vrt 0.4.6 → 0.5.0

data/lib/vrt.rb

@@ -17,7 +17,7 @@ module VRT
                    'name' => 'Other',
                    'priority' => nil,
                    'type' => 'category' }.freeze
-  MAPPINGS = %i[cvss_v3].freeze
+  MAPPINGS = %i[cvss_v3 remediation_advice cwe].freeze
 
   @version_json = {}
   @last_update = {}

data/lib/vrt/mapping.rb

@@ -14,19 +14,25 @@ module VRT
         id_list = VRT.find_node(vrt_id: id_list.join('.'), preferred_version: @min_version).id_list
         version = @min_version
       end
-
-      # iterate through the id components, keeping track of where we are in the mapping file
-      # and the most specific mapped value found so far
       mapping = @mappings[version]['content']
-      best_guess = @mappings[version]['metadata']['default']
-      id_list.each do |id|
-        entry = mapping[id]
-        break unless entry # mapping file doesn't go this deep, return previous value
-        best_guess = entry[@scheme] if entry[@scheme]
-        # use the children mapping for the next iteration
-        mapping = entry['children'] || {}
+      default = @mappings[version]['metadata']['default']
+      keys = @mappings[version]['metadata']['keys']
+      if keys
+        # Convert mappings with multiple keys to be nested under a single
+        # top-level key. Remediation advice has keys 'remediation_advice'
+        # and 'references' so we convert it to look like
+        # { remediation_advice: { remediation_advice: '...', references: [...] } }
+        keys.each_with_object({}) do |key, acc|
+          acc[key.to_sym] = get_key(
+            id_list: id_list,
+            mapping: mapping,
+            key: key,
+            default: default&.try(:[], key)
+          )
+        end
+      else
+        get_key(id_list: id_list, mapping: mapping, key: @scheme, default: default)
       end
-      best_guess
     end
 
     private
@@ -50,14 +56,35 @@ module VRT
     # becomes
     #     {one: {'id': 'one', 'foo': 'bar'}, two: {'id': 'two', 'foo': 'baz'}}
     def key_by_id(mapping)
-      case mapping
-      when Array
+      if mapping.is_a?(Array) && mapping.first.is_a?(Hash) && mapping.first.key?('id')
         mapping.each_with_object({}) { |entry, acc| acc[entry['id'].to_sym] = key_by_id(entry) }
-      when Hash
+      elsif mapping.is_a?(Hash)
         mapping.each_with_object({}) { |(key, value), acc| acc[key] = key_by_id(value) }
       else
         mapping
       end
     end
+
+    def get_key(id_list:, mapping:, key:, default:)
+      # iterate through the id components, keeping track of where we are in the mapping file
+      # and the most specific mapped value found so far
+      best_guess = default
+      id_list.each do |id|
+        entry = mapping[id]
+        break unless entry # mapping file doesn't go this deep, return previous value
+        best_guess = merge_arrays(best_guess, entry[key]) if entry[key]
+        # use the children mapping for the next iteration
+        mapping = entry['children'] || {}
+      end
+      best_guess
+    end
+
+    def merge_arrays(previous_value, new_value)
+      if previous_value.is_a?(Array) && new_value.is_a?(Array)
+        new_value | previous_value
+      else
+        new_value
+      end
+    end
   end
 end

data/lib/vrt/version.rb

@@ -1,3 +1,3 @@
 module Vrt
-  VERSION = '0.4.6'.freeze
+  VERSION = '0.5.0'.freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: vrt
 version: !ruby/object:Gem::Version
-  version: 0.4.6
+  version: 0.5.0
 platform: ruby
 authors:
 - Barnett Klane
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-02-05 00:00:00.000000000 Z
+date: 2018-05-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -109,6 +109,15 @@ files:
 - lib/data/1.3/mappings/cvss_v3.schema.json
 - lib/data/1.3/vrt.schema.json
 - lib/data/1.3/vulnerability-rating-taxonomy.json
+- lib/data/1.4/deprecated-node-mapping.json
+- lib/data/1.4/mappings/cvss_v3.json
+- lib/data/1.4/mappings/cvss_v3.schema.json
+- lib/data/1.4/mappings/cwe.json
+- lib/data/1.4/mappings/cwe.schema.json
+- lib/data/1.4/mappings/remediation_advice.json
+- lib/data/1.4/mappings/remediation_advice.schema.json
+- lib/data/1.4/vrt.schema.json
+- lib/data/1.4/vulnerability-rating-taxonomy.json
 - lib/generators/vrt.rb
 - lib/generators/vrt/install_generator.rb
 - lib/vrt.rb