import { getFixedVersionConstraint, getHighestVulnerabilitySeverity, getLastAffectedVersionConstraint, } from './utils.ts'; describe('util/vulnerability/utils', () => { describe('getHighestVulnerabilitySeverity', () => { it('parent CRITICAL vulnerability severity rating is maintained', () => { const parentConfig = { vulnerabilitySeverity: 'CRITICAL', }; const childConfig = { vulnerabilitySeverity: 'MODERATE', }; const severity = getHighestVulnerabilitySeverity( parentConfig, childConfig, ); expect(severity).toBe('CRITICAL'); }); it('child CRITICAL vulnerability severity rating is maintained', () => { const parentConfig = { vulnerabilitySeverity: 'MODERATE', }; const childConfig = { vulnerabilitySeverity: 'CRITICAL', }; const severity = getHighestVulnerabilitySeverity( parentConfig, childConfig, ); expect(severity).toBe('CRITICAL'); }); it('parent HIGH vulnerability severity rating is maintained', () => { const parentConfig = { vulnerabilitySeverity: 'HIGH', }; const childConfig = { vulnerabilitySeverity: 'MODERATE', }; const severity = getHighestVulnerabilitySeverity( parentConfig, childConfig, ); expect(severity).toBe('HIGH'); }); it('child HIGH vulnerability severity rating is maintained', () => { const parentConfig = { vulnerabilitySeverity: 'MODERATE', }; const childConfig = { vulnerabilitySeverity: 'HIGH', }; const severity = getHighestVulnerabilitySeverity( parentConfig, childConfig, ); expect(severity).toBe('HIGH'); }); it('parent MODERATE vulnerability severity rating is maintained', () => { const parentConfig = { vulnerabilitySeverity: 'MODERATE', }; const childConfig = { vulnerabilitySeverity: 'LOW', }; const severity = getHighestVulnerabilitySeverity( parentConfig, childConfig, ); expect(severity).toBe('MODERATE'); }); it('child MODERATE vulnerability severity rating is maintained', () => { const parentConfig = { vulnerabilitySeverity: 'LOW', }; const childConfig = { vulnerabilitySeverity: 'MODERATE', }; const severity = getHighestVulnerabilitySeverity( parentConfig, childConfig, ); expect(severity).toBe('MODERATE'); }); it('child MEDIUM vulnerability severity rating is maintained', () => { const parentConfig = { vulnerabilitySeverity: 'LOW', }; const childConfig = { vulnerabilitySeverity: 'MEDIUM', }; const severity = getHighestVulnerabilitySeverity( parentConfig, childConfig, ); expect(severity).toBe('MEDIUM'); }); it('parent LOW vulnerability severity rating is maintained', () => { const parentConfig = { vulnerabilitySeverity: 'LOW', }; const childConfig = { vulnerabilitySeverity: undefined, }; const severity = getHighestVulnerabilitySeverity( parentConfig, childConfig, ); expect(severity).toBe('LOW'); }); it('child LOW vulnerability severity rating is maintained', () => { const parentConfig = { vulnerabilitySeverity: undefined, }; const childConfig = { vulnerabilitySeverity: 'LOW', }; const severity = getHighestVulnerabilitySeverity( parentConfig, childConfig, ); expect(severity).toBe('LOW'); }); it('child UNKNOWN vulnerability severity rating is maintained', () => { const parentConfig = { vulnerabilitySeverity: 'CRITICAL', }; const childConfig = { vulnerabilitySeverity: 'UNKNOWN', }; const severity = getHighestVulnerabilitySeverity( parentConfig, childConfig, ); expect(severity).toBe('UNKNOWN'); }); it('handled undefined parent and child vulnerability severity', () => { const parentConfig = { vulnerabilitySeverity: undefined, }; const childConfig = { vulnerabilitySeverity: undefined, }; const severity = getHighestVulnerabilitySeverity( parentConfig, childConfig, ); expect(severity).toBeUndefined(); }); }); describe('getFixedVersionConstraint()', () => { it.each([ // checked in a case-insensitive manner ['MAVEn', '[1.2.3,)'], ['Maven', '[1.2.3,)'], ['NuGet', '[1.2.3,)'], ['maven', '[1.2.3,)'], ['nuget', '[1.2.3,)'], ['npm', '>= 1.2.3'], ['PyPI', '>= 1.2.3'], ['Go', '>= 1.2.3'], ['crates.io', '>= 1.2.3'], ])('returns correct range for %s', (ecosystem, expected) => { expect(getFixedVersionConstraint('1.2.3', ecosystem)).toBe(expected); }); }); describe('getLastAffectedVersionConstraint()', () => { it.each([ ['Maven', '(1.2.3,)'], ['maven', '(1.2.3,)'], ['NuGet', '> 1.2.3'], ['npm', '> 1.2.3'], ['Go', '> 1.2.3'], // checked in a case-insensitive manner ['gO', '> 1.2.3'], ])('returns correct range for %s', (ecosystem, expected) => { expect(getLastAffectedVersionConstraint('1.2.3', ecosystem)).toBe( expected, ); }); }); });