Module: CvssSuite

Defined in:
lib/cvss_suite.rb,
lib/cvss_suite/cvss.rb,
lib/cvss_suite/errors.rb,
lib/cvss_suite/version.rb,
lib/cvss_suite/cvss2/cvss2.rb,
lib/cvss_suite/cvss3/cvss3.rb,
lib/cvss_suite/cvss_metric.rb,
lib/cvss_suite/invalid_cvss.rb,
lib/cvss_suite/cvss31/cvss31.rb,
lib/cvss_suite/cvss40/cvss40.rb,
lib/cvss_suite/cvss_property.rb,
lib/cvss_suite/cvss2/cvss2_base.rb,
lib/cvss_suite/cvss3/cvss3_base.rb,
lib/cvss_suite/cvss_40_and_later.rb,
lib/cvss_suite/cvss31/cvss31_base.rb,
lib/cvss_suite/cvss40/cvss40_base.rb,
lib/cvss_suite/cvss_31_and_before.rb,
lib/cvss_suite/cvss2/cvss2_temporal.rb,
lib/cvss_suite/cvss3/cvss3_temporal.rb,
lib/cvss_suite/cvss40/cvss40_all_up.rb,
lib/cvss_suite/cvss40/cvss40_threat.rb,
lib/cvss_suite/helpers/cvss3_helper.rb,
lib/cvss_suite/helpers/cvss31_helper.rb,
lib/cvss_suite/cvss31/cvss31_temporal.rb,
lib/cvss_suite/cvss2/cvss2_environmental.rb,
lib/cvss_suite/cvss3/cvss3_environmental.rb,
lib/cvss_suite/cvss40/cvss40_calc_helper.rb,
lib/cvss_suite/cvss40/cvss40_supplemental.rb,
lib/cvss_suite/cvss31/cvss31_environmental.rb,
lib/cvss_suite/cvss40/cvss40_environmental.rb,
lib/cvss_suite/cvss40/cvss40_constants_levels.rb,
lib/cvss_suite/cvss40/cvss40_constants_max_composed.rb,
lib/cvss_suite/cvss40/cvss40_constants_max_severity.rb,
lib/cvss_suite/cvss40/cvss40_environmental_security.rb,
lib/cvss_suite/cvss40/cvss40_constants_macro_vector_lookup.rb

Overview

CVSS-Suite, a Ruby gem to manage the CVSS vector

This work is licensed under the terms of the MIT license. See the LICENSE.md file in the top-level directory.

Defined Under Namespace

Modules: Cvss31Helper, Cvss3Helper, Cvss40Constants, Error, Errors Classes: Cvss, Cvss2, Cvss2Base, Cvss2Environmental, Cvss2Temporal, Cvss3, Cvss31, Cvss31AndBefore, Cvss31Base, Cvss31Environmental, Cvss31Temporal, Cvss3Base, Cvss3Environmental, Cvss3Temporal, Cvss40, Cvss40AllUp, Cvss40AndLater, Cvss40Base, Cvss40CalcHelper, Cvss40Environmental, Cvss40EnvironmentalSecurity, Cvss40Supplemental, Cvss40Threat, CvssMetric, CvssProperty, InvalidCvss

Constant Summary collapse

CVSS_VECTOR_BEGINNINGS =

Exempt from the seal below, which covers only what has never shipped. Age is not the reason -- 5.0.0 privatizes three module methods that were public in 4.1.4 -- it stays because prefix-to-version lets a caller sniff a vector's version without constructing one. Sealing it means editing the three Cvss*#vector readers too: they use the qualified form, which a seal rejects.

[
  { string: 'AV:', version: 2 },
  { string: '(AV:', version: 2 },
  { string: 'CVSS:3.0/', version: 3.0 },
  { string: 'CVSS:3.1/', version: 3.1 },
  { string: 'CVSS:4.0/', version: 4.0 }
].freeze
VERSION = 
'5.0.0'

Class Method Summary collapse

Class Method Details

.metrics(version) ⇒ Object

Returns the static schema of metrics and their options for a CVSS version (2, 3.0, 3.1 or 4.0; the equivalent strings are accepted too) without constructing a vector. Each metric lists its options with the default option flagged, so a caller can build input forms directly. Closes #8.

Raises:



104
105
106
107
108
109
 
# File 'lib/cvss_suite.rb', line 104

def self.metrics(version)
  groups = METRIC_GROUPS[VERSION_ALIASES[version]]
  raise Errors::UnsupportedVersion, "Unsupported CVSS version: #{version.inspect}" if groups.nil?

  groups.map { |label, metric_class| { group: label, metrics: metric_schema(metric_class) } }
end

.new(vector) ⇒ Object

Returns a CVSS class by a vector.



59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
 
# File 'lib/cvss_suite.rb', line 59

def self.new(vector)
  return InvalidCvss.new(vector) unless vector.is_a? String

  # Always a copy, not only when frozen: the string is kept for the lifetime
  # of the returned object to name it in errors, and a caller who mutates
  # theirs afterwards would otherwise change what we report having rejected.
  @vector_string = vector.dup

  # version is a discrete value parsed from the vector and matched against exact
  # literals, not the result of float arithmetic, so these comparisons are reliable.
  # rubocop:disable-next Lint/FloatComparison
  case version
  when 2
    Cvss2.new(prepare_vector(@vector_string), @vector_string)
  when 3.0
    Cvss3.new(prepare_vector(@vector_string), @vector_string)
  when 3.1
    Cvss31.new(prepare_vector(@vector_string), @vector_string)
  when 4.0
    Cvss40.new(prepare_vector(@vector_string), @vector_string)
  else
    InvalidCvss.new(@vector_string)
  end
end

.parse(vector) ⇒ Object

Returns a CVSS class by a vector, raising CvssSuite::Errors::InvalidVector if the vector cannot be parsed.

Prefer this over .new when a bad vector is a bug rather than an expected input: .new answers with an InvalidCvss sentinel that only reports the problem once a score is asked for, so a caller who forgets valid? carries a broken vector until something far from the parse blows up.



92
93
94
95
96
97
 
# File 'lib/cvss_suite.rb', line 92

def self.parse(vector)
  cvss = new(vector)
  raise Errors::InvalidVector.for(vector) unless cvss.valid?

  cvss
end