csaf-rs 0.5.1

A parser for the CSAF standard written in Rust
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143

use crate::csaf_traits::{CsafTrait, ProductStatusGroup, ProductStatusGroupMap, RemediationTrait, VulnerabilityTrait};
use crate::schema::csaf2_1::schema::CategoryOfTheRemediation;
use crate::validation::ValidationError;

/// Remediation categories that conflict with the product status "not affected".
const NOT_AFFECTED_CONFLICTS: &[CategoryOfTheRemediation] = &[
    CategoryOfTheRemediation::Workaround,
    CategoryOfTheRemediation::Mitigation,
    CategoryOfTheRemediation::VendorFix,
    CategoryOfTheRemediation::NoneAvailable,
];

/// Remediation categories that conflict with "fixed" product statuses.
const FIXED_CONFLICTS: &[CategoryOfTheRemediation] = &[
    CategoryOfTheRemediation::NoneAvailable,
    CategoryOfTheRemediation::FixPlanned,
    CategoryOfTheRemediation::NoFixPlanned,
    CategoryOfTheRemediation::VendorFix,
    CategoryOfTheRemediation::Mitigation,
    CategoryOfTheRemediation::Workaround,
];

fn create_affected_conflict_error(
    product_id: &str,
    category: &CategoryOfTheRemediation,
    v_i: usize,
    r_i: usize,
) -> ValidationError {
    ValidationError {
        message: format!(
            "Product {product_id} is listed as affected but has conflicting remediation category {category}"
        ),
        instance_path: format!("/vulnerabilities/{v_i}/remediations/{r_i}"),
    }
}

fn create_not_affected_conflict_error(
    product_id: &str,
    category: &CategoryOfTheRemediation,
    v_i: usize,
    r_i: usize,
) -> ValidationError {
    ValidationError {
        message: format!(
            "Product {product_id} is listed as not affected but has conflicting remediation category {category}"
        ),
        instance_path: format!("/vulnerabilities/{v_i}/remediations/{r_i}"),
    }
}

fn create_fixed_conflict_error(
    product_id: &str,
    category: &CategoryOfTheRemediation,
    v_i: usize,
    r_i: usize,
) -> ValidationError {
    ValidationError {
        message: format!("Product {product_id} is listed as fixed but has conflicting remediation category {category}"),
        instance_path: format!("/vulnerabilities/{v_i}/remediations/{r_i}"),
    }
}

pub fn test_6_1_36_status_group_contradicting_remediation_categories(
    doc: &impl CsafTrait,
) -> Result<(), Vec<ValidationError>> {
    for (v_i, v) in doc.get_vulnerabilities().iter().enumerate() {
        if let Some(product_status) = v.get_product_status() {
            let status_map = ProductStatusGroupMap::from(product_status);
            // Iterate over remediations
            for (r_i, r) in v.get_remediations().iter().enumerate() {
                // Only handle Remediations having product IDs associated
                if let Some(product_ids) = r.get_all_product_ids(doc) {
                    // Category of current remediation
                    let cat = r.get_category();
                    // Iterate over product IDs
                    for p in product_ids {
                        if status_map.contains(&ProductStatusGroup::Affected, &p)
                            && cat == CategoryOfTheRemediation::OptionalPatch
                        {
                            return Err(vec![create_affected_conflict_error(&p, &cat, v_i, r_i)]);
                        }
                        if status_map.contains(&ProductStatusGroup::NotAffected, &p)
                            && NOT_AFFECTED_CONFLICTS.contains(&cat)
                        {
                            return Err(vec![create_not_affected_conflict_error(&p, &cat, v_i, r_i)]);
                        }
                        if status_map.contains(&ProductStatusGroup::Fixed, &p) && FIXED_CONFLICTS.contains(&cat) {
                            return Err(vec![create_fixed_conflict_error(&p, &cat, v_i, r_i)]);
                        }
                    }
                }
            }
        }
    }
    Ok(())
}

crate::test_validation::impl_validator!(
    csaf2_1,
    ValidatorForTest6_1_36,
    test_6_1_36_status_group_contradicting_remediation_categories
);

#[cfg(test)]
mod tests {
    use super::*;
    use crate::csaf2_1::testcases::TESTS_2_1;

    #[test]
    fn test_test_6_1_36() {
        // Only CSAF 2.1 has this test with 8 test cases (4 error cases, 4 success cases)
        TESTS_2_1.test_6_1_36.expect(
            Err(vec![create_not_affected_conflict_error(
                "CSAFPID-9080700",
                &CategoryOfTheRemediation::VendorFix,
                0,
                0,
            )]),
            Err(vec![create_fixed_conflict_error(
                "CSAFPID-9080703",
                &CategoryOfTheRemediation::NoneAvailable,
                0,
                0,
            )]),
            Err(vec![create_affected_conflict_error(
                "CSAFPID-9080700",
                &CategoryOfTheRemediation::OptionalPatch,
                0,
                0,
            )]),
            Err(vec![create_fixed_conflict_error(
                "CSAFPID-9080700",
                &CategoryOfTheRemediation::NoFixPlanned,
                0,
                0,
            )]),
            Ok(()),
            Ok(()),
            Ok(()),
            Ok(()),
        );
    }
}