Skip to content

Commit 2563eb7

Browse files
ziadhanyziadhany
committed
Resolve merge conflict
Change the style of cvss_printer display Add a new filter to print cvss vectors Change the table heading to Vertical Add support for CVSS vectors display Signed-off-by: ziadhany <ziadhany2016@gmail.com>
1 parent f1fad9f commit 2563eb7

5 files changed

Lines changed: 106 additions & 1 deletion

File tree

‎vulnerabilities/severity_systems.py‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,10 @@ def compute(self, scoring_elements: str) -> str:
3737
"""
3838
return NotImplementedError
3939

40+
def get(self, scoring_elements: str):
41+
""" """
42+
return None
43+
4044

4145
@dataclasses.dataclass(order=True)
4246
class Cvssv2ScoringSystem(ScoringSystem):
@@ -49,6 +53,9 @@ def compute(self, scoring_elements: str) -> str:
4953
"""
5054
return str(CVSS2(vector=scoring_elements).base_score)
5155

56+
def get(self, scoring_elements: str) -> dict:
57+
return CVSS2(vector=scoring_elements).as_json()
58+
5259

5360
CVSSV2 = Cvssv2ScoringSystem(
5461
identifier="cvssv2",
@@ -71,6 +78,9 @@ def compute(self, scoring_elements: str) -> str:
7178
"""
7279
return str(CVSS3(vector=scoring_elements).base_score)
7380

81+
def get(self, scoring_elements: str) -> dict:
82+
return CVSS3(vector=scoring_elements).as_json()
83+
7484

7585
CVSSV3 = Cvssv3ScoringSystem(
7686
identifier="cvssv3",

‎vulnerabilities/templates/vulnerability_details.html‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{% extends "base.html" %}
2+
{% load show_cvss %}
23
{% load humanize %}
34
{% load widget_tweaks %}
45
{% load static %}
@@ -52,6 +53,13 @@
5253
</span>
5354
</a>
5455
</li>
56+
<li data-tab="severities-vectors">
57+
<a>
58+
<span>
59+
Severities vectors ({{ severity_vectors|length }})
60+
</span>
61+
</a>
62+
</li>
5563
</ul>
5664
</div>
5765
<div id="tab-content">
@@ -297,6 +305,63 @@
297305
</table>
298306
</div>
299307

308+
<div class="tab-div content" data-content="severities-vectors">
309+
{% for severity_vector in severity_vectors %}
310+
{% if severity_vector.version == '2.0' %}
311+
Vector: {{ severity_vector.vectorString }}
312+
<table class="table is-bordered is-striped is-narrow is-hoverable is-fullwidth gray-header-border">
313+
<tr>
314+
<th>Exploitability (E)</th>
315+
<th>Access Vector (AV)</th>
316+
<th>Access Complexity (AC)</th>
317+
<th>Authentication (Au)</th>
318+
<th>Confidentiality Impact (C)</th>
319+
<th>Integrity Impact (I)</th>
320+
<th>Availability Impact (A)</th>
321+
</tr>
322+
<tr>
323+
<td>{{ severity_vector.exploitability|cvss_printer:"high,functional,unproven,proof_of_concept,not_defined" }}</td>
324+
<td>{{ severity_vector.accessVector|cvss_printer:"local,adjacent_network,network" }}</td>
325+
<td>{{ severity_vector.accessComplexity|cvss_printer:"high,medium,low" }}</td>
326+
<td>{{ severity_vector.authentication|cvss_printer:"multiple,single,none" }}</td>
327+
<td>{{ severity_vector.confidentialityImpact|cvss_printer:"none,partial,complete" }}</td>
328+
<td>{{ severity_vector.integrityImpact|cvss_printer:"none,partial,complete" }}</td>
329+
<td>{{ severity_vector.availabilityImpact|cvss_printer:"none,partial,complete" }}</td>
330+
</tr>
331+
</table>
332+
{% elif severity_vector.version == '3.1' or severity_vector.version == '3.0'%}
333+
Vector: {{ severity_vector.vectorString }}
334+
<table class="table is-bordered is-striped is-narrow is-hoverable is-fullwidth gray-header-border">
335+
<tr>
336+
<th>Attack Vector (AV)</th>
337+
<th>Attack Complexity (AC)</th>
338+
<th>Privileges Required (PR)</th>
339+
<th>User Interaction (UI)</th>
340+
<th>Scope (S)</th>
341+
<th>Confidentiality Impact (C)</th>
342+
<th>Integrity Impact (I)</th>
343+
<th>Availability Impact (A)</th>
344+
</tr>
345+
<tr>
346+
<td>{{ severity_vector.attackVector|cvss_printer:"network,adjacent_network,local,physical"}}</td>
347+
<td>{{ severity_vector.attackComplexity|cvss_printer:"low,high" }}</td>
348+
<td>{{ severity_vector.privilegesRequired|cvss_printer:"none,low,high" }}</td>
349+
<td>{{ severity_vector.userInteraction|cvss_printer:"none,required"}}</td>
350+
<td>{{ severity_vector.scope|cvss_printer:"unchanged,changed" }}</td>
351+
<td>{{ severity_vector.confidentialityImpact|cvss_printer:"high,low,none" }}</td>
352+
<td>{{ severity_vector.integrityImpact|cvss_printer:"high,low,none" }}</td>
353+
<td>{{ severity_vector.availabilityImpact|cvss_printer:"high,low,none" }}</td>
354+
</tr>
355+
</table>
356+
{% endif %}
357+
{% empty %}
358+
<tr>
359+
<td>
360+
There are no known CVSS vectors.
361+
</td>
362+
</tr>
363+
{% endfor %}
364+
</div>
300365
</div>
301366
</div>
302367
</section>

‎vulnerabilities/templatetags/__init__.py‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# VulnerableCode is a trademark of nexB Inc.
4+
# SPDX-License-Identifier: Apache-2.0
5+
# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
6+
# See https://github.com/nexB/vulnerablecode for support or download.
7+
# See https://aboutcode.org for more information about nexB OSS projects.
8+
#

‎vulnerabilities/templatetags/show_cvss.py‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
from django import template
2+
from django.utils.safestring import mark_safe
3+
4+
register = template.Library()
5+
6+
7+
@register.filter(is_safe=True)
8+
def cvss_printer(selected_vector, vector_values):
9+
"""highlight the selected vector value and return a list of paragraphs"""
10+
p_list = []
11+
selected_vector = selected_vector.lower()
12+
for vector_value in vector_values.split(","):
13+
if selected_vector == vector_value:
14+
p_list.append(f"<p class='has-text-black-bis mb-2'>{selected_vector}</p>")
15+
else:
16+
p_list.append(f"<p class='has-text-grey mb-2'>{vector_value}</p>")
17+
return mark_safe("".join(p_list))

‎vulnerabilities/views.py‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@
66
# See https://github.com/nexB/vulnerablecode for support or download.
77
# See https://aboutcode.org for more information about nexB OSS projects.
88
#
9-
109
from django.contrib import messages
1110
from django.core.exceptions import ValidationError
1211
from django.core.mail import send_mail
@@ -24,6 +23,7 @@
2423
from vulnerabilities.forms import PackageSearchForm
2524
from vulnerabilities.forms import VulnerabilitySearchForm
2625
from vulnerabilities.models import VulnerabilityStatusType
26+
from vulnerabilities.severity_systems import SCORING_SYSTEMS
2727
from vulnerabilities.utils import get_severity_range
2828
from vulnerablecode.settings import env
2929

@@ -130,6 +130,11 @@ def get_context_data(self, **kwargs):
130130
"severity_score_range": get_severity_range(
131131
{s.value for s in self.object.severities}
132132
),
133+
"severity_vectors": [
134+
SCORING_SYSTEMS[s.scoring_system].get(s.scoring_elements)
135+
for s in self.object.severities
136+
if s.scoring_elements
137+
],
133138
"references": self.object.references.all(),
134139
"aliases": self.object.aliases.all(),
135140
"affected_packages": self.object.affected_packages.all(),

0 commit comments

Comments
 (0)