Skip to content

Commit

Permalink
CVSSv4, skontar review changes
Browse files Browse the repository at this point in the history
-Fixed various typos: CVSS3 -> CVSS4
-Added malformed CVSS4MalformedError check for wrong cvss prefix
-Fixed prefix in clean_vector: "CVSS:4/" -> "CVSS:4.0/"
  • Loading branch information
jobiewinserapck committed Dec 11, 2023
1 parent c99cbbd commit 0f9079a
Showing 1 changed file with 10 additions and 4 deletions.
14 changes: 10 additions & 4 deletions cvss/cvss4.py
Original file line number Diff line number Diff line change
Expand Up @@ -91,10 +91,10 @@ def __init__(self, vector):

def check_mandatory(self):
"""
Checks if mandatory fields are in CVSS3 vector.
Checks if mandatory fields are in CVSS4 vector.
Raises:
CVSS3MandatoryError: if mandatory metric is missing in the vector
CVSS4MandatoryError: if mandatory metric is missing in the vector
"""
missing = []
for mandatory_metric in METRICS_MANDATORY:
Expand Down Expand Up @@ -153,6 +153,12 @@ def parse_vector(self):

if self.vector.endswith("/"):
raise CVSS4MalformedError('Malformed CVSS4 vector, trailing "/"')
# Handle 'CVSS:4.x' in the beginning of vector and split vector
if not self.vector.startswith("CVSS:4.0/"):
raise CVSS4MalformedError(
'Malformed CVSS4 vector "{0}" is missing mandatory prefix '
"or uses unsupported CVSS version".format(self.vector)
)
try:
fields = self.vector.split("/")[1:]
except IndexError:
Expand Down Expand Up @@ -557,7 +563,7 @@ def clean_vector(self, output_prefix=True):
output_prefix (bool): defines if CVSS vector should be printed with prefix
Returns:
(str): cleaned CVSS3 with metrics in correct order
(str): cleaned CVSS4 with metrics in correct order
"""
vector = []
for metric in METRICS_ABBREVIATIONS:
Expand All @@ -566,7 +572,7 @@ def clean_vector(self, output_prefix=True):
if value != "X":
vector.append("{0}:{1}".format(metric, value))
if output_prefix:
prefix = "CVSS:4/"
prefix = "CVSS:4.0/"
else:
prefix = ""
return prefix + "/".join(vector)
Expand Down

0 comments on commit 0f9079a

Please sign in to comment.