cvss-suite 3.2.1 → 3.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c13e3d336237b452f735f78972b31520c80115b7451bf81287f72a3b4b76d65a
-  data.tar.gz: fbbc06267f44b3ae4ddbafe5c0c3c2a50eeecec08dd95c1a3edb20ec15765307
+  metadata.gz: 773b87ded42d73797271e4dd4c05a261b69bc957295fe75654084f4edf4a4521
+  data.tar.gz: e5ecc4e25e13cc8663ca12cbb8b065246ee25b0e44fbfb6bfdbbfdb61ef16b61
 SHA512:
-  metadata.gz: 7a4255bb0a792743a9013763620a5c93d3530ebbbd760d915f20569693ec85ff3cd44744b5aa19ef356fd6555fec935c4f8191d2844e61ee533662094379090f
-  data.tar.gz: aa99f6949546a68d0145a7a964d8188ca07fd8c6cde4b8d9df6fa1d324410f2ca3a98c3c38e875f44d84b388a0ee6f5e33ca1db0deab1447c7da325d9dc9654a
+  metadata.gz: 3538af971b672a09547bc6f1286714876c7fe4ee61d19d4fddfaf961c42b014040cabd4259c0e22cb177064109d877a7339101ff7258afeb1b3ed937ed3cc516
+  data.tar.gz: 8b3ffb3367ee5437b1ee0026ca7f1677da233c844124455886c580cb2cedc5cd0b72c712a920741dc942600fc58a99c4f88f3c6c3b23ae750c962e6cc3ba1907

data/.rspec

@@ -1,2 +1,3 @@
 --format documentation
 --color
+--warning

data/CHANGES.md

@@ -2,6 +2,14 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## [3.2.2] - 2024-08-04
+
+### Fixes
+* Add extra CVSS vector validations for 3.1 and lower. Fixes [#41](https://github.com/0llirocks/cvss-suite/issues/41)
+
+### Notes
+* An invalid value like E:R (R doesn't exists) now counts as invalid, resulting in an invalid vector. In <= 3.2.1 an invalid value would be ignored/counted as default value.
+
 ## [3.2.1] - 2024-05-25
 
 ### Fixes

data/CODE_OF_CONDUCT.md

@@ -1,17 +1,5 @@
 CVSS-Suite, a Ruby gem to manage the CVSS vector
 
-Copyright (c) 2016-2022 Siemens AG
-Copyright (c) 2022-2024 0llirocks
-
-Author: 0llirocks <https://github.com/0llirocks>
-
-Contributors:
-    Florian Wininger <https://github.com/fwininger>
-    Adam David <https://github.com/adamrdavid>
-    Alexandre Zanni <https://github.com/noraj>
-    joePedantic <https://github.com/joePedantic>
-    Brandyn Phelps <https://github.com/brphelps>
-
 This work is licensed under the terms of the MIT license.
 See the LICENSE.md file in the top-level directory.
 

data/LICENSE.md

@@ -1,16 +1,17 @@
 The MIT License (MIT)
 
-Copyright (c) 2016-2022 Siemens AG
+Copyright (c) 2016-2022 Siemens AG\
 Copyright (c) 2022-2024 0llirocks
 
-Authors:
-   0llirocks <https://github.com/0llirocks>
+Author: 0llirocks <https://github.com/0llirocks>
+
 Contributors:
-    Florian Wininger <https://github.com/fwininger>
-    Adam David <https://github.com/adamrdavid>
-    Alexandre Zanni <https://github.com/noraj>
-    joePedantic <https://github.com/joePedantic>
-    Brandyn Phelps <https://github.com/brphelps>
+- Florian Wininger <https://github.com/fwininger>
+- Adam David <https://github.com/adamrdavid>
+- Alexandre Zanni <https://github.com/noraj>
+- joePedantic <https://github.com/joePedantic>
+- Brandyn Phelps <https://github.com/brphelps>
+- Karim ElGhandour <https://github.com/kghandour>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in

data/lib/cvss_suite/cvss40/cvss40_calc_helper.rb

@@ -351,7 +351,7 @@ module CvssSuite
     end
 
     def concat_and_stringify(first, second, third, fourth, fifth, sixth)
-      ''.concat(first.to_s, second.to_s, third.to_s, fourth.to_s, fifth.to_s, sixth.to_s)
+      String.new.concat(first.to_s, second.to_s, third.to_s, fourth.to_s, fifth.to_s, sixth.to_s)
     end
 
     def sum_or_nil(values)

data/lib/cvss_suite/cvss_31_and_before.rb

@@ -27,11 +27,10 @@ module CvssSuite
     # Returns if CVSS vector is valid.
     def valid?
       if @amount_of_properties >= required_amount_of_properties
-        base = @base.valid?
-        temporal = @base.valid? && @temporal&.valid?
-        environmental = @base.valid? && @environmental&.valid?
-        full = @base.valid? && @temporal&.valid? && @environmental&.valid?
-        base || temporal || environmental || full
+        entered_keys = @properties.collect { |p| p[:name] }
+        return false if (entered_keys - allowed_abbreviations).size.positive?
+
+        check_metrics_validity
       else
         false
       end
@@ -46,5 +45,17 @@ module CvssSuite
 
       base_score
     end
+
+    private
+
+    def allowed_abbreviations
+      @base.properties.collect(&:abbreviation) +
+        @temporal.properties.collect(&:abbreviation) +
+        @environmental.properties.collect(&:abbreviation)
+    end
+
+    def check_metrics_validity
+      @base.valid? && @temporal&.valid? && @environmental&.valid?
+    end
   end
 end

data/lib/cvss_suite/cvss_40_and_later.rb

@@ -41,5 +41,11 @@ module CvssSuite
 
       @all_up.score
     end
+
+    ##
+    # Alias for overall_score.
+    def score
+      overall_score
+    end
   end
 end

data/lib/cvss_suite/cvss_metric.rb

@@ -44,7 +44,7 @@ module CvssSuite
         end
         property&.set_selected_value selected_property[:selected]
       end
-      @properties.reject(&:valid?).each(&:set_default_value)
+      @properties.select(&:non_selected?).each(&:set_default_value)
     end
   end
 end

data/lib/cvss_suite/cvss_property.rb

@@ -58,7 +58,7 @@ module CvssSuite
     # Returns true if the property is valid.
 
     def valid?
-      !@selected_value.nil?
+      !@selected_value.nil? && @property[:values].map { |p| p[:abbreviation] }.include?(@selected_value[:abbreviation])
     end
 
     ##
@@ -76,6 +76,9 @@ module CvssSuite
         value[:selected] = selected_value.eql?(value[:abbreviation])
       end
       @selected_value = values.detect { |value| value[:selected] }
+      return unless @selected_value.nil?
+
+      @selected_value = { abbreviation: selected_value }
     end
 
     ##
@@ -84,8 +87,16 @@ module CvssSuite
     def set_default_value
       values.each do |value|
         value[:selected] = value[:abbreviation].eql?('X')
+        value[:selected] ||= value[:abbreviation].eql?('ND')
       end
       @selected_value = values.detect { |value| value[:selected] }
     end
+
+    ##
+    # Returns whether a selected_value is set
+
+    def non_selected?
+      @selected_value.nil?
+    end
   end
 end

data/lib/cvss_suite/version.rb

@@ -4,5 +4,5 @@
 # See the LICENSE.md file in the top-level directory.
 
 module CvssSuite
-  VERSION = '3.2.1'.freeze
+  VERSION = '3.3.0'.freeze
 end

data/lib/cvss_suite.rb

@@ -27,7 +27,12 @@ module CvssSuite
   def self.new(vector)
     return InvalidCvss.new unless vector.is_a? String
 
-    @vector_string = vector
+    @vector_string = if vector.frozen?
+                       vector.dup
+                     else
+                       vector
+                     end
+
     case version
     when 2
       Cvss2.new(prepare_vector(@vector_string))

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cvss-suite
 version: !ruby/object:Gem::Version
-  version: 3.2.1
+  version: 3.3.0
 platform: ruby
 authors:
 - 0llirocks
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-05-25 00:00:00.000000000 Z
+date: 2024-08-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -150,7 +150,7 @@ licenses:
 metadata:
   bug_tracker_uri: https://github.com/0llirocks/cvss-suite/issues
   changelog_uri: https://github.com/0llirocks/cvss-suite/blob/master/CHANGES.md
-  documentation_uri: https://www.rubydoc.info/gems/cvss-suite/3.2.1
+  documentation_uri: https://www.rubydoc.info/gems/cvss-suite/3.3.0
   homepage_uri: https://cvss-suite.0lli.rocks
   source_code_uri: https://github.com/0llirocks/cvss-suite
 post_install_message: