Fix(reporting): NotFixedYet of SourcePackage in OVAL match on Debian and Ubuntu (#656)

* fix(refactoring): oval

* Fix(reporting): NotFixedYet of SourcePackage in OVAL match on Debian and Ubuntu #655

models/packages.go

@@ -187,3 +187,15 @@ func (s *SrcPackage) AddBinaryName(name string) {
 // SrcPackages is Map of SrcPackage
 // { "package-name": SrcPackage }
 type SrcPackages map[string]SrcPackage
+
+// FindByBinName finds by bin-package-name
+func (s SrcPackages) FindByBinName(name string) (*SrcPackage, bool) {
+	for _, p := range s {
+		for _, binName := range p.BinaryNames {
+			if binName == name {
+				return &p, true
+			}
+		}
+	}
+	return nil, false
+}

models/packages_test.go

@@ -133,3 +133,61 @@ func TestAddBinaryName(t *testing.T) {
 		}
 	}
 }
+
+func TestFindByBinName(t *testing.T) {
+	var tests = []struct {
+		in       SrcPackages
+		name     string
+		expected *SrcPackage
+		ok       bool
+	}{
+		{
+			in: map[string]SrcPackage{
+				"packA": {
+					Name:        "srcA",
+					BinaryNames: []string{"binA"},
+					Version:     "1.0.0",
+				},
+				"packB": {
+					Name:        "srcB",
+					BinaryNames: []string{"binB"},
+					Version:     "2.0.0",
+				},
+			},
+			name: "binA",
+			expected: &SrcPackage{
+				Name:        "srcA",
+				BinaryNames: []string{"binA"},
+				Version:     "1.0.0",
+			},
+			ok: true,
+		},
+		{
+			in: map[string]SrcPackage{
+				"packA": {
+					Name:        "srcA",
+					BinaryNames: []string{"binA"},
+					Version:     "1.0.0",
+				},
+				"packB": {
+					Name:        "srcB",
+					BinaryNames: []string{"binB"},
+					Version:     "2.0.0",
+				},
+			},
+			name:     "nobin",
+			expected: nil,
+			ok:       false,
+		},
+	}
+
+	for i, tt := range tests {
+		act, ok := tt.in.FindByBinName(tt.name)
+		if ok != tt.ok {
+			t.Errorf("[%d] expected %#v, actual %#v", i, tt.in, tt.expected)
+		}
+		if act != nil && !reflect.DeepEqual(*tt.expected, *act) {
+			t.Errorf("[%d] expected %#v, actual %#v", i, tt.in, tt.expected)
+		}
+	}
+}

oval/alpine.go

@@ -67,7 +67,7 @@ func (o Alpine) update(r *models.ScanResult, defPacks defPacks) {
 		}
 	}
 
-	vinfo.AffectedPackages = defPacks.toPackStatuses(r.Family)
+	vinfo.AffectedPackages = defPacks.toPackStatuses()
 	vinfo.AffectedPackages.Sort()
 	r.ScannedCves[cveID] = vinfo
 }

oval/debian.go

@@ -64,7 +64,18 @@ func (o DebianBase) update(r *models.ScanResult, defPacks defPacks) {
 		defPacks.actuallyAffectedPackNames[pack.Name] = notFixedYet
 	}
 
-	vinfo.AffectedPackages = defPacks.toPackStatuses(r.Family)
+	// update notFixedYet of SrcPackage
+	for binName := range defPacks.actuallyAffectedPackNames {
+		if srcPack, ok := r.SrcPackages.FindByBinName(binName); ok {
+			for _, p := range defPacks.def.AffectedPacks {
+				if p.Name == srcPack.Name {
+					defPacks.actuallyAffectedPackNames[binName] = p.NotFixedYet
+				}
+			}
+		}
+	}
+
+	vinfo.AffectedPackages = defPacks.toPackStatuses()
 	vinfo.AffectedPackages.Sort()
 	r.ScannedCves[defPacks.def.Debian.CveID] = vinfo
 }

oval/redhat.go

@@ -137,7 +137,7 @@ func (o RedHatBase) update(r *models.ScanResult, defPacks defPacks) {
 			notFixedYet, _ := defPacks.actuallyAffectedPackNames[pack.Name]
 			defPacks.actuallyAffectedPackNames[pack.Name] = notFixedYet
 		}
-		vinfo.AffectedPackages = defPacks.toPackStatuses(r.Family)
+		vinfo.AffectedPackages = defPacks.toPackStatuses()
 		vinfo.AffectedPackages.Sort()
 		r.ScannedCves[cve.CveID] = vinfo
 	}

oval/suse.go

@@ -96,7 +96,7 @@ func (o SUSE) update(r *models.ScanResult, defPacks defPacks) {
 		notFixedYet, _ := defPacks.actuallyAffectedPackNames[pack.Name]
 		defPacks.actuallyAffectedPackNames[pack.Name] = notFixedYet
 	}
-	vinfo.AffectedPackages = defPacks.toPackStatuses(r.Family)
+	vinfo.AffectedPackages = defPacks.toPackStatuses()
 	vinfo.AffectedPackages.Sort()
 	r.ScannedCves[defPacks.def.Title] = vinfo
 }

oval/util.go

@@ -48,7 +48,7 @@ type defPacks struct {
 	actuallyAffectedPackNames map[string]bool
 }
 
-func (e defPacks) toPackStatuses(family string) (ps models.PackageStatuses) {
+func (e defPacks) toPackStatuses() (ps models.PackageStatuses) {
 	for name, notFixedYet := range e.actuallyAffectedPackNames {
 		ps = append(ps, models.PackageStatus{
 			Name:        name,

oval/util_test.go

@@ -105,9 +105,8 @@ func TestUpsert(t *testing.T) {
 
 func TestDefpacksToPackStatuses(t *testing.T) {
 	type in struct {
-		dp     defPacks
-		family string
-		packs  models.Packages
+		dp    defPacks
+		packs models.Packages
 	}
 	var tests = []struct {
 		in  in
@@ -116,7 +115,6 @@ func TestDefpacksToPackStatuses(t *testing.T) {
 		// Ubuntu
 		{
 			in: in{
-				family: "ubuntu",
 				dp: defPacks{
 					def: ovalmodels.Definition{
 						AffectedPacks: []ovalmodels.Package{
@@ -154,7 +152,7 @@ func TestDefpacksToPackStatuses(t *testing.T) {
 		},
 	}
 	for i, tt := range tests {
-		actual := tt.in.dp.toPackStatuses(tt.in.family)
+		actual := tt.in.dp.toPackStatuses()
 		sort.Slice(actual, func(i, j int) bool {
 			return actual[i].Name < actual[j].Name
 		})