From 7be18aedbc2aa7281ba0fc05941b2de2b49e3eb4 Mon Sep 17 00:00:00 2001
From: nscuro <nscuro@protonmail.com>
Date: Sat, 17 Jun 2023 16:49:13 +0200
Subject: [PATCH] feat(spec1-5): add support for `CVSSv4` scoring method

Signed-off-by: nscuro <nscuro@protonmail.com>
---
 convert.go   | 40 +++++++++++++++++++++++++++++++++++-----
 cyclonedx.go |  1 +
 2 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/convert.go b/convert.go
index 091616c..766fea4 100644
--- a/convert.go
+++ b/convert.go
@@ -77,11 +77,7 @@ func (b *BOM) convert(specVersion SpecVersion) {
 	}
 
 	if b.Vulnerabilities != nil {
-		for i := range *b.Vulnerabilities {
-			if specVersion < SpecVersion1_5 {
-				(*b.Vulnerabilities)[i].Rejected = ""
-			}
-		}
+		convertVulnerabilities(b.Vulnerabilities, specVersion)
 	}
 
 	if b.ExternalReferences != nil {
@@ -213,6 +209,29 @@ func convertLicenses(licenses *Licenses, specVersion SpecVersion) {
 	}
 }
 
+func convertVulnerabilities(vulns *[]Vulnerability, specVersion SpecVersion) {
+	if vulns == nil {
+		return
+	}
+
+	for i := range *vulns {
+		vuln := &(*vulns)[i]
+
+		if specVersion < SpecVersion1_5 {
+			vuln.Rejected = ""
+		}
+
+		if vuln.Ratings != nil {
+			for j := range *vuln.Ratings {
+				rating := &(*vuln.Ratings)[j]
+				if !specVersion.supportsScoringMethod(rating.Method) {
+					rating.Method = ScoringMethodOther
+				}
+			}
+		}
+	}
+}
+
 // serviceConverter modifies a Service such that it adheres to a given SpecVersion.
 func serviceConverter(specVersion SpecVersion) func(*Service) {
 	return func(s *Service) {
@@ -335,3 +354,14 @@ func (sv SpecVersion) supportsScope(scope Scope) bool {
 
 	return false
 }
+
+func (sv SpecVersion) supportsScoringMethod(method ScoringMethod) bool {
+	switch method {
+	case ScoringMethodCVSSv2, ScoringMethodCVSSv3, ScoringMethodCVSSv31, ScoringMethodOWASP, ScoringMethodOther:
+		return sv >= SpecVersion1_4
+	case ScoringMethodCVSSv4:
+		return sv >= SpecVersion1_5
+	}
+
+	return false
+}
diff --git a/cyclonedx.go b/cyclonedx.go
index 62597b5..35fb43a 100644
--- a/cyclonedx.go
+++ b/cyclonedx.go
@@ -446,6 +446,7 @@ const (
 	ScoringMethodCVSSv2  ScoringMethod = "CVSSv2"
 	ScoringMethodCVSSv3  ScoringMethod = "CVSSv3"
 	ScoringMethodCVSSv31 ScoringMethod = "CVSSv31"
+	ScoringMethodCVSSv4  ScoringMethod = "CVSSv4"
 	ScoringMethodOWASP   ScoringMethod = "OWASP"
 )