cvss-suite 3.2.1 → 3.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c13e3d336237b452f735f78972b31520c80115b7451bf81287f72a3b4b76d65a
-  data.tar.gz: fbbc06267f44b3ae4ddbafe5c0c3c2a50eeecec08dd95c1a3edb20ec15765307
+  metadata.gz: b7e95421f7d73fac437b3d59723213cf49773ee08ea56d07b7ac187ef6ec37c1
+  data.tar.gz: 85d0b31cd41e67461d507498675cd63b25f6740f3f7eff18c3c6b08dce647d40
 SHA512:
-  metadata.gz: 7a4255bb0a792743a9013763620a5c93d3530ebbbd760d915f20569693ec85ff3cd44744b5aa19ef356fd6555fec935c4f8191d2844e61ee533662094379090f
-  data.tar.gz: aa99f6949546a68d0145a7a964d8188ca07fd8c6cde4b8d9df6fa1d324410f2ca3a98c3c38e875f44d84b388a0ee6f5e33ca1db0deab1447c7da325d9dc9654a
+  metadata.gz: 1b210dd4db1a4b43259689fb35aaf9678c1a25272174136fb37cad9ae825f3a012c6a0dd60f98cbb2e729b0f35dffcfce840f5682ff1f3206df89276aa79af90
+  data.tar.gz: 0273cd45cfb5a59022e19479eef9807a2c12b46fc858c9406c9c13e96fa0689e395fde1550f9228edda30cd6614e5823f28bfda995898349d3c5943bfa969fa9

data/CHANGES.md

@@ -2,6 +2,14 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## [3.2.2] - 2024-08-04
+
+### Fixes
+* Add extra CVSS vector validations for 3.1 and lower. Fixes [#41](https://github.com/0llirocks/cvss-suite/issues/41)
+
+### Notes
+* An invalid value like E:R (R doesn't exists) now counts as invalid, resulting in an invalid vector. In <= 3.2.1 an invalid value would be ignored/counted as default value.
+
 ## [3.2.1] - 2024-05-25
 
 ### Fixes

data/CODE_OF_CONDUCT.md

@@ -1,17 +1,5 @@
 CVSS-Suite, a Ruby gem to manage the CVSS vector
 
-Copyright (c) 2016-2022 Siemens AG
-Copyright (c) 2022-2024 0llirocks
-
-Author: 0llirocks <https://github.com/0llirocks>
-
-Contributors:
-    Florian Wininger <https://github.com/fwininger>
-    Adam David <https://github.com/adamrdavid>
-    Alexandre Zanni <https://github.com/noraj>
-    joePedantic <https://github.com/joePedantic>
-    Brandyn Phelps <https://github.com/brphelps>
-
 This work is licensed under the terms of the MIT license.
 See the LICENSE.md file in the top-level directory.
 

data/LICENSE.md

@@ -1,16 +1,17 @@
 The MIT License (MIT)
 
-Copyright (c) 2016-2022 Siemens AG
+Copyright (c) 2016-2022 Siemens AG\
 Copyright (c) 2022-2024 0llirocks
 
-Authors:
-   0llirocks <https://github.com/0llirocks>
+Author: 0llirocks <https://github.com/0llirocks>
+
 Contributors:
-    Florian Wininger <https://github.com/fwininger>
-    Adam David <https://github.com/adamrdavid>
-    Alexandre Zanni <https://github.com/noraj>
-    joePedantic <https://github.com/joePedantic>
-    Brandyn Phelps <https://github.com/brphelps>
+- Florian Wininger <https://github.com/fwininger>
+- Adam David <https://github.com/adamrdavid>
+- Alexandre Zanni <https://github.com/noraj>
+- joePedantic <https://github.com/joePedantic>
+- Brandyn Phelps <https://github.com/brphelps>
+- Karim ElGhandour <https://github.com/kghandour>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in

data/lib/cvss_suite/cvss_31_and_before.rb

@@ -27,11 +27,10 @@ module CvssSuite
     # Returns if CVSS vector is valid.
     def valid?
       if @amount_of_properties >= required_amount_of_properties
-        base = @base.valid?
-        temporal = @base.valid? && @temporal&.valid?
-        environmental = @base.valid? && @environmental&.valid?
-        full = @base.valid? && @temporal&.valid? && @environmental&.valid?
-        base || temporal || environmental || full
+        entered_keys = @properties.collect { |p| p[:name] }
+        return false if (entered_keys - allowed_abbreviations).size.positive?
+
+        check_metrics_validity
       else
         false
       end
@@ -46,5 +45,17 @@ module CvssSuite
 
       base_score
     end
+
+    private
+
+    def allowed_abbreviations
+      @base.properties.collect(&:abbreviation) +
+        @temporal.properties.collect(&:abbreviation) +
+        @environmental.properties.collect(&:abbreviation)
+    end
+
+    def check_metrics_validity
+      @base.valid? && @temporal&.valid? && @environmental&.valid?
+    end
   end
 end

data/lib/cvss_suite/cvss_metric.rb

@@ -44,7 +44,7 @@ module CvssSuite
         end
         property&.set_selected_value selected_property[:selected]
       end
-      @properties.reject(&:valid?).each(&:set_default_value)
+      @properties.select(&:non_selected?).each(&:set_default_value)
     end
   end
 end

data/lib/cvss_suite/cvss_property.rb

@@ -58,7 +58,7 @@ module CvssSuite
     # Returns true if the property is valid.
 
     def valid?
-      !@selected_value.nil?
+      !@selected_value.nil? && @property[:values].map { |p| p[:abbreviation] }.include?(@selected_value[:abbreviation])
     end
 
     ##
@@ -76,6 +76,9 @@ module CvssSuite
         value[:selected] = selected_value.eql?(value[:abbreviation])
       end
       @selected_value = values.detect { |value| value[:selected] }
+      return unless @selected_value.nil?
+
+      @selected_value = { abbreviation: selected_value }
     end
 
     ##
@@ -84,8 +87,16 @@ module CvssSuite
     def set_default_value
       values.each do |value|
         value[:selected] = value[:abbreviation].eql?('X')
+        value[:selected] ||= value[:abbreviation].eql?('ND')
       end
       @selected_value = values.detect { |value| value[:selected] }
     end
+
+    ##
+    # Returns whether a selected_value is set
+
+    def non_selected?
+      @selected_value.nil?
+    end
   end
 end

data/lib/cvss_suite/version.rb

@@ -4,5 +4,5 @@
 # See the LICENSE.md file in the top-level directory.
 
 module CvssSuite
-  VERSION = '3.2.1'.freeze
+  VERSION = '3.2.2'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cvss-suite
 version: !ruby/object:Gem::Version
-  version: 3.2.1
+  version: 3.2.2
 platform: ruby
 authors:
 - 0llirocks
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-05-25 00:00:00.000000000 Z
+date: 2024-08-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -150,7 +150,7 @@ licenses:
 metadata:
   bug_tracker_uri: https://github.com/0llirocks/cvss-suite/issues
   changelog_uri: https://github.com/0llirocks/cvss-suite/blob/master/CHANGES.md
-  documentation_uri: https://www.rubydoc.info/gems/cvss-suite/3.2.1
+  documentation_uri: https://www.rubydoc.info/gems/cvss-suite/3.2.2
   homepage_uri: https://cvss-suite.0lli.rocks
   source_code_uri: https://github.com/0llirocks/cvss-suite
 post_install_message: