Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

0.0 score handled properly #3

Closed
j--- opened this issue Jan 12, 2023 · 3 comments
Closed

0.0 score handled properly #3

j--- opened this issue Jan 12, 2023 · 3 comments

Comments

@j---
Copy link

j--- commented Jan 12, 2023

We will need a new element in the lookup table for 0.0. The problem is we also need a new macrovector for it.

Table look up something like

"..44..": {
    "base_score": "0.0",
    "qual_score": "None"
  }

Implementation question whether we actually cycle through all the options (004400, 004401, 004402, etc.) and map them all to 0.0, or do wild carding somehow.

This also requires a change to the macroVector() in index to generate the right 0.0 score, which is actually surprisingly annoying because all six impact metrics (VC, VI, VA, SC, SI, SA) have to have a value 'N', if it is just the first three, you don't want to generate a '4' for that macrovector because it will break the other scoring (so in general, 'N' 'N' 'N' should get mapped to '3' in the bitmask.

It's possible

else if(this.checkMetric("VC", "N")
                      && this.checkMetric("VI", "N")
                      && this.checkMetric("VA", "N")
                      && this.checkMetric("SC", "N")
                      && this.checkMetric("SI", "N")
                      && this.checkMetric("SA", "N")) {
                eq3 = 4

Would do it, with an equivalent branch for eq4.

@skontar
Copy link
Collaborator

skontar commented Jan 12, 2023

We can also treat 0.0 as a specific case and skip vector lookup. So it would be something like:

baseScore() {
            if(...condition for 0.0 is met...) {
                return 0.0
            else {
                lookup = String(Number(this.macroVector))
                value = this.cvssLookupData[lookup].base_score
                return value
            }
        }

It would not be clean solution, but if it is the only exception, given the ease of implementation it would be an elegant solution?

@skontar
Copy link
Collaborator

skontar commented Jan 16, 2023

How about this? #14

@skontar
Copy link
Collaborator

skontar commented Jan 18, 2023

Based on our discussion I believe that this issue is resolved for now. We may want to add some notes or warnings, but I am guessing that formal computation requirements document may be enough.

@skontar skontar closed this as completed Jan 18, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants