renovate/lib/util/vulnerability/utils.spec.ts

import {
  getFixedVersionConstraint,
  getHighestVulnerabilitySeverity,
  getLastAffectedVersionConstraint,
} from './utils.ts';

describe('util/vulnerability/utils', () => {
  describe('getHighestVulnerabilitySeverity', () => {
    it('parent CRITICAL vulnerability severity rating is maintained', () => {
      const parentConfig = {
        vulnerabilitySeverity: 'CRITICAL',
      };

      const childConfig = {
        vulnerabilitySeverity: 'MODERATE',
      };

      const severity = getHighestVulnerabilitySeverity(
        parentConfig,
        childConfig,
      );

      expect(severity).toBe('CRITICAL');
    });

    it('child CRITICAL vulnerability severity rating is maintained', () => {
      const parentConfig = {
        vulnerabilitySeverity: 'MODERATE',
      };

      const childConfig = {
        vulnerabilitySeverity: 'CRITICAL',
      };

      const severity = getHighestVulnerabilitySeverity(
        parentConfig,
        childConfig,
      );

      expect(severity).toBe('CRITICAL');
    });

    it('parent HIGH vulnerability severity rating is maintained', () => {
      const parentConfig = {
        vulnerabilitySeverity: 'HIGH',
      };

      const childConfig = {
        vulnerabilitySeverity: 'MODERATE',
      };

      const severity = getHighestVulnerabilitySeverity(
        parentConfig,
        childConfig,
      );

      expect(severity).toBe('HIGH');
    });

    it('child HIGH vulnerability severity rating is maintained', () => {
      const parentConfig = {
        vulnerabilitySeverity: 'MODERATE',
      };

      const childConfig = {
        vulnerabilitySeverity: 'HIGH',
      };

      const severity = getHighestVulnerabilitySeverity(
        parentConfig,
        childConfig,
      );

      expect(severity).toBe('HIGH');
    });

    it('parent MODERATE vulnerability severity rating is maintained', () => {
      const parentConfig = {
        vulnerabilitySeverity: 'MODERATE',
      };

      const childConfig = {
        vulnerabilitySeverity: 'LOW',
      };

      const severity = getHighestVulnerabilitySeverity(
        parentConfig,
        childConfig,
      );

      expect(severity).toBe('MODERATE');
    });

    it('child MODERATE vulnerability severity rating is maintained', () => {
      const parentConfig = {
        vulnerabilitySeverity: 'LOW',
      };

      const childConfig = {
        vulnerabilitySeverity: 'MODERATE',
      };

      const severity = getHighestVulnerabilitySeverity(
        parentConfig,
        childConfig,
      );

      expect(severity).toBe('MODERATE');
    });

    it('child MEDIUM vulnerability severity rating is maintained', () => {
      const parentConfig = {
        vulnerabilitySeverity: 'LOW',
      };

      const childConfig = {
        vulnerabilitySeverity: 'MEDIUM',
      };

      const severity = getHighestVulnerabilitySeverity(
        parentConfig,
        childConfig,
      );

      expect(severity).toBe('MEDIUM');
    });

    it('parent LOW vulnerability severity rating is maintained', () => {
      const parentConfig = {
        vulnerabilitySeverity: 'LOW',
      };

      const childConfig = {
        vulnerabilitySeverity: undefined,
      };

      const severity = getHighestVulnerabilitySeverity(
        parentConfig,
        childConfig,
      );

      expect(severity).toBe('LOW');
    });

    it('child LOW vulnerability severity rating is maintained', () => {
      const parentConfig = {
        vulnerabilitySeverity: undefined,
      };

      const childConfig = {
        vulnerabilitySeverity: 'LOW',
      };

      const severity = getHighestVulnerabilitySeverity(
        parentConfig,
        childConfig,
      );

      expect(severity).toBe('LOW');
    });

    it('child UNKNOWN vulnerability severity rating is maintained', () => {
      const parentConfig = {
        vulnerabilitySeverity: 'CRITICAL',
      };

      const childConfig = {
        vulnerabilitySeverity: 'UNKNOWN',
      };

      const severity = getHighestVulnerabilitySeverity(
        parentConfig,
        childConfig,
      );

      expect(severity).toBe('UNKNOWN');
    });

    it('handled undefined parent and child vulnerability severity', () => {
      const parentConfig = {
        vulnerabilitySeverity: undefined,
      };

      const childConfig = {
        vulnerabilitySeverity: undefined,
      };

      const severity = getHighestVulnerabilitySeverity(
        parentConfig,
        childConfig,
      );

      expect(severity).toBeUndefined();
    });
  });

  describe('getFixedVersionConstraint()', () => {
    it.each([
      // checked in a case-insensitive manner
      ['MAVEn', '[1.2.3,)'],
      ['Maven', '[1.2.3,)'],
      ['NuGet', '[1.2.3,)'],
      ['maven', '[1.2.3,)'],
      ['nuget', '[1.2.3,)'],
      ['npm', '>= 1.2.3'],
      ['PyPI', '>= 1.2.3'],
      ['Go', '>= 1.2.3'],
      ['crates.io', '>= 1.2.3'],
    ])('returns correct range for %s', (ecosystem, expected) => {
      expect(getFixedVersionConstraint('1.2.3', ecosystem)).toBe(expected);
    });
  });

  describe('getLastAffectedVersionConstraint()', () => {
    it.each([
      ['Maven', '(1.2.3,)'],
      ['maven', '(1.2.3,)'],
      ['NuGet', '> 1.2.3'],
      ['npm', '> 1.2.3'],
      ['Go', '> 1.2.3'],
      // checked in a case-insensitive manner
      ['gO', '> 1.2.3'],
    ])('returns correct range for %s', (ecosystem, expected) => {
      expect(getLastAffectedVersionConstraint('1.2.3', ecosystem)).toBe(
        expected,
      );
    });
  });
});