Skip to content

Commit d3d10c9

Browse files
0llirocks0llirocks
authored
Merge pull request #43 from 0llirocks/add-validation
Add validation
2 parents 63f766d + 160313d commit d3d10c9

File tree

6 files changed

+139
-7
lines changed

6 files changed

+139
-7
lines changed

‎lib/cvss_suite/cvss_31_and_before.rb‎

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,11 +27,10 @@ def initialize(vector)
2727
# Returns if CVSS vector is valid.
2828
def valid?
2929
if @amount_of_properties >= required_amount_of_properties
30-
base = @base.valid?
31-
temporal = @base.valid? && @temporal&.valid?
32-
environmental = @base.valid? && @environmental&.valid?
33-
full = @base.valid? && @temporal&.valid? && @environmental&.valid?
34-
base || temporal || environmental || full
30+
entered_keys = @properties.collect { |p| p[:name] }
31+
return false if (entered_keys - allowed_abbreviations).size.positive?
32+
33+
check_metrics_validity
3534
else
3635
false
3736
end
@@ -46,5 +45,17 @@ def overall_score
4645

4746
base_score
4847
end
48+
49+
private
50+
51+
def allowed_abbreviations
52+
@base.properties.collect(&:abbreviation) +
53+
@temporal.properties.collect(&:abbreviation) +
54+
@environmental.properties.collect(&:abbreviation)
55+
end
56+
57+
def check_metrics_validity
58+
@base.valid? && @temporal&.valid? && @environmental&.valid?
59+
end
4960
end
5061
end

‎lib/cvss_suite/cvss_metric.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ def extract_selected_values_from(selected_properties)
4444
end
4545
property&.set_selected_value selected_property[:selected]
4646
end
47-
@properties.reject(&:valid?).each(&:set_default_value)
47+
@properties.select(&:non_selected?).each(&:set_default_value)
4848
end
4949
end
5050
end

‎lib/cvss_suite/cvss_property.rb‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ def selected_value
5858
# Returns true if the property is valid.
5959

6060
def valid?
61-
!@selected_value.nil?
61+
!@selected_value.nil? && @property[:values].map { |p| p[:abbreviation] }.include?(@selected_value[:abbreviation])
6262
end
6363

6464
##
@@ -76,6 +76,9 @@ def set_selected_value(selected_value)
7676
value[:selected] = selected_value.eql?(value[:abbreviation])
7777
end
7878
@selected_value = values.detect { |value| value[:selected] }
79+
return unless @selected_value.nil?
80+
81+
@selected_value = { abbreviation: selected_value }
7982
end
8083

8184
##
@@ -84,8 +87,16 @@ def set_selected_value(selected_value)
8487
def set_default_value
8588
values.each do |value|
8689
value[:selected] = value[:abbreviation].eql?('X')
90+
value[:selected] ||= value[:abbreviation].eql?('ND')
8791
end
8892
@selected_value = values.detect { |value| value[:selected] }
8993
end
94+
95+
##
96+
# Returns whether a selected_value is set
97+
98+
def non_selected?
99+
@selected_value.nil?
100+
end
90101
end
91102
end

‎spec/cvss2/cvss2_spec.rb‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,16 @@
2323
let(:invalid_cvss2) { CvssSuite.new('AV:N/AC:P/C:P/AV:U/RL:OF/RC:C') }
2424
let(:invalid_cvss2_parenthesis_closed) { CvssSuite.new('(AV:N/AC:L/Au:N/C:P/I:P/A:P') }
2525
let(:invalid_cvss2_parenthesis) { CvssSuite.new('(AV:N/AC:L/Au:N()/C:P/I:P/A:P') }
26+
let(:invalid_cvss2_missing_metric) { CvssSuite.new('AV:N/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C') }
27+
let(:invalid_cvss2_multiple_metrics) { CvssSuite.new('AV:N/AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C') }
28+
let(:invalid_cvss2_additional_fields) do
29+
CvssSuite.new('AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C/Extra/')
30+
end
31+
let(:invalid_cvss2_additional_fields_missing_temporal) do
32+
CvssSuite.new('AV:N/AC:L/Au:N/C:P/I:P/A:P/RL:OF/RC:C/Extra/')
33+
end
34+
let(:invalid_cvss2_extra_slash) { CvssSuite.new('AV:N//AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C') }
35+
let(:invalid_cvss2_wrong_value) { CvssSuite.new('AV:N/AC:L/Au:N/C:P/I:P/A:P/E:R/RL:OF/RC:C') }
2636

2737
describe 'valid cvss2' do
2838
subject { valid_cvss2 }
@@ -90,6 +100,42 @@
90100
it_behaves_like 'a invalid cvss vector with version', 2
91101
end
92102

103+
describe 'invalid cvss2 with missing base metric' do
104+
subject { invalid_cvss2_missing_metric }
105+
106+
it_behaves_like 'a invalid cvss vector with version', 2
107+
end
108+
109+
describe 'invalid cvss2 with multiple base metrics' do
110+
subject { invalid_cvss2_multiple_metrics }
111+
112+
it_behaves_like 'a invalid cvss vector with version', 2
113+
end
114+
115+
describe 'invalid cvss2 with additional fields' do
116+
subject { invalid_cvss2_additional_fields }
117+
118+
it_behaves_like 'a invalid cvss vector with version', 2
119+
end
120+
121+
describe 'invalid cvss2 with additional fields missing temporal' do
122+
subject { invalid_cvss2_additional_fields_missing_temporal }
123+
124+
it_behaves_like 'a invalid cvss vector with version', 2
125+
end
126+
127+
describe 'invalid cvss2 with extra slash' do
128+
subject { invalid_cvss2_extra_slash }
129+
130+
it_behaves_like 'a invalid cvss vector with version', 2
131+
end
132+
133+
describe 'invalid cvss2 with wrong value for Exploit Code Maturity (E)' do
134+
subject { invalid_cvss2_wrong_value }
135+
136+
it_behaves_like 'a invalid cvss vector with version', 2
137+
end
138+
93139
# Severity tests https://nvd.nist.gov/vuln-metrics/cvss
94140
# v2 Severity High: 7.0 - 10.0
95141
describe 'valid cvss2_severity_high' do

‎spec/cvss3/cvss3_spec.rb‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,14 @@
4040
let(:invalid_cvss3_not_defined) { CvssSuite.new('CVSS:3.0/AV:X/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H') }
4141
let(:invalid_cvss3_missing_metric) { CvssSuite.new('CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L') }
4242
let(:invalid_cvss3_multiple_metrics) { CvssSuite.new('CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L/A:L') }
43+
let(:invalid_cvss3_additional_fields) do
44+
CvssSuite.new('CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C/Extra/')
45+
end
46+
let(:invalid_cvss3_additional_fields_missing_temporal) do
47+
CvssSuite.new('CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/Extra/')
48+
end
49+
let(:invalid_cvss3_extra_slash) { CvssSuite.new('CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N//I:N/A:H/E:P/RL:U/RC:C/') }
50+
let(:invalid_cvss3_wrong_value) { CvssSuite.new('CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:R/RL:U/RC:C') }
4351

4452
describe 'valid cvss3' do
4553
subject { valid_cvss3 }
@@ -155,6 +163,30 @@
155163
it_behaves_like 'a invalid cvss vector with version', 3.0
156164
end
157165

166+
describe 'invalid cvss3 with additional fields' do
167+
subject { invalid_cvss3_additional_fields }
168+
169+
it_behaves_like 'a invalid cvss vector with version', 3.0
170+
end
171+
172+
describe 'invalid cvss3 with additional fields missing temporal' do
173+
subject { invalid_cvss3_additional_fields_missing_temporal }
174+
175+
it_behaves_like 'a invalid cvss vector with version', 3.0
176+
end
177+
178+
describe 'invalid cvss3 with extra slash' do
179+
subject { invalid_cvss3_extra_slash }
180+
181+
it_behaves_like 'a invalid cvss vector with version', 3.0
182+
end
183+
184+
describe 'invalid cvss3 with wrong value for Exploit Code Maturity (E)' do
185+
subject { invalid_cvss3_wrong_value }
186+
187+
it_behaves_like 'a invalid cvss vector with version', 3.0
188+
end
189+
158190
describe 'correct vector' do
159191
[
160192
['CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L', 'CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L'],

‎spec/cvss31/cvss31_spec.rb‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,14 @@
3939
let(:invalid_cvss31_not_defined) { CvssSuite.new('CVSS:3.1/AV:X/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H') }
4040
let(:invalid_cvss31_missing_metric) { CvssSuite.new('CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L') }
4141
let(:invalid_cvss31_multiple_metrics) { CvssSuite.new('CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L/A:L') }
42+
let(:invalid_cvss31_additional_fields) do
43+
CvssSuite.new('CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C/Extra/')
44+
end
45+
let(:invalid_cvss31_additional_fields_missing_temporal) do
46+
CvssSuite.new('CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/Extra/')
47+
end
48+
let(:invalid_cvss31_extra_slash) { CvssSuite.new('CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N//I:N/A:H/E:P/RL:U/RC:C/') }
49+
let(:invalid_cvss31_wrong_value) { CvssSuite.new('CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:R/RL:U/RC:C') }
4250

4351
describe 'valid cvss31' do
4452
subject { valid_cvss31 }
@@ -154,6 +162,30 @@
154162
it_behaves_like 'a invalid cvss vector with version', 3.1
155163
end
156164

165+
describe 'invalid cvss31 with additional fields' do
166+
subject { invalid_cvss31_additional_fields }
167+
168+
it_behaves_like 'a invalid cvss vector with version', 3.1
169+
end
170+
171+
describe 'invalid cvss31 with additional fields missing temporal' do
172+
subject { invalid_cvss31_additional_fields_missing_temporal }
173+
174+
it_behaves_like 'a invalid cvss vector with version', 3.1
175+
end
176+
177+
describe 'invalid cvss31 with extra slash' do
178+
subject { invalid_cvss31_extra_slash }
179+
180+
it_behaves_like 'a invalid cvss vector with version', 3.1
181+
end
182+
183+
describe 'invalid cvss31 with wrong value for Exploit Code Maturity (E)' do
184+
subject { invalid_cvss31_wrong_value }
185+
186+
it_behaves_like 'a invalid cvss vector with version', 3.1
187+
end
188+
157189
describe 'correct vector' do
158190
[
159191
['CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L', 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L'],

0 commit comments

Comments
 (0)