Skip to content

Commit

Permalink
Fix release finding
Browse files Browse the repository at this point in the history
  • Loading branch information
@skyargos
skyargos committed Nov 9, 2023
1 parent 8d9af12 commit 9e94af0
Show file tree
Hide file tree
Showing 14 changed files with 1,047 additions and 299 deletions.
35 changes: 17 additions & 18 deletions proto/shentu/bounty/v1/bounty.proto
View file
Original file line number Diff line number Diff line change
Expand Up @@ -32,12 +32,13 @@ message Finding {
string title = 3;
// JSON by FindingDetail
string description = 4 [(gogoproto.moretags) = "yaml:\"description\""];
string submitter_address = 5 [(gogoproto.moretags) = "yaml:\"submitter_address\""];
google.protobuf.Timestamp create_time = 6
// hash(desc + pos + submitter)
string finding_hash = 5 [(gogoproto.moretags) = "yaml:\"finding_hash\""];
string submitter_address = 6 [(gogoproto.moretags) = "yaml:\"submitter_address\""];
SeverityLevel severity_level = 7 [(gogoproto.moretags) = "yaml:\"severity_level\""];
FindingStatus status = 8 [(gogoproto.moretags) = "yaml:\"status\""];
google.protobuf.Timestamp create_time = 9
[(gogoproto.stdtime) = true, (gogoproto.nullable) = false, (gogoproto.moretags) = "yaml:\"create_time\""];
FindingStatus status = 7 [(gogoproto.moretags) = "yaml:\"status\""];
string finding_hash = 8 [(gogoproto.moretags) = "yaml:\"finding_hash\""];
SeverityLevel severity_level = 9 [(gogoproto.moretags) = "yaml:\"severity_level\""];
}

enum ProgramStatus {
Expand All @@ -51,22 +52,22 @@ enum ProgramStatus {
enum SeverityLevel {
option (gogoproto.goproto_enum_prefix) = false;

SEVERITY_LEVEL_CRITICAL = 0 [(gogoproto.enumvalue_customname) = "SeverityLevelCritical"];
SEVERITY_LEVEL_HIGH = 1 [(gogoproto.enumvalue_customname) = "SeverityLevelHigh"];
SEVERITY_LEVEL_MEDIUM = 2 [(gogoproto.enumvalue_customname) = "SeverityLevelMedium"];
SEVERITY_LEVEL_LOW = 3 [(gogoproto.enumvalue_customname) = "SeverityLevelLow"];
SEVERITY_LEVEL_INFORMATIONAL = 4 [(gogoproto.enumvalue_customname) = "SeverityLevelInformational"];
SEVERITY_LEVEL_UNSPECIFIED = 0 [(gogoproto.enumvalue_customname) = "Unspecified"];
SEVERITY_LEVEL_CRITICAL = 1 [(gogoproto.enumvalue_customname) = "Critical"];
SEVERITY_LEVEL_HIGH = 2 [(gogoproto.enumvalue_customname) = "High"];
SEVERITY_LEVEL_MEDIUM = 3 [(gogoproto.enumvalue_customname) = "Medium"];
SEVERITY_LEVEL_LOW = 4 [(gogoproto.enumvalue_customname) = "Low"];
SEVERITY_LEVEL_INFORMATIONAL = 5 [(gogoproto.enumvalue_customname) = "Informational"];
}

enum FindingStatus {
option (gogoproto.goproto_enum_prefix) = false;

FINDING_STATUS_REPORTED = 0 [(gogoproto.enumvalue_customname) = "FindingStatusReported"];
FINDING_STATUS_PROPOSED = 1 [(gogoproto.enumvalue_customname) = "FindingStatusProposed"];
FINDING_STATUS_ACTIVE = 2 [(gogoproto.enumvalue_customname) = "FindingStatusActive"];
FINDING_STATUS_CONFIRMED = 3 [(gogoproto.enumvalue_customname) = "FindingStatusConfirmed"];
FINDING_STATUS_PAID = 4 [(gogoproto.enumvalue_customname) = "FindingStatusPaid"];
FINDING_STATUS_CLOSED = 5 [(gogoproto.enumvalue_customname) = "FindingStatusClosed"];
FINDING_STATUS_SUBMITTED = 0 [(gogoproto.enumvalue_customname) = "FindingStatusSubmitted"];
FINDING_STATUS_ACTIVE = 1 [(gogoproto.enumvalue_customname) = "FindingStatusActive"];
FINDING_STATUS_CONFIRMED = 2 [(gogoproto.enumvalue_customname) = "FindingStatusConfirmed"];
FINDING_STATUS_PAID = 3 [(gogoproto.enumvalue_customname) = "FindingStatusPaid"];
FINDING_STATUS_CLOSED = 4 [(gogoproto.enumvalue_customname) = "FindingStatusClosed"];
}

message BountyLevel {
Expand All @@ -87,7 +88,6 @@ message BountyLevel {
// string description = 1;
// string scope_rules = 2;
// string known_issues = 3;
// repeated BountyLevel bounty_levels = 4 [(gogoproto.nullable) = false, (gogoproto.moretags) = "yaml:\"bounty_levels\""];
//}

//// FindingDetail defines a finding detail.
Expand All @@ -99,5 +99,4 @@ message BountyLevel {
// string proof_of_concept = 2 [(gogoproto.moretags) = "yaml:\"proof_of_concept\""];
// repeated string program_targets = 3 [(gogoproto.moretags) = "yaml:\"program_targets\""];
// repeated string attachments = 4;
// SeverityLevel severity_level = 5 [(gogoproto.moretags) = "yaml:\"severity_level\""];
//}
24 changes: 22 additions & 2 deletions proto/shentu/bounty/v1/tx.proto
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,9 @@ service Msg {
// SubmitFinding defines a method for submitting a new finding.
rpc SubmitFinding(MsgSubmitFinding) returns (MsgSubmitFindingResponse);

// EditFinding defines a method for editing a new finding.
rpc EditFinding(MsgEditFinding) returns (MsgEditFindingResponse);

// AcceptFinding defines a method for host accept a finding.
rpc AcceptFinding(MsgAcceptFinding) returns (MsgAcceptFindingResponse);

Expand Down Expand Up @@ -103,13 +106,30 @@ message MsgSubmitFinding {
string finding_id = 2 [(gogoproto.moretags) = "yaml:\"finding_id\""];
string title = 3;
string description = 4;
string submitter_address = 5 [(gogoproto.moretags) = "yaml:\"submitter_address\""];
SeverityLevel severity_level = 6 [(gogoproto.moretags) = "yaml:\"severity_level\""];
string finding_hash = 5 [(gogoproto.moretags) = "yaml:\"finding_hash\""];
string submitter_address = 6 [(gogoproto.moretags) = "yaml:\"submitter_address\""];
SeverityLevel severity_level = 7 [(gogoproto.moretags) = "yaml:\"severity_level\""];
}

// MsgSubmitFindingResponse defines the MsgSubmitFinding response type.
message MsgSubmitFindingResponse {}

// MsgEditFinding defines a message to edit a finding.
message MsgEditFinding {
option (gogoproto.equal) = false;
option (gogoproto.goproto_getters) = false;

string program_id = 1 [(gogoproto.moretags) = "yaml:\"program_id\""];
string finding_id = 2 [(gogoproto.moretags) = "yaml:\"finding_id\""];
string title = 3;
string description = 4;
string submitter_address = 5 [(gogoproto.moretags) = "yaml:\"submitter_address\""];
SeverityLevel severity_level = 6 [(gogoproto.moretags) = "yaml:\"severity_level\""];
}

// MsgEditFindingResponse defines the MsgEditFinding response type.
message MsgEditFindingResponse {}

// MsgAcceptFinding defines a message to accept a finding to an existing finding.
message MsgAcceptFinding {
option (gogoproto.equal) = false;
Expand Down
57 changes: 57 additions & 0 deletions x/bounty/client/cli/tx.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ func NewTxCmd() *cobra.Command {
NewOpenProgramCmd(),
NewCloseProgramCmd(),
NewSubmitFindingCmd(),
NewEditFindingCmd(),
NewAcceptFindingCmd(),
NewRejectFindingCmd(),
NewCloseFindingCmd(),
Expand Down Expand Up @@ -223,6 +224,62 @@ func NewSubmitFindingCmd() *cobra.Command {

_ = cmd.MarkFlagRequired(flags.FlagFrom)
_ = cmd.MarkFlagRequired(FlagProgramID)
_ = cmd.MarkFlagRequired(FlagFindingID)

return cmd
}

func NewEditFindingCmd() *cobra.Command {
cmd := &cobra.Command{
Use: "edit-finding",
Short: "edit finding for a program",
RunE: func(cmd *cobra.Command, args []string) error {
clientCtx, err := client.GetClientTxContext(cmd)
if err != nil {
return err
}
submitAddr := clientCtx.GetFromAddress()

pid, err := cmd.Flags().GetString(FlagProgramID)
if err != nil {
return err
}
fid, err := cmd.Flags().GetString(FlagFindingID)
if err != nil {
return err
}
title, err := cmd.Flags().GetString(FlagFindingTitle)
if err != nil {
return err
}
desc, err := cmd.Flags().GetString(FlagDesc)
if err != nil {
return err
}
severityLevel, err := cmd.Flags().GetInt32(FlagFindingSeverityLevel)
if err != nil {
return err
}
//_, ok := types.SeverityLevel_name[severityLevel]
//if !ok {
// return fmt.Errorf("invalid %s value", FlagFindingSeverityLevel)
//}

msg := types.NewMsgEditFinding(pid, fid, title, desc, submitAddr, types.SeverityLevel(severityLevel))
return tx.GenerateOrBroadcastTxCLI(clientCtx, cmd.Flags(), msg)
},
}

cmd.Flags().String(FlagProgramID, "", "The program's ID")
cmd.Flags().String(FlagFindingID, "", "The finding's ID")
cmd.Flags().String(FlagFindingTitle, "", "The finding's title")
cmd.Flags().String(FlagDesc, "", "The finding's description")
cmd.Flags().Int32(FlagFindingSeverityLevel, 8, "The finding's severity level")
flags.AddTxFlagsToCmd(cmd)

_ = cmd.MarkFlagRequired(flags.FlagFrom)
_ = cmd.MarkFlagRequired(FlagProgramID)
_ = cmd.MarkFlagRequired(FlagFindingID)

return cmd
}
Expand Down
3 changes: 3 additions & 0 deletions x/bounty/handler.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,9 @@ func NewHandler(k keeper.Keeper) sdk.Handler {
case *types.MsgSubmitFinding:
res, err := msgServer.SubmitFinding(sdk.WrapSDKContext(ctx), msg)
return sdk.WrapServiceResult(ctx, res, err)
case *types.MsgEditFinding:
res, err := msgServer.EditFinding(sdk.WrapSDKContext(ctx), msg)
return sdk.WrapServiceResult(ctx, res, err)
case *types.MsgAcceptFinding:
res, err := msgServer.AcceptFinding(sdk.WrapSDKContext(ctx), msg)
return sdk.WrapServiceResult(ctx, res, err)
Expand Down
4 changes: 2 additions & 2 deletions x/bounty/keeper/finding_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,9 +42,9 @@ func (suite *KeeperTestSuite) TestSetGetFinding() {
Description: "desc",
SubmitterAddress: suite.address[0].String(),
CreateTime: time.Time{},
Status: types.FindingStatusReported,
Status: types.FindingStatusSubmitted,
FindingHash: "",
SeverityLevel: types.SeverityLevelLow,
SeverityLevel: types.Low,
},
},
},
Expand Down
63 changes: 53 additions & 10 deletions x/bounty/keeper/msg_server.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -107,11 +107,6 @@ func (k msgServer) EditProgram(goCtx context.Context, msg *types.MsgEditProgram)
func (k msgServer) OpenProgram(goCtx context.Context, msg *types.MsgOpenProgram) (*types.MsgOpenProgramResponse, error) {
ctx := sdk.UnwrapSDKContext(goCtx)

_, found := k.GetProgram(ctx, msg.ProgramId)
if !found {
return nil, types.ErrNoProgramFound
}

operatorAddr, err := sdk.AccAddressFromBech32(msg.OperatorAddress)
if err != nil {
return nil, err
Expand Down Expand Up @@ -148,7 +143,7 @@ func (k msgServer) CloseProgram(goCtx context.Context, msg *types.MsgCloseProgra
}
ctx.EventManager().EmitEvents(sdk.Events{
sdk.NewEvent(
types.EventTypeOpenProgram,
types.EventTypeCloseProgram,
sdk.NewAttribute(types.AttributeKeyProgramID, msg.ProgramId),
),
sdk.NewEvent(
Expand Down Expand Up @@ -183,7 +178,7 @@ func (k msgServer) SubmitFinding(goCtx context.Context, msg *types.MsgSubmitFind
return nil, types.ErrFindingAlreadyExists
}

Check warning on line 179 in x/bounty/keeper/msg_server.go

View check run for this annotation

Codecov / codecov/patch

x/bounty/keeper/msg_server.go#L178-L179 

Added lines #L178 - L179 were not covered by tests

finding, err := types.NewFinding(msg.ProgramId, msg.FindingId, msg.Title, msg.Description, operatorAddr, submitTime, msg.SeverityLevel)
finding, err := types.NewFinding(msg.ProgramId, msg.FindingId, msg.Title, msg.Description, msg.FindingHash, operatorAddr, submitTime, msg.SeverityLevel)
if err != nil {
return nil, err
}

Check warning on line 184 in x/bounty/keeper/msg_server.go

View check run for this annotation

Codecov / codecov/patch

x/bounty/keeper/msg_server.go#L183-L184 

Added lines #L183 - L184 were not covered by tests
Expand All @@ -210,6 +205,53 @@ func (k msgServer) SubmitFinding(goCtx context.Context, msg *types.MsgSubmitFind
return &types.MsgSubmitFindingResponse{}, nil
}

func (k msgServer) EditFinding(goCtx context.Context, msg *types.MsgEditFinding) (*types.MsgEditFindingResponse, error) {
ctx := sdk.UnwrapSDKContext(goCtx)

program, isExist := k.GetProgram(ctx, msg.ProgramId)
if !isExist {
return nil, types.ErrProgramNotExists
}
if program.Status != types.ProgramStatusActive {
return nil, types.ErrProgramNotActive
}

Check warning on line 217 in x/bounty/keeper/msg_server.go

View check run for this annotation

Codecov / codecov/patch

x/bounty/keeper/msg_server.go#L208-L217 

Added lines #L208 - L217 were not covered by tests

finding, found := k.GetFinding(ctx, msg.FindingId)
if !found {
return nil, types.ErrFindingNotExists
}

Check warning on line 222 in x/bounty/keeper/msg_server.go

View check run for this annotation

Codecov / codecov/patch

x/bounty/keeper/msg_server.go#L219-L222 

Added lines #L219 - L222 were not covered by tests
// check submitter
if finding.SubmitterAddress != msg.SubmitterAddress {
return nil, types.ErrFindingSubmitterInvalid
}
if len(msg.Title) > 0 {
finding.Title = msg.Title
}
if len(msg.Description) > 0 {
finding.Description = msg.Description
}
if msg.SeverityLevel != types.Unspecified {
finding.SeverityLevel = msg.SeverityLevel
}

Check warning on line 235 in x/bounty/keeper/msg_server.go

View check run for this annotation

Codecov / codecov/patch

x/bounty/keeper/msg_server.go#L224-L235 

Added lines #L224 - L235 were not covered by tests

k.SetFinding(ctx, finding)

ctx.EventManager().EmitEvents(sdk.Events{
sdk.NewEvent(
types.EventTypeEditFinding,
sdk.NewAttribute(types.AttributeKeyFindingID, finding.FindingId),
sdk.NewAttribute(types.AttributeKeyProgramID, finding.ProgramId),
),
sdk.NewEvent(
sdk.EventTypeMessage,
sdk.NewAttribute(sdk.AttributeKeyModule, types.AttributeValueCategory),
sdk.NewAttribute(sdk.AttributeKeySender, msg.SubmitterAddress),
),
})

return &types.MsgEditFindingResponse{}, nil

Check warning on line 252 in x/bounty/keeper/msg_server.go

View check run for this annotation

Codecov / codecov/patch

x/bounty/keeper/msg_server.go#L237-L252 

Added lines #L237 - L252 were not covered by tests
}

func (k msgServer) AcceptFinding(goCtx context.Context, msg *types.MsgAcceptFinding) (*types.MsgAcceptFindingResponse, error) {
ctx := sdk.UnwrapSDKContext(goCtx)

Expand Down Expand Up @@ -303,12 +345,12 @@ func (k msgServer) CloseFinding(goCtx context.Context, msg *types.MsgCloseFindin
}

Check warning on line 345 in x/bounty/keeper/msg_server.go

View check run for this annotation

Codecov / codecov/patch

x/bounty/keeper/msg_server.go#L342-L345 

Added lines #L342 - L345 were not covered by tests

// check submitter
if finding.SubmitterAddress != msg.OperatorAddress || !k.certKeeper.IsCertifier(ctx, operatorAddr) {
if finding.SubmitterAddress != msg.OperatorAddress && !k.certKeeper.IsCertifier(ctx, operatorAddr) {
return nil, types.ErrFindingSubmitterInvalid
}

Check warning on line 350 in x/bounty/keeper/msg_server.go

View check run for this annotation

Codecov / codecov/patch

x/bounty/keeper/msg_server.go#L348-L350 

Added lines #L348 - L350 were not covered by tests

// check status
if finding.Status != types.FindingStatusReported {
if finding.Status != types.FindingStatusSubmitted {
return nil, types.ErrFindingStatusInvalid
}

Check warning on line 355 in x/bounty/keeper/msg_server.go

View check run for this annotation

Codecov / codecov/patch

x/bounty/keeper/msg_server.go#L353-L355 

Added lines #L353 - L355 were not covered by tests

Expand All @@ -317,7 +359,7 @@ func (k msgServer) CloseFinding(goCtx context.Context, msg *types.MsgCloseFindin

ctx.EventManager().EmitEvents(sdk.Events{
sdk.NewEvent(
types.EventTypeCancelFinding,
types.EventTypeCloseFinding,
sdk.NewAttribute(types.AttributeKeyFindingID, msg.FindingId),
sdk.NewAttribute(types.AttributeKeyProgramID, finding.ProgramId),
),
Expand Down Expand Up @@ -352,6 +394,7 @@ func (k msgServer) ReleaseFinding(goCtx context.Context, msg *types.MsgReleaseFi
return nil, types.ErrProgramCreatorInvalid
}

Check warning on line 395 in x/bounty/keeper/msg_server.go

View check run for this annotation

Codecov / codecov/patch

x/bounty/keeper/msg_server.go#L394-L395 

Added lines #L394 - L395 were not covered by tests

finding.Description = msg.Description
k.SetFinding(ctx, finding)

ctx.EventManager().EmitEvents(sdk.Events{
Expand Down
12 changes: 6 additions & 6 deletions x/bounty/keeper/msg_server_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ func (suite *KeeperTestSuite) TestSubmitFinding() {
Title: "Test bug 1",
Description: "Desc",
SubmitterAddress: suite.address[0].String(),
SeverityLevel: types.SeverityLevelCritical,
SeverityLevel: types.Critical,
},
},
},
Expand All @@ -103,7 +103,7 @@ func (suite *KeeperTestSuite) TestSubmitFinding() {
Title: "Test bug 1",
Description: "Desc",
SubmitterAddress: suite.address[0].String(),
SeverityLevel: types.SeverityLevelCritical,
SeverityLevel: types.Critical,
},
},
},
Expand All @@ -120,7 +120,7 @@ func (suite *KeeperTestSuite) TestSubmitFinding() {
Title: "Test bug 1",
Description: "Desc",
SubmitterAddress: "Test address",
SeverityLevel: types.SeverityLevelCritical,
SeverityLevel: types.Critical,
},
},
},
Expand Down Expand Up @@ -187,7 +187,7 @@ func (suite *KeeperTestSuite) TestAcceptFinding() {
suite.Require().Equal(finding.Status, types.FindingStatusConfirmed)
} else {
suite.Require().Error(err)
suite.Require().Equal(finding.Status, types.FindingStatusReported)
suite.Require().Equal(finding.Status, types.FindingStatusSubmitted)
}
})
}
Expand Down Expand Up @@ -231,7 +231,7 @@ func (suite *KeeperTestSuite) TestRejectFinding() {
suite.Require().Equal(finding.Status, types.FindingStatusClosed)
} else {
suite.Require().Error(err)
suite.Require().Equal(finding.Status, types.FindingStatusReported)
suite.Require().Equal(finding.Status, types.FindingStatusSubmitted)
}
})
}
Expand Down Expand Up @@ -270,7 +270,7 @@ func (suite *KeeperTestSuite) InitSubmitFinding(pid, fid string) string {
Title: "Bug title",
Description: "Bug desc",
SubmitterAddress: suite.address[0].String(),
SeverityLevel: types.SeverityLevelCritical,
SeverityLevel: types.Critical,
}

ctx := types1.WrapSDKContext(suite.ctx)
Expand Down
Loading

0 comments on commit 9e94af0

Please sign in to comment.