cvss-suite 1.2.3 → 2.0.0

data/lib/cvss_suite/cvss31/cvss31_environmental.rb

@@ -13,14 +13,12 @@ require_relative '../cvss_metric'
 require_relative '../helpers/cvss3_helper'
 require_relative '../helpers/cvss31_helper'
 
-##
-# This class represents a CVSS Environmental metric in version 3.1.
-
 module CvssSuite
+  ##
+  # This class represents a CVSS Environmental metric in version 3.1.
   class Cvss31Environmental < CvssMetric
     ##
     # Property of this metric
-
     attr_reader :confidentiality_requirement, :integrity_requirement, :availability_requirement,
                 :modified_attack_vector, :modified_attack_complexity, :modified_privileges_required,
                 :modified_user_interaction, :modified_scope, :modified_confidentiality,
@@ -28,20 +26,8 @@ module CvssSuite
 
     ##
     # Returns score of this metric
-    def score(base, temporal)
-      @base = base
-
-      merged_modified_privileges_required = @modified_privileges_required
-      if @modified_privileges_required.selected_choice[:name] == 'Not Defined'
-        merged_modified_privileges_required = @base.privileges_required
-      end
-
-      merged_modified_scope = @modified_scope
-      if @modified_scope.selected_choice[:name] == 'Not Defined'
-        merged_modified_scope = @base.scope
-      end
-
-      privilege_score = Cvss3Helper.privileges_required_score(merged_modified_privileges_required, merged_modified_scope)
+    def score(temporal_score)
+      privilege_score = Cvss3Helper.privileges_required_score(@modified_privileges_required, @modified_scope)
 
       modified_exploitability_sub_score = modified_exploitability_sub(privilege_score)
 
@@ -49,7 +35,7 @@ module CvssSuite
 
       return 0 if modified_impact_sub_score <= 0
 
-      calculate_score modified_impact_sub_score, modified_exploitability_sub_score, temporal.score
+      calculate_score modified_impact_sub_score, modified_exploitability_sub_score, temporal_score
     end
 
     private
@@ -57,81 +43,72 @@ module CvssSuite
     def init_properties
       @properties.push(@confidentiality_requirement =
                          CvssProperty.new(name: 'Confidentiality Requirement', abbreviation: 'CR', position: [8, 11],
-                                          choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
+                                          values: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
                                                     { name: 'Medium', abbreviation: 'M', weight: 1.0 },
                                                     { name: 'High', abbreviation: 'H', weight: 1.5 },
                                                     { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
       @properties.push(@integrity_requirement =
                          CvssProperty.new(name: 'Integrity Requirement', abbreviation: 'IR', position: [9, 12],
-                                          choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
+                                          values: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
                                                     { name: 'Medium', abbreviation: 'M', weight: 1.0 },
                                                     { name: 'High', abbreviation: 'H', weight: 1.5 },
                                                     { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
 
       @properties.push(@availability_requirement =
                          CvssProperty.new(name: 'Availability Requirement', abbreviation: 'AR', position: [10, 13],
-                                          choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
+                                          values: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
                                                     { name: 'Medium', abbreviation: 'M', weight: 1.0 },
                                                     { name: 'High', abbreviation: 'H', weight: 1.5 },
                                                     { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
       @properties.push(@modified_attack_vector =
                          CvssProperty.new(name: 'Modified Attack Vector', abbreviation: 'MAV', position: [11, 14],
-                                          choices: [{ name: 'Network', abbreviation: 'N', weight: 0.85 },
+                                          values: [{ name: 'Network', abbreviation: 'N', weight: 0.85 },
                                                     { name: 'Adjacent Network', abbreviation: 'A', weight: 0.62 },
                                                     { name: 'Local', abbreviation: 'L', weight: 0.55 },
                                                     { name: 'Physical', abbreviation: 'P', weight: 0.2 },
                                                     { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
       @properties.push(@modified_attack_complexity =
                          CvssProperty.new(name: 'Modified Attack Complexity', abbreviation: 'MAC', position: [12, 15],
-                                          choices: [{ name: 'Low', abbreviation: 'L', weight: 0.77 },
+                                          values: [{ name: 'Low', abbreviation: 'L', weight: 0.77 },
                                                     { name: 'High', abbreviation: 'H', weight: 0.44 },
                                                     { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
       @properties.push(@modified_privileges_required =
                          CvssProperty.new(name: 'Modified Privileges Required', abbreviation: 'MPR', position: [13, 16],
-                                          choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
+                                          values: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
                                                     { name: 'Low', abbreviation: 'L', weight: 0.62 },
                                                     { name: 'High', abbreviation: 'H', weight: 0.27 },
                                                     { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
       @properties.push(@modified_user_interaction =
                          CvssProperty.new(name: 'Modified User Interaction', abbreviation: 'MUI', position: [14, 17],
-                                          choices: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
+                                          values: [{ name: 'None', abbreviation: 'N', weight: 0.85 },
                                                     { name: 'Required', abbreviation: 'R', weight: 0.62 },
                                                     { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
       @properties.push(@modified_scope =
                          CvssProperty.new(name: 'Modified Scope', abbreviation: 'MS', position: [15, 18],
-                                          choices: [{ name: 'Changed', abbreviation: 'C' },
-                                                    { name: 'Unchanged', abbreviation: 'U' },
-                                                    { name: 'Not Defined', abbreviation: 'X' }]))
+                                          values: [{ name: 'Changed', abbreviation: 'C' },
+                                                    { name: 'Unchanged', abbreviation: 'U' }]))
       @properties.push(@modified_confidentiality =
                          CvssProperty.new(name: 'Modified Confidentiality', abbreviation: 'MC', position: [16, 19],
-                                          choices: [{ name: 'None', abbreviation: 'N', weight: 0 },
+                                          values: [{ name: 'None', abbreviation: 'N', weight: 0 },
                                                     { name: 'Low', abbreviation: 'L', weight: 0.22 },
                                                     { name: 'High', abbreviation: 'H', weight: 0.56 },
                                                     { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
       @properties.push(@modified_integrity =
                          CvssProperty.new(name: 'Modified Integrity', abbreviation: 'MI', position: [17, 20],
-                                          choices: [{ name: 'None', abbreviation: 'N', weight: 0 },
+                                          values: [{ name: 'None', abbreviation: 'N', weight: 0 },
                                                     { name: 'Low', abbreviation: 'L', weight: 0.22 },
                                                     { name: 'High', abbreviation: 'H', weight: 0.56 },
                                                     { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
       @properties.push(@modified_availability =
                          CvssProperty.new(name: 'Modified Availability', abbreviation: 'MA', position: [18, 21],
-                                          choices: [{ name: 'None', abbreviation: 'N', weight: 0 },
+                                          values: [{ name: 'None', abbreviation: 'N', weight: 0 },
                                                     { name: 'Low', abbreviation: 'L', weight: 0.22 },
                                                     { name: 'High', abbreviation: 'H', weight: 0.56 },
                                                     { name: 'Not Defined', abbreviation: 'X', weight: 1 }]))
     end
 
     def modified_impact_sub(isc_modified)
-      if @modified_scope.selected_choice[:name] == 'Not Defined'
-        if @base.scope.selected_choice[:name] == 'Changed'
-          return 7.52 * (isc_modified - 0.029) - 3.25 * (isc_modified * 0.9731 - 0.02)**13
-        else
-          return 6.42 * isc_modified
-        end
-      end
-
-      if @modified_scope.selected_choice[:name] == 'Changed'
+      if @modified_scope.selected_value[:name] == 'Changed'
         7.52 * (isc_modified - 0.029) - 3.25 * (isc_modified * 0.9731 - 0.02)**13
       else
         6.42 * isc_modified
@@ -139,54 +116,20 @@ module CvssSuite
     end
 
     def isc_modified
-      merged_modified_confidentiality = @modified_confidentiality
-      if @modified_confidentiality.selected_choice[:name] == 'Not Defined'
-        merged_modified_confidentiality = @base.confidentiality
-      end
-
-      merged_modified_integrity = @modified_integrity
-      if @modified_integrity.selected_choice[:name] == 'Not Defined'
-        merged_modified_integrity = @base.integrity
-      end
-
-      merged_modified_availability = @modified_availability
-      if @modified_availability.selected_choice[:name] == 'Not Defined'
-        merged_modified_availability = @base.availability
-      end
-
-      confidentiality_score = 1 - merged_modified_confidentiality.score * @confidentiality_requirement.score
-      integrity_score = 1 - merged_modified_integrity.score * @integrity_requirement.score
-      availability_score = 1 - merged_modified_availability.score * @availability_requirement.score
+      confidentiality_score = 1 - @modified_confidentiality.score * @confidentiality_requirement.score
+      integrity_score = 1 - @modified_integrity.score * @integrity_requirement.score
+      availability_score = 1 - @modified_availability.score * @availability_requirement.score
 
       [0.915, (1 - confidentiality_score * integrity_score * availability_score)].min
     end
 
     def modified_exploitability_sub(privilege_score)
-      merged_modified_attack_vector = @modified_attack_vector
-      if @modified_attack_vector.selected_choice[:name] == 'Not Defined'
-        merged_modified_attack_vector = @base.attack_vector
-      end
-
-      merged_modified_attack_complexity = @modified_attack_complexity
-      if @modified_attack_complexity.selected_choice[:name] == 'Not Defined'
-        merged_modified_attack_complexity = @base.attack_complexity
-      end
-
-      merged_modified_user_interaction = @modified_user_interaction
-      if @modified_user_interaction.selected_choice[:name] == 'Not Defined'
-        merged_modified_user_interaction = @base.user_interaction
-      end
-
-      8.22 * merged_modified_attack_vector.score * merged_modified_attack_complexity.score *
-        privilege_score * merged_modified_user_interaction.score
+      8.22 * @modified_attack_vector.score * @modified_attack_complexity.score *
+        privilege_score * @modified_user_interaction.score
     end
 
     def calculate_score(modified_impact_sub_score, modified_exploitability_sub_score, temporal_score)
-      if @modified_scope.selected_choice[:name] == 'Not Defined'
-        factor = @base.scope.selected_choice[:name] == 'Changed' ? 1.08 : 1.0
-      else
-        factor = @modified_scope.selected_choice[:name] == 'Changed' ? 1.08 : 1.0
-      end
+      factor = @modified_scope.selected_value[:name] == 'Changed' ? 1.08 : 1.0
 
       Cvss31Helper.round_up(
         [factor * (modified_impact_sub_score + modified_exploitability_sub_score), 10].min

data/lib/cvss_suite/cvss31/cvss31_temporal.rb

@@ -11,19 +11,16 @@
 require_relative '../cvss_property'
 require_relative '../cvss_metric'
 
-##
-# This class represents a CVSS Temporal metric in version 3.1.
-
 module CvssSuite
+  ##
+  # This class represents a CVSS Temporal metric in version 3.1.
   class Cvss31Temporal < CvssMetric
     ##
     # Property of this metric
-
     attr_reader :exploit_code_maturity, :remediation_level, :report_confidence
 
     ##
     # Returns score of this metric
-
     def score
       return 1.0 unless valid?
 
@@ -35,14 +32,14 @@ module CvssSuite
     def init_properties
       @properties.push(@exploit_code_maturity =
                          CvssProperty.new(name: 'Exploit Code Maturity', abbreviation: 'E', position: [8],
-                                          choices: [{ name: 'Not Defined', abbreviation: 'X', weight: 1.0 },
+                                          values: [{ name: 'Not Defined', abbreviation: 'X', weight: 1.0 },
                                                     { name: 'Unproven', abbreviation: 'U', weight: 0.91 },
                                                     { name: 'Proof-of-Concept', abbreviation: 'P', weight: 0.94 },
                                                     { name: 'Functional', abbreviation: 'F', weight: 0.97 },
                                                     { name: 'High', abbreviation: 'H', weight: 1.0 }]))
       @properties.push(@remediation_level =
                          CvssProperty.new(name: 'Remediation Level', abbreviation: 'RL', position: [9],
-                                          choices: [{ name: 'Not Defined', abbreviation: 'X', weight: 1.0 },
+                                          values: [{ name: 'Not Defined', abbreviation: 'X', weight: 1.0 },
                                                     { name: 'Official Fix', abbreviation: 'O', weight: 0.95 },
                                                     { name: 'Temporary Fix', abbreviation: 'T', weight: 0.96 },
                                                     { name: 'Workaround', abbreviation: 'W', weight: 0.97 },
@@ -50,7 +47,7 @@ module CvssSuite
 
       @properties.push(@report_confidence =
                          CvssProperty.new(name: 'Report Confidence', abbreviation: 'RC', position: [10],
-                                          choices: [{ name: 'Not Defined', abbreviation: 'X', weight: 1.0 },
+                                          values: [{ name: 'Not Defined', abbreviation: 'X', weight: 1.0 },
                                                     { name: 'Unknown', abbreviation: 'U', weight: 0.92 },
                                                     { name: 'Reasonable', abbreviation: 'R', weight: 0.96 },
                                                     { name: 'Confirmed', abbreviation: 'C', weight: 1.0 }]))

data/lib/cvss_suite/cvss_metric.rb

@@ -8,23 +8,20 @@
 # This work is licensed under the terms of the MIT license.
 # See the LICENSE.md file in the top-level directory.
 
-##
-# This class represents any CVSS metric.
-
 module CvssSuite
+  ##
+  # This class represents any CVSS metric.
   class CvssMetric
     ##
     # Creates a new CVSS metric by +properties+
-
     def initialize(selected_properties)
       @properties = []
       init_properties
-      extract_selected_choices_from selected_properties
+      extract_selected_values_from selected_properties
     end
 
     ##
     # Returns if the metric is valid.
-
     def valid?
       @properties.each do |property|
         return false unless property.valid?
@@ -34,19 +31,18 @@ module CvssSuite
 
     ##
     # Returns number of properties for this metric.
-
     def count
       @properties.count
     end
 
     private
 
-    def extract_selected_choices_from(selected_properties)
+    def extract_selected_values_from(selected_properties)
       selected_properties.each do |selected_property|
         property = @properties.detect do |p|
           p.abbreviation == selected_property[:name] && p.position.include?(selected_property[:position])
         end
-        property.set_selected_choice selected_property[:selected] unless property.nil?
+        property&.set_selected_value selected_property[:selected]
       end
     end
   end

data/lib/cvss_suite/cvss_property.rb

@@ -8,21 +8,20 @@
 # This work is licensed under the terms of the MIT license.
 # See the LICENSE.md file in the top-level directory.
 
-##
-# This class represents a CVSS property of a CVSS metric.
-
 module CvssSuite
+  ##
+  # This class represents a CVSS property of a CVSS metric.
   class CvssProperty
     ##
     # Creates a new CVSS property by a +property+.
     #
     # +Property+ needs to consist of a name, a abbreviation,
     # the possible positions in the CVSS vector, a weight, and the
-    # available choices for the property.
+    # available values for the property.
 
     def initialize(property)
       @property = property
-      @property[:default_choice] ||= 'Not Available'
+      @property[:default_value] ||= 'Not Available'
     end
 
     ##
@@ -40,10 +39,10 @@ module CvssSuite
     end
 
     ##
-    # Returns all available choices of the property.
+    # Returns all available values of the property.
 
-    def choices
-      @property[:choices]
+    def values
+      @property[:values]
     end
 
     ##
@@ -54,34 +53,34 @@ module CvssSuite
     end
 
     ##
-    # Returns the selected choice of the property.
+    # Returns the selected value of the property.
 
-    def selected_choice
-      @selected_choice || @property[:default_choice]
+    def selected_value
+      @selected_value || @property[:default_value]
     end
 
     ##
     # Returns true if the property is valid.
 
     def valid?
-      !@selected_choice.nil?
+      !@selected_value.nil?
     end
 
     ##
-    # Returns the score of the selected choice.
+    # Returns the score of the selected value.
 
     def score
-      @selected_choice[:weight]
+      @selected_value[:weight]
     end
 
     ##
-    # Sets the selected choice by a +choice+.
+    # Sets the selected value by a +value+.
 
-    def set_selected_choice(selected_choice)
-      choices.each do |choice|
-        choice[:selected] = selected_choice.eql?(choice[:abbreviation])
+    def set_selected_value(selected_value)
+      values.each do |value|
+        value[:selected] = selected_value.eql?(value[:abbreviation])
       end
-      @selected_choice = choices.detect { |choice| choice[:selected] }
+      @selected_value = values.detect { |value| value[:selected] }
     end
   end
 end

data/lib/cvss_suite/helpers/cvss3_helper.rb

@@ -8,10 +8,9 @@
 # This work is licensed under the terms of the MIT license.
 # See the LICENSE.md file in the top-level directory.
 
-##
-# This module includes methods which are used by the CVSS 3 classes.
-
 module CvssSuite
+  ##
+  # This module includes methods which are used by the CVSS 3 classes.
   module Cvss3Helper
     ##
     # Since CVSS 3 all float values are rounded up, therefore this method is used
@@ -21,14 +20,14 @@ module CvssSuite
     end
 
     ##
-    # Since CVSS 3 the Privilege Required score depends on the selected choice of the Scope metric.
+    # Since CVSS 3 the Privilege Required score depends on the selected value of the Scope metric.
     # This method takes a +Privilege+ +Required+ and a +Scope+ metric and returns the newly calculated score.
     def self.privileges_required_score(privileges_required, scope)
-      changed = scope.selected_choice[:name] == 'Changed'
+      changed = scope.selected_value[:name] == 'Changed'
       privilege_score = privileges_required.score
       if changed
-        privilege_score = 0.68 if privileges_required.selected_choice[:name] == 'Low'
-        privilege_score = 0.50 if privileges_required.selected_choice[:name] == 'High'
+        privilege_score = 0.68 if privileges_required.selected_value[:name] == 'Low'
+        privilege_score = 0.50 if privileges_required.selected_value[:name] == 'High'
       end
       privilege_score
     end

data/lib/cvss_suite/invalid_cvss.rb

@@ -8,47 +8,40 @@
 # This work is licensed under the terms of the MIT license.
 # See the LICENSE.md file in the top-level directory.
 
-# ##
-# # This class represents a invalid CVSS vector.
-
 module CvssSuite
+  ##
+  # This class represents a invalid CVSS vector.
   class InvalidCvss < Cvss
     ##
     # Creates a new invalid CVSS vector.
-
     def initialize; end
 
     ##
     # Since this is an invalid CVSS vector, it always returns false.
-
     def valid?
       false
     end
 
     ##
     # Since this is an invalid CVSS vector, it always throws an exception.
-
     def version
       check_validity
     end
 
     ##
     # Since this is an invalid CVSS vector, it always throws an exception.
-
     def base_score
       check_validity
     end
 
     ##
     # Since this is an invalid CVSS vector, it always throws an exception.
-
     def temporal_score
       check_validity
     end
 
     ##
     # Since this is an invalid CVSS vector, it always throws an exception.
-
     def environmental_score
       check_validity
     end

data/lib/cvss_suite/version.rb

@@ -9,5 +9,5 @@
 # See the LICENSE.md file in the top-level directory.
 
 module CvssSuite
-  VERSION = '1.2.3'
+  VERSION = '2.0.0'.freeze
 end

data/lib/cvss_suite.rb

@@ -17,18 +17,15 @@ require 'cvss_suite/invalid_cvss'
 
 ##
 # Module of this gem.
-
 module CvssSuite
   CVSS_VECTOR_BEGINNINGS = [
     { string: 'AV:', version: 2 },
-    { string: '(AV:', version: 2 },
     { string: 'CVSS:3.0/', version: 3.0 },
     { string: 'CVSS:3.1/', version: 3.1 }
-  ]
+  ].freeze
 
   ##
   # Returns a CVSS class by a +vector+.
-
   def self.new(vector)
     return InvalidCvss.new unless vector.is_a? String
 
@@ -49,9 +46,7 @@ module CvssSuite
 
   def self.version
     CVSS_VECTOR_BEGINNINGS.each do |beginning|
-      if @vector_string.start_with? beginning[:string]
-        return beginning[:version]
-      end
+      return beginning[:version] if @vector_string.start_with? beginning[:string]
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cvss-suite
 version: !ruby/object:Gem::Version
-  version: 1.2.3
+  version: 2.0.0
 platform: ruby
 authors:
 - Oliver Hamboerger
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-12-05 00:00:00.000000000 Z
+date: 2020-05-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -79,6 +79,7 @@ files:
 - ".github/ISSUE_TEMPLATE/custom.md"
 - ".github/ISSUE_TEMPLATE/feature_request.md"
 - ".github/workflows/rspec.yml"
+- ".github/workflows/rubocop.yml"
 - ".gitignore"
 - ".rspec"
 - ".rubocop.yml"
@@ -118,8 +119,7 @@ homepage: https://siemens.github.io/cvss-suite/
 licenses:
 - MIT
 metadata: {}
-post_install_message: Version 1.x of this gem is no longer supported, please update
-  to a supported version.
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -127,7 +127,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.0.0
+      version: 2.4.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="