76 lines
2.9 KiB
Python
Executable File
76 lines
2.9 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""
|
|
Test script to check for vulnerable dependencies.
|
|
This script scans requirements.txt for known vulnerable packages.
|
|
"""
|
|
|
|
import os
|
|
import unittest
|
|
import subprocess
|
|
import sys
|
|
|
|
|
|
class DependencySecurityTests(unittest.TestCase):
|
|
"""Tests to verify that dependencies don't have known vulnerabilities."""
|
|
|
|
def setUp(self):
|
|
"""Set up the test environment."""
|
|
self.project_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
|
|
self.requirements_path = os.path.join(self.project_root, 'docker', 'ploughshares', 'requirements.txt')
|
|
|
|
def test_requirements_file_exists(self):
|
|
"""Test that requirements.txt exists."""
|
|
self.assertTrue(os.path.exists(self.requirements_path),
|
|
"requirements.txt file should exist")
|
|
|
|
def test_no_pinned_vulnerable_packages(self):
|
|
"""Test that requirements.txt doesn't contain known vulnerable package versions."""
|
|
# This is a simplified check - in production, you would use a tool like safety
|
|
with open(self.requirements_path, 'r') as f:
|
|
requirements = f.read()
|
|
|
|
# List of known vulnerable packages and versions (example)
|
|
known_vulnerable = [
|
|
"flask==0.12.0", # Example vulnerable version
|
|
"psycopg2==2.4.5", # Example vulnerable version
|
|
"werkzeug==0.11.0", # Example vulnerable version
|
|
]
|
|
|
|
for package in known_vulnerable:
|
|
self.assertNotIn(package, requirements,
|
|
f"requirements.txt contains vulnerable package: {package}")
|
|
|
|
def test_safety_check(self):
|
|
"""
|
|
Test using safety to check for vulnerabilities (if installed).
|
|
|
|
Note: This test is skipped if safety is not installed.
|
|
To install safety: pip install safety
|
|
"""
|
|
try:
|
|
# Check if safety is installed
|
|
subprocess.run(["safety", "--version"],
|
|
stdout=subprocess.PIPE,
|
|
stderr=subprocess.PIPE,
|
|
check=True)
|
|
|
|
# Skip the actual test - in CI/CD you would run this
|
|
self.skipTest("Safety check skipped in test - run manually or in CI/CD")
|
|
|
|
# Example of how to run safety:
|
|
# result = subprocess.run(
|
|
# ["safety", "check", "-r", self.requirements_path, "--json"],
|
|
# stdout=subprocess.PIPE,
|
|
# stderr=subprocess.PIPE,
|
|
# text=True,
|
|
# check=False
|
|
# )
|
|
# self.assertEqual(result.returncode, 0,
|
|
# f"Safety check failed: {result.stdout}")
|
|
|
|
except (subprocess.SubprocessError, FileNotFoundError):
|
|
self.skipTest("safety not installed, skipping vulnerability check")
|
|
|
|
|
|
if __name__ == '__main__':
|
|
unittest.main() |