/**
 * This file is part of Eclipse Steady.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 * SPDX-License-Identifier: Apache-2.0
 * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
 */
package org.eclipse.steady.backend.cve;

import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertTrue;

import java.text.ParseException;
import java.text.SimpleDateFormat;
import java.util.Calendar;
import java.util.GregorianCalendar;

import org.eclipse.steady.shared.cache.CacheException;
import org.junit.Test;

public class CveReader2Test {

  static final SimpleDateFormat format = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm");

  /**
   * Create several instances of {@link Cve} from local JSON data.
   * @throws CacheException
   */
  @Test
  public void testBuildFromJson() throws CacheException {
    NvdRestServiceMockup.create();
    try {
      final Cve cve_2014_0050 = CveReader2.read("CVE-2014-0050");
      assertEquals(Float.valueOf("7.5"), cve_2014_0050.getCvssScore());
      assertEquals("2.0", cve_2014_0050.getCvssVersion());
      assertEquals("AV:N/AC:L/Au:N/C:P/I:P/A:P", cve_2014_0050.getCvssVector());
      assertEquals(
          "MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache"
              + " Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial"
              + " of service (infinite loop and CPU consumption) via a crafted Content-Type header"
              + " that bypasses a loop's intended exit conditions.",
          cve_2014_0050.getSummary());
      final Calendar publ = new GregorianCalendar();
      publ.setTime(format.parse("2014-04-01T06:27Z"));
      assertEquals(publ, cve_2014_0050.getPublished());
      final Calendar modi = new GregorianCalendar();
      modi.setTime(format.parse("2018-10-09T19:35Z"));
      assertEquals(modi, cve_2014_0050.getModified());

      final Cve cve_2018_0123 = CveReader2.read("CVE-2018-0123");
      assertEquals(Float.valueOf("5.5"), cve_2018_0123.getCvssScore());
      assertEquals("3.0", cve_2018_0123.getCvssVersion());
      assertEquals("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", cve_2018_0123.getCvssVector());
      assertEquals(
          "A Path Traversal vulnerability in the diagnostic shell for Cisco IOS and IOS XE"
              + " Software could allow an authenticated, local attacker to use certain diagnostic"
              + " shell commands that can overwrite system files. These system files may be"
              + " sensitive and should not be able to be overwritten by a user of the diagnostic"
              + " shell. The vulnerability is due to lack of proper input validation for certain"
              + " diagnostic shell commands. An attacker could exploit this vulnerability by"
              + " authenticating to the device, entering the diagnostic shell, and providing"
              + " crafted user input to commands at the local diagnostic shell CLI. Successful"
              + " exploitation could allow the attacker to overwrite system files that should be"
              + " restricted. Cisco Bug IDs: CSCvg41950.",
          cve_2018_0123.getSummary());
      publ.setTime(format.parse("2018-02-08T07:29Z"));
      assertEquals(publ, cve_2018_0123.getPublished());
      modi.setTime(format.parse("2019-10-09T23:31Z"));
      assertEquals(modi, cve_2018_0123.getModified());

      final Cve cve_2018_1000865 = CveReader2.read("CVE-2018-1000865");
      assertEquals(Float.valueOf("8.8"), cve_2018_1000865.getCvssScore());
      assertEquals("3.0", cve_2018_1000865.getCvssVersion());
      assertEquals(
          "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", cve_2018_1000865.getCvssVector());
      assertEquals(
          "A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in"
              + " groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java"
              + " that allows attackers with Job/Configure permission to execute arbitrary code on"
              + " the Jenkins master JVM, if plugins using the Groovy sandbox are installed.",
          cve_2018_1000865.getSummary());
      publ.setTime(format.parse("2018-12-10T14:29Z"));
      assertEquals(publ, cve_2018_1000865.getPublished());
      modi.setTime(format.parse("2019-10-03T00:03Z"));
      assertEquals(modi, cve_2018_1000865.getModified());

      // Check CVSS version is properly read (3.1)
      final Cve cve_2019_0047 = CveReader2.read("CVE-2019-0047");
      assertEquals(Float.valueOf("8.8"), cve_2019_0047.getCvssScore());
      assertEquals("3.1", cve_2019_0047.getCvssVersion());
      assertEquals("CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", cve_2019_0047.getCvssVector());
      assertEquals(
          "A persistent Cross-Site Scripting (XSS) vulnerability in Junos OS J-Web interface may"
              + " allow remote unauthenticated attackers to perform administrative actions on the"
              + " Junos device. Successful exploitation requires a Junos administrator to first"
              + " perform certain diagnostic actions on J-Web. This issue affects: Juniper"
              + " Networks Junos OS 12.1X46 versions prior to 12.1X46-D86; 12.3 versions prior to"
              + " 12.3R12-S13; 12.3X48 versions prior to 12.3X48-D80; 14.1X53 versions prior to"
              + " 14.1X53-D51; 15.1 versions prior to 15.1F6-S13, 15.1R7-S4; 15.1X49 versions"
              + " prior to 15.1X49-D171, 15.1X49-D180; 15.1X53 versions prior to 15.1X53-D497,"
              + " 15.1X53-D69; 16.1 versions prior to 16.1R7-S5; 16.2 versions prior to 16.2R2-S9;"
              + " 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R2-S7,"
              + " 17.2R3-S1; 17.3 versions prior to 17.3R3-S6; 17.4 versions prior to 17.4R1-S7,"
              + " 17.4R2-S4, 17.4R3; 18.1 versions prior to 18.1R3-S5; 18.2 versions prior to"
              + " 18.2R1-S5, 18.2R2-S3, 18.2R3; 18.3 versions prior to 18.3R1-S3, 18.3R2, 18.3R3;"
              + " 18.4 versions prior to 18.4R1-S2, 18.4R2.",
          cve_2019_0047.getSummary());
    } catch (ParseException e) {
      e.printStackTrace();
      assertTrue(false);
    }
  }

  /**
   * Fetches CVE data.
   * Requires that system property vulas.backend.cveCache.serviceUrl is set.
   * @throws CacheException
   */
  @Test
  public void testFetch() throws CacheException {
    NvdRestServiceMockup.create();
    final CveReader2 reader = new CveReader2();
    reader.fetch("CVE-2019-17531");
  }
}
