Repository: CVEProject/cve-services
Pull request #349 (2021-03-24 16:48:53)

Issue 303
1) Addressing issue #303 

2) Adding npm packages `yamljs` and `swagger-ui-express` to serve the openapi doc in `/api-docs` endpoint. Serving this doc will help test and debug the development of the `openapi.yml` file.

References:
* https://www.npmjs.com/package/yamljs
* https://www.npmjs.com/package/swagger-ui-express


Patch:
diff --git a/docs/openapi.yml b/docs/openapi.yml
index e3d44a43..51f1ca5f 100644
--- a/docs/openapi.yml
+++ b/docs/openapi.yml
@@ -33,28 +33,33 @@ components:
         type: string
     api-entity-header:
       name: CVE-API-ORG
-      description: >
-        The shortname for the entity (e.g., CNA, ADP) that is authenticated or requesting authentication.
+      description: The shortname for the entity (e.g., CNA, ADP) that is authenticated or requesting authentication.
       in: header
       required: true
       schema:
         type: string
     api-user-header:
       name: CVE-API-USER
-      description: >
-        The username for the account that is making the request.
+      description: The username for the account that is making the request.
       in: header
       required: true
       schema:
         type: string
     api-secret-header:
       name: CVE-API-KEY
-      description: >
-        The user's api key. \[TODO:: Is there a pattern for the format?\]
+      description: The user's api key. \[TODO:: Is there a pattern for the format?\]
       in: header
       required: true
       schema:
         type: string
+    paginator-header:
+      name: PAGINATOR-PAGINATE
+      description: The current page in the paginator.
+      in: header
+      required: false
+      schema:
+        type: integer
+        minimum: 1
   schemas:
     cve-id:
       properties:
@@ -101,6 +106,12 @@ components:
           type: array
           items:
             $ref: '#/components/schemas/cve-id'
+    ArrayOfCveRecords:
+      type: array
+      items:
+        anyOf:
+          - $ref: 'https://raw.githubusercontent.com/CVEProject/cve-schema/master/schema/v4.0/CVE_JSON_4.0_min_public.schema'
+          - $ref: 'https://raw.githubusercontent.com/CVEProject/cve-schema/master/schema/v4.0/CVE_JSON_4.0_min_reject.schema'
 paths:
   /org/{shortname}/id_quota:
     parameters:
@@ -197,8 +208,7 @@ paths:
           schema:
             type: string
             enum: [sequential, nonsequential, non-sequential]
-          description: >
-            When amount is greater than one, indicates whether IDs should be sequential or nonsequential.
+          description: When amount is greater than one, indicates whether IDs should be sequential or nonsequential.
         - in: query
           name: amount
           schema:
@@ -216,8 +226,7 @@ paths:
           schema:
             type: string
           required: true
-          description: >
-            Identifies the Org who should own the IDs reserved.
+          description: Identifies the Org who should own the IDs reserved.
       responses:
         200:
           description: A list of the newly reserved CVE-IDs the account requested.
@@ -301,10 +310,11 @@ paths:
           description: The requested CVE Record is returned.
           content:
             application/json:
-            schema: 
-              oneOf:
-                $ref: 'https://github.com/CVEProject/cve-schema/blob/master/schema/v4.0/CVE_JSON_4.0_min_public.schema'
-                $ref: 'https://github.com/CVEProject/cve-schema/blob/master/schema/v4.0/CVE_JSON_4.0_min_reject.schema'
+              schema:
+                type: object
+                anyOf:
+                  - $ref: 'https://raw.githubusercontent.com/CVEProject/cve-schema/master/schema/v4.0/CVE_JSON_4.0_min_public.schema'
+                  - $ref: 'https://raw.githubusercontent.com/CVEProject/cve-schema/master/schema/v4.0/CVE_JSON_4.0_min_reject.schema'
         400:
           description: Bad Request
         403:
@@ -326,10 +336,11 @@ paths:
           description: Returns the cve record created.
           content:
             application/json:
-              schema: 
-                oneOf:
-                  $ref: 'https://github.com/CVEProject/cve-schema/blob/master/schema/v4.0/CVE_JSON_4.0_min_public.schema'
-                  $ref: 'https://github.com/CVEProject/cve-schema/blob/master/schema/v4.0/CVE_JSON_4.0_min_reject.schema'
+              schema:
+                type: object
+                anyOf:
+                  - $ref: 'https://raw.githubusercontent.com/CVEProject/cve-schema/master/schema/v4.0/CVE_JSON_4.0_min_public.schema'
+                  - $ref: 'https://raw.githubusercontent.com/CVEProject/cve-schema/master/schema/v4.0/CVE_JSON_4.0_min_reject.schema'
         400:
           description: Bad Request
         401:
@@ -353,10 +364,58 @@ paths:
           description: Returns the cve record updated.
           content:
             application/json:
-              schema: 
-                oneOf:
-                  $ref: 'https://github.com/CVEProject/cve-schema/blob/master/schema/v4.0/CVE_JSON_4.0_min_public.schema'
-                  $ref: 'https://github.com/CVEProject/cve-schema/blob/master/schema/v4.0/CVE_JSON_4.0_min_reject.schema'
+              schema:
+                type: object
+                anyOf:
+                  - $ref: 'https://raw.githubusercontent.com/CVEProject/cve-schema/master/schema/v4.0/CVE_JSON_4.0_min_public.schema'
+                  - $ref: 'https://raw.githubusercontent.com/CVEProject/cve-schema/master/schema/v4.0/CVE_JSON_4.0_min_reject.schema'
+        400:
+          description: Bad Request
+        401:
+          description: Not Authenticated
+        403:
+          description: Forbidden
+        404:
+          description: Not Found
+        500:
+          description: Internal Server Error
+  /cve:
+    get:
+      summary: Retrieves all CVE Records.
+      operationId: getCVERecords
+      parameters:
+        - "$ref": "#/components/parameters/api-entity-header"
+        - "$ref": "#/components/parameters/api-secret-header"
+        - "$ref": "#/components/parameters/api-user-header"
+        - "$ref": "#/components/parameters/paginator-header"
+      responses:
+        200:
+          description: A list of CVE Records and pagination fields, only allowed by the Secretariat.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  totalCount:
+                    type: integer
+                    description: "Total CVE Records found"
+                  itemsPerPage:
+                    type: integer
+                    description: "Number of CVE Records in a page"
+                  pageCount:
+                    type: integer
+                    description: "Total number of pages"
+                  currentPage:
+                    type: integer
+                    description: "Current page"
+                  prevPage:
+                    type: integer
+                    description: "Previous page"
+                  nextPage:
+                    type: integer
+                    description: "Next page"
+                  cveRecords:
+                    $ref: '#/components/schemas/ArrayOfCveRecords'
         400:
           description: Bad Request
         401:
diff --git a/package-lock.json b/package-lock.json
index ed19396b..3d650110 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -668,7 +668,6 @@
       "version": "1.0.10",
       "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
       "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
-      "dev": true,
       "requires": {
         "sprintf-js": "~1.0.2"
       }
@@ -4989,8 +4988,7 @@
     "sprintf-js": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
-      "integrity": "sha1-BOaSb2YolTVPPdAVIDYzuFcpfiw=",
-      "dev": true
+      "integrity": "sha1-BOaSb2YolTVPPdAVIDYzuFcpfiw="
     },
     "stack-trace": {
       "version": "0.0.10",
@@ -5386,6 +5384,19 @@
         "has-flag": "^3.0.0"
       }
     },
+    "swagger-ui-dist": {
+      "version": "3.45.1",
+      "resolved": "https://registry.npmjs.org/swagger-ui-dist/-/swagger-ui-dist-3.45.1.tgz",
+      "integrity": "sha512-QWotWWYkgSdPtI6HW12q4Ua5zxIhhvnYvx9iZKtDbZuVvJSTnMIzaHrE6KJVe/8plWh7Wpd/qqeBfpOxF8g1/g=="
+    },
+    "swagger-ui-express": {
+      "version": "4.1.6",
+      "resolved": "https://registry.npmjs.org/swagger-ui-express/-/swagger-ui-express-4.1.6.tgz",
+      "integrity": "sha512-Xs2BGGudvDBtL7RXcYtNvHsFtP1DBFPMJFRxHe5ez/VG/rzVOEjazJOOSc/kSCyxreCTKfJrII6MJlL9a6t8vw==",
+      "requires": {
+        "swagger-ui-dist": "^3.18.1"
+      }
+    },
     "table": {
       "version": "5.4.6",
       "resolved": "https://registry.npmjs.org/table/-/table-5.4.6.tgz",
@@ -5850,6 +5861,15 @@
       "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
       "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="
     },
+    "yamljs": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/yamljs/-/yamljs-0.3.0.tgz",
+      "integrity": "sha512-C/FsVVhht4iPQYXOInoxUM/1ELSf9EsgKH34FofQOp6hwCPrW4vG4w5++TED3xRUo8gD7l0P1J1dLlDYzODsTQ==",
+      "requires": {
+        "argparse": "^1.0.7",
+        "glob": "^7.0.5"
+      }
+    },
     "yargs": {
       "version": "15.4.1",
       "resolved": "https://registry.npmjs.org/yargs/-/yargs-15.4.1.tgz",
diff --git a/package.json b/package.json
index 61487f0b..513b9c96 100644
--- a/package.json
+++ b/package.json
@@ -42,9 +42,11 @@
     "node-dev": "^4.0.0",
     "progress": "^2.0.3",
     "prompt-sync": "^4.2.0",
+    "swagger-ui-express": "^4.1.6",
     "uuid": "^8.3.2",
     "uuid-apikey": "^1.5.1",
-    "winston": "^3.2.1"
+    "winston": "^3.2.1",
+    "yamljs": "^0.3.0"
   },
   "apidoc": {
     "name": "CVE-Services",
@@ -62,7 +64,6 @@
     "action:lint-test": "node node_modules/eslint/bin/eslint.js test/",
     "action:lint-test-utils": "node node_modules/eslint/bin/eslint.js test-utils/",
     "clean": "node node_modules/depcheck/bin/depcheck.js",
-    "docs": "./node_modules/apidoc/bin/apidoc -i src/ -o apidoc/",
     "hash:dev": "NODE_ENV=development node-dev src/scripts/hashPasswords.js",
     "hash:int": "NODE_ENV=integration node src/scripts/hashPasswords.js",
     "hash:prd": "NODE_ENV=production node src/scripts/hashPasswords.js",
diff --git a/src/constants/index.js b/src/constants/index.js
index 5d69ee49..a3851383 100644
--- a/src/constants/index.js
+++ b/src/constants/index.js
@@ -59,7 +59,7 @@ module.exports = {
   },
   PAGINATOR_PAGE: 1,
   PAGINATOR_OPTIONS: {
-    limit: 1000,
+    limit: 500,
     customLabels: {
       totalDocs: 'itemCount',
       docs: 'itemsList',
diff --git a/src/controller/cve.controller/cve.controller.js b/src/controller/cve.controller/cve.controller.js
index 90b70d89..d3a88748 100644
--- a/src/controller/cve.controller/cve.controller.js
+++ b/src/controller/cve.controller/cve.controller.js
@@ -3,6 +3,8 @@ const logger = require('../../middleware/logger')
 const errors = require('./error')
 const error = new errors.CveControllerError()
 const CONSTANTS = require('../../constants')
+const utils = require('../../utils/utils')
+const options = CONSTANTS.PAGINATOR_OPTIONS
 
 async function getCve (req, res, next) {
   try {
@@ -20,6 +22,43 @@ async function getCve (req, res, next) {
   }
 }
 
+async function getAllCves (req, res, next) {
+  try {
+    options.page = req.ctx.paginator.page
+    const cveRepo = req.ctx.repositories.getCveRepository()
+    const agt = [
+      {
+        $project: {
+          _id: false,
+          time: false
+        }
+      }
+    ]
+
+    const pg = await cveRepo.aggregatePaginate(agt, options)
+    const cveRecords = pg.itemsList.map(val => { return val.cve })
+
+    if (pg.itemCount >= CONSTANTS.PAGINATOR_OPTIONS.limit) {
+      utils.setPaginatorHeaders(res, pg)
+    }
+
+    const payload = {
+      totalCount: pg.itemCount,
+      itemsPerPage: pg.itemsPerPage,
+      pageCount: pg.pageCount,
+      currentPage: pg.currentPage,
+      prevPage: pg.prevPage,
+      nextPage: pg.nextPage,
+      cveRecords: cveRecords
+    }
+
+    logger.info({ uuid: req.ctx.uuid, message: 'The cve records were sent to the user.' })
+    return res.status(200).json(payload)
+  } catch (err) {
+    next(err)
+  }
+}
+
 // Creates a new CVE only if it does not exists for the specified CVE ID in the request body. If it exists, it does not update the CVE.
 async function submitCve (req, res, next) {
   try {
@@ -147,6 +186,7 @@ async function updateCve (req, res, next) {
 
 module.exports = {
   CVE_GET_SINGLE: getCve,
+  CVE_LIST_ALL: getAllCves,
   CVE_SUBMIT: submitCve,
   CVE_UPDATE_SINGLE: updateCve
 }
diff --git a/src/controller/cve.controller/cve.middleware.js b/src/controller/cve.controller/cve.middleware.js
index 2b37d259..5777a3bb 100644
--- a/src/controller/cve.controller/cve.middleware.js
+++ b/src/controller/cve.controller/cve.middleware.js
@@ -9,6 +9,11 @@ function parsePostParams (req, res, next) {
   next()
 }
 
+function parseGetParams (req, res, next) {
+  utils.reqCtxMapping(req, 'params', ['id'])
+  next()
+}
+
 function parseError (req, res, next) {
   const err = validationResult(req).formatWith(({ location, msg, param, value, nestedErrors }) => {
     return { msg: msg, param: param, location: location }
@@ -20,6 +25,7 @@ function parseError (req, res, next) {
 }
 
 module.exports = {
+  parseGetParams,
   parsePostParams,
   parseError
 }
diff --git a/src/controller/cve.controller/index.js b/src/controller/cve.controller/index.js
index abc8048a..5ae1de50 100644
--- a/src/controller/cve.controller/index.js
+++ b/src/controller/cve.controller/index.js
@@ -3,17 +3,22 @@ const router = express.Router()
 const mw = require('../../middleware/middleware')
 const controller = require('./cve.controller')
 const { param } = require('express-validator')
-const { parsePostParams, parseError } = require('./cve.middleware')
+const { parseGetParams, parsePostParams, parseError } = require('./cve.middleware')
 
 router.get('/cve/:id',
   mw.onlySecretariat,
   mw.validateUser,
   param(['id']).isString().matches(/^CVE-[0-9]{4}-[0-9]{4,}$/i),
   parseError,
-  parsePostParams,
+  parseGetParams,
   controller.CVE_GET_SINGLE)
 
-// router.get('/cve', mw.validateUser, controller.CVE_LIST_ALL)
+router.get('/cve',
+  mw.onlySecretariat,
+  mw.validateUser,
+  parseError,
+  parseGetParams,
+  controller.CVE_LIST_ALL)
 
 router.post('/cve/:id',
   mw.onlySecretariat,
diff --git a/src/model/cve.js b/src/model/cve.js
index 471bc251..81b1442b 100644
--- a/src/model/cve.js
+++ b/src/model/cve.js
@@ -1,4 +1,5 @@
 const mongoose = require('mongoose')
+const aggregatePaginate = require('mongoose-aggregate-paginate-v2')
 
 const CveSchema = new mongoose.Schema({
   _id: false,
@@ -13,5 +14,6 @@ CveSchema.query.byCveId = function (cveId) {
   return this.where({ 'cve.CVE_data_meta.ID': cveId })
 }
 
+CveSchema.plugin(aggregatePaginate)
 const Cve = mongoose.model('Cve', CveSchema)
 module.exports = Cve
diff --git a/src/routes.config.js b/src/routes.config.js
index 00a24fab..f90c13ce 100644
--- a/src/routes.config.js
+++ b/src/routes.config.js
@@ -1,3 +1,9 @@
+const swaggerUi = require('swagger-ui-express')
+const YAML = require('yamljs')
+const path = require('path')
+const dirPath = path.join(__dirname, '../docs/openapi.yml')
+const openApiDocumentation = YAML.load(dirPath)
+
 const CveController = require('./controller/cve.controller')
 const OrgController = require('./controller/org.controller')
 const CveIdController = require('./controller/cve-id.controller')
@@ -8,4 +14,5 @@ module.exports = async function configureRoutes (app) {
   app.use('/api/', OrgController)
   app.use('/api/', CveIdController)
   app.use('/api/', SystemController)
+  app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(openApiDocumentation))
 }


Test patch:
diff --git a/test/schemas/4.0/cveRecordList.json b/test/schemas/4.0/cveRecordList.json
new file mode 100644
index 00000000..9b415086
--- /dev/null
+++ b/test/schemas/4.0/cveRecordList.json
@@ -0,0 +1,284 @@
+[
+    {
+        "cve": {
+            "CVE_data_meta": {
+                "ASSIGNER": "vuln_notice@krcert.or.kr",
+                "ID": "CVE-2020-7842",
+                "STATE": "PUBLIC",
+                "TITLE": "D'live AP command injection vulnerability"
+            },
+            "affects": {
+                "vendor": {
+                    "vendor_data": [
+                        {
+                            "product": {
+                                "product_data": [
+                                    {
+                                        "product_name": "D'live set-top box AP(WF2429TB)",
+                                        "version": {
+                                            "version_data": [
+                                                {
+                                                    "platform": "Linux",
+                                                    "version_affected": "<=",
+                                                    "version_name": "1.1.10",
+                                                    "version_value": "1.1.10"
+                                                }
+                                            ]
+                                        }
+                                    }
+                                ]
+                            },
+                            "vendor_name": "Netis Korea"
+                        }
+                    ]
+                }
+            },
+            "data_format": "MITRE",
+            "data_type": "CVE",
+            "data_version": "4.0",
+            "description": {
+                "description_data": [
+                    {
+                        "lang": "eng",
+                        "value": "Improper Input validation vulnerability exists in Netis Korea D'live AP which could cause arbitrary command injection and execution when the time setting (using ntpServerlp1 parameter) for the users."
+                    }
+                ]
+            },
+            "generator": {
+                "engine": "Vulnogram 0.0.9"
+            },
+            "impact": {
+                "cvss": {
+                    "attackComplexity": "HIGH",
+                    "attackVector": "ADJACENT_NETWORK",
+                    "availabilityImpact": "HIGH",
+                    "baseScore": 6.4,
+                    "baseSeverity": "MEDIUM",
+                    "confidentialityImpact": "HIGH",
+                    "integrityImpact": "HIGH",
+                    "privilegesRequired": "HIGH",
+                    "scope": "UNCHANGED",
+                    "userInteraction": "NONE",
+                    "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
+                    "version": "3.1"
+                }
+            },
+            "problemtype": {
+                "problemtype_data": [
+                    {
+                        "description": [
+                            {
+                                "lang": "eng",
+                                "value": "CWE-20 Improper Input Validation"
+                            }
+                        ]
+                    }
+                ]
+            },
+            "references": {
+                "reference_data": [
+                    {
+                        "refsource": "CONFIRM",
+                        "url": "https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35797"
+                    }
+                ]
+            },
+            "source": {
+                "discovery": "UNKNOWN"
+            }
+        }
+    },
+    {
+        "cve": {
+            "CVE_data_meta": {
+                "ASSIGNER": "vuln_notice@krcert.or.kr",
+                "ID": "CVE-2020-7843",
+                "STATE": "PUBLIC",
+                "TITLE": "D'live AP command injection vulnerability"
+            },
+            "affects": {
+                "vendor": {
+                    "vendor_data": [
+                        {
+                            "product": {
+                                "product_data": [
+                                    {
+                                        "product_name": "D'live set-top box AP(WF2429TB)",
+                                        "version": {
+                                            "version_data": [
+                                                {
+                                                    "platform": "Linux",
+                                                    "version_affected": "<=",
+                                                    "version_name": "1.1.10",
+                                                    "version_value": "1.1.10"
+                                                }
+                                            ]
+                                        }
+                                    }
+                                ]
+                            },
+                            "vendor_name": "Netis Korea"
+                        }
+                    ]
+                }
+            },
+            "data_format": "MITRE",
+            "data_type": "CVE",
+            "data_version": "4.0",
+            "description": {
+                "description_data": [
+                    {
+                        "lang": "eng",
+                        "value": "Improper Input validation vulnerability exists in Netis Korea D'live AP which could cause arbitrary command injection and execution when the time setting (using ntpServerlp1 parameter) for the users."
+                    }
+                ]
+            },
+            "generator": {
+                "engine": "Vulnogram 0.0.9"
+            },
+            "impact": {
+                "cvss": {
+                    "attackComplexity": "HIGH",
+                    "attackVector": "ADJACENT_NETWORK",
+                    "availabilityImpact": "HIGH",
+                    "baseScore": 6.4,
+                    "baseSeverity": "MEDIUM",
+                    "confidentialityImpact": "HIGH",
+                    "integrityImpact": "HIGH",
+                    "privilegesRequired": "HIGH",
+                    "scope": "UNCHANGED",
+                    "userInteraction": "NONE",
+                    "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
+                    "version": "3.1"
+                }
+            },
+            "problemtype": {
+                "problemtype_data": [
+                    {
+                        "description": [
+                            {
+                                "lang": "eng",
+                                "value": "CWE-20 Improper Input Validation"
+                            }
+                        ]
+                    }
+                ]
+            },
+            "references": {
+                "reference_data": [
+                    {
+                        "refsource": "CONFIRM",
+                        "url": "https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35797"
+                    }
+                ]
+            },
+            "source": {
+                "discovery": "UNKNOWN"
+            }
+        }
+    },
+    {
+        "cve": {
+            "CVE_data_meta": {
+                "ASSIGNER": "cve@mitre.org",
+                "ID": "CVE-2017-5833",
+                "STATE": "REJECT"
+            },
+            "data_format": "MITRE",
+            "data_type": "CVE",
+            "data_version": "4.0",
+            "description": {
+                "description_data": [
+                    {
+                        "lang": "eng",
+                        "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none."
+                    }
+                ]
+            }
+        }
+    },
+    {
+        "cve": {
+            "CVE_data_meta": {
+                "ASSIGNER": "cve@mitre.org",
+                "ID": "CVE-2020-35071",
+                "STATE": "REJECT"
+            },
+            "data_format": "MITRE",
+            "data_type": "CVE",
+            "data_version": "4.0",
+            "description": {
+                "description_data": [
+                    {
+                        "lang": "eng",
+                        "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none."
+                    }
+                ]
+            }
+        }
+    }, 
+    { 
+        "cve": {
+            "data_type": "CVE",
+            "data_format": "MITRE",
+            "data_version": "4.0",
+            "CVE_data_meta": {
+                "ID": "CVE-2019-14828",
+                "ASSIGNER": "secalert@redhat.com",
+                "STATE": "PUBLIC"
+            },
+            "affects": {
+                "vendor": {
+                    "vendor_data": [
+                        {
+                            "vendor_name": "n/a",
+                            "product": {
+                                "product_data": [
+                                    {
+                                        "product_name": "Moodle",
+                                        "version": {
+                                            "version_data": [
+                                                {
+                                                    "version_value": "3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions"
+                                                }
+                                            ]
+                                        }
+                                    }
+                                ]
+                            }
+                        }
+                    ]
+                }
+            },
+            "problemtype": {
+                "problemtype_data": [
+                    {
+                        "description": [
+                            {
+                                "lang": "eng",
+                                "value": "CWE-285"
+                            }
+                        ]
+                    }
+                ]
+            },
+            "references": {
+                "reference_data": [
+                    {
+                        "refsource": "MISC",
+                        "name": "https://moodle.org/mod/forum/discuss.php?d=391031",
+                        "url": "https://moodle.org/mod/forum/discuss.php?d=391031"
+                    }
+                ]
+            },
+            "description": {
+                "description_data": [
+                    {
+                        "lang": "eng",
+                        "value": "A vulnerability was found in Moodle affecting 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where users with the capability to create courses were assigned as a teacher in those courses, regardless of whether they had the capability to be automatically assigned that role."
+                    }
+                ]
+            }
+        } 
+    }
+]
\ No newline at end of file
diff --git a/test/unit-tests/cve/cveGetAllTest.js b/test/unit-tests/cve/cveGetAllTest.js
new file mode 100644
index 00000000..deb7dd9f
--- /dev/null
+++ b/test/unit-tests/cve/cveGetAllTest.js
@@ -0,0 +1,110 @@
+const server = require('../../../test-utils/index')
+const chai = require('chai')
+const expect = chai.expect
+chai.use(require('chai-http'))
+
+const cveFixtures = require('./mockObjects.cve')
+const cveController = require('../../../src/controller/cve.controller/cve.controller')
+const cveParams = require('../../../src/controller/cve.controller/cve.middleware')
+const CONSTANTS = require('../../../src/constants')
+const cveList = require('../../schemas/4.0/cveRecordList.json')
+
+describe('Testing the GET /cve endpoint in Cve Controller', () => {
+  context('Positive Tests', () => {
+    it('JSON schema v4.0 returned: The secretariat gets a list of cve records', (done) => {
+      class MyCvePositiveTests {
+        async aggregatePaginate () {
+          const res = {
+            itemsList: cveList,
+            itemCount: cveList.length,
+            itemsPerPage: CONSTANTS.PAGINATOR_OPTIONS.limit,
+            currentPage: 1,
+            pageCount: 1,
+            pagingCounter: 1,
+            hasPrevPage: false,
+            hasNextPage: false,
+            prevPage: null,
+            nextPage: null
+          }
+
+          return res
+        }
+      }
+
+      server.route('/cve-get-all-records-positive-tests-non-empty')
+        .get((req, res, next) => {
+          const factory = {
+            getCveRepository: () => { return new MyCvePositiveTests() }
+          }
+          req.ctx.repositories = factory
+          next()
+        }, cveParams.parseGetParams, cveController.CVE_LIST_ALL)
+
+      chai.request(server)
+        .get('/cve-get-all-records-positive-tests-non-empty')
+        .set(cveFixtures.secretariatHeader)
+        .end((err, res) => {
+          if (err) {
+            done(err)
+          }
+
+          expect(res).to.have.status(200)
+          expect(res).to.have.property('body').and.to.be.a('object')
+          expect(res.body).to.have.property('totalCount').and.to.equal(cveList.length)
+          expect(res.body).to.have.property('cveRecords').and.to.be.a('array')
+          expect(res.body.cveRecords).to.have.lengthOf(res.body.totalCount)
+          res.body.cveRecords.forEach(obj => {
+            // only cve records with state 'PUBLIC' or 'REJECTED' are stored in the db
+            expect(obj).to.have.nested.property('CVE_data_meta.STATE').and.to.be.oneOf([CONSTANTS.CVE_STATES.PUBLIC, CONSTANTS.CVE_STATES.REJECT])
+          })
+          done()
+        })
+    })
+
+    it('JSON schema v4.0 returned: The secretariat gets an empty list of cve records because there are no cve records in the database', (done) => {
+      class MyCvePositiveTests {
+        async aggregatePaginate () {
+          const res = {
+            itemsList: [],
+            itemCount: 0,
+            itemsPerPage: CONSTANTS.PAGINATOR_OPTIONS.limit,
+            currentPage: 1,
+            pageCount: 1,
+            pagingCounter: 1,
+            hasPrevPage: false,
+            hasNextPage: false,
+            prevPage: null,
+            nextPage: null
+          }
+
+          return res
+        }
+      }
+
+      server.route('/cve-get-all-records-positive-tests-empty')
+        .get((req, res, next) => {
+          const factory = {
+            getCveRepository: () => { return new MyCvePositiveTests() }
+          }
+          req.ctx.repositories = factory
+          next()
+        }, cveParams.parseGetParams, cveController.CVE_LIST_ALL)
+
+      chai.request(server)
+        .get('/cve-get-all-records-positive-tests-empty')
+        .set(cveFixtures.secretariatHeader)
+        .end((err, res) => {
+          if (err) {
+            done(err)
+          }
+
+          expect(res).to.have.status(200)
+          expect(res).to.have.property('body').and.to.be.a('object')
+          expect(res.body).to.have.property('totalCount').and.to.equal(0)
+          expect(res.body).to.have.property('cveRecords').and.to.be.a('array')
+          expect(res.body.cveRecords).to.have.lengthOf(res.body.totalCount)
+          done()
+        })
+    })
+  })
+})
diff --git a/test/unit-tests/cve/cveGetSingleTest.js b/test/unit-tests/cve/cveGetSingleTest.js
index 8aaf4db7..be6f04b7 100644
--- a/test/unit-tests/cve/cveGetSingleTest.js
+++ b/test/unit-tests/cve/cveGetSingleTest.js
@@ -37,7 +37,7 @@ server.route('/cve-get-record-negative-tests/:id')
     }
     req.ctx.repositories = factory
     next()
-  }, cveParams.parsePostParams, cveController.CVE_GET_SINGLE)
+  }, cveParams.parseGetParams, cveController.CVE_GET_SINGLE)
 
 server.route('/cve-get-record-positive-tests/:id')
   .get((req, res, next) => {
@@ -46,7 +46,7 @@ server.route('/cve-get-record-positive-tests/:id')
     }
     req.ctx.repositories = factory
     next()
-  }, cveParams.parsePostParams, cveController.CVE_GET_SINGLE)
+  }, cveParams.parseGetParams, cveController.CVE_GET_SINGLE)
 
 describe('Testing the GET /cve/:id endpoint in Cve Controller', () => {
   context('Negative Tests', () => {