| 1 | import assert from "node:assert/strict"; |
| 2 | import { test } from "node:test"; |
| 3 | |
| 4 | import { advisoryFromForm, advisoryStanding, parseAdvisoryState, parseReportState, parseSeverity, reportFromForm } from "./advisories.ts"; |
| 5 | |
| 6 | const form = (fields: Record<string, string>): FormData => { |
| 7 | const data = new FormData(); |
| 8 | for (const [key, value] of Object.entries(fields)) data.set(key, value); |
| 9 | return data; |
| 10 | }; |
| 11 | |
| 12 | test("an advisory form is checked and cleaned", () => { |
| 13 | const input = advisoryFromForm( |
| 14 | form({ |
| 15 | title: " Path traversal in the archive reader ", |
| 16 | description: "Details", |
| 17 | severity: "high", |
| 18 | cveId: "cve-2026-12345", |
| 19 | cvssScore: "8.1", |
| 20 | credits: "@ana, bo\n\ncy", |
| 21 | package: "@flagon/hello", |
| 22 | affectedVersions: ">= 1.2.0, < 1.4.1", |
| 23 | }), |
| 24 | ); |
| 25 | assert.ok(typeof input !== "string"); |
| 26 | assert.equal(input.title, "Path traversal in the archive reader"); |
| 27 | assert.equal(input.cveId, "CVE-2026-12345"); |
| 28 | assert.equal(input.cvssScore, 8.1); |
| 29 | assert.deepEqual(input.credits, ["ana", "bo", "cy"]); |
| 30 | assert.equal(input.ecosystem, null); |
| 31 | assert.equal(advisoryFromForm(form({ title: " ", severity: "high" })), "Give the advisory a title."); |
| 32 | assert.equal(advisoryFromForm(form({ title: "x", severity: "severe" })), "Choose a severity."); |
| 33 | assert.equal(advisoryFromForm(form({ title: "x", severity: "low", cvssScore: "11" })), "A CVSS score is 0 to 10."); |
| 34 | assert.equal(advisoryFromForm(form({ title: "x", severity: "low", cveId: "CVE-1" })), "A CVE id looks like CVE-2026-12345."); |
| 35 | }); |
| 36 | |
| 37 | test("a report needs a title and a description, and an email when signed out", () => { |
| 38 | const signedIn = reportFromForm(form({ title: "XSS in the search box", description: "Type <script> into…", severity: "medium" }), true); |
| 39 | assert.ok(typeof signedIn !== "string"); |
| 40 | assert.equal(signedIn.severity, "medium"); |
| 41 | assert.equal(signedIn.email, null); |
| 42 | assert.equal(reportFromForm(form({ title: "XSS", description: "…" }), false), "Give an email address the maintainers can answer at, or sign in."); |
| 43 | assert.equal(reportFromForm(form({ title: "XSS", description: "…", email: "not an address" }), false), "Give an email address the maintainers can answer at, or sign in."); |
| 44 | const signedOut = reportFromForm(form({ title: "XSS", description: "…", email: "finder@example.com", severity: "nope" }), false); |
| 45 | assert.ok(typeof signedOut !== "string"); |
| 46 | assert.equal(signedOut.email, "finder@example.com"); |
| 47 | assert.equal(signedOut.severity, null); |
| 48 | assert.equal(reportFromForm(form({ title: "", description: "…" }), true), "Give the report a title: one line on what you found."); |
| 49 | assert.equal(reportFromForm(form({ title: "x", description: " " }), true), "Describe the vulnerability: what is affected and how to reproduce it."); |
| 50 | }); |
| 51 | |
| 52 | test("states and severities parse only to what is known", () => { |
| 53 | assert.equal(parseSeverity("critical"), "critical"); |
| 54 | assert.equal(parseSeverity("severe"), null); |
| 55 | assert.equal(parseAdvisoryState("withdrawn"), "withdrawn"); |
| 56 | assert.equal(parseAdvisoryState("gone"), null); |
| 57 | assert.equal(parseReportState("new"), "new"); |
| 58 | assert.deepEqual(advisoryStanding({ state: "draft", createdBy: "ana" }), { verb: "Drafted by ana", at: null }); |
| 59 | assert.deepEqual(advisoryStanding({ state: "published", createdBy: "ana", publishedAt: "2026-10-07T15:02:40.000Z" }), { verb: "Published", at: "2026-10-07T15:02:40.000Z" }); |
| 60 | assert.deepEqual(advisoryStanding({ state: "withdrawn", createdBy: "ana", withdrawnAt: "2026-10-08T00:00:00.000Z" }), { verb: "Withdrawn", at: "2026-10-08T00:00:00.000Z" }); |
| 61 | }); |