/
test_main.py
323 lines (282 loc) · 13.2 KB
/
test_main.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
# Copyright 2016 IBM Corp.
#
# SPDX-License-Identifier: Apache-2.0
import logging
import os
from unittest import mock
import fixtures
import testtools
from bandit.cli import main as bandit
from bandit.core import extension_loader as ext_loader
from bandit.core import utils
bandit_config_content = """
include:
- '*.py'
- '*.pyw'
profiles:
test:
include:
- start_process_with_a_shell
shell_injection:
subprocess:
shell:
- os.system
"""
bandit_baseline_content = """{
"results": [
{
"code": "some test code",
"filename": "test_example.py",
"issue_severity": "low",
"issue_confidence": "low",
"issue_text": "test_issue",
"test_name": "some_test",
"test_id": "x",
"line_number": "n",
"line_range": "n-m"
}
]
}
"""
class BanditCLIMainLoggerTests(testtools.TestCase):
def setUp(self):
super(BanditCLIMainLoggerTests, self).setUp()
self.logger = logging.getLogger()
self.original_logger_handlers = self.logger.handlers
self.original_logger_level = self.logger.level
self.logger.handlers = []
def tearDown(self):
super(BanditCLIMainLoggerTests, self).tearDown()
self.logger.handlers = self.original_logger_handlers
self.logger.level = self.original_logger_level
def test_init_logger(self):
# Test that a logger was properly initialized
bandit._init_logger()
self.assertIsNotNone(self.logger)
self.assertNotEqual(self.logger.handlers, [])
self.assertEqual(logging.INFO, self.logger.level)
def test_init_logger_debug_mode(self):
# Test that the logger's level was set at 'DEBUG'
bandit._init_logger(logging.DEBUG)
self.assertEqual(logging.DEBUG, self.logger.level)
class BanditCLIMainTests(testtools.TestCase):
def setUp(self):
super(BanditCLIMainTests, self).setUp()
self.current_directory = os.getcwd()
def tearDown(self):
super(BanditCLIMainTests, self).tearDown()
os.chdir(self.current_directory)
def test_get_options_from_ini_no_ini_path_no_target(self):
# Test that no config options are loaded when no ini path or target
# directory are provided
self.assertIsNone(bandit._get_options_from_ini(None, []))
def test_get_options_from_ini_empty_directory_no_target(self):
# Test that no config options are loaded when an empty directory is
# provided as the ini path and no target directory is provided
ini_directory = self.useFixture(fixtures.TempDir()).path
self.assertIsNone(bandit._get_options_from_ini(ini_directory, []))
def test_get_options_from_ini_no_ini_path_no_bandit_files(self):
# Test that no config options are loaded when no ini path is provided
# and the target directory contains no bandit config files (.bandit)
target_directory = self.useFixture(fixtures.TempDir()).path
self.assertIsNone(bandit._get_options_from_ini(None,
[target_directory]))
def test_get_options_from_ini_no_ini_path_multi_bandit_files(self):
# Test that bandit exits when no ini path is provided and the target
# directory(s) contain multiple bandit config files (.bandit)
target_directory = self.useFixture(fixtures.TempDir()).path
second_config = 'second_config_directory'
os.mkdir(os.path.join(target_directory, second_config))
bandit_config_one = os.path.join(target_directory, '.bandit')
bandit_config_two = os.path.join(target_directory, second_config,
'.bandit')
bandit_files = [bandit_config_one, bandit_config_two]
for bandit_file in bandit_files:
with open(bandit_file, 'wt') as fd:
fd.write(bandit_config_content)
self.assertRaisesRegex(SystemExit, '2', bandit._get_options_from_ini,
None, [target_directory])
def test_init_extensions(self):
# Test that an extension loader manager is returned
self.assertEqual(ext_loader.MANAGER, bandit._init_extensions())
def test_log_option_source_arg_val(self):
# Test that the command argument value is returned when provided
# with None or a string default value
arg_val = 'file'
ini_val = 'vuln'
option_name = 'aggregate'
for default_val in (None, 'default'):
self.assertEqual(arg_val, bandit._log_option_source(
default_val,
arg_val,
ini_val,
option_name
))
def test_log_option_source_ini_value(self):
# Test that the ini value is returned when no command argument is
# provided
default_val = None
ini_val = 'vuln'
option_name = 'aggregate'
self.assertEqual(ini_val, bandit._log_option_source(
default_val,
None,
ini_val,
option_name
))
def test_log_option_source_ini_val_with_str_default_and_no_arg_val(self):
# Test that the ini value is returned when no command argument is
# provided
default_val = "file"
arg_val = 'file'
ini_val = 'vuln'
option_name = 'aggregate'
self.assertEqual(ini_val, bandit._log_option_source(
default_val,
arg_val,
ini_val,
option_name
))
def test_log_option_source_no_values(self):
# Test that None is returned when no command argument or ini value are
# provided
option_name = 'aggregate'
self.assertIsNone(bandit._log_option_source(
None,
None,
None,
option_name
))
@mock.patch('sys.argv', ['bandit', '-c', 'bandit.yaml', 'test'])
def test_main_config_unopenable(self):
# Test that bandit exits when a config file cannot be opened
with mock.patch('bandit.core.config.__init__') as mock_bandit_config:
mock_bandit_config.side_effect = utils.ConfigError('', '')
# assert a SystemExit with code 2
self.assertRaisesRegex(SystemExit, '2', bandit.main)
@mock.patch('sys.argv', ['bandit', '-c', 'bandit.yaml', 'test'])
def test_main_invalid_config(self):
# Test that bandit exits when a config file contains invalid YAML
# content
with mock.patch('bandit.core.config.BanditConfig.__init__'
) as mock_bandit_config:
mock_bandit_config.side_effect = utils.ConfigError('', '')
# assert a SystemExit with code 2
self.assertRaisesRegex(SystemExit, '2', bandit.main)
@mock.patch('sys.argv', ['bandit', '-c', 'bandit.yaml', 'test'])
def test_main_handle_ini_options(self):
# Test that bandit handles cmdline args from a bandit.yaml file
temp_directory = self.useFixture(fixtures.TempDir()).path
os.chdir(temp_directory)
with open('bandit.yaml', 'wt') as fd:
fd.write(bandit_config_content)
with mock.patch('bandit.cli.main._get_options_from_ini'
) as mock_get_opts:
mock_get_opts.return_value = {"exclude": "/tmp",
"skips": "skip_test",
"tests": "some_test"}
with mock.patch('bandit.cli.main.LOG.error') as err_mock:
# SystemExit with code 2 when test not found in profile
self.assertRaisesRegex(SystemExit, '2', bandit.main)
self.assertEqual(str(err_mock.call_args[0][0]),
'Unknown test found in profile: some_test')
@mock.patch('sys.argv', ['bandit', '-c', 'bandit.yaml', '-t', 'badID',
'test'])
def test_main_unknown_tests(self):
# Test that bandit exits when an invalid test ID is provided
temp_directory = self.useFixture(fixtures.TempDir()).path
os.chdir(temp_directory)
with open('bandit.yaml', 'wt') as fd:
fd.write(bandit_config_content)
# assert a SystemExit with code 2
self.assertRaisesRegex(SystemExit, '2', bandit.main)
@mock.patch('sys.argv', ['bandit', '-c', 'bandit.yaml', '-s', 'badID',
'test'])
def test_main_unknown_skip_tests(self):
# Test that bandit exits when an invalid test ID is provided to skip
temp_directory = self.useFixture(fixtures.TempDir()).path
os.chdir(temp_directory)
with open('bandit.yaml', 'wt') as fd:
fd.write(bandit_config_content)
# assert a SystemExit with code 2
self.assertRaisesRegex(SystemExit, '2', bandit.main)
@mock.patch('sys.argv', ['bandit', '-c', 'bandit.yaml', '-p', 'bad',
'test'])
def test_main_profile_not_found(self):
# Test that bandit exits when an invalid profile name is provided
temp_directory = self.useFixture(fixtures.TempDir()).path
os.chdir(temp_directory)
with open('bandit.yaml', 'wt') as fd:
fd.write(bandit_config_content)
# assert a SystemExit with code 2
with mock.patch('bandit.cli.main.LOG.error') as err_mock:
self.assertRaisesRegex(SystemExit, '2', bandit.main)
self.assertEqual(
str(err_mock.call_args[0][0]),
'Unable to find profile (bad) in config file: bandit.yaml')
@mock.patch('sys.argv', ['bandit', '-c', 'bandit.yaml', '-b', 'base.json',
'test'])
def test_main_baseline_ioerror(self):
# Test that bandit exits when encountering an IOError while reading
# baseline data
temp_directory = self.useFixture(fixtures.TempDir()).path
os.chdir(temp_directory)
with open('bandit.yaml', 'wt') as fd:
fd.write(bandit_config_content)
with open('base.json', 'wt') as fd:
fd.write(bandit_baseline_content)
with mock.patch('bandit.core.manager.BanditManager.populate_baseline'
) as mock_mgr_pop_bl:
mock_mgr_pop_bl.side_effect = IOError
# assert a SystemExit with code 2
self.assertRaisesRegex(SystemExit, '2', bandit.main)
@mock.patch('sys.argv', ['bandit', '-c', 'bandit.yaml', '-b', 'base.json',
'-f', 'csv', 'test'])
def test_main_invalid_output_format(self):
# Test that bandit exits when an invalid output format is selected
temp_directory = self.useFixture(fixtures.TempDir()).path
os.chdir(temp_directory)
with open('bandit.yaml', 'wt') as fd:
fd.write(bandit_config_content)
with open('base.json', 'wt') as fd:
fd.write(bandit_baseline_content)
# assert a SystemExit with code 2
self.assertRaisesRegex(SystemExit, '2', bandit.main)
@mock.patch('sys.argv', ['bandit', '-c', 'bandit.yaml', 'test', '-o',
'output'])
def test_main_exit_with_results(self):
# Test that bandit exits when there are results
temp_directory = self.useFixture(fixtures.TempDir()).path
os.chdir(temp_directory)
with open('bandit.yaml', 'wt') as fd:
fd.write(bandit_config_content)
with mock.patch('bandit.core.manager.BanditManager.results_count'
) as mock_mgr_results_ct:
mock_mgr_results_ct.return_value = 1
# assert a SystemExit with code 1
self.assertRaisesRegex(SystemExit, '1', bandit.main)
@mock.patch('sys.argv', ['bandit', '-c', 'bandit.yaml', 'test', '-o',
'output'])
def test_main_exit_with_no_results(self):
# Test that bandit exits when there are no results
temp_directory = self.useFixture(fixtures.TempDir()).path
os.chdir(temp_directory)
with open('bandit.yaml', 'wt') as fd:
fd.write(bandit_config_content)
with mock.patch('bandit.core.manager.BanditManager.results_count'
) as mock_mgr_results_ct:
mock_mgr_results_ct.return_value = 0
# assert a SystemExit with code 0
self.assertRaisesRegex(SystemExit, '0', bandit.main)
@mock.patch('sys.argv', ['bandit', '-c', 'bandit.yaml', 'test', '-o',
'output', '--exit-zero'])
def test_main_exit_with_results_and_with_exit_zero_flag(self):
# Test that bandit exits with 0 on results and zero flag
temp_directory = self.useFixture(fixtures.TempDir()).path
os.chdir(temp_directory)
with open('bandit.yaml', 'wt') as fd:
fd.write(bandit_config_content)
with mock.patch('bandit.core.manager.BanditManager.results_count'
) as mock_mgr_results_ct:
mock_mgr_results_ct.return_value = 1
self.assertRaisesRegex(SystemExit, '0', bandit.main)