Repository: CVEProject/cve-services
Pull request #993 (2023-01-23 14:13:54)

Update INT from DEV
Deploy Sprint 23 to INT


Patch:
diff --git a/.github/PULL_REQUEST_TEMPLATE/bug_fix.md b/.github/PULL_REQUEST_TEMPLATE/bug_fix.md
deleted file mode 100644
index 00d3309e..00000000
--- a/.github/PULL_REQUEST_TEMPLATE/bug_fix.md
+++ /dev/null
@@ -1,56 +0,0 @@
-### Requirements for Contributing a Bug Fix
-
-* Fill out the template below. Any pull request that does not include enough information to be reviewed in a timely manner may be closed at the maintainers' discretion.
-* The pull request must only fix an existing bug. To contribute other changes, you must use a different template. You can see all templates at <https://github.com/CVEProject/CVE-Services/tree/dev/.github/PULL_REQUEST_TEMPLATE>.
-* The pull request must update the test suite to demonstrate the changed functionality.
-* After you create the pull request, all status checks must be pass before a maintainer reviews your contribution. For more details, please see <https://github.com/CVEPRoject/CVE-Services/tree/dev/CONTRIBUTING.md#pull-requests>.
-
-### Identify the Bug
-
-<!--
-
-Link to the issue describing the bug that you're fixing.
-
-If there is not yet an issue for your bug, please open a new issue and then link to that issue in your pull request.
-Note: In some cases, one person's "bug" is another person's "feature." If the pull request does not address an existing issue with the "bug" label, the maintainers have the final say on whether the current behavior is a bug.
-
--->
-
-### Description of the Change
-
-<!--
-
-We must be able to understand the design of your change from this description. If we can't get a good idea of what the code will be doing from the description here, the pull request may be closed at the maintainers' discretion. Keep in mind that the maintainer reviewing this PR may not be familiar with or have worked with the code here recently, so please walk us through the concepts.
-
--->
-
-### Alternate Designs
-
-<!-- Explain what other alternates were considered and why the proposed version was selected -->
-
-### Possible Drawbacks
-
-<!-- What are the possible side-effects or negative impacts of the code change? -->
-
-### Verification Process
-
-<!--
-
-What process did you follow to verify that the change has not introduced any regressions? Describe the actions you performed, and describe the results you observed.
-
--->
-
-### Release Notes
-
-<!--
-
-Please describe the changes in a single line that explains this improvement in
-terms that a user can understand. This text will be used in release notes.
-
-If this change is not user-facing or notable enough to be included in release notes
-you may use the strings "Not applicable" or "N/A" here.
-
-Examples:
-`TODO`
-
--->
diff --git a/.github/PULL_REQUEST_TEMPLATE/documentation.md b/.github/PULL_REQUEST_TEMPLATE/documentation.md
deleted file mode 100644
index c33f911e..00000000
--- a/.github/PULL_REQUEST_TEMPLATE/documentation.md
+++ /dev/null
@@ -1,28 +0,0 @@
-### Requirements for Contributing Documentation
-
-* Fill out the template below. Any pull request that does not include enough information to be reviewed in a timely manner may be closed at the maintainers' discretion.
-* The pull request must only contribute documentation (for example, markdown files or API docs). To contribute other changes, you must use a different template. You can see all templates at <https://github.com/CVEPRoject/CVE-Services/tree/dev/PULL_REQUEST_TEMPLATE>.
-
-### Description of the Change
-
-<!--
-
-We must be able to understand the purpose of your change from this description. If we can't get a good idea of the benefits of the change from the description here, the pull request may be closed at the maintainers' discretion.
-
--->
-
-### Release Notes
-
-<!--
-
-Please describe the changes in a single line that explains this improvement in
-terms that a user can understand.  This text will be used in release notes.
-
-If this change is not user-facing or notable enough to be included in release notes
-you may use the strings "Not applicable" or "N/A" here.
-
-Examples:
-
-`TODO`
-
--->
diff --git a/.github/PULL_REQUEST_TEMPLATE/feature_change.md b/.github/PULL_REQUEST_TEMPLATE/feature_change.md
deleted file mode 100644
index 0d711d4a..00000000
--- a/.github/PULL_REQUEST_TEMPLATE/feature_change.md
+++ /dev/null
@@ -1,67 +0,0 @@
-### Requirements for Adding, Changing, or Removing a Feature
-
-* Fill out the template below. Any pull request that does not include enough information to be reviewed in a timely manner may be closed at the maintainers' discretion.
-* The pull request must contribute a change that has been endorsed by the maintainer team. See details in the template below.
-* The pull request must update the test suite to exercise the updated functionality.
-* After you create the pull request, all status checks must be pass before a maintainer reviews your contribution. For more details, please see <https://github.com/CVEPRoject/CVE-Services/tree/dev/CONTRIBUTING.md#pull-requests>.
-
-### Issue Endorsed by Maintainers
-
-<!--
-
-Link to the issue that relates to your change. This must be one of the following:
-
-* An open issue with the `help-wanted` label
-* An open issue with the `triaged` label
-
-To contribute an enhancement that isn't covered by one of the items above, please follow our guide for suggesting an enhancement: https://github.com/CVEPRoject/CVE-Services/tree/dev/CONTRIBUTING.md#suggesting-enhancements
-
-To contribute other changes, you must use a different template. You can see all templates at <https://github.com/atom/.github/tree/master/.github/PULL_REQUEST_TEMPLATE>.
-
--->
-
-### Description of the Change
-
-<!--
-
-We must be able to understand the design of your change from this description. If we can't get a good idea of what the code will be doing from the description here, the pull request may be closed at the maintainers' discretion. Keep in mind that the maintainer reviewing this PR may not be familiar with or have worked with the code here recently, so please walk us through the concepts.
-
--->
-
-### Alternate Designs
-
-<!-- Explain what other alternates were considered and why the proposed version was selected -->
-
-### Possible Drawbacks
-
-<!-- What are the possible side-effects or negative impacts of the code change? -->
-
-### Verification Process
-
-<!--
-
-What process did you follow to verify that your change has the desired effects?
-
-- How did you verify that all new functionality works as expected?
-- How did you verify that all changed functionality works as expected?
-- How did you verify that the change has not introduced any regressions?
-
-Describe the actions you performed, and describe the results you observed.
-
--->
-
-### Release Notes
-
-<!--
-
-Please describe the changes in a single line that explains this improvement in
-terms that a user can understand. This text will be used in Atom's release notes.
-
-If this change is not user-facing or notable enough to be included in release notes
-you may use the strings "Not applicable" or "N/A" here.
-
-Examples:
-
-`TODO`
-
--->
diff --git a/.github/PULL_REQUEST_TEMPLATE/performance_improvement.md b/.github/PULL_REQUEST_TEMPLATE/performance_improvement.md
deleted file mode 100644
index ea8c345a..00000000
--- a/.github/PULL_REQUEST_TEMPLATE/performance_improvement.md
+++ /dev/null
@@ -1,52 +0,0 @@
-### Requirements for Contributing a Performance Improvement
-
-* Fill out the template below. Any pull request that does not include enough information to be reviewed in a timely manner may be closed at the maintainers' discretion.
-* The pull request must only affect performance of existing functionality. To contribute other changes, you must use a different template. You can see all templates at <https://github.com/CVEProject/CVE-Services/tree/dev/.github/PULL_REQUEST_TEMPLATE>.
-* After you create the pull request, all status checks must be pass before a maintainer reviews your contribution. For more details, please see <https://github.com/CVEPRoject/CVE-Services/tree/dev/CONTRIBUTING.md#pull-requests>.
-
-### Description of the Change
-
-<!--
-
-We must be able to understand the design of your change from this description. If we can't get a good idea of what the code will be doing from the description here, the pull request may be closed at the maintainers' discretion. Keep in mind that the maintainer reviewing this PR may not be familiar with or have worked with the code here recently, so please walk us through the concepts.
-
--->
-
-### Quantitative Performance Benefits
-
-<!--
-
-Describe the exact performance improvement observed (for example, reduced time to complete an operation, reduced memory use, etc.). Describe how you measured this change. Bonus points for including graphs that demonstrate the improvement or attached dumps from profiling tools.
-
--->
-
-### Possible Drawbacks
-
-<!-- What are the possible side-effects or negative impacts of the code change? -->
-
-### Verification Process
-
-<!--
-
-What process did you follow to verify that the change has not introduced any regressions? Describe the actions you performed  and describe the results you observed.
-
--->
-
-### Applicable Issues
-
-<!-- Enter any applicable Issues here -->
-
-### Release Notes
-
-<!--
-
-Please describe the changes in a single line that explains this improvement in
-terms that a user can understand.  This text will be used in release notes.
-
-If this change is not user-facing or notable enough to be included in release notes
-you may use the strings "Not applicable" or "N/A" here.
-
-Examples:
-`TODO`
-
--->
diff --git a/PULL_REQUEST_TEMPLATE.md b/PULL_REQUEST_TEMPLATE.md
index c208e420..9f5ee473 100644
--- a/PULL_REQUEST_TEMPLATE.md
+++ b/PULL_REQUEST_TEMPLATE.md
@@ -1,10 +1,20 @@
-Hello there! Welcome. Please follow the steps below to tell us about your contribution.
-
-1. Copy the correct template for your contribution
-  - Are you fixing a bug? Copy the template from <https://github.com/CVEProject/CVE-Services/blob/dev/.github/PULL_REQUEST_TEMPLATE/bug_fix.md>
-  - Are you improving performance? Copy the template from <https://github.com/CVEProject/CVE-Services/blob/dev/.github/PULL_REQUEST_TEMPLATE/performance_improvement.md>
-  - Are you updating documentation? Copy the template from <https://github.com/CVEProject/CVE-Services/blob/dev/.github/PULL_REQUEST_TEMPLATE/documentation.md>
-  - Are you changing functionality? Copy the template from <https://github.com/CVEProject/CVE-Services/blob/dev/.github/PULL_REQUEST_TEMPLATE/feature_change.md>
-2. Replace this text with the contents of the template
-3. Fill in all sections of the template
-4. Click "Create pull request"
+Note: Please format the pull request title like:
+"Resolves issue ###, High level description of pull request."
+
+Closes Issue ###
+
+# Summary
+Write out a concise summary of this MR.
+
+# Important Changes
+`example_file.js`
+- Cleaned code and added comments.
+- Added method to handle adding items. 
+
+# Testing
+
+Steps to manually test updated functionality, if possible
+- [ ] 1) Example test step.
+
+# Notes
+- Some additional notes about this MR.
diff --git a/datadump/pre-population/cve-ids-range.json b/datadump/pre-population/cve-ids-range.json
index 6cfbc267..5e82185b 100644
--- a/datadump/pre-population/cve-ids-range.json
+++ b/datadump/pre-population/cve-ids-range.json
@@ -358,6 +358,21 @@
               "end": 50000000
           }
       }
-    }
+    },
+    {
+        "cve_year": 2023,
+        "ranges": {
+            "priority": {
+                "top_id": 0,
+                "start": 0,
+                "end": 20000
+            },
+            "general": {
+                "top_id": 20000,
+                "start": 20000,
+                "end": 50000000
+            }
+        }
+      }
   ]
   
\ No newline at end of file
diff --git a/src/controller/cve.controller/cve.controller.js b/src/controller/cve.controller/cve.controller.js
index bdf24693..15183683 100644
--- a/src/controller/cve.controller/cve.controller.js
+++ b/src/controller/cve.controller/cve.controller.js
@@ -4,6 +4,7 @@ const errors = require('./error')
 const getConstants = require('../../constants').getConstants
 const error = new errors.CveControllerError()
 const booleanIsTrue = require('../../utils/utils').booleanIsTrue
+const url = process.env.NODE_ENV === 'staging' ? 'https://test.cve.org/' : 'https://cve.org/'
 
 // Helper function to create providerMetadata object
 function createProviderMetadata (orgId, shortName, updateDate) {
@@ -334,7 +335,7 @@ async function submitCna (req, res, next) {
     }
 
     const responseMessage = {
-      message: id + ' record was successfully created.',
+      message: id + ' record was successfully created. This submission should appear on ' + url + ' within 15 minutes.',
       created: cveModel.cve
     }
 
@@ -423,7 +424,7 @@ async function updateCna (req, res, next) {
     }
 
     const responseMessage = {
-      message: id + ' record was successfully updated.',
+      message: id + ' record was successfully updated. This submission should appear on ' + url + ' within 15 minutes.',
       updated: cveModel.cve
     }
 
@@ -475,8 +476,9 @@ async function rejectCVE (req, res, next) {
     const newCveObj = new Cve({ cve: rejectedCve })
 
     result = Cve.validateCveRecord(newCveObj.cve)
-    if (!result) {
-      return res.status(500).json(error.serverError())
+    if (!result.isValid) {
+      logger.error(JSON.stringify({ uuid: req.ctx.uuid, message: 'CVE JSON schema validation FAILED.' }))
+      return res.status(400).json(error.invalidCnaContainerJsonSchema(result.errors))
     }
 
     // Save rejected CVE record object
@@ -540,9 +542,10 @@ async function rejectExistingCve (req, res, next) {
     // update CVE record to rejected
     const updatedRecord = Cve.updateCveToRejected(id, providerMetadata, result.cve, req.ctx.body)
     const updatedCve = new Cve({ cve: updatedRecord })
-    result = Cve.validateCveRecord(updatedCve)
-    if (!result) {
-      return res.status(500).json(error.serverError())
+    result = Cve.validateCveRecord(updatedCve.cve)
+    if (!result.isValid) {
+      logger.error(JSON.stringify({ uuid: req.ctx.uuid, message: 'CVE JSON schema validation FAILED.' }))
+      return res.status(400).json(error.invalidCnaContainerJsonSchema(result.errors))
     }
     result = await cveRepo.updateByCveId(id, updatedCve)
     if (!result) {
diff --git a/src/controller/org.controller/error.js b/src/controller/org.controller/error.js
index 87e66c80..cce70e5a 100644
--- a/src/controller/org.controller/error.js
+++ b/src/controller/org.controller/error.js
@@ -57,6 +57,13 @@ class OrgControllerError extends idrErr.IDRError {
     return err
   }
 
+  alreadyInOrg (shortname, username) { // org
+    const err = {}
+    err.error = 'USER_ALREADY_IN_ORG'
+    err.message = `The user could not be updated because the user '${username}' already belongs to the '${shortname}' organization.`
+    return err
+  }
+
   duplicateShortname (shortname) { // org
     const err = {}
     err.error = 'DUPLICATE_SHORTNAME'
diff --git a/src/controller/org.controller/org.controller.js b/src/controller/org.controller/org.controller.js
index 96973a33..826c8adc 100644
--- a/src/controller/org.controller/org.controller.js
+++ b/src/controller/org.controller/org.controller.js
@@ -604,7 +604,7 @@ async function updateUser (req, res, next) {
       }
     })
 
-    // updating user's roles and org_uuid is only allowed for secretariats and org admins
+    // Check for correct privileges if the requested changes require them
     if (changesRequirePrivilegedRole && !(isAdmin || isSecretariat)) {
       logger.info({ uuid: req.ctx.uuid, message: 'The user could not be updated because ' + requesterUsername + ' user is not Org Admin or Secretariat to modify these fields.' })
       return res.status(403).json(error.notOrgAdminOrSecretariat())
@@ -620,6 +620,12 @@ async function updateUser (req, res, next) {
       }
     }
 
+    // error if trying to set org to same org
+    if (newOrgShortName === shortName) {
+      logger.info({ uuid: req.ctx.uuid, message: 'The user could not be updated because user is already in ' + newOrgShortName })
+      return res.status(403).json(error.alreadyInOrg(newOrgShortName, user.username))
+    }
+
     let agt = setAggregateUserObj({ username: username, org_UUID: orgUUID })
 
     // check if org has user of same username already
diff --git a/src/middleware/errorMessages.js b/src/middleware/errorMessages.js
index b038e4d0..864005c4 100644
--- a/src/middleware/errorMessages.js
+++ b/src/middleware/errorMessages.js
@@ -2,5 +2,5 @@
 
 module.exports = {
   ID_QUOTA: 'The id_quota does not comply with CVE id quota limitations',
-  TIMESTAMP_FORMAT: 'Bad date, or invalid timestamp format: valid format is yyyy-MM-ddTHH:mm:ss or yyyy-MM-ddTHH:mm:ssZZZZ'
+  TIMESTAMP_FORMAT: "Bad date, or invalid timestamp format: valid format is yyyy-MM-ddTHH:mm:ss or yyyy-MM-ddTHH:mm:ssZZZZ (to use '+' in timezone offset, encode as '%2B)"
 }
diff --git a/src/utils/utils.js b/src/utils/utils.js
index 49bcfc2f..ef83b775 100644
--- a/src/utils/utils.js
+++ b/src/utils/utils.js
@@ -117,10 +117,9 @@ function booleanIsTrue (val) {
 // Sanitizer for dates
 function toDate (val) {
   val = val.toUpperCase()
-  let value = val.match(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(|Z|((-|\+|\s)\d{2}:\d{2}))$/)
+  let value = val.match(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(|Z|((-|\+)\d{2}:\d{2}))$/)
   let result = null
   if (value) {
-    value[0] = value[0].replace(' ', '+') // Re-add literal '+' which was stripped
     const dateStr = value[0]
     // Make sure that the string passed is a valid date
     // eslint doesn't like that responseType is not defined, but it is needed as is
@@ -131,7 +130,8 @@ function toDate (val) {
     }
   } else {
     value = val.match(/^\d{4}-\d{2}-\d{2}$/)
-    if (value) {
+    /* eslint-disable-next-line */
+    if ((value) && (validateDate(value.toString().substring(0, 10), responseType = 'boolean'))) {
       result = new Date(`${value[0]}T00:00:00.000+00:00`)
     }
   }


Test patch:
diff --git a/test-http/src/test/user_tests/user.py b/test-http/src/test/user_tests/user.py
index 38447692..4a1ee99f 100644
--- a/test-http/src/test/user_tests/user.py
+++ b/test-http/src/test/user_tests/user.py
@@ -1,6 +1,8 @@
 # Tests in this file use the secretariat credentials
 import requests
 import json
+import random
+import string
 from src import env, utils
 from src.utils import (assert_contains, ok_response_contains,
                        ok_response_contains_json, response_contains,
@@ -84,3 +86,90 @@ def test_get_bad_user_page():
     assert res.status_code == 400
     response_contains_json(res, 'error', 'BAD_INPUT')
     response_contains_json(res, 'details', utils.BAD_PAGE_ERROR_DETAILS)
+
+def test_put_user_update_name():
+    """ correct error is returned when updating user to same org """
+
+    # grab all users to find one to update
+    res = requests.get(
+        f'{env.AWG_BASE_URL}/api/users',
+        headers=utils.BASE_HEADERS
+    )
+
+    assert res.status_code == 200
+    all_users = json.loads(res.content.decode())['users']
+
+    assert len(all_users) > 0
+
+    test_user = all_users[0]
+
+    # can only use the org shortname in the URL
+    org_res = requests.get(
+        f'{env.AWG_BASE_URL}/api/org/{test_user["org_UUID"]}',
+        headers=utils.BASE_HEADERS
+    )
+
+    assert org_res.status_code == 200
+    org = json.loads(org_res.content.decode())
+
+    # random string for test name
+    test_name = ''.join(random.choices(string.ascii_letters, k=16))
+
+    res = requests.put(
+        f'{env.AWG_BASE_URL}/api/org/{org["short_name"]}/user/{test_user["username"]}',
+        headers=utils.BASE_HEADERS,
+        params={
+            'name.first': test_name
+        }
+    )
+
+    assert res.status_code == 200
+
+    res = requests.get(
+        f'{env.AWG_BASE_URL}/api/org/{org["short_name"]}/user/{test_user["username"]}',
+        headers=utils.BASE_HEADERS
+    )
+
+    assert json.loads(res.content.decode())['name']['first'] == test_name
+
+
+
+def test_put_user_error_for_same_org():
+    """ correct error is returned when updating user to same org """
+
+    # grab all users to find one to update
+    res = requests.get(
+        f'{env.AWG_BASE_URL}/api/users',
+        headers=utils.BASE_HEADERS
+    )
+
+    assert res.status_code == 200
+    all_users = json.loads(res.content.decode())['users']
+
+    assert len(all_users) > 0
+
+    # try to update user to same org
+    test_user = all_users[0]
+
+    # can only use the org shortname in the URL
+    org_res = requests.get(
+        f'{env.AWG_BASE_URL}/api/org/{test_user["org_UUID"]}',
+        headers=utils.BASE_HEADERS
+    )
+
+    assert org_res.status_code == 200
+    org = json.loads(org_res.content.decode())
+
+    res = requests.put(
+        f'{env.AWG_BASE_URL}/api/org/{org["short_name"]}/user/{test_user["username"]}',
+        headers=utils.BASE_HEADERS,
+        params={
+            'org_short_name': org['short_name']
+        }
+    )
+
+    assert res.status_code == 403
+    err = json.loads(res.content.decode())
+
+    assert err['error'] == 'USER_ALREADY_IN_ORG'
+    assert err['message'] == 'The user could not be updated because the user \'cps@mitre.org\' already belongs to the \'mitre\' organization.'
diff --git a/test/unit-tests/cve/cveCnaContainerCreateTest.js b/test/unit-tests/cve/cveCnaContainerCreateTest.js
index 39e0b48f..ebc484eb 100644
--- a/test/unit-tests/cve/cveCnaContainerCreateTest.js
+++ b/test/unit-tests/cve/cveCnaContainerCreateTest.js
@@ -13,6 +13,7 @@ app.use(middleware.createCtxAndReqUUID)
 const nonExistentCveId = 'CVE-2020-1425'
 const cveIdPublished5 = 'CVE-2017-4024'
 const cveIdReserved = 'CVE-2017-5835'
+const url = process.env.NODE_ENV === 'staging' ? 'https://test.cve.org/' : 'https://cve.org/' // Used in submitCna response messages
 const cveCnaContainerFail = require('../../schemas/cna-container/cna-container_fail.json')
 const cveCnaContainerPass = require('../../schemas/cna-container/cna-container_pass.json')
 const errors = require('../../../src/controller/cve.controller/error')
@@ -229,7 +230,7 @@ describe('Testing the POST /cve/:id/cna endpoint in Cve Controller', () => {
 
           expect(res).to.have.status(200)
           expect(res).to.have.property('body').and.to.be.a('object')
-          expect(res.body.message).to.equal(`${cveIdReserved} record was successfully created.`)
+          expect(res.body.message).to.equal(`${cveIdReserved} record was successfully created. This submission should appear on ${url} within 15 minutes.`)
           done()
         })
     })
@@ -249,7 +250,7 @@ describe('Testing the POST /cve/:id/cna endpoint in Cve Controller', () => {
 
           expect(res).to.have.status(200)
           expect(res).to.have.property('body').and.to.be.a('object')
-          expect(res.body.message).to.equal(`${cveIdReserved} record was successfully created.`)
+          expect(res.body.message).to.equal(`${cveIdReserved} record was successfully created. This submission should appear on ${url} within 15 minutes.`)
           done()
         })
     })
diff --git a/test/unit-tests/cve/cveCnaContainerUpdateTest.js b/test/unit-tests/cve/cveCnaContainerUpdateTest.js
index 93497104..cad7c512 100644
--- a/test/unit-tests/cve/cveCnaContainerUpdateTest.js
+++ b/test/unit-tests/cve/cveCnaContainerUpdateTest.js
@@ -13,6 +13,7 @@ app.use(middleware.createCtxAndReqUUID)
 const nonExistentCveId = 'CVE-2020-1425'
 const cveIdPublished5 = 'CVE-2017-4024'
 const cveIdReserved = 'CVE-2017-5835'
+const url = process.env.NODE_ENV === 'staging' ? 'https://test.cve.org/' : 'https://cve.org/' // Used in updateCna response messages
 const cveCnaContainerFail = require('../../schemas/cna-container/cna-container_fail.json')
 const cveCnaContainerPass = require('../../schemas/cna-container/cna-container_pass.json')
 const cveRecordPublished = require('../../schemas/5.0/CVE-2017-4024_published.json')
@@ -260,7 +261,7 @@ describe('Testing the PUT /cve/:id/cna endpoint in Cve Controller', () => {
 
           expect(res).to.have.status(200)
           expect(res).to.have.property('body').and.to.be.a('object')
-          expect(res.body.message).to.equal(`${cveIdPublished5} record was successfully updated.`)
+          expect(res.body.message).to.equal(`${cveIdPublished5} record was successfully updated. This submission should appear on ${url} within 15 minutes.`)
           done()
         })
     })
@@ -280,7 +281,7 @@ describe('Testing the PUT /cve/:id/cna endpoint in Cve Controller', () => {
 
           expect(res).to.have.status(200)
           expect(res).to.have.property('body').and.to.be.a('object')
-          expect(res.body.message).to.equal(`${cveIdPublished5} record was successfully updated.`)
+          expect(res.body.message).to.include(`${cveIdPublished5} record was successfully updated. This submission should appear on ${url} within 15 minutes.`)
           expect(res.body.created).to.not.equal(cveRecordPublished)
           done()
         })