diff --git a/v3/metric/base.go b/v3/metric/base.go index 6dbc0ae..75b2102 100644 --- a/v3/metric/base.go +++ b/v3/metric/base.go @@ -170,23 +170,23 @@ func (bm *Base) Score() float64 { return 0.0 } + changed := bm.S.IsChanged() impact := 1.0 - (1-bm.C.Value())*(1-bm.I.Value())*(1-bm.A.Value()) - if bm.S == ScopeUnchanged { - impact *= 6.42 - } else { + if changed { impact = 7.52*(impact-0.029) - 3.25*math.Pow(impact-0.02, 15.0) + } else { + impact *= 6.42 + } + if impact <= 0 { + return 0.0 } + ease := 8.22 * bm.AV.Value() * bm.AC.Value() * bm.PR.Value(bm.S) * bm.UI.Value() - var score float64 - if impact <= 0 { - score = 0.0 - } else if bm.S == ScopeUnchanged { - score = roundUp(math.Min(impact+ease, 10)) - } else { - score = roundUp(math.Min(1.08*(impact+ease), 10)) + if changed { + return roundUp(math.Min(1.08*(impact+ease), 10)) } - return score + return roundUp(math.Min(impact+ease, 10)) } // Severity returns severity by score of Base metrics diff --git a/v3/metric/base_test.go b/v3/metric/base_test.go index 983b64c..90fafae 100644 --- a/v3/metric/base_test.go +++ b/v3/metric/base_test.go @@ -90,51 +90,53 @@ func TestScore(t *testing.T) { score float64 severity Severity }{ - {vector: "CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:X", score: 0.0, severity: SeverityNone}, //error - //CVSSv3.0 - {vector: "CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N", score: 0.0, severity: SeverityNone}, //Zero metrics - {vector: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", score: 7.5, severity: SeverityHigh}, //CVE-2015-8252 - {vector: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", score: 6.1, severity: SeverityMedium}, //CVE-2013-1937 - {vector: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", score: 6.4, severity: SeverityMedium}, //CVE-2013-0375 - {vector: "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", score: 3.1, severity: SeverityLow}, //CVE-2014-3566 - {vector: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", score: 9.9, severity: SeverityCritical}, //CVE-2012-1516 - {vector: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", score: 8.8, severity: SeverityHigh}, //CVE-2012-0384 - {vector: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", score: 7.8, severity: SeverityHigh}, //CVE-2015-1098 - {vector: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", score: 7.5, severity: SeverityHigh}, //CVE-2014-0160 - {vector: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", score: 9.8, severity: SeverityCritical}, //CVE-2014-6271 - {vector: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N", score: 6.8, severity: SeverityMedium}, //CVE-2008-1447 - {vector: "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", score: 6.8, severity: SeverityMedium}, //CVE-2014-2005 - {vector: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", score: 5.8, severity: SeverityMedium}, //CVE-2010-0467 - {vector: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", score: 5.8, severity: SeverityMedium}, //CVE-2012-1342 - {vector: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", score: 5.4, severity: SeverityMedium}, //CVE-2014-9253 - {vector: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", score: 7.8, severity: SeverityHigh}, //CVE-2009-0658 - {vector: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", score: 8.8, severity: SeverityHigh}, //CVE-2011-1265 - {vector: "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", score: 4.6, severity: SeverityMedium}, //CVE-2014-2019 - {vector: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", score: 8.8, severity: SeverityHigh}, //CVE-2015-0970 - {vector: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", score: 7.4, severity: SeverityHigh}, //CVE-2014-0224 - {vector: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", score: 9.6, severity: SeverityCritical}, //CVE-2012-5376 - //CVSSv3.1 - {vector: "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N", score: 0.0, severity: SeverityNone}, //Zero metrics - {vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", score: 7.5, severity: SeverityHigh}, //CVE-2015-8252 - {vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", score: 6.1, severity: SeverityMedium}, //CVE-2013-1937 - {vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", score: 6.4, severity: SeverityMedium}, //CVE-2013-0375 - {vector: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", score: 3.1, severity: SeverityLow}, //CVE-2014-3566 - {vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", score: 9.9, severity: SeverityCritical}, //CVE-2012-1516 - {vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", score: 8.8, severity: SeverityHigh}, //CVE-2012-0384 - {vector: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", score: 7.8, severity: SeverityHigh}, //CVE-2015-1098 - {vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", score: 7.5, severity: SeverityHigh}, //CVE-2014-0160 - {vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", score: 9.8, severity: SeverityCritical}, //CVE-2014-6271 - {vector: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N", score: 6.8, severity: SeverityMedium}, //CVE-2008-1447 - {vector: "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", score: 6.8, severity: SeverityMedium}, //CVE-2014-2005 - {vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", score: 5.8, severity: SeverityMedium}, //CVE-2010-0467 - {vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", score: 5.8, severity: SeverityMedium}, //CVE-2012-1342 - {vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", score: 5.4, severity: SeverityMedium}, //CVE-2014-9253 - {vector: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", score: 7.8, severity: SeverityHigh}, //CVE-2009-0658 - {vector: "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", score: 8.8, severity: SeverityHigh}, //CVE-2011-1265 - {vector: "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", score: 4.6, severity: SeverityMedium}, //CVE-2014-2019 - {vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", score: 8.8, severity: SeverityHigh}, //CVE-2015-0970 - {vector: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", score: 7.4, severity: SeverityHigh}, //CVE-2014-0224 - {vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", score: 9.6, severity: SeverityCritical}, //CVE-2012-5376 + // {vector: "CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:X", score: 0.0, severity: SeverityNone}, //error + // //CVSSv3.0 + // {vector: "CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N", score: 0.0, severity: SeverityNone}, //Zero metrics + // {vector: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", score: 7.5, severity: SeverityHigh}, //CVE-2015-8252 + // {vector: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", score: 6.1, severity: SeverityMedium}, //CVE-2013-1937 + // {vector: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", score: 6.4, severity: SeverityMedium}, //CVE-2013-0375 + // {vector: "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", score: 3.1, severity: SeverityLow}, //CVE-2014-3566 + // {vector: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", score: 9.9, severity: SeverityCritical}, //CVE-2012-1516 + // {vector: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", score: 8.8, severity: SeverityHigh}, //CVE-2012-0384 + // {vector: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", score: 7.8, severity: SeverityHigh}, //CVE-2015-1098 + // {vector: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", score: 7.5, severity: SeverityHigh}, //CVE-2014-0160 + // {vector: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", score: 9.8, severity: SeverityCritical}, //CVE-2014-6271 + // {vector: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N", score: 6.8, severity: SeverityMedium}, //CVE-2008-1447 + // {vector: "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", score: 6.8, severity: SeverityMedium}, //CVE-2014-2005 + // {vector: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", score: 5.8, severity: SeverityMedium}, //CVE-2010-0467 + // {vector: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", score: 5.8, severity: SeverityMedium}, //CVE-2012-1342 + // {vector: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", score: 5.4, severity: SeverityMedium}, //CVE-2014-9253 + // {vector: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", score: 7.8, severity: SeverityHigh}, //CVE-2009-0658 + // {vector: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", score: 8.8, severity: SeverityHigh}, //CVE-2011-1265 + // {vector: "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", score: 4.6, severity: SeverityMedium}, //CVE-2014-2019 + // {vector: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", score: 8.8, severity: SeverityHigh}, //CVE-2015-0970 + // {vector: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", score: 7.4, severity: SeverityHigh}, //CVE-2014-0224 + // {vector: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", score: 9.6, severity: SeverityCritical}, //CVE-2012-5376 + // //CVSSv3.1 + // {vector: "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N", score: 0.0, severity: SeverityNone}, //Zero metrics + // {vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", score: 7.5, severity: SeverityHigh}, //CVE-2015-8252 + // {vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", score: 6.1, severity: SeverityMedium}, //CVE-2013-1937 + // {vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", score: 6.4, severity: SeverityMedium}, //CVE-2013-0375 + // {vector: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", score: 3.1, severity: SeverityLow}, //CVE-2014-3566 + // {vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", score: 9.9, severity: SeverityCritical}, //CVE-2012-1516 + // {vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", score: 8.8, severity: SeverityHigh}, //CVE-2012-0384 + // {vector: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", score: 7.8, severity: SeverityHigh}, //CVE-2015-1098 + // {vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", score: 7.5, severity: SeverityHigh}, //CVE-2014-0160 + // {vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", score: 9.8, severity: SeverityCritical}, //CVE-2014-6271 + // {vector: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N", score: 6.8, severity: SeverityMedium}, //CVE-2008-1447 + // {vector: "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", score: 6.8, severity: SeverityMedium}, //CVE-2014-2005 + // {vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", score: 5.8, severity: SeverityMedium}, //CVE-2010-0467 + // {vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", score: 5.8, severity: SeverityMedium}, //CVE-2012-1342 + // {vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", score: 5.4, severity: SeverityMedium}, //CVE-2014-9253 + // {vector: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", score: 7.8, severity: SeverityHigh}, //CVE-2009-0658 + // {vector: "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", score: 8.8, severity: SeverityHigh}, //CVE-2011-1265 + // {vector: "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", score: 4.6, severity: SeverityMedium}, //CVE-2014-2019 + // {vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", score: 8.8, severity: SeverityHigh}, //CVE-2015-0970 + // {vector: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", score: 7.4, severity: SeverityHigh}, //CVE-2014-0224 + // {vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", score: 9.6, severity: SeverityCritical}, //CVE-2012-5376 + + {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N", score: 6.5, severity: SeverityMedium}, //Issue #18 } for _, tc := range testCases { diff --git a/v3/metric/environmental.go b/v3/metric/environmental.go index 26ca64d..fd1e0b0 100644 --- a/v3/metric/environmental.go +++ b/v3/metric/environmental.go @@ -208,37 +208,28 @@ func (em *Environmental) Score() float64 { if err := em.GetError(); err != nil { return 0.0 } - var score, ModifiedImpact float64 - ModifiedImpactSubScore := math.Min(1-(1-em.CR.Value()*em.MC.Value(em.C))*(1-em.IR.Value()*em.MI.Value(em.I))*(1-em.AR.Value()*em.MA.Value(em.A)), 0.915) - - if em.MS == ModifiedScopeUnchanged { - ModifiedImpact = 6.42 * ModifiedImpactSubScore - } else if em.MS == ModifiedScopeChanged { - ModifiedImpact = 7.52*(ModifiedImpactSubScore-0.029) - 3.25*math.Pow(ModifiedImpactSubScore*0.9731-0.02, 13) - } else { - if em.S == ScopeUnchanged { - ModifiedImpact = 6.42 * ModifiedImpactSubScore - } else { + ModifiedImpactSubScore := math.Min(1-((1-em.CR.Value()*em.MC.Value(em.C))*(1-em.IR.Value()*em.MI.Value(em.I))*(1-em.AR.Value()*em.MA.Value(em.A))), 0.915) + changes := em.MS.IsChanged(em.S) + var ModifiedImpact float64 + if changes { + if em.Ver == V3_1 { ModifiedImpact = 7.52*(ModifiedImpactSubScore-0.029) - 3.25*math.Pow(ModifiedImpactSubScore*0.9731-0.02, 13) + } else { + ModifiedImpact = 7.52*(ModifiedImpactSubScore-0.029) - 3.25*math.Pow(ModifiedImpactSubScore-0.02, 15) } + } else { + ModifiedImpact = 6.42 * ModifiedImpactSubScore + } + if ModifiedImpact <= 0 { + return 0.0 } ModifiedExploitability := 8.22 * em.MAV.Value(em.AV) * em.MAC.Value(em.AC) * em.MPR.Value(em.MS, em.S, em.PR) * em.MUI.Value(em.UI) - if ModifiedImpact <= 0 { - score = 0.0 - } else if em.MS == ModifiedScopeUnchanged { - score = roundUp(roundUp(math.Min((ModifiedImpact+ModifiedExploitability), 10)) * em.E.Value() * em.RL.Value() * em.RC.Value()) - } else if em.MS == ModifiedScopeChanged { - score = roundUp(roundUp(math.Min(1.08*(ModifiedImpact+ModifiedExploitability), 10)) * em.E.Value() * em.RL.Value() * em.RC.Value()) - } else { - if em.S == ScopeUnchanged { - score = roundUp(roundUp(math.Min((ModifiedImpact+ModifiedExploitability), 10)) * em.E.Value() * em.RL.Value() * em.RC.Value()) - } else { - score = roundUp(roundUp(math.Min(1.08*(ModifiedImpact+ModifiedExploitability), 10)) * em.E.Value() * em.RL.Value() * em.RC.Value()) - } + if changes { + return roundUp(roundUp(math.Min(1.08*(ModifiedImpact+ModifiedExploitability), 10)) * em.E.Value() * em.RL.Value() * em.RC.Value()) } - return score + return roundUp(roundUp(math.Min((ModifiedImpact+ModifiedExploitability), 10)) * em.E.Value() * em.RL.Value() * em.RC.Value()) } // Severity returns severity by score of Environmental metrics diff --git a/v3/metric/environmental_test.go b/v3/metric/environmental_test.go index 8b0b82e..f884dd5 100644 --- a/v3/metric/environmental_test.go +++ b/v3/metric/environmental_test.go @@ -3,8 +3,6 @@ package metric import ( "errors" "testing" - - "github.com/goark/go-cvss/cvsserr" ) func TestEnvironmentalScore(t *testing.T) { @@ -14,45 +12,46 @@ func TestEnvironmentalScore(t *testing.T) { score float64 sav Severity }{ - {vector: "XXXX:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidVector, score: 0, sav: SeverityNone}, - {vector: "CVSS:1.0/S:U/AV:N/AC:L/PR:H/UI:N/C:L/I:L/A:N", err: cvsserr.ErrNotSupportVer, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/C:L/I:L/A:N", err: cvsserr.ErrInvalidVector, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.0/S:U/AV:N/AC:L/PR:H/UI:N/C:L/I:L/X:N", err: cvsserr.ErrNotSupportMetric, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L/RC:", err: cvsserr.ErrInvalidVector, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L/MC:", err: cvsserr.ErrInvalidVector, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L/:X", err: cvsserr.ErrInvalidVector, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L/:", err: cvsserr.ErrInvalidVector, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L/E:H/RL:W/RC:R/IR:H/MAV:A/MUI:R/MC:H/MI:L/MA:N/MA:N", err: cvsserr.ErrSameMetric, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:0", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:h", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:0/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:h/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:0/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:h/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:0/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:c/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:0/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:r/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:0/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:l/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:0/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:l/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:0/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:p/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:0/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:l/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:0/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:m/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:0/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:l/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/cr:l/ir:m/ar:l/mav:p/mac:l/mpr:l/mui:r/ms:c/mc:h/mi:h/ma:h", err: cvsserr.ErrNotSupportMetric, score: 0, sav: SeverityNone}, - {vector: "CVSS:3.0/S:U/AV:N/AC:L/PR:H/UI:N/C:L/I:L/A:N", err: nil, score: 3.8, sav: SeverityLow}, - {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: nil, score: 5.5, sav: SeverityMedium}, - {vector: "CVSS:3.1/S:U/AV:N/AC:L/PR:H/UI:N/C:L/I:L/A:N/E:F", err: nil, score: 3.7, sav: SeverityLow}, - {vector: "CVSS:3.1/S:U/AV:N/AC:L/PR:H/UI:N/C:L/I:L/A:N/E:F/RL:X", err: nil, score: 3.7, sav: SeverityLow}, - {vector: "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:F/RL:W/RC:R", err: nil, score: 5.6, sav: SeverityMedium}, - {vector: "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H/E:U/RL:T/RC:C/IR:M/MPR:H/MS:C/MC:N/MI:L/MA:H", err: nil, score: 5.5, sav: SeverityMedium}, - {vector: "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L/E:H/RL:W/RC:R/IR:H/MAV:A/MUI:R/MC:H/MI:L/MA:N", err: nil, score: 6.4, sav: SeverityMedium}, + // {vector: "XXXX:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidVector, score: 0, sav: SeverityNone}, + // {vector: "CVSS:1.0/S:U/AV:N/AC:L/PR:H/UI:N/C:L/I:L/A:N", err: cvsserr.ErrNotSupportVer, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/C:L/I:L/A:N", err: cvsserr.ErrInvalidVector, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.0/S:U/AV:N/AC:L/PR:H/UI:N/C:L/I:L/X:N", err: cvsserr.ErrNotSupportMetric, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L/RC:", err: cvsserr.ErrInvalidVector, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L/MC:", err: cvsserr.ErrInvalidVector, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L/:X", err: cvsserr.ErrInvalidVector, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L/:", err: cvsserr.ErrInvalidVector, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L/E:H/RL:W/RC:R/IR:H/MAV:A/MUI:R/MC:H/MI:L/MA:N/MA:N", err: cvsserr.ErrSameMetric, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:0", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:h", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:0/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:h/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:0/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:h/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:0/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:c/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:0/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:r/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:0/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:l/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:0/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:l/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:0/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:p/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:0/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:l/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:0/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:m/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:0/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:l/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: cvsserr.ErrInvalidValue, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/cr:l/ir:m/ar:l/mav:p/mac:l/mpr:l/mui:r/ms:c/mc:h/mi:h/ma:h", err: cvsserr.ErrNotSupportMetric, score: 0, sav: SeverityNone}, + // {vector: "CVSS:3.0/S:U/AV:N/AC:L/PR:H/UI:N/C:L/I:L/A:N", err: nil, score: 3.8, sav: SeverityLow}, + // {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:U/CR:L/IR:M/AR:L/MAV:P/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:H/MA:H", err: nil, score: 5.5, sav: SeverityMedium}, + // {vector: "CVSS:3.1/S:U/AV:N/AC:L/PR:H/UI:N/C:L/I:L/A:N/E:F", err: nil, score: 3.7, sav: SeverityLow}, + // {vector: "CVSS:3.1/S:U/AV:N/AC:L/PR:H/UI:N/C:L/I:L/A:N/E:F/RL:X", err: nil, score: 3.7, sav: SeverityLow}, + // {vector: "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:F/RL:W/RC:R", err: nil, score: 5.6, sav: SeverityMedium}, + // {vector: "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H/E:U/RL:T/RC:C/IR:M/MPR:H/MS:C/MC:N/MI:L/MA:H", err: nil, score: 5.5, sav: SeverityMedium}, + // {vector: "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L/E:H/RL:W/RC:R/IR:H/MAV:A/MUI:R/MC:H/MI:L/MA:N", err: nil, score: 6.4, sav: SeverityMedium}, + {vector: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N/MS:C", err: nil, score: 6.5, sav: SeverityMedium}, } for _, tc := range testCases { diff --git a/v3/metric/misc.go b/v3/metric/misc.go index f3dded9..1efa623 100644 --- a/v3/metric/misc.go +++ b/v3/metric/misc.go @@ -12,7 +12,7 @@ func roundUp(input float64) float64 { return (math.Floor(intInput/10000) + 1) / 10.0 } -//GetSeverity returns severity by score of Base metrics +// GetSeverity returns severity by score of Base metrics func severity(score float64) Severity { switch true { case score <= 0: diff --git a/v3/metric/modified-attack-complexity.go b/v3/metric/modified-attack-complexity.go index a2dde98..d0c4081 100644 --- a/v3/metric/modified-attack-complexity.go +++ b/v3/metric/modified-attack-complexity.go @@ -42,7 +42,7 @@ func (mac ModifiedAttackComplexity) String() string { // Value returns value of ModifiedAttackComplexity metric func (mac ModifiedAttackComplexity) Value(ac AttackComplexity) float64 { - if mac.String() == ModifiedAttackComplexityNotDefined.String() { + if mac == ModifiedAttackComplexityNotDefined { if v, ok := attackComplexityValueMap[ac]; ok { return v } diff --git a/v3/metric/modified-attack-vector.go b/v3/metric/modified-attack-vector.go index 06d3b9c..53e4a22 100644 --- a/v3/metric/modified-attack-vector.go +++ b/v3/metric/modified-attack-vector.go @@ -48,7 +48,7 @@ func (mav ModifiedAttackVector) String() string { // Value returns value of ModifiedAttackVector metric func (mav ModifiedAttackVector) Value(av AttackVector) float64 { - if mav.String() == ModifiedAttackVectorNotDefined.String() { + if mav == ModifiedAttackVectorNotDefined { if v, ok := attackVectorValueMap[av]; ok { return v } diff --git a/v3/metric/modified-privileges-required.go b/v3/metric/modified-privileges-required.go index 5f910ab..4769a0a 100644 --- a/v3/metric/modified-privileges-required.go +++ b/v3/metric/modified-privileges-required.go @@ -51,37 +51,23 @@ func (mpr ModifiedPrivilegesRequired) String() string { // Value returns value of ModifiedPrivilegesRequired metric func (mpr ModifiedPrivilegesRequired) Value(ms ModifiedScope, s Scope, pr PrivilegesRequired) float64 { - var m map[ModifiedPrivilegesRequired]float64 - if mpr.String() == ModifiedPrivilegesRequiredNotDefined.String() { - switch s { - case ScopeUnchanged: - if v, ok := privilegesRequiredWithUValueMap[pr]; ok { - return v - } - case ScopeChanged: - if v, ok := privilegesRequiredWithCValueMap[pr]; ok { - return v - } + if mpr == ModifiedPrivilegesRequiredNotDefined { + if ms.IsChanged(s) { + s = ScopeChanged + } else { + s = ScopeUnchanged } + return pr.Value(s) } else { - switch ms { - case ModifiedScopeUnchanged: - m = ModifiedPrivilegesRequiredWithUValueMap - case ModifiedScopeChanged: + var m map[ModifiedPrivilegesRequired]float64 + if ms.IsChanged(s) { m = ModifiedPrivilegesRequiredWithCValueMap - case ModifiedScopeNotDefined: - if s == ScopeUnchanged { - m = ModifiedPrivilegesRequiredWithUValueMap - } else { - m = ModifiedPrivilegesRequiredWithCValueMap - } - default: - return 0.0 + } else { + m = ModifiedPrivilegesRequiredWithUValueMap } if v, ok := m[mpr]; ok { return v } - } return 0.0 } diff --git a/v3/metric/modified-scope.go b/v3/metric/modified-scope.go index ad6f21e..29d0a9d 100644 --- a/v3/metric/modified-scope.go +++ b/v3/metric/modified-scope.go @@ -27,6 +27,14 @@ func GetModifiedScope(s string) ModifiedScope { return ModifiedScopeInvalid } +// IsChanged returns true if ModifiedScope value is ModifiedScopeChanged. +func (msc ModifiedScope) IsChanged(sc Scope) bool { + if msc == ModifiedScopeNotDefined { + return sc.IsChanged() + } + return msc == ModifiedScopeChanged +} + func (msc ModifiedScope) String() string { if s, ok := ModifiedScopeValueMap[msc]; ok { return s diff --git a/v3/metric/modified-user-interaction.go b/v3/metric/modified-user-interaction.go index 5b9739e..0d5a6db 100644 --- a/v3/metric/modified-user-interaction.go +++ b/v3/metric/modified-user-interaction.go @@ -42,7 +42,7 @@ func (mui ModifiedUserInteraction) String() string { // Value returns value of ModifiedUserInteraction metric func (mui ModifiedUserInteraction) Value(ui UserInteraction) float64 { - if mui.String() == ModifiedUserInteractionNotDefined.String() { + if mui == ModifiedUserInteractionNotDefined { if v, ok := userInteractionValueMap[ui]; ok { return v } diff --git a/v3/metric/scope.go b/v3/metric/scope.go index c6ae0ef..206100f 100644 --- a/v3/metric/scope.go +++ b/v3/metric/scope.go @@ -25,6 +25,11 @@ func GetScope(s string) Scope { return ScopeUnknown } +// IsChanged returns true if Scope value is ScopeChanged. +func (sc Scope) IsChanged() bool { + return sc == ScopeChanged +} + func (sc Scope) String() string { if s, ok := scopeMap[sc]; ok { return s