Another rounding fix (#65)

* Another rounding fix * Match fix in Javascript implementation
RedHatProductSecurity · Nov 1, 2024 · 1bfc39f · 1bfc39f
1 parent 42a77b6
commit 1bfc39f
Show file tree

Hide file tree

Showing 7 changed files with 1,958 additions and 1,943 deletions.
diff --git a/cvss/__init__.py b/cvss/__init__.py
@@ -8,4 +8,4 @@
 from .exceptions import CVSS2Error, CVSS3Error, CVSS4Error, CVSSError
 from .interactive import ask_interactively
 
-__version__ = "3.2"
+__version__ = "3.3"
diff --git a/cvss/constants4.py b/cvss/constants4.py
@@ -12,6 +12,10 @@
     # noinspection PyUnresolvedReferences
     from ordereddict import OrderedDict
 
+# Small enough value which can be added to a value which will be rounded to 1 decimal place so the
+# result is rounded correctly despite floating point inaccuracies.
+EPSILON = 10**-6
+
 METRICS = [
     "AV",
     "AC",

diff --git a/cvss/cvss4.py b/cvss/cvss4.py
@@ -40,6 +40,7 @@
 
 from .constants4 import (
     CVSS_LOOKUP_GLOBAL,
+    EPSILON,
     MAX_COMPOSED,
     MAX_SEVERITY,
     METRICS,
@@ -52,8 +53,18 @@
 from .exceptions import CVSS4MalformedError, CVSS4MandatoryError
 
 
-def round_away_from_zero(x):
-    return float(D(x * 10).quantize(D("1"), rounding=ROUND_HALF_UP) / 10)
+def final_rounding(x):
+    """
+    Round to one decimal place. Use Decimal because Python float rounding defaults to
+    "round half to even". We actually want "round half away from zero" aka "round half up" for
+    positive numbers.
+
+    Add a small value to make sure that values like the following are correctly rounded despite
+    floating point inaccuracies:
+
+    8.6 - 7.15 = 1.4499999999999993 (float) => 1.5
+    """
+    return float(D(x + EPSILON).quantize(D("0.1"), rounding=ROUND_HALF_UP))
 
 
 class CVSS4(object):
@@ -547,7 +558,7 @@ def compute_base_score(self):
         value = max(0.0, value)
         value = min(10.0, value)
 
-        self.base_score = round_away_from_zero(value)
+        self.base_score = final_rounding(value)
 
     def clean_vector(self, output_prefix=True):
         """

diff --git a/tests/vectors_base4 b/tests/vectors_base4
diff --git a/tests/vectors_modified4 b/tests/vectors_modified4
diff --git a/tests/vectors_random4 b/tests/vectors_random4
diff --git a/tests/vectors_threat4 b/tests/vectors_threat4
@@ -1,6 +1,6 @@
-CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:A - 0.0
-CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A - 7.3
-CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:P - 0.0
-CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P - 5.9
-CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - 0.0
-CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U - 4.1
+CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:A - 0.0
+CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A - 7.3
+CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:P - 0.0
+CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P - 5.9
+CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - 0.0
+CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U - 4.1