diff --git a/pkg/security/risks/builtin/missing_file_validation_rule_test.go b/pkg/security/risks/builtin/missing_file_validation_rule_test.go new file mode 100644 index 00000000..5e260bf9 --- /dev/null +++ b/pkg/security/risks/builtin/missing_file_validation_rule_test.go @@ -0,0 +1,163 @@ +package builtin + +import ( + "testing" + + "github.com/stretchr/testify/assert" + "github.com/threagile/threagile/pkg/security/types" +) + +func TestMissingFileValidationRuleGenerateRisksEmptyModelNotRisksCreated(t *testing.T) { + rule := NewMissingFileValidationRule() + + risks, err := rule.GenerateRisks(&types.Model{}) + + assert.Nil(t, err) + assert.Empty(t, risks) +} + +func TestMissingFileValidationRuleGenerateRisksOutOfScopeNoRisksCreated(t *testing.T) { + rule := NewMissingFileValidationRule() + risks, err := rule.GenerateRisks(&types.Model{ + TechnicalAssets: map[string]*types.TechnicalAsset{ + "ta1": { + Title: "Test Technical Asset", + CustomDevelopedParts: true, + OutOfScope: true, + }, + }, + }) + + assert.Nil(t, err) + assert.Empty(t, risks) +} + +func TestMissingFileValidationRuleGenerateRisksNotCustomlyDevelopedTechnicalAssetNoRisksCreated(t *testing.T) { + rule := NewMissingFileValidationRule() + risks, err := rule.GenerateRisks(&types.Model{ + TechnicalAssets: map[string]*types.TechnicalAsset{ + "ta1": { + Title: "Test Technical Asset", + CustomDevelopedParts: false, + OutOfScope: false, + }, + }, + }) + + assert.Nil(t, err) + assert.Empty(t, risks) +} + +func TestMissingFileValidationRuleGenerateRisksNoFileAcceptedAssetNoRisksCreated(t *testing.T) { + rule := NewMissingFileValidationRule() + risks, err := rule.GenerateRisks(&types.Model{ + TechnicalAssets: map[string]*types.TechnicalAsset{ + "ta1": { + Title: "Test Technical Asset", + CustomDevelopedParts: true, + OutOfScope: false, + DataFormatsAccepted: []types.DataFormat{types.CSV, types.Serialization, types.XML}, + }, + }, + }) + + assert.Nil(t, err) + assert.Empty(t, risks) +} + +func TestMissingFileValidationRuleGenerateRisksFileDataFormatsAcceptedRisksCreated(t *testing.T) { + rule := NewMissingFileValidationRule() + risks, err := rule.GenerateRisks(&types.Model{ + TechnicalAssets: map[string]*types.TechnicalAsset{ + "ta1": { + Title: "Test Technical Asset", + CustomDevelopedParts: true, + OutOfScope: false, + DataFormatsAccepted: []types.DataFormat{types.File}, + }, + }, + }) + + assert.Nil(t, err) + assert.Len(t, risks, 1) + assert.Equal(t, types.LowImpact, risks[0].ExploitationImpact) + assert.Equal(t, "Missing File Validation risk at Test Technical Asset", risks[0].Title) +} + +func TestMissingFileValidationRuleGenerateRisksProcessStrictlyConfidentialDataRisksCreatedWithMediumImpact(t *testing.T) { + rule := NewMissingFileValidationRule() + risks, err := rule.GenerateRisks(&types.Model{ + TechnicalAssets: map[string]*types.TechnicalAsset{ + "ta1": { + Title: "Test Technical Asset", + CustomDevelopedParts: true, + OutOfScope: false, + DataFormatsAccepted: []types.DataFormat{types.File}, + DataAssetsProcessed: []string{"da1"}, + }, + }, + DataAssets: map[string]*types.DataAsset{ + "da1": { + Title: "Test Data Asset", + Confidentiality: types.StrictlyConfidential, + }, + }, + }) + + assert.Nil(t, err) + assert.Len(t, risks, 1) + assert.Equal(t, types.MediumImpact, risks[0].ExploitationImpact) + assert.Equal(t, "Missing File Validation risk at Test Technical Asset", risks[0].Title) +} + +func TestMissingFileValidationRuleGenerateRisksProcessMissionCriticalIntegrityDataRisksCreatedWithMediumImpact(t *testing.T) { + rule := NewMissingFileValidationRule() + risks, err := rule.GenerateRisks(&types.Model{ + TechnicalAssets: map[string]*types.TechnicalAsset{ + "ta1": { + Title: "Test Technical Asset", + CustomDevelopedParts: true, + OutOfScope: false, + DataFormatsAccepted: []types.DataFormat{types.File}, + DataAssetsProcessed: []string{"da1"}, + }, + }, + DataAssets: map[string]*types.DataAsset{ + "da1": { + Title: "Test Data Asset", + Integrity: types.MissionCritical, + }, + }, + }) + + assert.Nil(t, err) + assert.Len(t, risks, 1) + assert.Equal(t, types.MediumImpact, risks[0].ExploitationImpact) + assert.Equal(t, "Missing File Validation risk at Test Technical Asset", risks[0].Title) +} + +func TestMissingFileValidationRuleGenerateRisksProcessMissionCriticalAvailabilityDataRisksCreatedWithMediumImpact(t *testing.T) { + rule := NewMissingFileValidationRule() + risks, err := rule.GenerateRisks(&types.Model{ + TechnicalAssets: map[string]*types.TechnicalAsset{ + "ta1": { + Title: "Test Technical Asset", + CustomDevelopedParts: true, + OutOfScope: false, + DataFormatsAccepted: []types.DataFormat{types.File}, + DataAssetsProcessed: []string{"da1"}, + }, + }, + DataAssets: map[string]*types.DataAsset{ + "da1": { + Title: "Test Data Asset", + Availability: types.MissionCritical, + }, + }, + }) + + assert.Nil(t, err) + assert.Len(t, risks, 1) + assert.Equal(t, types.MediumImpact, risks[0].ExploitationImpact) + assert.Equal(t, "Missing File Validation risk at Test Technical Asset", risks[0].Title) +}