cvss: bugs, tests #1386
Open
cvss: bugs, tests #1386
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #1386 +/- ##
==========================================
- Coverage 55.37% 55.30% -0.07%
==========================================
Files 282 282
Lines 17836 17836
==========================================
- Hits 9876 9864 -12
- Misses 6927 6934 +7
- Partials 1033 1038 +5 ☔ View full report in Codecov by Sentry. |
hdonnay
force-pushed
the
hack/cvss_bugs-tests
branch
from
956cc2b
to
ff5b394
Compare
The previous version was too permissive with allowed orderings. Per spec: > The vector lists these metrics in a predetermined order, using the "/" > (slash) character to separate the metrics. Signed-off-by: Hank Donnay <[email protected]>
Signed-off-by: Hank Donnay <[email protected]>
Putting all the fixtures into separate files makes adding new cases just an `echo` instead of editing go source. Signed-off-by: Hank Donnay <[email protected]>
hdonnay
force-pushed
the
hack/cvss_bugs-tests
branch
from
ff5b394
to
0ec0489
Compare
RTann
reviewed
Aug 27, 2024
Comment on lines
+57
to
+58
| temporal = e "/" rl "/" rc; | ||
| environmental = cdp "/" td "/" cr "/" ir "/" ar; |
There was a problem hiding this comment.
I'm not as familiar with these. Let's say E is set. Does that mean RL and RC both must also be set?
| @@ -62,7 +62,7 @@ func (v *V4) getString(m V4Metric) (string, error) { | |||
| // GetScore implements [Vector]. | |||
| func (v *V4) getScore(m V4Metric) byte { | |||
| b := v.mv[int(m)] | |||
| if m >= V4ExploitMaturity && b == 0 { | |||
| if m >= V4ExploitMaturity && (b == 0 /* not present */ || b == 'X' /* not defined */) { | |||
There was a problem hiding this comment.
Are you able to show me where in the spec it says this? The 4.0 spec does not seem to show me a nice formula that v3.1 had
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This fixes some bugs and moves the test fixtures to external files (something that was bugging me).
Closes: #1382