dradis-calculator_cvss 4.19.0 → 5.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f4cb44d80784997ffd2cf5416fb4687d521f3bc30753e7f4a60edeb1f5be59d1
-  data.tar.gz: 80bba699853b1b173eaafd9d069df3a96a8bb8cc23a0d0f2d117b4ea1402f4f0
+  metadata.gz: 6a1a2072b667c860a4b3fd935ab8fb241f6c36a0650572ded51717a2787942c7
+  data.tar.gz: f39277db07d072d179b1951c97d32ffc2c8f2e4ddf527156213ace741ee20fc8
 SHA512:
-  metadata.gz: ec893d5419528c35558cfe18c5866dc4933fc0b30fbfa99d245fbbcea3f300a53a5f042df6a90cd3f35cbbb35beabd3029a1ee18ac18ce2128378aefa06f0253
-  data.tar.gz: 7a955f2ab965190472befb591deadde143ba16b2fa024d6825b290f1582b52d0d7c67f1ac89105b60b0a83b1ba4e57fee871e94b88f3096c6affb8c565121af2
+  metadata.gz: 95956efbf3a2a1fe8552c7695641700ce136d9b16acbc911f8f515ca1d5b6d8b3141ca9527255c602da85027efdce716a9ad97b6c4dc46e392378de3aa3ccb9a
+  data.tar.gz: 89c187a8dc111632c4458d362f7c9e3e975fe2d782f00410530bfbca6c96935a79a221a2775ab28d127aab67b282f1d054715fc2eee86808e02f92249f6ceb9f

data/CHANGELOG.md

@@ -1,3 +1,13 @@
+v5.1.0 (May 2026)
+  - No changes
+
+v5.0.0 (March 2026)
+  - No changes
+
+v4.20.0 (Month 2026)
+  - Calculator: Remove extra click to access the calculator
+  - CVSSv4: configure fields you care about
+
 v4.19.0 (November 2025)
   - No changes
 

data/app/assets/javascripts/dradis/plugins/calculators/cvss/v4/calculator.js

@@ -31,26 +31,54 @@ class CVSS4Calculator {
 
 class CVSS40Calculator extends CVSS4Calculator {
   constructor() {
-    super()
+    super();
 
     this.app = cvss_v4_app();
+    this.updateFieldList();
+    this.bindFieldSwitches();
     this.calculate();
   }
 
+  updateFieldList() {
+    const switches = $('[data-behavior=cvss4-field-switch]');
+    if (switches.length) {
+      this.fieldList = [];
+      switches.filter(':checked').each((_, el) => {
+        this.fieldList.push($(el).data('field-name'));
+      });
+    } else {
+      this.fieldList = Object.keys(this.fieldMap());
+    }
+  }
+
+  bindFieldSwitches() {
+    $('[data-behavior=cvss4-field-switch]').on('change', () => {
+      this.updateFieldList();
+      this.setResult();
+    });
+
+    $('[data-behavior=form-select-all], [data-behavior=form-select-none]').on('click', () => {
+      this.updateFieldList();
+      this.setResult();
+    });
+  }
+
   calculate() {
     const regex = / \(.+?\)/i;
 
     $('input[type=submit]').attr('disabled', null);
 
     const that = this;
-    $('[data-cvss-metrics] .btn-group').each(function(){
+    $('[data-cvss-metrics] .btn-group').each(function () {
       const selected = $(this).find('[data-cvss-option].active');
 
       if (selected.length == 1) {
-        that.app.cvssSelected[selected.attr('name').toUpperCase()] = selected.attr('value');
+        that.app.cvssSelected[selected.attr('name').toUpperCase()] =
+          selected.attr('value');
 
         const label = selected.data('cvss-option');
-        that.app.cvssSelectedValue[selected.attr('name').toUpperCase()] = label.replace(regex, '');
+        that.app.cvssSelectedValue[selected.attr('name').toUpperCase()] =
+          label.replace(regex, '');
       }
     });
 
@@ -63,106 +91,126 @@ class CVSS40Calculator extends CVSS4Calculator {
     let baseVector = 'CVSS:4.0';
     const that = this;
 
-    Object.keys(expectedMetricOrder).forEach(function(metric) {
-      if (that.app.cvssSelected[metric] && that.app.cvssSelected[metric] != 'X') {
-        baseVector += `/${metric}:${that.app.cvssSelected[metric]}`
+    Object.keys(expectedMetricOrder).forEach(function (metric) {
+      if (
+        that.app.cvssSelected[metric] &&
+        that.app.cvssSelected[metric] != 'X'
+      ) {
+        baseVector += `/${metric}:${that.app.cvssSelected[metric]}`;
       }
-    })
+    });
 
     return baseVector;
   }
 
+  fieldMap() {
+    return {
+      'CVSSv4.BaseVector': () => this.baseVector(),
+      'CVSSv4.BaseScore': () => this.app.score(),
+      'CVSSv4.BaseSeverity': () => this.app.qualScore(),
+
+      'CVSSv4.MacroVector': () => this.app.macroVector(),
+      'CVSSv4.Exploitability': () =>
+        cvssMacroVectorValues[
+          this.app.macroVector()[cvssMacroVectorDetails['Exploitability']]
+        ],
+      'CVSSv4.Complexity': () =>
+        cvssMacroVectorValues[
+          this.app.macroVector()[cvssMacroVectorDetails['Complexity']]
+        ],
+      'CVSSv4.VulnerableSystem': () =>
+        cvssMacroVectorValues[
+          this.app.macroVector()[cvssMacroVectorDetails['VulnerableSystem']]
+        ],
+      'CVSSv4.SubsequentSystem': () =>
+        cvssMacroVectorValues[
+          this.app.macroVector()[cvssMacroVectorDetails['SubsequentSystem']]
+        ],
+      'CVSSv4.Exploitation': () =>
+        cvssMacroVectorValues[
+          this.app.macroVector()[cvssMacroVectorDetails['Exploitation']]
+        ],
+      'CVSSv4.SecurityRequirements': () =>
+        cvssMacroVectorValues[
+          this.app.macroVector()[cvssMacroVectorDetails['SecurityRequirements']]
+        ],
+
+      'CVSSv4.BaseExploitableAttackVector': () =>
+        this.app.cvssSelectedValue['AV'],
+      'CVSSv4.BaseExploitableAttackComplexity': () =>
+        this.app.cvssSelectedValue['AC'],
+      'CVSSv4.BaseExploitableAttackRequirements': () =>
+        this.app.cvssSelectedValue['AT'],
+      'CVSSv4.BaseExploitablePrivilegesRequired': () =>
+        this.app.cvssSelectedValue['PR'],
+      'CVSSv4.BaseExploitableUserInteraction': () =>
+        this.app.cvssSelectedValue['UI'],
+      'CVSSv4.BaseVulnerableConfidentiality': () =>
+        this.app.cvssSelectedValue['VC'],
+      'CVSSv4.BaseVulnerableIntegrity': () => this.app.cvssSelectedValue['VI'],
+      'CVSSv4.BaseVulnerableAvailability': () =>
+        this.app.cvssSelectedValue['VA'],
+      'CVSSv4.BaseSubsequentConfidentiality': () =>
+        this.app.cvssSelectedValue['SC'],
+      'CVSSv4.BaseSubsequentIntegrity': () => this.app.cvssSelectedValue['SI'],
+      'CVSSv4.BaseSubsequentAvailability': () =>
+        this.app.cvssSelectedValue['SA'],
+
+      'CVSSv4.SupplementalSafety': () => this.app.cvssSelectedValue['S'],
+      'CVSSv4.SupplementalAutomatable': () => this.app.cvssSelectedValue['AU'],
+      'CVSSv4.SupplementalRecovery': () => this.app.cvssSelectedValue['R'],
+      'CVSSv4.SupplementalValueDensity': () => this.app.cvssSelectedValue['V'],
+      'CVSSv4.SupplementalVulnerabilityResponseEffort': () =>
+        this.app.cvssSelectedValue['RE'],
+      'CVSSv4.SupplementalProviderUrgency': () =>
+        this.app.cvssSelectedValue['U'],
+      'CVSSv4.EnvironmentalExploitabilityAttackVector': () =>
+        this.app.cvssSelectedValue['MAV'],
+      'CVSSv4.EnvironmentalExploitabilityAttackComplexity': () =>
+        this.app.cvssSelectedValue['MAC'],
+      'CVSSv4.EnvironmentalExploitabilityAttackRequirements': () =>
+        this.app.cvssSelectedValue['MAT'],
+      'CVSSv4.EnvironmentalExploitabilityPrivilegesRequired': () =>
+        this.app.cvssSelectedValue['MPR'],
+      'CVSSv4.EnvironmentalExploitabilityUserInteraction': () =>
+        this.app.cvssSelectedValue['MUI'],
+      'CVSSv4.EnvironmentalVulnerableConfidentiality': () =>
+        this.app.cvssSelectedValue['MVC'],
+      'CVSSv4.EnvironmentalVulnerableIntegrity': () =>
+        this.app.cvssSelectedValue['MVI'],
+      'CVSSv4.EnvironmentalVulnerableAvailability': () =>
+        this.app.cvssSelectedValue['MVA'],
+      'CVSSv4.EnvironmentalSubsequentConfidentiality': () =>
+        this.app.cvssSelectedValue['MSC'],
+      'CVSSv4.EnvironmentalSubsequentIntegrity': () =>
+        this.app.cvssSelectedValue['MSI'],
+      'CVSSv4.EnvironmentalSubsequentAvailability': () =>
+        this.app.cvssSelectedValue['MSA'],
+      'CVSSv4.EnvironmentalConfidentialityRequirements': () =>
+        this.app.cvssSelectedValue['CR'],
+      'CVSSv4.EnvironmentalIntegrityRequirements': () =>
+        this.app.cvssSelectedValue['IR'],
+      'CVSSv4.EnvironmentalAvailabilityRequirements': () =>
+        this.app.cvssSelectedValue['AR'],
+      'CVSSv4.ThreatExploitMaturity': () => this.app.cvssSelectedValue['E'],
+    };
+  }
   setResult() {
-    let issue_cvss = ''
+    let issue_cvss = '';
 
-    issue_cvss += "#[CVSSv4.BaseVector]#\n"
-    issue_cvss += `${this.baseVector()}\n\n`
-    issue_cvss += "#[CVSSv4.BaseScore]#\n"
-    issue_cvss += `${this.app.score()}\n\n`
-    issue_cvss += "#[CVSSv4.BaseSeverity]#\n"
-    issue_cvss += `${this.app.qualScore()}\n\n`
+    for (const [name, getValue] of Object.entries(this.fieldMap())) {
+      const value = getValue();
 
-    issue_cvss += "#[CVSSv4.MacroVector]#\n";
-    issue_cvss += `${this.app.macroVector()}\n\n`
+      $(`[data-behavior=cvss4-field-value][data-field-name="${name}"]`).text(value);
 
-    const that = this;
-    [
-      'Exploitability', 'Complexity', 'VulnerableSystem', 'SubsequentSystem',
-      'Exploitation', 'SecurityRequirements'
-    ].forEach(function(macroMetric) {
-      issue_cvss += "#[CVSSv4." + macroMetric + "]#\n"
-      issue_cvss += cvssMacroVectorValues[that.app.macroVector()[cvssMacroVectorDetails[macroMetric]]] + "\n\n"
-    });
+      if (this.fieldList.includes(name)) {
+        issue_cvss += `#[${name}]#\n${value}\n\n`;
+      }
+    }
 
-    issue_cvss += "#[CVSSv4.BaseExploitableAttackVector]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['AV']}\n\n`
-    issue_cvss += "#[CVSSv4.BaseExploitableAttackComplexity]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['AC']}\n\n`
-    issue_cvss += "#[CVSSv4.BaseExploitableAttackRequirements]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['AT']}\n\n`
-    issue_cvss += "#[CVSSv4.BaseExploitablePrivilegesRequired]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['PR']}\n\n`
-    issue_cvss += "#[CVSSv4.BaseExploitableUserInteraction]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['UI']}\n\n`
-    issue_cvss += "#[CVSSv4.BaseVulnerableConfidentiality]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['VC']}\n\n`
-    issue_cvss += "#[CVSSv4.BaseVulnerableIntegrity]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['VI']}\n\n`
-    issue_cvss += "#[CVSSv4.BaseVulnerableAvailability]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['VA']}\n\n`
-    issue_cvss += "#[CVSSv4.BaseSubsequentConfidentiality]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['SC']}\n\n`
-    issue_cvss += "#[CVSSv4.BaseSubsequentIntegrity]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['SI']}\n\n`
-    issue_cvss += "#[CVSSv4.BaseSubsequentAvailability]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['SA']}\n\n`
-
-    issue_cvss += "#[CVSSv4.SupplementalSafety]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['S']}\n\n`
-    issue_cvss += "#[CVSSv4.SupplementalAutomatable]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['AU']}\n\n`
-    issue_cvss += "#[CVSSv4.SupplementalRecovery]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['R']}\n\n`
-    issue_cvss += "#[CVSSv4.SupplementalValueDensity]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['V']}\n\n`
-    issue_cvss += "#[CVSSv4.SupplementalVulnerabilityResponseEffort]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['RE']}\n\n`
-    issue_cvss += "#[CVSSv4.SupplementalProviderUrgency]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['U']}\n\n`
-
-    issue_cvss += "#[CVSSv4.EnvironmentalExploitabilityAttackVector]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['MAV']}\n\n`
-    issue_cvss += "#[CVSSv4.EnvironmentalExploitabilityAttackComplexity]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['MAC']}\n\n`
-    issue_cvss += "#[CVSSv4.EnvironmentalExploitabilityAttackRequirements]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['MAT']}\n\n`
-    issue_cvss += "#[CVSSv4.EnvironmentalExploitabilityPrivilegesRequired]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['MPR']}\n\n`
-    issue_cvss += "#[CVSSv4.EnvironmentalExploitabilityUserInteraction]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['MUI']}\n\n`
-    issue_cvss += "#[CVSSv4.EnvironmentalVulnerableConfidentiality]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['MVC']}\n\n`
-    issue_cvss += "#[CVSSv4.EnvironmentalVulnerableIntegrity]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['MVI']}\n\n`
-    issue_cvss += "#[CVSSv4.EnvironmentalVulnerableAvailability]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['MVA']}\n\n`
-    issue_cvss += "#[CVSSv4.EnvironmentalSubsequentConfidentiality]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['MSC']}\n\n`
-    issue_cvss += "#[CVSSv4.EnvironmentalSubsequentIntegrity]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['MSI']}\n\n`
-    issue_cvss += "#[CVSSv4.EnvironmentalSubsequentAvailability]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['MSA']}\n\n`
-    issue_cvss += "#[CVSSv4.EnvironmentalConfidentialityRequirements]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['CR']}\n\n`
-    issue_cvss += "#[CVSSv4.EnvironmentalIntegrityRequirements]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['IR']}\n\n`
-    issue_cvss += "#[CVSSv4.EnvironmentalAvailabilityRequirements]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['AR']}\n\n`
-
-    issue_cvss += "#[CVSSv4.ThreatExploitMaturity]#\n"
-    issue_cvss += `${this.app.cvssSelectedValue['E']}\n\n`
-
-    $('[data-behavior=cvss4-result-text] textarea').val(issue_cvss)
-    $('[data-behavior=cvss4-result]').html(this.app.score() + ' (' + this.app.qualScore() + ')')
+    $('[data-behavior=cvss4-result-text] textarea').val(issue_cvss);
+    $('[data-behavior=cvss4-result]').html(
+      this.app.score() + ' (' + this.app.qualScore() + ')',
+    );
   }
 }

data/app/controllers/dradis/plugins/calculators/cvss/issues_controller.rb

@@ -3,17 +3,23 @@ module Dradis::Plugins::Calculators::CVSS
   class IssuesController < ::IssuesController
     before_action :set_cvss_version, only: :edit
     before_action :set_cvss_vector, only: :edit
+    before_action :set_v4_field_groups, only: :edit
 
     skip_before_action :remove_unused_state_param
 
     def edit; end
 
     def update
-      cvss_fields = Hash[ *params[:cvss_fields].scan(FieldParser::FIELDS_REGEX).flatten.map(&:strip) ]
+      cvss_fields = Hash[*params[:cvss_fields].scan(FieldParser::FIELDS_REGEX).flatten.map(&:strip)]
       cvss_fields.each do |name, value|
         @issue.set_field(name, value)
       end
 
+      existing_v4_fields = @issue.fields.keys & V4::FIELDS
+      (existing_v4_fields - cvss_fields.keys).each do |name|
+        @issue.delete_field(name)
+      end
+
       if @issue.save
         redirect_to main_app.project_issue_path(current_project, @issue), notice: 'CVSS fields updated.'
       else
@@ -28,34 +34,53 @@ module Dradis::Plugins::Calculators::CVSS
       @cvss3_vector = Hash.new { |h, k| h[k] = 'X' }
       @cvss4_vector = Dradis::Plugins::Calculators::CVSS::V4::DEFAULT_CVSS_V4.clone
       field_value_v3 = @issue.fields['CVSSv3.Vector'] || @issue.fields['CVSSv3Vector']
-      field_value_v4  = @issue.fields['CVSSv4.BaseVector']
+      field_value_v4 = @issue.fields['CVSSv4.BaseVector']
 
       # If no vector is set yet, that's OK
       return if field_value_v3.blank? && field_value_v4.blank?
 
       if field_value_v3
         if field_value_v3 =~ V3::VECTOR_REGEXP
-          field_value_v3.split('/').each { |pair| @cvss3_vector.store *pair.split(':') }
+          field_value_v3.split('/').each { |pair| @cvss3_vector.store(*pair.split(':')) }
         else
-          redirect_to main_app.project_issue_path(current_project, @issue), alert: 'The format of the CVSSv3 Vector field is invalid.'
+          redirect_to main_app.project_issue_path(current_project, @issue),
+                      alert: 'The format of the CVSSv3 Vector field is invalid.'
         end
       end
 
-      if field_value_v4
-        if field_value_v4.starts_with?('CVSS:4.0')
-          field_value_v4.split('/').each { |pair| @cvss4_vector.store *pair.split(':') }
-        else
-          redirect_to main_app.project_issue_path(current_project, @issue), alert: 'The format of the CVSSv4 Vector field is invalid.'
+      return unless field_value_v4
+
+      if field_value_v4.starts_with?('CVSS:4.0')
+        field_value_v4.split('/').each { |pair| @cvss4_vector.store(*pair.split(':')) }
+      else
+        redirect_to main_app.project_issue_path(current_project, @issue),
+                    alert: 'The format of the CVSSv4 Vector field is invalid.'
+      end
+    end
+
+    def set_v4_field_groups
+      default_fields = Engine.settings.v4_fields.split(',')
+      existing_fields = @issue.fields.keys.select { |k| k.start_with?('CVSSv4.') }
+      @enabled_fields = existing_fields.any? ? existing_fields : default_fields
+
+      @v4_field_groups = V4::FIELDS.group_by do |field|
+        name = field.sub('CVSSv4.', '')
+        case name
+        when 'BaseVector', 'BaseScore', 'BaseSeverity' then 'Score'
+        when /^Base/ then 'Base Metrics'
+        when /^Supplemental/ then 'Supplemental'
+        when /^Environmental/ then 'Environmental'
+        when /^Threat/ then 'Threat'
+        else 'Macro Vector'
         end
       end
     end
 
     def set_cvss_version
       @cvss_version =
-        case
-        when @issue.fields['CVSSv3.Vector']&.include?('CVSS:3.1')
+        if @issue.fields['CVSSv3.Vector']&.include?('CVSS:3.1')
           '3.1'
-        when @issue.fields['CVSSv3.Vector']&.include?('CVSS:3.0')
+        elsif @issue.fields['CVSSv3.Vector']&.include?('CVSS:3.0')
           '3.0'
         else
           '4.0'

data/app/views/dradis/plugins/calculators/cvss/_tools_menu.html.erb

@@ -1,5 +1,3 @@
-<% unless defined?(Dradis::Pro) && current_user.role?(:contributor) %>
-  <li>
-    <%= link_to 'Risk Calculators - CVSS', cvss_calculator.calculators_cvss_path, class: 'dropdown-item', data: { turbolinks: false } %>
-  </li>
-<% end %>
+<li>
+  <%= link_to 'Risk Calculators - CVSS', cvss_calculator.calculators_cvss_path, class: 'dropdown-item', data: { turbolinks: false } %>
+</li>

data/app/views/dradis/plugins/calculators/cvss/issues/_show-tabs.html.erb

@@ -1,3 +1,5 @@
 <li class="nav-item">
-  <a href="#cvss-tab" data-bs-toggle="tab" class="nav-link"><i class="fa-solid fa-calculator"></i> CVSS</a>
+  <%= link_to cvss_calculator.cvss_project_issue_path(current_project, @issue), class: 'nav-link' do %>
+    <i class="fa-solid fa-calculator"></i> CVSS
+  <% end %>
 </li>

data/app/views/dradis/plugins/calculators/cvss/issues/edit/_v3.html.erb

@@ -83,7 +83,7 @@ N/A
       </div>
     </div>
 
-    <div class="form-actions">
+    <div class="form-actions sticky">
       <%= f.button :submit, nil, class: 'btn btn-primary' %> or
       <%= link_to 'Cancel', main_app.project_issue_path(current_project, @issue), class: 'cancel-link' %>
     </div>

data/app/views/dradis/plugins/calculators/cvss/issues/edit/_v4.html.erb

@@ -1,4 +1,8 @@
-<div class="inner note-text-inner d-none" data-cvss-version="4">
+<div
+  class="inner note-text-inner d-none"
+  data-behavior="cvss-v4-calculator"
+  data-cvss-version="4"
+>
 
   <%= simple_form_for [:cvss, current_project, @issue] do |f| %>
 
@@ -39,63 +43,36 @@
       </div>
 
       <div class="tab-pane" id="cvss4-edit-result" data-behavior="cvss4-result-text">
-        <textarea class="form-control" name="cvss_fields" rows="10" style="width:95%">#[CVSSv4.Vector]#
-N/A
+        <p>Toggle the fields you'd like to include in the issue content. Defaults can be set in the <%= link_to 'Configuration Manager', main_app.project_configurations_path %>.</p>
+        <div class="mb-2">
+          <a href="javascript:void(0)" data-behavior="form-select-all">Select all</a>
+          - <a href="javascript:void(0)" data-behavior="form-select-none">Deselect all</a>
+        </div>
+        <% @v4_field_groups.each do |group_name, fields| %>
+          <div class="mb-3">
+            <h6 class="mb-2"><%= group_name %></h6>
+            <% fields.each do |field| %>
+              <div class="form-check form-switch mb-2">
+                <input class="form-check-input"
+                       type="checkbox"
+                       role="switch"
+                       id="cvss4-field-<%= field.parameterize %>"
+                       data-behavior="cvss4-field-switch"
+                       data-field-name="<%= field %>"
+                       <%= 'checked' if @enabled_fields.include?(field) || field == 'CVSSv4.BaseVector' %>
+                       <%= 'disabled' if field == 'CVSSv4.BaseVector' %>>
+                <label class="form-check-label<%= ' opacity-100' if field == 'CVSSv4.BaseVector' %>" for="cvss4-field-<%= field.parameterize %>"><%= field %></label>
+                <p class="small mb-0" data-behavior="cvss4-field-value" data-field-name="<%= field %>"></p>
+              </div>
+            <% end %>
+          </div>
+        <% end %>
 
-#[CVSSv4.BaseScore]#
-N/A
-
-#[CVSSv4.BaseSeverity]#
-N/A
-
-#[CVSSv4.MacroVector]#
-#[CVSSv4.Expoitability]#
-#[CVSSv4.Complexity]#
-#[CVSSv4.VulnerableSystem]#
-#[CVSSv4.SubsequentSystem]#
-#[CVSSv4.Exploitation]#
-#[CVSSv4.SecurityRequirements]#
-
-#[CVSSv4.BaseExploitableAttackVector]#
-#[CVSSv4.BaseExploitableAttackComplexity]#
-#[CVSSv4.BaseExploitableAttackRequirements]#
-#[CVSSv4.BaseExploitablePrivilegesRequired]#
-#[CVSSv4.BaseExploitableUserInteraction]#
-#[CVSSv4.BaseVulnerableConfidentiality]#
-#[CVSSv4.BaseVulnerableIntegrity]#
-#[CVSSv4.BaseVulnerableAvailability]#
-#[CVSSv4.BaseSubsequentConfidentiality]#
-#[CVSSv4.BaseSubsequentIntegrity]#
-#[CVSSv4.BaseSubsequentAvailability]#
-
-#[CVSSv4.SupplementalSafety]#
-#[CVSSv4.SupplementalAutomatable]#
-#[CVSSv4.SupplementalRecovery]#
-#[CVSSv4.SupplementalValueDensity]#
-#[CVSSv4.SupplementalVulnerabilityResponseEffort]#
-#[CVSSv4.SupplementalProviderUrgency]#
-
-#[CVSSv4.EnvironmentalExploitabilityAttackVector]#
-#[CVSSv4.EnvironmentalExploitabilityAttackComplexity]#
-#[CVSSv4.EnvironmentalExploitabilityAttackRequirements]#
-#[CVSSv4.EnvironmentalExploitabilityPrivilegesRequired]#
-#[CVSSv4.EnvironmentalExploitabilityUserInteraction]#
-#[CVSSv4.EnvironmentalVulnerableConfidentiality]#
-#[CVSSv4.EnvironmentalVulnerableIntegrity]#
-#[CVSSv4.EnvironmentalVulnerableAvailability]#
-#[CVSSv4.EnvironmentalSubsequentConfidentiality]#
-#[CVSSv4.EnvironmentalSubsequentIntegrity]#
-#[CVSSv4.EnvironmentalSubsequentAvailability]#
-#[CVSSv4.EnvironmentalConfidentialityRequirements]#
-#[CVSSv4.EnvironmentalIntegrityRequirements]#
-#[CVSSv4.EnvironmentalAvailabilityRequirements]#
-
-#[CVSSv4.ThreatExploitMaturity]#
-        </textarea>
+        <textarea class="d-none" name="cvss_fields"></textarea>
       </div>
     </div>
 
-    <div class="form-actions">
+    <div class="form-actions sticky">
       <%= f.button :submit, nil, class: 'btn btn-primary' %> or
       <%= link_to 'Cancel', main_app.project_issue_path(current_project, @issue), class: 'cancel-link' %>
     </div>

data/dradis-calculator_cvss.gemspec

@@ -19,7 +19,7 @@ Gem::Specification.new do |spec|
   spec.executables = spec.files.grep(%r{^bin/}).map { |f| File.basename(f) }
   spec.test_files = spec.files.grep(%r{^(test|spec|features)/})
 
-  spec.add_dependency 'dradis-plugins', '~> 4.0'
+  spec.add_dependency 'dradis-plugins', '>= 4.0'
 
   spec.add_development_dependency 'bundler', '~> 2.0'
   spec.add_development_dependency 'rake', '~> 10.0'

data/lib/dradis/plugins/calculators/cvss/engine.rb

@@ -6,6 +6,10 @@ module Dradis::Plugins::Calculators::CVSS
     provides :addon
     description 'Risk Calculator: CVSS'
 
+    addon_settings :cvss do
+      settings.default_v4_fields = 'CVSSv4.BaseVector,CVSSv4.BaseScore,CVSSv4.BaseSeverity'
+    end
+
     initializer 'calculator_cvss.asset_precompile_paths' do |app|
       app.config.assets.precompile += [
         'dradis/plugins/calculators/cvss/base.css',
@@ -22,13 +26,11 @@ module Dradis::Plugins::Calculators::CVSS
     end
 
     initializer 'calculator_cvss.mount_engine' do
-      Rails.application.reloader.to_prepare do
-        Rails.application.routes.append do
-          # Enabling/disabling integrations calls Rails.application.reload_routes! we need the enable
-          # check inside the block to ensure the routes can be re-enabled without a server restart
-          if Engine.enabled?
-            mount Engine => '/', as: :cvss_calculator
-          end
+      Rails.application.routes.append do
+        # Enabling/disabling integrations calls Rails.application.reload_routes! we need the enable
+        # check inside the block to ensure the routes can be re-enabled without a server restart
+        if Engine.enabled?
+          mount Engine => '/', as: :cvss_calculator
         end
       end
     end

data/lib/dradis/plugins/calculators/cvss/gem_version.rb

@@ -8,8 +8,8 @@ module Dradis
         end
 
         module VERSION
-          MAJOR = 4
-          MINOR = 19
+          MAJOR = 5
+          MINOR = 1
           TINY = 0
           PRE = nil
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dradis-calculator_cvss
 version: !ruby/object:Gem::Version
-  version: 4.19.0
+  version: 5.1.0
 platform: ruby
 authors:
 - Daniel Martin
@@ -13,14 +13,14 @@ dependencies:
   name: dradis-plugins
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '4.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '4.0'
 - !ruby/object:Gem::Dependency
@@ -100,7 +100,6 @@ files:
 - app/views/dradis/plugins/calculators/cvss/base/v4/_index.html.erb
 - app/views/dradis/plugins/calculators/cvss/base/v4/_supplemental.html.erb
 - app/views/dradis/plugins/calculators/cvss/base/v4/_threat.html.erb
-- app/views/dradis/plugins/calculators/cvss/issues/_show-content.html.erb
 - app/views/dradis/plugins/calculators/cvss/issues/_show-tabs.html.erb
 - app/views/dradis/plugins/calculators/cvss/issues/edit.html.erb
 - app/views/dradis/plugins/calculators/cvss/issues/edit/_v3.html.erb

data/app/views/dradis/plugins/calculators/cvss/issues/_show-content.html.erb

@@ -1,34 +0,0 @@
-<div class="tab-pane" id="cvss-tab">
-  <div class="inner">
-    <h4 class="header-underline">CVSS Risk Scoring -
-      <span class="actions">
-        <%= link_to cvss_calculator.cvss_project_issue_path(current_project, @issue) do %>
-          <i class="fa-solid fa-pencil"></i> Edit
-        <% end %>
-    </h4>
-
-    <div class="mb-4 content-textile">
-      <% if @issue.fields['CVSSv4.BaseVector'] %>
-        <%=
-          markup(
-            @issue.fields
-              .select { |k,v| Dradis::Plugins::Calculators::CVSS::V4::FIELDS.include?(k) }
-              .map { |k,v| "#[#{k}]#\n#{v}" }.join("\n\n")
-          )
-        %>
-      <% end%>
-
-      <br>
-
-      <% if @issue.fields['CVSSv3.Vector'] %>
-        <%=
-          markup(
-            @issue.fields
-              .select { |k,v| Dradis::Plugins::Calculators::CVSS::V3::FIELDS.include?(k) }
-              .map { |k,v| "#[#{k}]#\n#{v}" }.join("\n\n")
-          )
-        %>
-      <% end %>
-    </div>
-  </div>
-</div>