94 lines
2.5 KiB
Rego
94 lines
2.5 KiB
Rego
# -----------------------------------------------------------------------------
|
|
# epss-threshold_test.rego
|
|
# Tests for EPSS threshold policy
|
|
# -----------------------------------------------------------------------------
|
|
|
|
package stellaops.gates.epss
|
|
|
|
import future.keywords.if
|
|
|
|
# Test allow - all CVEs below threshold
|
|
test_allow_below_threshold if {
|
|
allow with input as {
|
|
"cve_findings": [
|
|
{"cve_id": "CVE-2024-0001", "epss_score": 0.3},
|
|
{"cve_id": "CVE-2024-0002", "epss_score": 0.5}
|
|
],
|
|
"config": {"epss_threshold": 0.6}
|
|
}
|
|
}
|
|
|
|
# Test deny - CVE above threshold
|
|
test_deny_above_threshold if {
|
|
not allow with input as {
|
|
"cve_findings": [
|
|
{"cve_id": "CVE-2024-0001", "epss_score": 0.3},
|
|
{"cve_id": "CVE-2024-0002", "epss_score": 0.7}
|
|
],
|
|
"config": {"epss_threshold": 0.6}
|
|
}
|
|
}
|
|
|
|
# Test allow - empty findings
|
|
test_allow_empty_findings if {
|
|
allow with input as {
|
|
"cve_findings": [],
|
|
"config": {"epss_threshold": 0.6}
|
|
}
|
|
}
|
|
|
|
# Test environment override
|
|
test_environment_override if {
|
|
not allow with input as {
|
|
"cve_findings": [
|
|
{"cve_id": "CVE-2024-0001", "epss_score": 0.4}
|
|
],
|
|
"environment": "production",
|
|
"config": {
|
|
"epss_threshold": 0.6,
|
|
"environments": {
|
|
"production": {"epss_threshold": 0.3}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
# Test only_reachable filter
|
|
test_only_reachable_filters_unreachable if {
|
|
allow with input as {
|
|
"cve_findings": [
|
|
{"cve_id": "CVE-2024-0001", "epss_score": 0.8, "is_reachable": false},
|
|
{"cve_id": "CVE-2024-0002", "epss_score": 0.3, "is_reachable": true}
|
|
],
|
|
"config": {"epss_threshold": 0.6, "only_reachable": true}
|
|
}
|
|
}
|
|
|
|
# Test denial message content
|
|
test_deny_message_content if {
|
|
msg := deny[_] with input as {
|
|
"cve_findings": [
|
|
{"cve_id": "CVE-2024-1234", "epss_score": 0.72}
|
|
],
|
|
"config": {"epss_threshold": 0.6}
|
|
}
|
|
contains(msg, "CVE-2024-1234")
|
|
contains(msg, "0.72")
|
|
}
|
|
|
|
# Test summary output
|
|
test_summary_structure if {
|
|
s := summary with input as {
|
|
"cve_findings": [
|
|
{"cve_id": "CVE-2024-0001", "epss_score": 0.3},
|
|
{"cve_id": "CVE-2024-0002", "epss_score": 0.7}
|
|
],
|
|
"environment": "staging",
|
|
"config": {"epss_threshold": 0.6}
|
|
}
|
|
s.total_cves == 2
|
|
s.exceeding_count == 1
|
|
s.threshold == 0.6
|
|
s.environment == "staging"
|
|
}
|