🧹 improve cvss version detection (#4692)

mondoohq · Sep 25, 2024 · fc20edb · fc20edb
1 parent 77779d0
commit fc20edb
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 1 deletion.
diff --git a/providers-sdk/v1/upstream/mvd/cvss/cvss.go b/providers-sdk/v1/upstream/mvd/cvss/cvss.go
@@ -122,7 +122,7 @@ func init() {
 
 const NoneVector = "0.0/CVSS:3.0"
 
-var CVSS_VERSION = regexp.MustCompile(`^.*\/CVSS:([\d.]+)(?:\/.*)*$`)
+var CVSS_VERSION = regexp.MustCompile(`^(?:.*\/)?CVSS:([\d.]+)(?:\/.*)*$`)
 
 func New(vector string) (*Cvss, error) {
 	if len(vector) == 0 {

diff --git a/providers-sdk/v1/upstream/mvd/cvss/cvss_test.go b/providers-sdk/v1/upstream/mvd/cvss/cvss_test.go
@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestCvss2Parsing(t *testing.T) {
@@ -113,6 +114,16 @@ func TestCvss31Parsing1(t *testing.T) {
 	assert.Equal(t, "High", c.Severity().String(), "severity properly extracted")
 }
 
+func TestCvss31WithoutScoreParsing(t *testing.T) {
+	c, err := New("CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H")
+	require.NoError(t, err, "could parse the cvss vector")
+	assert.True(t, c.Verify(), "valid cvss vector")
+	assert.Equal(t, "3.1", c.Version(), "vector format version")
+
+	// TODO: when the score prefix is missing we need to calculate the score
+	//assert.Equal(t, float32(7.5), c.Score, "score properly detected")
+}
+
 func TestCvss3Comparison(t *testing.T) {
 	c, err := New("9.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H")
 	assert.Nil(t, err, "could parse the cvss vector")