inspec_tools 2.0.2.pre9 → 2.0.2.pre10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b75aa0b436aae36965200a1ca02ca855c07783b51b554110643eca1b8570a7ee
-  data.tar.gz: bba056d0df721fc0d1c3346193b62eb80c41e61d35e8a11dc1410bf017cf0433
+  metadata.gz: 3cf626f1d93b888c79af9021e808299cb08144fa9d89be83e8243223797df79b
+  data.tar.gz: 5b9b69478c7a11a02366b7fa0a8eeba4abb320e1a5e1338b73923b401bc38b33
 SHA512:
-  metadata.gz: 00cdbaa21811eea1ba654c59f893e59d2d342cad3a0d2ed9007c1029f39e48d649c24b5a45a22eb88218604692ef37a1c3022a0a58c3bd8efe7a8f2f21d1e53f
-  data.tar.gz: 9d4586896d1f87031abe6a3d6c855d88357a2d16cb2af8dda7be6098d20935cd68f9c2f160b909e39d80f1143af9aa507c548c5cfed204cc6ede27477ffc0cc2
+  metadata.gz: 351a6fd25c64e1564a82034f6998cd1a5f5b06b3b915128d0d4d01e65ac7e90b8fb3f92ab48518b86de2d229cde3910be2e4b5a97d0c5a66333a627b19a737cc
+  data.tar.gz: d3f5f6be0e6ac4a61c3cbb3298ea49e36221f3f6c7ed54c213790a3463c8580d0bebab228f81946de3d2f23749e57fadbc0ae7fa7f47d37b062a64082c84be27

data/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 ## [Unreleased](https://github.com/mitre/inspec_tools/tree/HEAD)
 
-[Full Changelog](https://github.com/mitre/inspec_tools/compare/v2.0.2.pre8...HEAD)
+[Full Changelog](https://github.com/mitre/inspec_tools/compare/v2.0.2.pre9...HEAD)
+
+**Implemented enhancements:**
+
+- Standardize Severity Tag on CVSS 3.0 Terms [\#107](https://github.com/mitre/inspec_tools/issues/107)
+
+**Merged pull requests:**
+
+- Standardize Output of Severity and Impact to CVSS v3.0 terms [\#174](https://github.com/mitre/inspec_tools/pull/174) ([Bialogs](https://github.com/Bialogs))
+
+## [v2.0.2.pre9](https://github.com/mitre/inspec_tools/tree/v2.0.2.pre9) (2020-05-04)
+
+[Full Changelog](https://github.com/mitre/inspec_tools/compare/v2.0.2.pre8...v2.0.2.pre9)
 
 **Implemented enhancements:**
 
@@ -157,6 +169,7 @@
 **Merged pull requests:**
 
 - added two digit contol parsing fixes \#117 [\#120](https://github.com/mitre/inspec_tools/pull/120) ([yarick](https://github.com/yarick))
+- Update build/test process to only use GitHub actions [\#115](https://github.com/mitre/inspec_tools/pull/115) ([Bialogs](https://github.com/Bialogs))
 
 ## [v1.8.9](https://github.com/mitre/inspec_tools/tree/v1.8.9) (2020-03-30)
 
@@ -190,10 +203,6 @@
 
 - GitHub Actions Build Matrix [\#112](https://github.com/mitre/inspec_tools/issues/112)
 
-**Merged pull requests:**
-
-- Update build/test process to only use GitHub actions [\#115](https://github.com/mitre/inspec_tools/pull/115) ([Bialogs](https://github.com/Bialogs))
-
 ## [v1.8.5](https://github.com/mitre/inspec_tools/tree/v1.8.5) (2020-03-27)
 
 [Full Changelog](https://github.com/mitre/inspec_tools/compare/v1.8.4...v1.8.5)
@@ -297,7 +306,6 @@
 **Merged pull requests:**
 
 - Remove warnings \(\#minor\) [\#101](https://github.com/mitre/inspec_tools/pull/101) ([Bialogs](https://github.com/Bialogs))
-- Update github workflows [\#99](https://github.com/mitre/inspec_tools/pull/99) ([Bialogs](https://github.com/Bialogs))
 
 ## [v1.6.21](https://github.com/mitre/inspec_tools/tree/v1.6.21) (2020-03-20)
 
@@ -323,6 +331,10 @@
 
 [Full Changelog](https://github.com/mitre/inspec_tools/compare/v1.6.18...v1.6.19)
 
+**Merged pull requests:**
+
+- Update github workflows [\#99](https://github.com/mitre/inspec_tools/pull/99) ([Bialogs](https://github.com/Bialogs))
+
 ## [v1.6.18](https://github.com/mitre/inspec_tools/tree/v1.6.18) (2020-03-16)
 
 [Full Changelog](https://github.com/mitre/inspec_tools/compare/v1.6.17...v1.6.18)

data/lib/inspec_tools/csv.rb

@@ -90,7 +90,10 @@ module InspecTools
         @mapping['control.tags'].each do |tag|
           control['tags'][tag.first.to_s] = row[tag.last] unless row[tag.last].nil?
         end
-        control['impact'] = Utils::InspecUtil.get_impact(row[@mapping['control.tags']['severity']]) unless @mapping['control.tags']['severity'].nil? || row[@mapping['control.tags']['severity']].nil?
+        unless @mapping['control.tags']['severity'].nil? || row[@mapping['control.tags']['severity']].nil?
+          control['impact'] = Utils::InspecUtil.get_impact(row[@mapping['control.tags']['severity']])
+          control['tags']['severity'] = Utils::InspecUtil.get_impact_string(control['impact'])
+        end
         @controls << control
       end
     end

data/lib/inspec_tools/inspec.rb

@@ -304,11 +304,9 @@ module InspecTools
     def handle_severity(control)
       return if control[:impact].nil?
 
-      value = Utils::InspecUtil.get_impact_string(control[:impact])
+      value = Utils::InspecUtil.get_impact_string(control[:impact], use_cvss_terms: false)
       return if value == 'none'
 
-      value = 'high' if value == 'critical'
-
       HappyMapperTools::StigChecklist::StigData.new('Severity', value)
     end
 

data/lib/inspec_tools/pdf.rb

@@ -65,6 +65,7 @@ module InspecTools
         control['desc'] = contr[:descr]
         control['impact'] = Utils::InspecUtil.get_impact('medium')
         control['tags'] = {}
+        control['tags']['severity'] = Utils::InspecUtil.get_impact_string(control['impact'])
         control['tags']['ref'] = contr[:ref] unless contr[:ref].nil?
         control['tags']['applicability'] = contr[:applicability] unless contr[:applicability].nil?
         control['tags']['cis_id'] = contr[:title].split(' ')[0] unless contr[:title].nil?

data/lib/inspec_tools/xccdf.rb

@@ -126,6 +126,7 @@ module InspecTools
         control['desc'] = group.rule.description.vuln_discussion.split('Satisfies: ')[0]
         control['impact'] = Utils::InspecUtil.get_impact(group.rule.severity)
         control['tags'] = {}
+        control['tags']['severity'] = Utils::InspecUtil.get_impact_string(control['impact'])
         control['tags']['gtitle'] = group.title
         control['tags']['satisfies'] = group.rule.description.vuln_discussion.split('Satisfies: ')[1].split(',').map(&:strip) if group.rule.description.vuln_discussion.split('Satisfies: ').length > 1
         control['tags']['gid'] = group.id

data/lib/utilities/inspec_util.rb

@@ -16,7 +16,6 @@ require 'overrides/string'
 # rubocop:disable Metrics/AbcSize
 # rubocop:disable Metrics/PerceivedComplexity
 # rubocop:disable Metrics/CyclomaticComplexity
-# rubocop:disable Metrics/BlockLength
 # rubocop:disable Metrics/MethodLength
 
 module Utils
@@ -46,7 +45,7 @@ module Utils
       end
       c_data = {}
 
-      controls.each do |control| # rubocop:disable Metrics/BlockLength
+      controls.each do |control|
         c_id = control['id'].to_sym
         c_data[c_id] = {}
         c_data[c_id]['id']             = control['id']    || DATA_NOT_FOUND_MESSAGE
@@ -192,18 +191,20 @@ module Utils
     # @todo Allow for the user to pass in a hash for the desired mapping of text
     # values to numbers or to override our hard coded values.
     #
-    def self.get_impact(severity)
-      return float_to_impact(severity) if severity.is_a?(Float)
+    def self.get_impact(severity, use_cvss_terms: true)
+      return float_to_impact(severity, use_cvss_terms) if severity.is_a?(Float)
 
-      return string_to_impact(severity) if severity.is_a?(String)
+      return string_to_impact(severity, use_cvss_terms) if severity.is_a?(String)
 
       raise SeverityInputError, "'#{severity}' is not a valid severity value. It should be a Float between 0.0 and " \
                                 '1.0 or one of the approved keywords.'
     end
 
-    private_class_method def self.float_to_impact(severity)
-      raise SeverityInputError, "'#{severity}' is not a valid severity value. It should be a Float between 0.0 and " \
-                                  '1.0 or one of the approved keywords.' unless severity.between?(0, 1)
+    private_class_method def self.float_to_impact(severity, use_cvss_terms)
+      unless severity.between?(0, 1)
+        raise SeverityInputError, "'#{severity}' is not a valid severity value. It should be a Float between 0.0 and " \
+                                  '1.0 or one of the approved keywords.'
+      end
 
       if severity <= 0.01
         0.0 # Informative
@@ -211,31 +212,33 @@ module Utils
         0.3 # Low Impact
       elsif severity < 0.7
         0.5 # Medium Impact
-      elsif severity < 0.9
+      elsif severity < 0.9 || use_cvss_terms
         0.7 # High Impact
       else
         1.0 # Critical Controls
       end
     end
 
-    private_class_method def self.string_to_impact(severity)
+    private_class_method def self.string_to_impact(severity, use_cvss_terms)
       if /none|na|n\/a|not[_|(\s*)]?applicable/i.match?(severity)
-        0.0 # Informative
+        impact = 0.0 # Informative
       elsif /low|cat(egory)?\s*(iii|3)/i.match?(severity)
-        0.3 # Low Impact
+        impact = 0.3 # Low Impact
       elsif /med(ium)?|cat(egory)?\s*(ii|2)/i.match?(severity)
-        0.5 # Medium Impact
+        impact = 0.5 # Medium Impact
       elsif /high|cat(egory)?\s*(i|1)/i.match?(severity)
-        0.7 # High Impact
+        impact = 0.7 # High Impact
       elsif /crit(ical)?|severe/i.match?(severity)
-        1.0 # Critical Controls
+        impact = 1.0 # Critical Controls
       else
         raise SeverityInputError, "'#{severity}' is not a valid severity value. It should be a Float between 0.0 and " \
                                   '1.0 or one of the approved keywords.'
       end
+
+      impact == 1.0 && use_cvss_terms ? 0.7 : impact
     end
 
-    def self.get_impact_string(impact)
+    def self.get_impact_string(impact, use_cvss_terms: true)
       return if impact.nil?
 
       value = impact.to_f
@@ -243,8 +246,14 @@ module Utils
         raise ImpactInputError, "'#{value}' is not a valid impact score. Valid impact scores: [0.0 - 1.0]."
       end
 
-      IMPACT_SCORES.reverse_each do |name, impact|
-        return name if value >= impact
+      IMPACT_SCORES.reverse_each do |name, impact_score|
+        if name == 'critical' && value >= impact_score && use_cvss_terms
+          return 'high'
+        elsif value >= impact_score
+          return name
+        else
+          next
+        end
       end
     end
 
@@ -418,3 +427,9 @@ module Utils
     end
   end
 end
+
+# rubocop:enable Metrics/ClassLength
+# rubocop:enable Metrics/AbcSize
+# rubocop:enable Metrics/PerceivedComplexity
+# rubocop:enable Metrics/CyclomaticComplexity
+# rubocop:enable Metrics/MethodLength

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: inspec_tools
 version: !ruby/object:Gem::Version
-  version: 2.0.2.pre9
+  version: 2.0.2.pre10
 platform: ruby
 authors:
 - Robert Thew
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-05-04 00:00:00.000000000 Z
+date: 2020-05-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: colorize