require 'helper'

module Gemsurance
  class VulnerabilityTest < Test::Unit::TestCase
    def test_attributes
      v = Vulnerability.new(vulnerability_yaml)

      expected = YAML.load(vulnerability_yaml)
      assert_equal expected, v.attributes
      expected.each do |expected_key, expected_value|
        assert_equal expected_value, v.send(expected_key)
      end
    end

    def test_equality
      v_1 = Vulnerability.new(vulnerability_yaml)
      v_2 = Vulnerability.new(vulnerability_yaml)

      assert_equal v_1, v_2
    end

  private

    def vulnerability_yaml
<<-YAML
---
gem: actionpack
framework: rails
cve: 2013-6416
osvdb: 100526
url: https://groups.google.com/forum/#!topic/ruby-security-ann/5ZI1-H5OoIM
title: XSS Vulnerability in simple_format helper
date: 2013-12-03

description: |
  There is a vulnerability in the simple_format helper in Ruby on Rails.
  The simple_format helper converts user supplied text into html text 
  which is intended to be safe for display. A change made to the 
  implementation of this helper means that any user provided HTML 
  attributes will not be escaped correctly. As a result of this error, 
  applications which pass user-controlled data to be included as html 
  attributes will be vulnerable to an XSS attack.

cvss_v2: 

unaffected_versions:
  - ~> 2.3.0
  - ~> 3.1.0
  - ~> 3.2.0

patched_versions:
  - ">= 4.0.2"
YAML
    end

  end
end
