e504b3dbcf
38 tests covering the pure worker-line logic: Classifyline rules, Routeline TLP/country/incident-type gates, Sealine seal/unseal round-trip, Proofline confidence scoring, Mapline CVEResolver escalation, Trainline dataset well-posedness (the v1/v3 input-signal bugs are now regression-guarded), and the Scoutline feed parsers. pytest added as a dev extra. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
43 lines
1.5 KiB
Python
43 lines
1.5 KiB
Python
"""Mapline tests — CVEResolver KEV cross-check."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from psyc.lines.map import _looks_like_ip, kev_cve_set, resolve_cves
|
|
from psyc.models import Severity
|
|
from conftest import make_case
|
|
|
|
|
|
def test_kev_cve_set_only_from_kev_cases():
|
|
kev = make_case(feed="cisa-kev", cves=["CVE-2026-0001"])
|
|
urlhaus = make_case(feed="urlhaus", cves=["CVE-2099-9999"]) # not KEV-sourced
|
|
assert kev_cve_set([kev, urlhaus]) == {"CVE-2026-0001"}
|
|
|
|
|
|
def test_resolve_cves_flags_and_escalates_non_kev_case():
|
|
kev_set = {"CVE-2026-0001"}
|
|
case = make_case(feed="urlhaus", cves=["CVE-2026-0001"], severity=Severity.LOW)
|
|
resolve_cves(case, kev_set)
|
|
assert case.source_metadata["kev_cves"] == "CVE-2026-0001"
|
|
assert case.classification.severity is Severity.HIGH
|
|
|
|
|
|
def test_resolve_cves_does_not_escalate_kev_source_case():
|
|
kev_set = {"CVE-2026-0001"}
|
|
case = make_case(feed="cisa-kev", cves=["CVE-2026-0001"], severity=Severity.LOW)
|
|
resolve_cves(case, kev_set)
|
|
# its own CVE is in KEV by definition — no self-escalation
|
|
assert case.classification.severity is Severity.LOW
|
|
|
|
|
|
def test_resolve_cves_noop_without_match():
|
|
case = make_case(feed="urlhaus", cves=["CVE-2099-9999"], severity=Severity.MEDIUM)
|
|
resolve_cves(case, {"CVE-2026-0001"})
|
|
assert "kev_cves" not in case.source_metadata
|
|
assert case.classification.severity is Severity.MEDIUM
|
|
|
|
|
|
def test_looks_like_ip():
|
|
assert _looks_like_ip("8.8.8.8")
|
|
assert not _looks_like_ip("example.com")
|
|
assert not _looks_like_ip("999.1.1.1")
|