102 lines
3.0 KiB
Rego
102 lines
3.0 KiB
Rego
# -----------------------------------------------------------------------------
|
|
# reachable-cve_test.rego
|
|
# Tests for reachability-aware CVE policy
|
|
# -----------------------------------------------------------------------------
|
|
|
|
package stellaops.gates.reachable
|
|
|
|
import future.keywords.if
|
|
|
|
# Test allow - high severity but not reachable
|
|
test_allow_high_not_reachable if {
|
|
allow with input as {
|
|
"cve_findings": [
|
|
{"cve_id": "CVE-2024-0001", "cvss_score": 9.0, "is_reachable": false}
|
|
],
|
|
"config": {"severity_threshold": 7.0}
|
|
}
|
|
}
|
|
|
|
# Test allow - reachable but below threshold
|
|
test_allow_reachable_below_threshold if {
|
|
allow with input as {
|
|
"cve_findings": [
|
|
{"cve_id": "CVE-2024-0001", "cvss_score": 5.0, "is_reachable": true}
|
|
],
|
|
"config": {"severity_threshold": 7.0}
|
|
}
|
|
}
|
|
|
|
# Test deny - reachable and above threshold
|
|
test_deny_reachable_above_threshold if {
|
|
not allow with input as {
|
|
"cve_findings": [
|
|
{"cve_id": "CVE-2024-0001", "cvss_score": 8.5, "is_reachable": true}
|
|
],
|
|
"config": {"severity_threshold": 7.0}
|
|
}
|
|
}
|
|
|
|
# Test deny - confirmed_reachable state
|
|
test_deny_confirmed_reachable_state if {
|
|
not allow with input as {
|
|
"cve_findings": [
|
|
{"cve_id": "CVE-2024-0001", "cvss_score": 8.5, "reachability_state": "confirmed_reachable"}
|
|
],
|
|
"config": {"severity_threshold": 7.0}
|
|
}
|
|
}
|
|
|
|
# Test allow - not_reachable state
|
|
test_allow_not_reachable_state if {
|
|
allow with input as {
|
|
"cve_findings": [
|
|
{"cve_id": "CVE-2024-0001", "cvss_score": 9.5, "reachability_state": "not_reachable"}
|
|
],
|
|
"config": {"severity_threshold": 7.0}
|
|
}
|
|
}
|
|
|
|
# Test environment threshold override
|
|
test_environment_threshold_override if {
|
|
not allow with input as {
|
|
"cve_findings": [
|
|
{"cve_id": "CVE-2024-0001", "cvss_score": 5.0, "is_reachable": true}
|
|
],
|
|
"environment": "production",
|
|
"config": {
|
|
"severity_threshold": 7.0,
|
|
"environments": {
|
|
"production": {"severity_threshold": 4.0}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
# Test denial message content
|
|
test_deny_message_content if {
|
|
msg := deny[_] with input as {
|
|
"cve_findings": [
|
|
{"cve_id": "CVE-2024-1234", "cvss_score": 8.1, "is_reachable": true}
|
|
],
|
|
"config": {"severity_threshold": 7.0}
|
|
}
|
|
contains(msg, "CVE-2024-1234")
|
|
contains(msg, "8.1")
|
|
}
|
|
|
|
# Test summary structure
|
|
test_summary_structure if {
|
|
s := summary with input as {
|
|
"cve_findings": [
|
|
{"cve_id": "CVE-2024-0001", "cvss_score": 9.0, "is_reachable": true},
|
|
{"cve_id": "CVE-2024-0002", "cvss_score": 8.0, "is_reachable": false},
|
|
{"cve_id": "CVE-2024-0003", "cvss_score": 5.0, "is_reachable": true}
|
|
],
|
|
"config": {"severity_threshold": 7.0}
|
|
}
|
|
s.total_cves == 3
|
|
s.reachable_high_severity == 1
|
|
s.unreachable_high_severity == 1
|
|
}
|