From 3c9bfc6efd8aaa5a48cc6ee50ba5433001272d94 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Bonhomme?= Date: Wed, 22 Jul 2026 12:12:50 +0200 Subject: [PATCH] fix: [tests] Comment on an existing vulnerability, not a hardcoded CVE Vulnerability-Lookup now rejects comment creation when the target vulnerability is absent from storage (added in vulnerability-lookup#497). The two local comment tests hardcoded CVE-2024-20401, which the CI sample instance never imports, so create_comment returned 404 'Vulnerability not found'. Fetch a vulnerability actually present in the instance via get_last(source='pysec', number=1) and comment on it (the CI instance loads pysec). The test skips if no vulnerability is available. Co-Authored-By: Claude Fable 5 --- tests/test_web.py | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-) diff --git a/tests/test_web.py b/tests/test_web.py index e01549c..2ada1d3 100644 --- a/tests/test_web.py +++ b/tests/test_web.py @@ -131,6 +131,15 @@ def test_comments_local(self) -> None: return None # Makes sure the userkey is set to the right one self.client.set_apikey(self.admin_token) + + # Comment creation requires the target vulnerability to exist in the + # instance, so comment on one that is actually imported (the CI sample + # instance loads pysec) rather than a hardcoded id. + last = self.client.get_last(source="pysec", number=1) + if not last: + return None + vuln_id = last[-1]["id"] + comments = self.client.get_comments() self.assertTrue("metadata" in comments) self.assertTrue("data" in comments) @@ -142,7 +151,7 @@ def test_comments_local(self) -> None: "title": "Comment", "description": "Comment", "description_format": "markdown", - "vulnerability": "CVE-2024-20401", + "vulnerability": vuln_id, "related_vulnerabilities": ["ghsa-4rcj-fmjg-q9fv"], } comments = self.client.create_comment(comment=comment) @@ -161,10 +170,10 @@ def test_comments_local(self) -> None: comments["data"][0]["uuid"], "a309d024-2714-4a81-a425-60f83f6d5740" ) - comments = self.client.get_comments(vuln_id="CVE-2024-20401") + comments = self.client.get_comments(vuln_id=vuln_id) self.assertTrue(len(comments["data"]) >= 1) for comment in comments["data"]: - self.assertEqual(comment["vulnerability"], "CVE-2024-20401") + self.assertEqual(comment["vulnerability"], vuln_id) # comments = self.client.get_comments(author='admin') # self.assertTrue(len(comments['data']) >= 1) @@ -172,13 +181,13 @@ def test_comments_local(self) -> None: # self.assertEqual(comment['author']['login'], 'admin') # type: ignore[call-overload] comments = self.client.get_comments( - uuid="a309d024-2714-4a81-a425-60f83f6d5740", vuln_id="CVE-2024-20401" + uuid="a309d024-2714-4a81-a425-60f83f6d5740", vuln_id=vuln_id ) self.assertTrue(len(comments["data"]) == 1) self.assertEqual( comments["data"][0]["uuid"], "a309d024-2714-4a81-a425-60f83f6d5740" ) - self.assertEqual(comments["data"][0]["vulnerability"], "CVE-2024-20401") + self.assertEqual(comments["data"][0]["vulnerability"], vuln_id) # self.assertEqual(comments['data'][0]['author']['login'], 'admin') status_code = self.client.delete_comment("a309d024-2714-4a81-a425-60f83f6d5740") @@ -339,8 +348,16 @@ def test_create_user_comment(self) -> None: self.assertTrue('login' in user, user) # self.assertTrue('apikey' in user, user) # self.client.set_apikey(user['apikey']) + + # Comment creation requires the target vulnerability to exist, so use + # one actually imported by the instance (pysec in CI). + last = self.client.get_last(source='pysec', number=1) + if not last: + return None + vuln_id = last[-1]['id'] + comment = {'title': 'test', 'description': 'test', - 'vulnerability': 'CVE-2024-20401', + 'vulnerability': vuln_id, 'related_vulnerabilities': ['CVE-2024-20402']} created_comment = self.client.create_comment(comment=comment) print(created_comment)