@secureport/core 1.0.0-rc.0 → 1.0.0-rc.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -2
- package/dist/severity.d.ts +15 -6
- package/dist/severity.d.ts.map +1 -1
- package/dist/severity.js +1 -1
- package/dist/severity.js.map +1 -1
- package/package.json +1 -1
- package/src/severity.ts +15 -6
package/README.md
CHANGED
|
@@ -95,8 +95,12 @@ SEVERITY_WEIGHTS.advisory; // 0 — advisories never inflate the exposure score
|
|
|
95
95
|
```
|
|
96
96
|
|
|
97
97
|
`severitySource` records _why_ a severity was assigned — `explicit`, `cvss`,
|
|
98
|
-
`engine_default` or `
|
|
99
|
-
provenance is not evidence.
|
|
98
|
+
`engine_default` or `published_advisory`, in that precedence order. A severity
|
|
99
|
+
with no provenance is not evidence.
|
|
100
|
+
|
|
101
|
+
`published_advisory` means a security bulletin said so. It is deliberately not
|
|
102
|
+
called `advisory`: that is the name of the lowest severity, and a `critical`
|
|
103
|
+
finding whose source read `advisory` was one word away from being skimmed past.
|
|
100
104
|
|
|
101
105
|
## Remediation deadlines
|
|
102
106
|
|
package/dist/severity.d.ts
CHANGED
|
@@ -58,19 +58,28 @@ export declare const SEVERITY_WEIGHTS: Readonly<Record<Severity, number>>;
|
|
|
58
58
|
* 3. `engine_default` — the engine's own rating for the rule that fired.
|
|
59
59
|
* 4. `advisory` — taken from a published advisory for the associated CVE.
|
|
60
60
|
*
|
|
61
|
-
*
|
|
62
|
-
*
|
|
63
|
-
*
|
|
64
|
-
*
|
|
61
|
+
* `published_advisory` means the severity came from a security bulletin —
|
|
62
|
+
* a vendor advisory, a GitHub Security Advisory, an OSV entry.
|
|
63
|
+
*
|
|
64
|
+
* **It was called `advisory` until 6 September, and the rename is the whole
|
|
65
|
+
* point of this comment.** `advisory` is also the lowest {@link Severity}, so
|
|
66
|
+
* the two collided on the one axis where being misread matters: a finding can
|
|
67
|
+
* be `critical` from an `advisory` source, and a reader skimming a report sees
|
|
68
|
+
* the word and files it under "not urgent". Renaming the *source* keeps
|
|
69
|
+
* `advisory` for the severity, where it is the right word.
|
|
70
|
+
*
|
|
71
|
+
* Done while `@secureport/core` was at `1.0.0-rc.0`, which is what a release
|
|
72
|
+
* candidate is for — after `1.0.0` this would be a major and a deprecation
|
|
73
|
+
* cycle for a word.
|
|
65
74
|
*/
|
|
66
|
-
export type SeveritySource = 'explicit' | 'cvss' | 'engine_default' | '
|
|
75
|
+
export type SeveritySource = 'explicit' | 'cvss' | 'engine_default' | 'published_advisory';
|
|
67
76
|
/**
|
|
68
77
|
* Every {@link SeveritySource}, most authoritative first.
|
|
69
78
|
*
|
|
70
79
|
* The order is the precedence rule: when two sources offer a severity for the
|
|
71
80
|
* same finding, the one appearing earlier here wins.
|
|
72
81
|
*/
|
|
73
|
-
export declare const SEVERITY_SOURCE_PRECEDENCE: readonly ["explicit", "cvss", "engine_default", "
|
|
82
|
+
export declare const SEVERITY_SOURCE_PRECEDENCE: readonly ["explicit", "cvss", "engine_default", "published_advisory"];
|
|
74
83
|
/**
|
|
75
84
|
* Maps a CVSS base score to a {@link Severity}.
|
|
76
85
|
*
|
package/dist/severity.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"severity.d.ts","sourceRoot":"","sources":["../src/severity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,UAAU,CAAC;AAE3E;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4DAA6D,CAAC;AAEzF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAEvD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAM9D,CAAC;AAEH
|
|
1
|
+
{"version":3,"file":"severity.d.ts","sourceRoot":"","sources":["../src/severity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,UAAU,CAAC;AAE3E;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4DAA6D,CAAC;AAEzF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAEvD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAM9D,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,uEAK7B,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CASxD;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;IAEjE;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAS/B,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,CAAC;AAE3D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,IAAI,EACf,MAAM,GAAE,SAA8B,GACrC,IAAI,GAAG,IAAI,CAIb;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,IAAI,GAAG,IAAI,EAClB,GAAG,EAAE,IAAI,EACT,MAAM,GAAE,SAA8B,GACrC,SAAS,CAKX"}
|
package/dist/severity.js
CHANGED
package/dist/severity.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"severity.js","sourceRoot":"","sources":["../src/severity.ts"],"names":[],"mappings":"AAaA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAU,CAAC;AAEzF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,QAAkB;IAC7C,OAAO,cAAc,CAAC,MAAM,GAAG,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAuC,MAAM,CAAC,MAAM,CAAC;IAChF,QAAQ,EAAE,EAAE;IACZ,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,QAAQ,EAAE,CAAC;CACZ,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"severity.js","sourceRoot":"","sources":["../src/severity.ts"],"names":[],"mappings":"AAaA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAU,CAAC;AAEzF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,QAAkB;IAC7C,OAAO,cAAc,CAAC,MAAM,GAAG,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAuC,MAAM,CAAC,MAAM,CAAC;IAChF,QAAQ,EAAE,EAAE;IACZ,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,QAAQ,EAAE,CAAC;CACZ,CAAC,CAAC;AA8BH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,UAAU;IACV,MAAM;IACN,gBAAgB;IAChB,oBAAoB;CACZ,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,UAAU,CAAC,iDAAiD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9B,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,UAAU,CAAC;AACpB,CAAC;AA8BD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAc,MAAM,CAAC,MAAM,CAAC;IACzD,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1B,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,EAAE;QACR,MAAM,EAAE,EAAE;QACV,GAAG,EAAE,GAAG;QACR,QAAQ,EAAE,IAAI;KACf,CAAC;IACF,WAAW,EAAE,CAAC;CACf,CAAC,CAAC;AAcH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,QAAQ,CACtB,QAAkB,EAClB,SAAe,EACf,SAAoB,kBAAkB;IAEtC,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CACvB,KAAkB,EAClB,GAAS,EACT,SAAoB,kBAAkB;IAEtC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACpC,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE;QAAE,OAAO,UAAU,CAAC;IACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC5E,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC3D,CAAC"}
|
package/package.json
CHANGED
package/src/severity.ts
CHANGED
|
@@ -70,12 +70,21 @@ export const SEVERITY_WEIGHTS: Readonly<Record<Severity, number>> = Object.freez
|
|
|
70
70
|
* 3. `engine_default` — the engine's own rating for the rule that fired.
|
|
71
71
|
* 4. `advisory` — taken from a published advisory for the associated CVE.
|
|
72
72
|
*
|
|
73
|
-
*
|
|
74
|
-
*
|
|
75
|
-
*
|
|
76
|
-
*
|
|
73
|
+
* `published_advisory` means the severity came from a security bulletin —
|
|
74
|
+
* a vendor advisory, a GitHub Security Advisory, an OSV entry.
|
|
75
|
+
*
|
|
76
|
+
* **It was called `advisory` until 6 September, and the rename is the whole
|
|
77
|
+
* point of this comment.** `advisory` is also the lowest {@link Severity}, so
|
|
78
|
+
* the two collided on the one axis where being misread matters: a finding can
|
|
79
|
+
* be `critical` from an `advisory` source, and a reader skimming a report sees
|
|
80
|
+
* the word and files it under "not urgent". Renaming the *source* keeps
|
|
81
|
+
* `advisory` for the severity, where it is the right word.
|
|
82
|
+
*
|
|
83
|
+
* Done while `@secureport/core` was at `1.0.0-rc.0`, which is what a release
|
|
84
|
+
* candidate is for — after `1.0.0` this would be a major and a deprecation
|
|
85
|
+
* cycle for a word.
|
|
77
86
|
*/
|
|
78
|
-
export type SeveritySource = 'explicit' | 'cvss' | 'engine_default' | '
|
|
87
|
+
export type SeveritySource = 'explicit' | 'cvss' | 'engine_default' | 'published_advisory';
|
|
79
88
|
|
|
80
89
|
/**
|
|
81
90
|
* Every {@link SeveritySource}, most authoritative first.
|
|
@@ -87,7 +96,7 @@ export const SEVERITY_SOURCE_PRECEDENCE = [
|
|
|
87
96
|
'explicit',
|
|
88
97
|
'cvss',
|
|
89
98
|
'engine_default',
|
|
90
|
-
'
|
|
99
|
+
'published_advisory',
|
|
91
100
|
] as const;
|
|
92
101
|
|
|
93
102
|
/**
|