ self, mock_filter, _mock_is_my_case, _mock_get_case, _mock_pending
+ ):
+ mock_filter.return_value.first.return_value = DummyAttachment(
+ case=DummyCase(id=123),
+ shared=False,
+ )
+ view = self._build_view(self.staff_user)
+
+ self.assertTrue(view.test_func())
+
+ @patch("vinny.views.PendingTestMixin.test_func", return_value=True)
+ @patch("vinny.views.get_object_or_404", return_value=DummyCase(id=123))
+ @patch("vinny.views._is_my_case", return_value=True)
+ @patch("vinny.views.VinceTrackAttachment.objects.filter")
+ def test_track_unshared_accessible_to_superuser(
+ self, mock_filter, _mock_is_my_case, _mock_get_case, _mock_pending
+ ):
+ mock_filter.return_value.first.return_value = DummyAttachment(
+ case=DummyCase(id=123),
+ shared=False,
+ )
+ view = self._build_view(self.super_user)
+
+ self.assertTrue(view.test_func())
+
+ @patch("vinny.views.VinceTrackAttachment.objects.filter")
+ def test_track_missing_attachment_raises_404(self, mock_filter):
+ mock_filter.return_value.first.return_value = None
+ view = self._build_view(self.normal_user)
+
+ with self.assertRaises(Http404):
+ view.test_func()
diff --git a/vinny/tests/test_vulreport_api.py b/vinny/tests/test_vulreport_api.py
new file mode 100644
index 0000000..48f44fe
--- /dev/null
+++ b/vinny/tests/test_vulreport_api.py
@@ -0,0 +1,344 @@
+#########################################################################
+# VINCE
+#
+# Copyright 2023 Carnegie Mellon University.
+#
+# NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING
+# INSTITUTE MATERIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON
+# UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED,
+# AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR
+# PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE
+# MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND
+# WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.
+#
+# Released under a MIT (SEI)-style license, please see license.txt or contact
+# permission@sei.cmu.edu for full terms.
+#
+# [DISTRIBUTION STATEMENT A] This material has been approved for public
+# release and unlimited distribution. Please see Copyright notice for non-US
+# Government use and distribution.
+#
+# Carnegie Mellon®, CERT® and CERT Coordination Center® are registered in the
+# U.S. Patent and Trademark Office by Carnegie Mellon University.
+#
+# This Software includes and/or makes use of Third-Party Software each subject
+# to its own license.
+#
+# DM21-1126
+########################################################################
+import json
+from contextlib import ExitStack
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from django.contrib.auth.models import User
+from django.core.files.uploadedfile import SimpleUploadedFile
+from django.test import TestCase
+from rest_framework.test import APIRequestFactory, force_authenticate
+
+from vinny.views import CommVulReportAPIView
+
+
+class _MockTemplate:
+ def render(self, context=None):
+ return "rendered"
+
+
+class _MockS3Client:
+ def copy_object(self, **kwargs):
+ return {"ok": True}
+
+ def put_object(self, **kwargs):
+ return {"ok": True}
+
+
+class _MockSESClient:
+ def send_email(self, **kwargs):
+ return {"MessageId": "test-message-id"}
+
+
+class _MockCaseRequest:
+ def __init__(self, user_file=None):
+ self.user = None
+ self.user_file = user_file
+
+ def save(self):
+ return None
+
+
+class CommVulReportAPIViewTests(TestCase):
+ databases = {"default", "vincecomm"}
+ def setUp(self):
+ self.factory = APIRequestFactory()
+ self.view = CommVulReportAPIView.as_view()
+ self.user = User.objects.create_user(
+ username="tester@example.com",
+ email="tester@example.com",
+ password="password123",
+ )
+ self.url = "/vince/comm/api/vulreport/"
+ self.csaf_payload = {
+ "document": {
+ "publisher": {
+ "name": "Alice",
+ "issuing_authority": "Org",
+ "namespace": "mailto:alice@example.com",
+ },
+ "acknowledgments": [{"name": "Alice"}],
+ },
+ "product_tree": {
+ "branches": [
+ {
+ "category": "vendor",
+ "name": "Vendor A",
+ "branches": [
+ {
+ "category": "product_name",
+ "name": "Product A",
+ "branches": [{"category": "product_version", "name": "1.2.3"}],
+ }
+ ],
+ },
+ {
+ "category": "vendor",
+ "name": "Vendor B",
+ "branches": [
+ {
+ "category": "product_name",
+ "name": "Product B",
+ "branches": [{"category": "product_version", "name": "2.0.0"}],
+ }
+ ],
+ },
+ ]
+ },
+ "vulnerabilities": [
+ {
+ "title": "Fallback title",
+ "notes": [
+ {"category": "description", "text": "Description from note"},
+ {"title": "Vulnerability Discovery Method", "text": "Discovery text"},
+ ],
+ "threats": [
+ {"category": "impact", "details": "Impact details"},
+ {"category": "exploit_status", "details": "Exploit details"},
+ ],
+ "involvements": [
+ {
+ "status": "contact_attempted",
+ "summary": "Reached out to vendor",
+ "date": "2026-01-01T00:00:00Z",
+ },
+ {"status": "open", "party": "discoverer", "summary": "Public disclosure timeline"},
+ ],
+ "references": [
+ {"summary": "Publicly known reference", "url": "https://example.com/public"},
+ {"summary": "Actively exploited in the wild", "url": "https://example.com/exploit"},
+ ],
+ "metrics":[{"content":{"ssvc_v2":{"schemaVersion":"2.0.0","selections":[{"key":"E","name":"Exploitation","namespace":"ssvc","values":[{"key":"A","name":"Active"}],"version":"1.1.0"}]}}}],
+ }
+ ],
+ "x_extensions": [
+ {
+ "content": {
+ "ics_impact": True,
+ "ai_ml_system": True,
+ "share_contact_with_vendor": True,
+ "multiple_vendors_impacted": False,
+ "multiple_vendors": ["Vendor C"],
+ "Tracking_IDs": "VU#123456",
+ "private_comments": "Private note",
+ }
+ }
+ ],
+ }
+
+ def _mock_boto_client(self, name, *args, **kwargs):
+ if name == "s3":
+ return _MockS3Client()
+ if name == "ses":
+ return _MockSESClient()
+ return SimpleNamespace()
+
+ def _patched_success_dependencies(self, form_save_side_effect=None):
+ stack = ExitStack()
+ self.addCleanup(stack.close)
+
+ mocks = {
+ "get_template": stack.enter_context(
+ patch("vinny.views.get_template", return_value=_MockTemplate())
+ ),
+ "send_sns_json": stack.enter_context(patch("vinny.views.send_sns_json")),
+ "send_sns": stack.enter_context(patch("vinny.views.send_sns")),
+ "record_access": stack.enter_context(patch("vinny.views.create_record_of_API_access")),
+ "get_vrf_id": stack.enter_context(patch("vinny.views.get_vrf_id", return_value="12345")),
+ "boto_client": stack.enter_context(patch("vinny.views.boto3.client")),
+ # autospec=True ensures first arg is the bound form instance (self)
+ "form_save": stack.enter_context(patch("vinny.views.CaseRequestForm.save", autospec=True)),
+ }
+
+ mocks["boto_client"].side_effect = self._mock_boto_client
+ if form_save_side_effect is None:
+ mocks["form_save"].side_effect = lambda form, *args, **kwargs: _MockCaseRequest()
+ else:
+ mocks["form_save"].side_effect = form_save_side_effect
+
+ return mocks
+
+ def test_application_json_csaf_success(self):
+ mocks = self._patched_success_dependencies()
+
+ request = self.factory.post(self.url, data=self.csaf_payload, format="json")
+ force_authenticate(request, user=self.user)
+
+ response = self.view(request)
+ payload = json.loads(response.content)
+
+ self.assertEqual(response.status_code, 201)
+ self.assertEqual(payload["status"], "success")
+ self.assertTrue(payload["vrf_id"].endswith("12345"))
+
+ self.assertIsNotNone(mocks["form_save"].call_args)
+ form_instance = mocks["form_save"].call_args.args[0]
+ mapped_data = form_instance.cleaned_data
+
+ self.assertEqual(mapped_data["vendor_name"], "Vendor A")
+ self.assertEqual(mapped_data["other_vendors"], "Vendor B")
+ self.assertEqual(mapped_data["product_name"], "Product A")
+ self.assertEqual(mapped_data["product_version"], "1.2.3,2.0.0")
+ self.assertEqual(mapped_data["multiplevendors"], "True")
+ self.assertEqual(mapped_data["comm_attempt"], "True")
+ self.assertEqual(mapped_data["vendor_communication"], "Reached out to vendor")
+ self.assertEqual(mapped_data["disclosure_plans"], "Public disclosure timeline")
+ self.assertEqual(mapped_data["vul_exploit"], "Exploit details")
+ self.assertEqual(mapped_data["vul_impact"], "Impact details")
+
+ submitted_payload = json.loads(mocks["send_sns_json"].call_args[0][2])
+ self.assertEqual(submitted_payload["metadata"]["csaf"], self.csaf_payload)
+ self.assertTrue(submitted_payload["metadata"]["ai_ml_system"])
+
+ def test_application_json_csaf_involvements_order_independent(self):
+ mocks = self._patched_success_dependencies()
+
+ payload = json.loads(json.dumps(self.csaf_payload))
+ payload["vulnerabilities"][0]["involvements"] = [
+ {"status": "not_contacted", "summary": "I have not attempted to contact any vendors"},
+ {"status": "open", "party": "vendor", "summary": "Vendor internal review"},
+ {"status": "contact_attempted", "summary": "Reached out later", "date": "2026-02-01T00:00:00Z"},
+ {"status": "open", "party": "discoverer", "summary": "Discoverer disclosure plan"},
+ ]
+
+ request = self.factory.post(self.url, data=payload, format="json")
+ force_authenticate(request, user=self.user)
+
+ response = self.view(request)
+ body = json.loads(response.content)
+
+ self.assertEqual(response.status_code, 201)
+ self.assertEqual(body["status"], "success")
+
+ self.assertIsNotNone(mocks["form_save"].call_args)
+ form_instance = mocks["form_save"].call_args.args[0]
+ mapped_data = form_instance.cleaned_data
+
+ self.assertEqual(mapped_data["comm_attempt"], "True")
+ self.assertEqual(mapped_data["vendor_communication"], "Reached out later")
+ self.assertEqual(mapped_data["first_contact"], "2026-02-01")
+ self.assertEqual(mapped_data["disclosure_plans"], "Discoverer disclosure plan")
+
+ def test_contact_attempted_without_date_returns_400(self):
+ payload = json.loads(json.dumps(self.csaf_payload))
+ payload["vulnerabilities"][0]["involvements"] = [
+ {"status": "contact_attempted", "summary": "Reached out to vendor"},
+ ]
+ request = self.factory.post(self.url, data=payload, format="json")
+ force_authenticate(request, user=self.user)
+
+ response = self.view(request)
+ body = json.loads(response.content)
+
+ self.assertEqual(response.status_code, 400)
+ self.assertEqual(
+ body["errors"]["csaf"][0],
+ "first_contact date is required when involvement status is contact_attempted.",
+ )
+
+ def test_multipart_csaf_with_file_success(self):
+ upload = SimpleUploadedFile("sample.txt", b"sample data", content_type="text/plain")
+ mocks = self._patched_success_dependencies(
+ form_save_side_effect=lambda form, *args, **kwargs: _MockCaseRequest(user_file=upload)
+ )
+
+ request = self.factory.post(
+ self.url,
+ data={"csaf": json.dumps(self.csaf_payload), "user_file": upload},
+ format="multipart",
+ )
+ force_authenticate(request, user=self.user)
+
+ response = self.view(request)
+ body = json.loads(response.content)
+
+ self.assertEqual(response.status_code, 201)
+ self.assertEqual(body["status"], "success")
+
+ submitted_payload = json.loads(mocks["send_sns_json"].call_args[0][2])
+ self.assertEqual(submitted_payload["metadata"]["csaf"], self.csaf_payload)
+ self.assertTrue(submitted_payload["metadata"]["ai_ml_system"])
+
+ def test_malformed_csaf_json_returns_400(self):
+ request = self.factory.post(self.url, data={"csaf": '{"document":'}, format="multipart")
+ force_authenticate(request, user=self.user)
+
+ response = self.view(request)
+ payload = json.loads(response.content)
+
+ self.assertEqual(response.status_code, 400)
+ self.assertIn("csaf", payload["errors"])
+
+ def test_csaf_missing_product_tree_categories_returns_400(self):
+ invalid_payload = {
+ **self.csaf_payload,
+ "product_tree": {"branches": [{"category": "vendor", "name": "Vendor A"}]},
+ }
+ request = self.factory.post(self.url, data=invalid_payload, format="json")
+ force_authenticate(request, user=self.user)
+
+ response = self.view(request)
+ payload = json.loads(response.content)
+
+ self.assertEqual(response.status_code, 400)
+ self.assertEqual(
+ payload["errors"]["csaf"][0],
+ "At least one value for vendor, product_name, and product_version is required.",
+ )
+
+ def test_legacy_form_submission_still_works(self):
+ self._patched_success_dependencies()
+
+ legacy_data = {
+ "contact_name": "Legacy User",
+ "contact_email": "legacy@example.com",
+ "product_name": "Legacy Product",
+ "product_version": "1.0",
+ "vul_description": "Description",
+ "vul_exploit": "Exploit",
+ "vul_impact": "Impact",
+ "vul_discovery": "Discovery",
+ "vul_public": "False",
+ "vul_exploited": "False",
+ "vul_disclose": "False",
+ "share_release": "True",
+ "credit_release": "True",
+ "comm_attempt": "False",
+ "multiplevendors": "False",
+ }
+
+ request = self.factory.post(self.url, data=legacy_data, format="multipart")
+ force_authenticate(request, user=self.user)
+
+ response = self.view(request)
+ payload = json.loads(response.content)
+
+ self.assertEqual(response.status_code, 201)
+ self.assertEqual(payload["status"], "success")
diff --git a/vinny/urls.py b/vinny/urls.py
index 749d3f3..98d5b26 100644
--- a/vinny/urls.py
+++ b/vinny/urls.py
@@ -56,76 +56,76 @@
views.VinceCommPrintReportsView.as_view(),
name="printreport",
),
- re_path("^case/summary/(?P\d+)/$", views.CaseSummaryView.as_view(), name="case_summary"),
- re_path("^case/request/(?P\d+)/$", views.RequestAccessView.as_view(), name="requestaccess"),
+ re_path(r"^case/summary/(?P\d+)/$", views.CaseSummaryView.as_view(), name="case_summary"),
+ re_path(r"^case/request/(?P\d+)/$", views.RequestAccessView.as_view(), name="requestaccess"),
path("preferences/", views.PreferencesView.as_view(), name="preferences"),
path("dashboard/filter/", views.DashboardCaseView.as_view(), name="dashboardfilter"),
path("limited/filter/", views.LimitedAccessSearch.as_view(), name="limitedfilter"),
path("reports/filter/", views.MyReportsFilterView.as_view(), name="myreportsfilter"),
path("contact/", views.ContactView.as_view(), name="contact"),
path("profile/newcolor/", views.GenerateNewRandomColor.as_view(), name="newcolor"),
- re_path("^contact/(?P\d+)/$", views.ContactView.as_view(), name="contact"),
+ re_path(r"^contact/(?P\d+)/$", views.ContactView.as_view(), name="contact"),
path("contact/multi/", views.MultipleContactView.as_view(), name="multiple_contacts"),
- re_path("^vc/contact/edit/(?P\d+)/$", views.EditContactView.as_view(), name="editcontact"),
- re_path("^contact/(?P\d+)/add/logo/$", views.ContactAddLogoView.as_view(), name="addlogo"),
+ re_path(r"^vc/contact/edit/(?P\d+)/$", views.EditContactView.as_view(), name="editcontact"),
+ re_path(r"^contact/(?P\d+)/add/logo/$", views.ContactAddLogoView.as_view(), name="addlogo"),
re_path(
- "^groupadmin/change/access/(?P\d+)/", views.ChangeDefaultCaseAccess.as_view(), name="changeaccess"
+ r"^groupadmin/change/access/(?P\d+)/", views.ChangeDefaultCaseAccess.as_view(), name="changeaccess"
),
re_path(
- "^groupadmin/caseaccess/(?P\d+)/(?P\d+)/",
+ r"^groupadmin/caseaccess/(?P\d+)/(?P\d+)/",
views.CaseAccessView.as_view(),
name="caseaccess",
),
path("groupadmin/", views.AdminView.as_view(), name="admin"),
path("groupadmin/multi/", views.MultipleGroupAdminView.as_view(), name="multiple_admins"),
re_path(
- "^groupadmin/(?P\d+)/promote/(?P\d+)/$", views.PromoteUserView.as_view(), name="promoteuser"
+ r"^groupadmin/(?P\d+)/promote/(?P\d+)/$", views.PromoteUserView.as_view(), name="promoteuser"
),
- re_path("^groupadmin/(?P\d+)/$", views.AdminView.as_view(), name="admin"),
- re_path("^groupadmin/users/(?P\d+)/$", views.UserCaseAccessView.as_view(), name="adminusers"),
+ re_path(r"^groupadmin/(?P\d+)/$", views.AdminView.as_view(), name="admin"),
+ re_path(r"^groupadmin/users/(?P\d+)/$", views.UserCaseAccessView.as_view(), name="adminusers"),
re_path(
- "^groupadmin/service/create/(?P\d+)/$",
+ r"^groupadmin/service/create/(?P\d+)/$",
views.CreateServiceAccountView.as_view(),
name="createservice",
),
- re_path("groupadmin/(?P\d+)/adduser/", views.AdminAddUserView.as_view(), name="adduser"),
+ re_path(r"groupadmin/(?P\d+)/adduser/", views.AdminAddUserView.as_view(), name="adduser"),
re_path(
- "^groupadmin/(?P\d+)/rmuser/(?P(contact|user))/(?P\d+)/$",
+ r"^groupadmin/(?P\d+)/rmuser/(?P(contact|user))/(?P\d+)/$",
views.AdminRemoveUser.as_view(),
name="rmuser",
),
re_path(
- "^groupadmin/(?P\d+)/email/modify/(?P(email|user))/(?P\d+)/$",
+ r"^groupadmin/(?P\d+)/email/modify/(?P(email|user))/(?P\d+)/$",
views.ModifyEmailNotifications.as_view(),
name="changeemail",
),
path("inbox/", views.InboxView.as_view(), name="inbox"),
re_path("^inbox/(?P(sent))/$", views.InboxView.as_view(), name="inbox"),
path("inbox/filter/", views.SearchThreadsView.as_view(), name="filterthreads"),
- re_path("^thread/(?P\d+)/$", views.ThreadView.as_view(), name="thread_detail"),
- re_path("^thread/msg/(?P\d+)/$", views.MessageView.as_view(), name="msg_detail"),
- re_path("^thread/messages/(?P
+
{% endblock %}
diff --git a/vincepub/urls.py b/vincepub/urls.py
index 740401d..5bc00fc 100644
--- a/vincepub/urls.py
+++ b/vincepub/urls.py
@@ -35,8 +35,8 @@
from django.views.generic import RedirectView
router = routers.DefaultRouter()
-router.register("notes", views.VUNoteViewSet)
-router.register("api", views.VUNoteViewSet)
+router.register("notes", views.VUNoteViewSet, basename="notes")
+router.register("api", views.VUNoteViewSet, basename="api_notes")
urlpatterns = [
# path("health/", health_check),
@@ -60,29 +60,29 @@
path("help/fieldhelp/", views.HelpFieldView.as_view(), name="fields"),
path("html/fieldhelp/", RedirectView.as_view(pattern_name="vincepub:fields")),
path("html/help/", RedirectView.as_view(pattern_name="vincepub:fields")),
- re_path("^api/vendors/(?P-
+
- + Vulnerability Information + +
- + CSAF JSON View + +
+
{% else %}
@@ -51,7 +65,6 @@
{% endif %}
-
+
+
+
+ Vulnerability Reporting Form
Vulnerability Information
{% render_field form.comm_attempt class="form-control" %}
@@ -81,257 +94,257 @@
+Vulnerability Information
{% else %} -
- {{ form.vendor_name.label_tag }}
- {% render_field form.vendor_name class="form-control" %}
- {% if form.vendor_name.errors %}{{ form.vendor_name.errors }} {% endif %}
-
+
+ {{ form.vendor_name.label_tag }}
+ {% render_field form.vendor_name class="form-control" %}
+ {% if form.vendor_name.errors %}{{ form.vendor_name.errors }} {% endif %}
+
-
-
- {% render_field form.multiplevendors class="form-control" %}
-
-
+
+
+ {% render_field form.multiplevendors class="form-control" %}
+
+
-
-
- {{ form.product_name.help_text }}
- {% render_field form.product_name class="form-control" %}
- {% if field.product_name.errors %}{{ field.product_name.errors }} {% endif %}
-
+
+
+ {{ form.product_name.help_text }}
+ {% render_field form.product_name class="form-control" %}
+ {% if field.product_name.errors %}{{ field.product_name.errors }} {% endif %}
+
-
-
- {{ form.product_version.help_text }}
- {% render_field form.product_version class="form-control" %}
- {% if form.product_version.errors %}{{ form.product_version.errors }} {% endif %}
-
+
+
+ {{ form.product_version.help_text }}
+ {% render_field form.product_version class="form-control" %}
+ {% if form.product_version.errors %}{{ form.product_version.errors }} {% endif %}
+
-
-
- {% render_field form.ics_impact class="check-sameline" %}
-
+
+
+ {% render_field form.ics_impact class="check-sameline" %}
+
-
-
- {% render_field form.ai_ml_system class="check-sameline" %}
-
-
-
-
- {{ form.vul_description.help_text }}
- {% render_field form.vul_description class="form-control" %}
- {% if form.vul_description.errors %}{{ form.vul_description.errors }} {% endif %}
-
-
+
+
+ {% render_field form.ai_ml_system class="check-sameline" %}
+
+
+
+
+ {{ form.vul_description.help_text }}
+ {% render_field form.vul_description class="form-control" %}
+ {% if form.vul_description.errors %}{{ form.vul_description.errors }} {% endif %}
+
+
-
-
- {{ form.vul_exploit.help_text }}
- {% render_field form.vul_exploit class="form-control" %}
- {% if form.vul_exploit.errors %}{{ form.vul_exploit.errors }} {% endif %}
-
-
+
+
+ {{ form.vul_exploit.help_text }}
+ {% render_field form.vul_exploit class="form-control" %}
+ {% if form.vul_exploit.errors %}{{ form.vul_exploit.errors }} {% endif %}
+
+
-
-
- {{ form.vul_impact.help_text }}
- {% render_field form.vul_impact class="form-control" %}
- {% if form.vul_impact.errors %}{{ form.vul_impact.errors }} {% endif %}
-
-
+
+
+ {{ form.vul_impact.help_text }}
+ {% render_field form.vul_impact class="form-control" %}
+ {% if form.vul_impact.errors %}{{ form.vul_impact.errors }} {% endif %}
+
+
-
-
- {{ form.vul_discovery.help_text }}
- {% render_field form.vul_discovery class="form-control" %}
- {% if form.vul_discovery.errors %}{{ form.vul_discovery.errors }} {% endif %}
-
-
+
+
+ {{ form.vul_discovery.help_text }}
+ {% render_field form.vul_discovery class="form-control" %}
+ {% if form.vul_discovery.errors %}{{ form.vul_discovery.errors }} {% endif %}
+
+
-
-
- {% render_field form.vul_public class="form-control" %}
-
-
-
-
- {% render_field form.vul_exploited class="form-control" %}
-
-
-
-
- {% render_field form.vul_disclose class="form-control" %}
-
-
-
+
+
-
-
- You can upload one file limited to 10 MB. Please leave a note in
- the Private Comments below if you would like to
- make alternative arrangements to send files.
-
- {% if form.user_file.errors %}
-
+
-
- {% endif %}
- Error uploading file! Please try again. 10 MB limit.
- {{ form.user_file.errors %} -
-
+
-
- {% render_field form.user_file class="form-control show-for-sr" %}
+
+
+ You can upload one file limited to 10 MB. Please leave a note in
+ the Private Comments below if you would like to
+ make alternative arrangements to send files.
+
+ {% if form.user_file.errors %}
+
+
-
+
+
+ Submit
+
+
+
- Error uploading file! Please try again. 10 MB limit.
+ {{ form.user_file.errors %}
-
-
-
-
+ {% endif %}
+
+
+
+ {% render_field form.user_file class="form-control show-for-sr" %}
+
+
+
+
+
+
-
Your Contact Information
-
- {{ form.contact_name.label_tag }}
- {{ form.contact_name.help_text }}
- {% render_field form.contact_name class="form-control" %}
- {% if form.contact_name.errors %}{{ form.contact_name.errors }} {% endif %}
-
-
- {{ form.contact_org.label_tag }}
- {{ form.contact_org.help_text }}
- {% render_field form.contact_org class="form-control" %}
- {% if form.contact_org.errors %}{{ form.contact_org.errors }} {% endif %}
+
+ Your Contact Information
+
+ {{ form.contact_name.label_tag }}
+ {{ form.contact_name.help_text }}
+ {% render_field form.contact_name class="form-control" %}
+ {% if form.contact_name.errors %}{{ form.contact_name.errors }} {% endif %}
+
+
+ {{ form.contact_org.label_tag }}
+ {{ form.contact_org.help_text }}
+ {% render_field form.contact_org class="form-control" %}
+ {% if form.contact_org.errors %}{{ form.contact_org.errors }} {% endif %}
-
-
- {% if form.contact_email.errors %}
- {{ form.contact_email.errors }} {% endif %}
-
+
- Incorrect email format! Please enter an email address in the format: email@example.com.
-
- {% endif %}
- {{ form.contact_email.label_tag }}
- {{ form.contact_email.help_text }}
- {% render_field form.contact_email class="form-control" %}
- {% if form.contact_email.errors %}
+ {% if form.contact_email.errors %}
+ {{ form.contact_email.errors }} {% endif %}
+
-
+ Incorrect email format! Please enter an email address in the format: email@example.com.
+
+ {% endif %}
+ {{ form.contact_email.label_tag }}
+ {{ form.contact_email.help_text }}
+ {% render_field form.contact_email class="form-control" %}
+ {% if form.contact_email.errors %}
-
- {{ form.share_release.help_text }}
- {% render_field form.share_release class="form-control" %}
-
-
-
- {{ form.credit_release.help_text }}
- {% render_field form.credit_release class="form-control" %}
-
-
-
- {{ form.reporter_pgp.label_tag }}
- {% if form.reporter_pgp.errors %}
-
- {{ form.reporter_pgp.errors }}
+
-
+
+ {{ form.share_release.help_text }}
+ {% render_field form.share_release class="form-control" %}
+
+
+
+ {{ form.credit_release.help_text }}
+ {% render_field form.credit_release class="form-control" %}
+
+
+
+ {{ form.reporter_pgp.label_tag }}
+ {% if form.reporter_pgp.errors %}
+
+ {{ form.reporter_pgp.errors }}
+
+ {% endif %}
+ {{ form.reporter_pgp.help_text }}
+ {{ form.reporter_pgp }}
+
+
+ {{ form.tracking.help_text }}
+ {% render_field form.tracking class="form-control" %}
- {% endif %}
- {{ form.reporter_pgp.help_text }}
- {{ form.reporter_pgp }}
-
-
- {{ form.tracking.help_text }}
- {% render_field form.tracking class="form-control" %}
-
-
-
- {% if form.comments.errors %}
-
- -
-
- Form Error
- {{ form.comments.errors }} +
-
- - {{ form.comments.errors }} +
+
+ {% if form.comments.errors %}
+
- {% endif %}
- {{ form.comments.help_text }}
- {% render_field form.comments class="form-control" %}
-
+ Form Error
+ {{ form.comments.errors }} +
+ {% endif %}
+ {{ form.comments.help_text }}
+ {% render_field form.comments class="form-control" %}
+ {{ form.comments.errors }} +
- -
-
+
+
+
-
-
-
- Submit
-
-
- Coordination Preference
+ ++
+
+ + {% render_field form.cisa_please class="check-sameline" %}
+ Coordination Preference
-
- {% render_field form.cisa_please class="check-sameline" %}
-
- + + {% render_field form.cisa_please class="check-sameline" %}
+
- {% if user.is_authenticated %}
- {#include "vincepub/vince_sidebar.html" #}
- {% else %}
- Create an Account
- Sign In
- {% endif %}
-
-
-
+ {% if user.is_authenticated %}
+ {#include "vincepub/vince_sidebar.html" #}
+ {% else %}
+ Create an Account
+ Sign In
+ {% endif %}
+
+