Fixed Environmental Score calculation in CvssV3_1 #17
Conversation
* fixed environmental score calculation by using base score values if the environmental score values are null or "X" (not defined) -> otherwise the environmental score is zero if not all fields are set * updated getVector() method to only return vector fields that have a value assigned (all "X"/NOT_DEFINED fields are removed from the vector string) * added check for negative values (invalid, use zero instead) * updated/added tests
|
Hi @michael-hinterdorfer, About the getVector update, which compress/remove the undefined (
Would it be acceptable, to simplify human eyes comparisons, grep, ... to have a getVector() without arg which do the default behaviour (the new one which removes or the previous one for retrocompatibility) and a getVector(includeAll = true/false) form which would allow to choose the expanded or compress form? |
|
Hi @lounagen, |
…fields in the vector
* Fixed environmental score calculation by using base score values if the environmental score values are null or NOT_DEFINED ("X") -> otherwise the environmental score is zero if not all fields are set
* Adds check for negative values in `CvssV3#roundNearestTenth`
Extracted from stevespringett#17
Aligns `CvssV3_1#calculateScore` with the calculator from first.org (https://www.first.org/cvss/calculator/cvsscalc31.js).
Aside from fixing the score calculation, it also streamlines the calculation logic by removing unnecessary nesting.
Co-authored-by: Michael Hinterdorfer <[email protected]>
* Fixed environmental score calculation by using base score values if the environmental score values are null or NOT_DEFINED ("X") -> otherwise the environmental score is zero if not all fields are set
* Adds check for negative values in `CvssV3#roundNearestTenth`
Extracted from stevespringett#17
Aligns `CvssV3_1#calculateScore` with the calculator from first.org (https://www.first.org/cvss/calculator/cvsscalc31.js).
Aside from fixing the score calculation, it also streamlines the calculation logic by removing unnecessary nesting.
Co-authored-by: Michael Hinterdorfer <[email protected]>
|
I'm confused, is there anything in here that's still useful and not included in #89? |
NOT_DEFINED("X") -> otherwise the environmental score is zero if not all fields are setgetVector()method to only return vector fields that have a value assigned (allNOT_DEFINEDfields are removed from the vector string)the changes are based on the cvss-calculator script from first.org (https://www.first.org/cvss/calculator/cvsscalc31.js)