+ {
+ "precompile",
+ "-t",
+ templateFilePath,
+ "-m",
+ "Samples\\FindingsWithSourceCodeInfo.json"
+ };
+ if (jsonQuery != null)
+ {
+ commandLineArgs.AddRange(new[] { "-q", jsonQuery });
+ }
+
+ var actual = Helper.RunCommand(commandLineArgs.ToArray()).ToString();
+ Assert.AreEqual(expected, actual);
+ }
+ }
+}
\ No newline at end of file
diff --git a/tests/RazorLight.Precompile.Tests/Render2Tests.cs b/tests/RazorLight.Precompile.Tests/Render2Tests.cs
new file mode 100644
index 00000000..8492ca98
--- /dev/null
+++ b/tests/RazorLight.Precompile.Tests/Render2Tests.cs
@@ -0,0 +1,161 @@
+using NUnit.Framework;
+using RazorLight.Caching;
+
+namespace RazorLight.Precompile.Tests
+{
+ public class Render2Tests
+ {
+ private static TestCaseData T(string templateFilePath, string templateFilePath2, IFileSystemCachingStrategy s, string expected) =>
+ new(templateFilePath, templateFilePath2, s, expected) { TestName = "{m}({0},{1},{2})" };
+
+ private const string EXPECTED = @"Count of issues with the source information: 2
+
+
+Issue Id: 123
+
+src/_sqlutil.async.cs:251
+
+This database query contains a SQL injection flaw. The call to system_data_dll.System.Data.Common.DbCommand.ExecuteReaderAsync() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. ExecuteReaderAsync() was called on the \5__1 object, which contains tainted data. The tainted data originated from earlier calls to vacationbidding_dll.VirtualController.vc_wcfentry, and system_data_dll.System.Data.SqlClient.SqlCommand.ExecuteReader. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP
+
+Module: Architecture
+
+Type Name: SharpTop.Common.Utils._SqlUtil
+
+Member Name: GetReaderSource
+
+First Found Date: 9/9/2021 3:35:49 PM
+
+ Found no annotations.
+
+
+Issue Id: 987
+
+src/sqlconnectioncontext.cs:35
+
+This call to system_data_dll.System.Data.SqlClient.SqlConnection.!newinit_0_1() allows external control of system settings. The argument to the function is constructed using untrusted input, which can disrupt service or cause an application to behave in unexpected ways. The first argument to !newinit_0_1() contains tainted data from the variable m_connectionString. The tainted data originated from an earlier call to backgroundjobs_dll.VirtualController.vc_wcfentry. Never allow untrusted or otherwise untrusted data to control system-level settings. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE
+
+Module: Architecture
+
+Type Name: xyz.UtilitySuite.DbUpgrade.SqlConnectionContext
+
+Member Name: CreateConnectionAsync
+
+First Found Date: 7/10/2020 7:00:28 PM
+
+ Found 3 annotations:
+
+ | Action | Created | User Name | Comment |
|---|
+ | APPROVED | 3/31/2021 6:44:12 PM | Michael Jackson | Approved per rationale provided and John Smith' review and approval on 3/30. |
+ | COMMENT | 3/31/2021 6:42:26 PM | John Smith | Mitigation statements reviewed. Recommend for closure and approval |
+ | APPDESIGN | 10/22/2020 6:58:56 PM | Li Jet | Some explanation |
+
+
+
+";
+
+ private static readonly TestCaseData[] s_testCases = new TestCaseData[]
+ {
+ T("FullMessage.cshtml", "folder\\MessageItem.cshtml", FileHashCachingStrategy.Instance, EXPECTED),
+ T("FullMessage.cshtml", "folder\\MessageItem.cshtml", SimpleFileCachingStrategy.Instance, EXPECTED),
+ };
+
+ [SetUp]
+ public void Cleanup()
+ {
+ PrecompileTestCases.CleanupDlls("Samples");
+ }
+
+ [TestCaseSource(nameof(s_testCases))]
+ public void RenderOrder1(string key, string key2, IFileSystemCachingStrategy s, string expected)
+ {
+ var (a1, a2) = Precompile(key, key2, s);
+
+ Run(key, expected, a1 + ',' + a2);
+ }
+
+ [TestCaseSource(nameof(s_testCases))]
+ public void RenderOrder2(string key, string key2, IFileSystemCachingStrategy s, string expected)
+ {
+ var (a1, a2) = Precompile(key, key2, s);
+
+ Run(key, expected, a2 + ',' + a1);
+ }
+
+ [TestCaseSource(nameof(s_testCases))]
+ public void RenderGlobRecursive(string key, string key2, IFileSystemCachingStrategy s, string expected)
+ {
+ Precompile(key, key2, s);
+
+ Run(key, expected, "**\\*.dll");
+ }
+
+ [TestCaseSource(nameof(s_testCases))]
+ public void RenderFolderRecursive(string key, string key2, IFileSystemCachingStrategy s, string expected)
+ {
+ Precompile(key, key2, s);
+
+ Run(key, expected, "Samples", "-r");
+ }
+
+ [TestCaseSource(nameof(s_testCases))]
+ public void RenderFolderNonRecursive(string key, string key2, IFileSystemCachingStrategy s, string expected)
+ {
+ Precompile(key, key2, s);
+
+ var exc = Assert.Throws(() => Run(key, expected, "Samples"));
+ Assert.AreEqual("No precompiled template found for the key /folder/MessageItem.cshtml", exc.Message);
+ }
+
+ [TestCaseSource(nameof(s_testCases))]
+ public void RenderGlobNonRecursive(string key, string key2, IFileSystemCachingStrategy s, string expected)
+ {
+ Precompile(key, key2, s);
+
+ var exc = Assert.Throws(() => Run(key, expected, "Samples\\*.dll"));
+ Assert.AreEqual("No precompiled template found for the key /folder/MessageItem.cshtml", exc.Message);
+ }
+
+ private static (string, string) Precompile(string key, string key2, IFileSystemCachingStrategy s) => (
+ Helper.RunCommandTrimNewline("precompile", "-t", key, "-b", "Samples", "-s", s.Name),
+ Helper.RunCommandTrimNewline("precompile", "-t", key2, "-b", "Samples", "-s", s.Name)
+ );
+
+ private static void Run(string key, string expected, string precompiledFilePath, params string[] args)
+ {
+ var commandLineArgs = new List
+ {
+ "render",
+ "-p",
+ precompiledFilePath,
+ "-m",
+ "Samples\\FindingsWithSourceCodeInfo.json",
+ "-k",
+ key
+ };
+ commandLineArgs.AddRange(args);
+
+ var actual = Helper.RunCommand(commandLineArgs.ToArray()).ToString();
+ Assert.AreEqual(expected, actual);
+ }
+
+ [TestCaseSource(nameof(s_testCases))]
+ public void PrecompileAndRender(string templateFilePath, string _, IFileSystemCachingStrategy s, string expected)
+ {
+ var commandLineArgs = new List
+ {
+ "precompile",
+ "-t",
+ templateFilePath,
+ "-b",
+ "Samples",
+ "-s",
+ s.Name,
+ "-m",
+ "Samples\\FindingsWithSourceCodeInfo.json"
+ };
+
+ var actual = Helper.RunCommand(commandLineArgs.ToArray()).ToString();
+ Assert.AreEqual(expected, actual);
+ }
+ }
+}
\ No newline at end of file
diff --git a/tests/RazorLight.Precompile.Tests/Samples/FindingsWithSourceCodeInfo.json b/tests/RazorLight.Precompile.Tests/Samples/FindingsWithSourceCodeInfo.json
new file mode 100644
index 00000000..5a04e2f1
--- /dev/null
+++ b/tests/RazorLight.Precompile.Tests/Samples/FindingsWithSourceCodeInfo.json
@@ -0,0 +1,110 @@
+[
+ {
+ "issue_id": 123,
+ "scan_type": "STATIC",
+ "description": "This database query contains a SQL injection flaw. The call to system_data_dll.System.Data.Common.DbCommand.ExecuteReaderAsync() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. ExecuteReaderAsync() was called on the \\5__1 object, which contains tainted data. The tainted data originated from earlier calls to vacationbidding_dll.VirtualController.vc_wcfentry, and system_data_dll.System.Data.SqlClient.SqlCommand.ExecuteReader. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP",
+ "count": 23,
+ "context_type": "APPLICATION",
+ "context_guid": "4ba52443-07df-433e-9717-21b603b72145",
+ "violates_policy": true,
+ "finding_status": {
+ "first_found_date": "2021-09-09T15:35:49.818Z",
+ "status": "OPEN",
+ "resolution": "UNRESOLVED",
+ "mitigation_review_status": "NONE",
+ "new": false,
+ "resolution_status": "NONE",
+ "last_seen_date": "2022-07-22T23:47:15.187Z"
+ },
+ "finding_details": {
+ "severity": 4,
+ "cwe": {
+ "id": 89,
+ "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+ "href": "https://api.veracode.com/appsec/v1/cwes/89"
+ },
+ "file_name": "_sqlutil.async.cs",
+ "relative_location": 60,
+ "finding_category": {
+ "id": 19,
+ "name": "SQL Injection",
+ "href": "https://api.veracode.com/appsec/v1/categories/19"
+ },
+ "exploitability": 0,
+ },
+ "build_id": 1234,
+ "SourceCodeInfo": {
+ "Module": "Architecture",
+ "Key": 123,
+ "FilePath": "src/_sqlutil.async.cs",
+ "LineNo": 251,
+ "TypeName": "SharpTop.Common.Utils._SqlUtil",
+ "MemberName": "GetReaderSource",
+ "SourceCodeUrl": "https://www.youtube.com/watch?v=Rhc5jXWu55c&t=4815s"
+ }
+ },
+ {
+ "issue_id": 987,
+ "scan_type": "STATIC",
+ "description": "This call to system_data_dll.System.Data.SqlClient.SqlConnection.!newinit_0_1() allows external control of system settings. The argument to the function is constructed using untrusted input, which can disrupt service or cause an application to behave in unexpected ways. The first argument to !newinit_0_1() contains tainted data from the variable m_connectionString. The tainted data originated from an earlier call to backgroundjobs_dll.VirtualController.vc_wcfentry. Never allow untrusted or otherwise untrusted data to control system-level settings. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE",
+ "count": 2,
+ "context_type": "APPLICATION",
+ "context_guid": "4ba52443-07df-433e-9717-21b603b72145",
+ "violates_policy": true,
+ "finding_status": {
+ "first_found_date": "2020-07-10T19:00:28.539Z",
+ "status": "CLOSED",
+ "resolution": "MITIGATED",
+ "mitigation_review_status": "NONE",
+ "new": false,
+ "resolution_status": "APPROVED",
+ "last_seen_date": "2022-07-15T01:33:23.129Z"
+ },
+ "finding_details": {
+ "severity": 4,
+ "cwe": {
+ "id": 15,
+ "name": "External Control of System or Configuration Setting",
+ "href": "https://api.veracode.com/appsec/v1/cwes/15"
+ },
+ "file_name": "sqlconnectioncontext.cs",
+ "relative_location": 16,
+ "finding_category": {
+ "id": 24,
+ "name": "Untrusted Initialization",
+ "href": "https://api.veracode.com/appsec/v1/categories/24"
+ },
+ "exploitability": 0,
+ },
+ "annotations": [
+ {
+ "comment": "Approved per rationale provided and John Smith' review and approval on 3/30.",
+ "action": "APPROVED",
+ "created": "2021-03-31T18:44:12.294Z",
+ "user_name": "Michael Jackson"
+ },
+ {
+ "comment": "Mitigation statements reviewed. Recommend for closure and approval",
+ "action": "COMMENT",
+ "created": "2021-03-31T18:42:26.222Z",
+ "user_name": "John Smith"
+ },
+ {
+ "comment": "Some explanation",
+ "action": "APPDESIGN",
+ "created": "2020-10-22T18:58:56.880Z",
+ "user_name": "Li Jet"
+ }
+ ],
+ "build_id": 9876,
+ "SourceCodeInfo": {
+ "Module": "Architecture",
+ "Key": 987,
+ "FilePath": "src/sqlconnectioncontext.cs",
+ "LineNo": 35,
+ "TypeName": "xyz.UtilitySuite.DbUpgrade.SqlConnectionContext",
+ "MemberName": "CreateConnectionAsync",
+ "SourceCodeUrl": "https://www.youtube.com/watch?v=Rhc5jXWu55c&t=4815s"
+ }
+ }
+]
\ No newline at end of file
diff --git a/tests/RazorLight.Precompile.Tests/Samples/FullMessage.cshtml b/tests/RazorLight.Precompile.Tests/Samples/FullMessage.cshtml
new file mode 100644
index 00000000..e0708208
--- /dev/null
+++ b/tests/RazorLight.Precompile.Tests/Samples/FullMessage.cshtml
@@ -0,0 +1,8 @@
+Count of issues with the source information: @Model.Count
+
+@foreach (var item in Model)
+{
+
+ @{await IncludeAsync("folder\\MessageItem.cshtml", item);}
+
+}
diff --git a/tests/RazorLight.Precompile.Tests/Samples/WorkItemComment.cshtml b/tests/RazorLight.Precompile.Tests/Samples/WorkItemComment.cshtml
new file mode 100644
index 00000000..566eae82
--- /dev/null
+++ b/tests/RazorLight.Precompile.Tests/Samples/WorkItemComment.cshtml
@@ -0,0 +1,5 @@
+Action: @Model.action
+Created: @Model.created
+User name: @Model.user_name
+
+@Model.comment
diff --git a/tests/RazorLight.Precompile.Tests/Samples/WorkItemFields.json b/tests/RazorLight.Precompile.Tests/Samples/WorkItemFields.json
new file mode 100644
index 00000000..a76f804a
--- /dev/null
+++ b/tests/RazorLight.Precompile.Tests/Samples/WorkItemFields.json
@@ -0,0 +1,14 @@
+{
+ "Title": "Veracode Issue @Model.issue_id",
+ "HyperLinks": [
+ {
+ "url": "@Model.SourceCodeInfo.SourceCodeUrl",
+ "comment": "@Model.SourceCodeInfo.FilePath:@Model.SourceCodeInfo.LineNo"
+ }
+ ],
+ "Tags": [
+ "@Model.finding_details.finding_category.name",
+ "resolution:@Model.finding_status.resolution",
+ "status:@Model.finding_status.status"
+ ]
+}
\ No newline at end of file
diff --git a/tests/RazorLight.Precompile.Tests/Samples/folder/MessageItem.cshtml b/tests/RazorLight.Precompile.Tests/Samples/folder/MessageItem.cshtml
new file mode 100644
index 00000000..18ecad8c
--- /dev/null
+++ b/tests/RazorLight.Precompile.Tests/Samples/folder/MessageItem.cshtml
@@ -0,0 +1,29 @@
+Issue Id: @Model.issue_id
+
+@Model.SourceCodeInfo.FilePath:@Model.SourceCodeInfo.LineNo
+
+@Raw(@Model.description)
+
+Module: @Model.SourceCodeInfo.Module
+
+Type Name: @Model.SourceCodeInfo.TypeName
+
+Member Name: @Model.SourceCodeInfo.MemberName
+
+First Found Date: @Model.finding_status.first_found_date
+
+@if (Model.annotations == null || Model.annotations.Count == 0)
+{
+ Found no annotations.
+}
+else
+{
+ Found @Model.annotations.Count annotations:
+
+ | Action | Created | User Name | Comment |
|---|
+ @foreach (var annotation in Model.annotations)
+ {
+ | @annotation.action | @annotation.created | @annotation.user_name | @annotation.comment |
+ }
+
+}
diff --git a/tests/RazorLight.Precompile.Tests/SamplesWithBaseDir/FullMessage.cshtml b/tests/RazorLight.Precompile.Tests/SamplesWithBaseDir/FullMessage.cshtml
new file mode 100644
index 00000000..60f47b85
--- /dev/null
+++ b/tests/RazorLight.Precompile.Tests/SamplesWithBaseDir/FullMessage.cshtml
@@ -0,0 +1,8 @@
+Count of issues with the source information: @Model.Count
+
+@foreach (var item in Model)
+{
+
+ @{await IncludeAsync("SamplesWithBaseDir\\MessageItem.cshtml", item);}
+
+}
diff --git a/tests/RazorLight.Precompile.Tests/SamplesWithBaseDir/MessageItem.cshtml b/tests/RazorLight.Precompile.Tests/SamplesWithBaseDir/MessageItem.cshtml
new file mode 100644
index 00000000..67b2b652
--- /dev/null
+++ b/tests/RazorLight.Precompile.Tests/SamplesWithBaseDir/MessageItem.cshtml
@@ -0,0 +1,29 @@
+Issue Id: @Model.issue_id
+
+@Model.SourceCodeInfo.FilePath:@Model.SourceCodeInfo.LineNo
+
+@Raw(@Model.description)
+
+Module: @Model.SourceCodeInfo.Module
+
+Type Name: @Model.SourceCodeInfo.TypeName
+
+Member Name: @Model.SourceCodeInfo.MemberName
+
+First Found Date: @Model.finding_status.first_found_date
+
+@if (Model.annotations == null || Model.annotations.Count == 0)
+{
+ Found no annotations.
+}
+else
+{
+ Found @Model.annotations.Count annotations:
+
+ | Action | Created | User Name | Comment |
|---|
+ @foreach (var annotation in Model.annotations)
+ {
+ | @annotation.action | @annotation.created | @annotation.user_name | @annotation.comment |
+ }
+
+}
diff --git a/tests/RazorLight.Precompile.Tests/TestScenario.cs b/tests/RazorLight.Precompile.Tests/TestScenario.cs
new file mode 100644
index 00000000..54996c69
--- /dev/null
+++ b/tests/RazorLight.Precompile.Tests/TestScenario.cs
@@ -0,0 +1,15 @@
+using RazorLight.Caching;
+
+namespace RazorLight.Precompile.Tests
+{
+ public record TestScenario
+ (
+ string Name,
+ IFileSystemCachingStrategy ExpectedCachingStrategy,
+ Func GetExpectedCacheDirectory,
+ Func GetExpectedPrecompiledFilePath,
+ Func GetTemplateKey,
+ string[] ExtraCommandLineArgs,
+ Action Cleanup
+ );
+}
\ No newline at end of file
diff --git a/tests/RazorLight.Tests/RazorLight.Tests.csproj b/tests/RazorLight.Tests/RazorLight.Tests.csproj
index 0faf23fc..524b10c5 100644
--- a/tests/RazorLight.Tests/RazorLight.Tests.csproj
+++ b/tests/RazorLight.Tests/RazorLight.Tests.csproj
@@ -5,7 +5,8 @@
false
true
$(DefineConstants);SOME_TEST_DEFINE
- true
+ true
+ NU1701;CS0618