|
11 | 11 | from django.test.client import Client |
12 | 12 | from django.urls import reverse |
13 | 13 | from django.utils import timezone |
| 14 | +from parameterized import parameterized |
14 | 15 |
|
15 | 16 | from dojo.models import Engagement, Finding, Product, Product_Type, Test, Test_Type, User |
16 | 17 |
|
@@ -2003,6 +2004,74 @@ def test_import_nuclei_emptyc(self): |
2003 | 2004 | test_id2 = reimport0["test"] |
2004 | 2005 | self.assertEqual(test_id, test_id2) |
2005 | 2006 |
|
| 2007 | + @parameterized.expand( |
| 2008 | + [ |
| 2009 | + ("Test False Positive Status (Endpoint Status)", {"false_positive": True}, "status_finding"), |
| 2010 | + ("Test Out of Scope Status (Endpoint Status)", {"out_of_scope": True}, "status_finding"), |
| 2011 | + ("Test Risk Accepted Status (Endpoint Status)", {"risk_accepted": True}, "status_finding"), |
| 2012 | + ("Test False Positive Status (Locations)", {"status": "FalsePositive"}, "locations"), |
| 2013 | + ("Test Out of Scope Status (Locations)", {"status": "OutOfScope"}, "locations"), |
| 2014 | + ("Test Risk Accepted Status (Locations)", {"status": "RiskAccepted"}, "locations"), |
| 2015 | + ], |
| 2016 | + ) |
| 2017 | + def test_import_reimport_endpoint_where_eps_reactivation_skips_special_status(self, label: str, special_status_fields: dict, m2m_key: str): |
| 2018 | + """ |
| 2019 | + When Findings are set to False Positive, Out of Scope, or Risk Accepted, they are not reactivated |
| 2020 | + because these statuses are often set by humans. The same needs to apply for the Endpoint Status as |
| 2021 | + they are an extension of the finding being partially mitigated. |
| 2022 | + """ |
| 2023 | + if settings.V3_FEATURE_LOCATIONS: |
| 2024 | + # TODO: Delete this after the move to Locations |
| 2025 | + if m2m_key == "status_finding": |
| 2026 | + # This test will fail for endpoint statuses with locations enabled |
| 2027 | + # return early here |
| 2028 | + return |
| 2029 | + context = { |
| 2030 | + "auditor": User.objects.get(username="admin"), |
| 2031 | + "audit_time": timezone.now(), |
| 2032 | + } |
| 2033 | + # TODO: Delete this after the move to Locations |
| 2034 | + else: |
| 2035 | + if m2m_key == "locations": |
| 2036 | + # This test will fail for locations with locations disabled |
| 2037 | + # return early here |
| 2038 | + return |
| 2039 | + context = { |
| 2040 | + "mitigated": True, |
| 2041 | + "mitigated_by": User.objects.get(username="admin"), |
| 2042 | + "mitigated_time": timezone.now(), |
| 2043 | + } |
| 2044 | + # Now start the test |
| 2045 | + with assertTestImportModelsCreated(self, imports=1, affected_findings=1, created=1): |
| 2046 | + import0 = self.import_scan_with_params( |
| 2047 | + self.gitlab_dast_file_name, self.scan_type_gitlab_dast, active=True, verified=True, |
| 2048 | + ) |
| 2049 | + test_id = import0["test"] |
| 2050 | + findings = self.get_test_findings_api(test_id) |
| 2051 | + self.assert_finding_count_json(1, findings) |
| 2052 | + finding = Finding.objects.get(id=findings["results"][0]["id"]) |
| 2053 | + # Get the related objects on the finding |
| 2054 | + related_obects = getattr(finding, m2m_key).all() |
| 2055 | + self.assertEqual(len(related_obects), 1) |
| 2056 | + # Update the related objects with the special status fields |
| 2057 | + related_objects_context = {**context, **special_status_fields} |
| 2058 | + related_obects.update(**related_objects_context) |
| 2059 | + # Reimport the same file |
| 2060 | + reimport0 = self.reimport_scan_with_params( |
| 2061 | + test_id, self.gitlab_dast_file_name, scan_type=self.scan_type_gitlab_dast, |
| 2062 | + ) |
| 2063 | + test_id = reimport0["test"] |
| 2064 | + findings = self.get_test_findings_api(test_id) |
| 2065 | + self.assert_finding_count_json(1, findings) |
| 2066 | + finding = Finding.objects.get(id=findings["results"][0]["id"]) |
| 2067 | + # Get the related objects on the finding |
| 2068 | + related_obects = getattr(finding, m2m_key).all() |
| 2069 | + self.assertEqual(len(related_obects), 1) |
| 2070 | + related_object = related_obects.first() |
| 2071 | + # Ensure the status is the same as the baseline |
| 2072 | + for key, value in related_objects_context.items(): |
| 2073 | + self.assertEqual(getattr(related_object, key), value) |
| 2074 | + |
2006 | 2075 | def test_import_reimport_endpoint_where_eps_date_is_different(self): |
2007 | 2076 | endpoint_count_before = self.db_endpoint_count() |
2008 | 2077 | endpoint_status_count_before_active = self.db_endpoint_status_count(mitigated=False) |
|
0 commit comments