cvss-suite 3.2.0 → 3.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 56b4970c7134073d2940b58730249883898bff82628949a38dfcdb805de8a204
-  data.tar.gz: ecee84d8b3d5abec9004c6223fb8ab321b015ee4bbef18a528b24c1776e0d3fa
+  metadata.gz: b7e95421f7d73fac437b3d59723213cf49773ee08ea56d07b7ac187ef6ec37c1
+  data.tar.gz: 85d0b31cd41e67461d507498675cd63b25f6740f3f7eff18c3c6b08dce647d40
 SHA512:
-  metadata.gz: d5f8ea8fa286f41fb7505a3f59c5b995f827b57415c486340ac6d3e540baab7e1e81b045f075587e832027d812a46cccaa521abd5ac7dcda6836a9f290ba2139
-  data.tar.gz: 948c07fe25adfb5acc09ba85ccfff096f7caaaec3bd832ae5b7da61087ccfb957c58bd1b8a584244a582cdca4252bdf4378fe81c574f1bec2e45c799cca530e4
+  metadata.gz: 1b210dd4db1a4b43259689fb35aaf9678c1a25272174136fb37cad9ae825f3a012c6a0dd60f98cbb2e729b0f35dffcfce840f5682ff1f3206df89276aa79af90
+  data.tar.gz: 0273cd45cfb5a59022e19479eef9807a2c12b46fc858c9406c9c13e96fa0689e395fde1550f9228edda30cd6614e5823f28bfda995898349d3c5943bfa969fa9

data/CHANGES.md

@@ -2,6 +2,19 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## [3.2.2] - 2024-08-04
+
+### Fixes
+* Add extra CVSS vector validations for 3.1 and lower. Fixes [#41](https://github.com/0llirocks/cvss-suite/issues/41)
+
+### Notes
+* An invalid value like E:R (R doesn't exists) now counts as invalid, resulting in an invalid vector. In <= 3.2.1 an invalid value would be ignored/counted as default value.
+
+## [3.2.1] - 2024-05-25
+
+### Fixes
+* String.truncate method in Rails gets overwritten. Fixes [#39](https://github.com/0llirocks/cvss-suite/issues/39)
+
 ## [3.2.0] - 2024-05-04
 
 ### Improvements

data/CODE_OF_CONDUCT.md

@@ -1,17 +1,5 @@
 CVSS-Suite, a Ruby gem to manage the CVSS vector
 
-Copyright (c) 2016-2022 Siemens AG
-Copyright (c) 2022-2024 0llirocks
-
-Author: 0llirocks <https://github.com/0llirocks>
-
-Contributors:
-    Florian Wininger <https://github.com/fwininger>
-    Adam David <https://github.com/adamrdavid>
-    Alexandre Zanni <https://github.com/noraj>
-    joePedantic <https://github.com/joePedantic>
-    Brandyn Phelps <https://github.com/brphelps>
-
 This work is licensed under the terms of the MIT license.
 See the LICENSE.md file in the top-level directory.
 

data/LICENSE.md

@@ -1,16 +1,17 @@
 The MIT License (MIT)
 
-Copyright (c) 2016-2022 Siemens AG
+Copyright (c) 2016-2022 Siemens AG\
 Copyright (c) 2022-2024 0llirocks
 
-Authors:
-   0llirocks <https://github.com/0llirocks>
+Author: 0llirocks <https://github.com/0llirocks>
+
 Contributors:
-    Florian Wininger <https://github.com/fwininger>
-    Adam David <https://github.com/adamrdavid>
-    Alexandre Zanni <https://github.com/noraj>
-    joePedantic <https://github.com/joePedantic>
-    Brandyn Phelps <https://github.com/brphelps>
+- Florian Wininger <https://github.com/fwininger>
+- Adam David <https://github.com/adamrdavid>
+- Alexandre Zanni <https://github.com/noraj>
+- joePedantic <https://github.com/joePedantic>
+- Brandyn Phelps <https://github.com/brphelps>
+- Karim ElGhandour <https://github.com/kghandour>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in

data/cvss_suite.gemspec

@@ -26,6 +26,7 @@ in version 4.0, 3.1, 3.0 and 2.'
     'bug_tracker_uri' => 'https://github.com/0llirocks/cvss-suite/issues',
     'changelog_uri' => 'https://github.com/0llirocks/cvss-suite/blob/master/CHANGES.md',
     'documentation_uri' => "https://www.rubydoc.info/gems/cvss-suite/#{CvssSuite::VERSION}",
+    'homepage_uri' => 'https://cvss-suite.0lli.rocks',
     'source_code_uri' => 'https://github.com/0llirocks/cvss-suite'
   }
 

data/lib/cvss_suite/cvss40/cvss40_calc_helper.rb

@@ -377,7 +377,7 @@ module CvssSuite
       # remove what follow
       if extracted.index('/').positive?
         index_to_drop_after = extracted.index('/') - 1
-        metric_val = extracted.truncate(index_to_drop_after)
+        metric_val = truncate(extracted, index_to_drop_after)
       elsif extracted
         metric_val = extracted
         # case where it is the last metric so no ending /
@@ -385,5 +385,13 @@ module CvssSuite
 
       metric_val
     end
+
+    # rails defines this method on String, so we need to avoid polluting the
+    #  String class to preserve Rails behavior.
+    def truncate(string_to_truncate, truncate_to)
+      return string_to_truncate.dup unless string_to_truncate.length > truncate_to
+
+      (string_to_truncate[0, truncate_to + 1]).to_s
+    end
   end
 end

data/lib/cvss_suite/cvss_31_and_before.rb

@@ -27,11 +27,10 @@ module CvssSuite
     # Returns if CVSS vector is valid.
     def valid?
       if @amount_of_properties >= required_amount_of_properties
-        base = @base.valid?
-        temporal = @base.valid? && @temporal&.valid?
-        environmental = @base.valid? && @environmental&.valid?
-        full = @base.valid? && @temporal&.valid? && @environmental&.valid?
-        base || temporal || environmental || full
+        entered_keys = @properties.collect { |p| p[:name] }
+        return false if (entered_keys - allowed_abbreviations).size.positive?
+
+        check_metrics_validity
       else
         false
       end
@@ -46,5 +45,17 @@ module CvssSuite
 
       base_score
     end
+
+    private
+
+    def allowed_abbreviations
+      @base.properties.collect(&:abbreviation) +
+        @temporal.properties.collect(&:abbreviation) +
+        @environmental.properties.collect(&:abbreviation)
+    end
+
+    def check_metrics_validity
+      @base.valid? && @temporal&.valid? && @environmental&.valid?
+    end
   end
 end

data/lib/cvss_suite/cvss_metric.rb

@@ -44,7 +44,7 @@ module CvssSuite
         end
         property&.set_selected_value selected_property[:selected]
       end
-      @properties.reject(&:valid?).each(&:set_default_value)
+      @properties.select(&:non_selected?).each(&:set_default_value)
     end
   end
 end

data/lib/cvss_suite/cvss_property.rb

@@ -58,7 +58,7 @@ module CvssSuite
     # Returns true if the property is valid.
 
     def valid?
-      !@selected_value.nil?
+      !@selected_value.nil? && @property[:values].map { |p| p[:abbreviation] }.include?(@selected_value[:abbreviation])
     end
 
     ##
@@ -76,6 +76,9 @@ module CvssSuite
         value[:selected] = selected_value.eql?(value[:abbreviation])
       end
       @selected_value = values.detect { |value| value[:selected] }
+      return unless @selected_value.nil?
+
+      @selected_value = { abbreviation: selected_value }
     end
 
     ##
@@ -84,8 +87,16 @@ module CvssSuite
     def set_default_value
       values.each do |value|
         value[:selected] = value[:abbreviation].eql?('X')
+        value[:selected] ||= value[:abbreviation].eql?('ND')
       end
       @selected_value = values.detect { |value| value[:selected] }
     end
+
+    ##
+    # Returns whether a selected_value is set
+
+    def non_selected?
+      @selected_value.nil?
+    end
   end
 end

data/lib/cvss_suite/version.rb

@@ -4,5 +4,5 @@
 # See the LICENSE.md file in the top-level directory.
 
 module CvssSuite
-  VERSION = '3.2.0'.freeze
+  VERSION = '3.2.2'.freeze
 end

data/lib/cvss_suite.rb

@@ -10,7 +10,6 @@ require 'cvss_suite/cvss40/cvss40'
 require 'cvss_suite/version'
 require 'cvss_suite/errors'
 require 'cvss_suite/invalid_cvss'
-require 'cvss_suite/extensions/string'
 
 ##
 # Module of this gem.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cvss-suite
 version: !ruby/object:Gem::Version
-  version: 3.2.0
+  version: 3.2.2
 platform: ruby
 authors:
 - 0llirocks
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-05-04 00:00:00.000000000 Z
+date: 2024-08-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -140,7 +140,6 @@ files:
 - lib/cvss_suite/cvss_metric.rb
 - lib/cvss_suite/cvss_property.rb
 - lib/cvss_suite/errors.rb
-- lib/cvss_suite/extensions/string.rb
 - lib/cvss_suite/helpers/cvss31_helper.rb
 - lib/cvss_suite/helpers/cvss3_helper.rb
 - lib/cvss_suite/invalid_cvss.rb
@@ -151,7 +150,8 @@ licenses:
 metadata:
   bug_tracker_uri: https://github.com/0llirocks/cvss-suite/issues
   changelog_uri: https://github.com/0llirocks/cvss-suite/blob/master/CHANGES.md
-  documentation_uri: https://www.rubydoc.info/gems/cvss-suite/3.2.0
+  documentation_uri: https://www.rubydoc.info/gems/cvss-suite/3.2.2
+  homepage_uri: https://cvss-suite.0lli.rocks
   source_code_uri: https://github.com/0llirocks/cvss-suite
 post_install_message: 
 rdoc_options: []

data/lib/cvss_suite/extensions/string.rb

@@ -1,8 +0,0 @@
-# Extension for String class
-class String
-  def truncate(truncate_to)
-    return dup unless length > truncate_to
-
-    (self[0, truncate_to + 1]).to_s
-  end
-end