fix findings

Author: TheTechromancer

bbot_server/models/base.py

@@ -1,7 +1,9 @@
 import logging
 from hashlib import sha1
+from typing import Union
 
 from bbot.models.pydantic import BBOTBaseModel
+from bbot_server.errors import BBOTServerValueError
 from bbot_server.utils.misc import _sanitize_mongo_query
 
 log = logging.getLogger("bbot_server.models")
@@ -13,3 +15,33 @@ def model_dump(self, *args, mode="json", exclude_none=True, **kwargs):
 
     def sha1(self, data: str) -> str:
         return sha1(data.encode()).hexdigest()
+
+
+class BaseScore:
+    """Base class for mapping string levels to numeric scores."""
+
+    levels: dict = {}
+    name: str = "score"
+
+    @classmethod
+    def to_score(cls, value: Union[str, int]) -> int:
+        """Convert a level to its numeric score."""
+        if isinstance(value, int):
+            if value not in cls.levels.values():
+                raise BBOTServerValueError(f'Invalid {cls.name} score: "{value}". Must be between 1 and 5.')
+            return value
+        if isinstance(value, str):
+            value = value.upper()
+            if value not in cls.levels:
+                raise BBOTServerValueError(
+                    f'Invalid {cls.name} string: "{value}". Must be one of {list(cls.levels.keys())}'
+                )
+            return cls.levels[value]
+
+    @classmethod
+    def to_str(cls, score: int) -> str:
+        """Convert a numeric score to its string equivalent."""
+        for level, value in cls.levels.items():
+            if value == score:
+                return level
+        raise BBOTServerValueError(f"Invalid {cls.name} score: {score}. Must be between 1 and 5.")

bbot_server/modules/findings/findings_api.py

@@ -247,7 +247,7 @@ async def compute_stats(self, asset, stats):
         max_severity_score = max([asset.finding_max_severity_score, finding_stats.get("max_severity_score", 0)])
         finding_stats["max_severity_score"] = max_severity_score
         if max_severity_score > 0:
-            max_severity = SeverityScore.to_severity(max_severity_score)
+            max_severity = SeverityScore.to_str(max_severity_score)
         else:
             max_severity = None
         finding_stats["max_severity"] = max_severity
@@ -304,8 +304,8 @@ async def _insert_or_update_finding(self, finding: Finding, asset, event=None):
                 {
                     "$set": {
                         "modified": self.helpers.utc_now(),
-                        "confidence": finding.confidence,
-                        "severity": finding.severity,
+                        "confidence": finding.confidence_score,
+                        "severity_score": finding.severity_score,
                     }
                 },
             )
@@ -318,7 +318,7 @@ async def _insert_or_update_finding(self, finding: Finding, asset, event=None):
         severity_scores = {SeverityScore.to_score(severity) for severity in finding_severities}
         if severity_scores:
             asset.finding_max_severity_score = max(severity_scores)
-            asset.finding_max_severity = SeverityScore.to_severity(asset.finding_max_severity_score)
+            asset.finding_max_severity = SeverityScore.to_str(asset.finding_max_severity_score)
         else:
             asset.finding_max_severity_score = 0
             asset.finding_max_severity = None

bbot_server/modules/findings/findings_models.py

@@ -1,12 +1,15 @@
+from typing import Annotated, Optional
 from pydantic import Field, computed_field
-from typing import Annotated, Optional, Union
 
-from bbot_server.errors import BBOTServerValueError
+from bbot_server.models.base import BaseScore
 from bbot_server.models.asset_models import BaseAssetFacet
 
 # Severity levels as constants
 SEVERITY_LEVELS = {"INFO": 1, "LOW": 2, "MEDIUM": 3, "HIGH": 4, "CRITICAL": 5}
 
+# Confidence levels as constants
+CONFIDENCE_LEVELS = {"UNKNOWN": 1, "LOW": 2, "MODERATE": 3, "HIGH": 4, "CONFIRMED": 5}
+
 # severity colors for rich, etc. (bash color names)
 SEVERITY_COLORS = {
     1: "deep_sky_blue1",  # INFO = blue
@@ -17,31 +20,18 @@
 }
 
 
-class SeverityScore:
+class SeverityScore(BaseScore):
     """Maps severity levels to numeric scores and provides conversion methods."""
 
-    @classmethod
-    def to_score(cls, severity: Union[str, int]) -> int:
-        """Convert a severity level to its numeric score."""
-        if isinstance(severity, int):
-            if severity not in SEVERITY_LEVELS.values():
-                raise BBOTServerValueError(f'Invalid severity score: "{severity}". Must be between 1 and 5.')
-            return severity
-        if isinstance(severity, str):
-            severity = severity.upper()
-            if severity not in SEVERITY_LEVELS:
-                raise BBOTServerValueError(
-                    f'Invalid severity string: "{severity}". Must be one of {list(SEVERITY_LEVELS.keys())}'
-                )
-            return SEVERITY_LEVELS[severity]
-
-    @classmethod
-    def to_severity(cls, score: int) -> str:
-        """Convert a numeric score to its string equivalent."""
-        for level, value in SEVERITY_LEVELS.items():
-            if value == score:
-                return level
-        raise BBOTServerValueError(f"Invalid severity score: {score}. Must be between 1 and 5.")
+    levels = SEVERITY_LEVELS
+    name = "severity"
+
+
+class ConfidenceScore(BaseScore):
+    """Maps confidence levels to numeric scores and provides conversion methods."""
+
+    levels = CONFIDENCE_LEVELS
+    name = "confidence"
 
 
 class Finding(BaseAssetFacet):
@@ -53,11 +43,12 @@ class Finding(BaseAssetFacet):
         ge=1,
         le=5,
     )
-    confidence: Annotated[int, "indexed"] = Field(
-        description="Confidence level of the vulnerability (1-5)",
+    confidence_score: Annotated[int, "indexed"] = Field(
+        description="Numeric confidence score of the vulnerability (1-5)",
         ge=1,
         le=5,
         default=1,
+        alias="confidence",
     )
     temptation: Optional[Annotated[int, "indexed"]] = Field(
         description="Likelihood of an attacker taking interest in this finding (1-5)",
@@ -75,6 +66,10 @@ def __init__(self, **kwargs):
         severity = kwargs.pop("severity", None)
         if severity is not None:
             kwargs["severity_score"] = SeverityScore.to_score(severity)
+        # convert confidence to confidence_score
+        confidence = kwargs.pop("confidence", None)
+        if confidence is not None:
+            kwargs["confidence_score"] = ConfidenceScore.to_score(confidence)
         super().__init__(**kwargs)
 
     @computed_field
@@ -83,7 +78,15 @@ def severity(self) -> str:
         """
         The string version of the severity score, e.g. 3 -> "MEDIUM", 4 -> "HIGH", etc.
         """
-        return SeverityScore.to_severity(self.severity_score)
+        return SeverityScore.to_str(self.severity_score)
+
+    @computed_field
+    @property
+    def confidence(self) -> str:
+        """
+        The string version of the confidence score, e.g. 1 -> "UNKNOWN", 5 -> "CONFIRMED", etc.
+        """
+        return ConfidenceScore.to_str(self.confidence_score)
 
     @computed_field
     @property