Fix missing parts in the vector

Add some tests

Signed-off-by: ziadhany <ziadhany2016@gmail.com>

Author: ziadhany

vulnerabilities/tests/test_convert_cvsss_vectors.py

@@ -0,0 +1,21 @@
+import pytest
+
+from vulnerabilities.utils import convert_cvssv2_vector_to_cvssv3_vector
+
+
+@pytest.mark.parametrize(
+    "cvssv2_vector,cvssv3_vector",
+    [
+        ("AV:A/AC:H/Au:S/C:P/I:P/A:P", "CVSS:3.0/AV:A/UI:R/AC:H/PR:L/C:L/I:L/A:L/S:C"),
+        ("AV:L/AC:L/Au:N/C:N/I:N/A:P", "CVSS:3.0/AV:L/UI:N/AC:L/PR:N/C:N/I:N/A:L/S:C"),
+        ("AV:L/AC:L/Au:N/C:P/I:P/A:C", "CVSS:3.0/AV:L/UI:N/AC:L/PR:N/C:L/I:L/A:H/S:C"),
+        ("AV:L/AC:L/Au:N/C:P/I:P/A:N", "CVSS:3.0/AV:L/UI:N/AC:L/PR:N/C:L/I:L/A:N/S:C"),
+        ("AV:L/AC:L/Au:N/C:P/I:P/A:P", "CVSS:3.0/AV:L/UI:N/AC:L/PR:N/C:L/I:L/A:L/S:C"),
+        ("AV:N/AC:L/Au:N/C:P/I:N/A:N", "CVSS:3.0/AV:N/UI:N/AC:L/PR:N/C:L/I:N/A:N/S:C"),
+        ("AV:N/AC:L/Au:N/C:P/I:P/A:P", "CVSS:3.0/AV:N/UI:N/AC:L/PR:N/C:L/I:L/A:L/S:C"),
+        ("AV:N/AC:M/Au:N/C:N/I:P/A:N", "CVSS:3.0/AV:N/UI:R/AC:L/PR:N/C:N/I:L/A:N/S:C"),
+        ("AV:N/AC:M/Au:N/C:P/I:N/A:N", "CVSS:3.0/AV:N/UI:R/AC:L/PR:N/C:L/I:N/A:N/S:C"),
+    ],
+)
+def convert_cvssv2_to_cvssv3(cvssv2_vector, cvssv3_vector):
+    assert convert_cvssv2_vector_to_cvssv3_vector(cvssv2_vector) == cvssv3_vector

vulnerabilities/utils.py

@@ -510,7 +510,7 @@ def convert_cvssv2_vector_to_cvssv3_vector(cvssv2_vector):
     Returns the CVSSv3 vector
     >>> cvssv2_vector = "AV:L/AC:L/Au:M/C:N/I:P/A:C/E:U/RL:W/RC:ND/CDP:L/TD:H/CR:ND/IR:ND/AR:M"
     >>> cvssv3_vector = convert_cvssv2_vector_to_cvssv3_vector(cvssv2_vector)
-    >>> assert cvssv3_vector == 'AV:L/AC:L/PR:H/C:N/I:L/A:H/S:C/E:U/RL:W/RC:X'
+    >>> assert cvssv3_vector == 'CVSS:3.0/AV:L/UI:N/AC:L/PR:H/C:N/I:L/A:H/S:C/E:U/RL:W/RC:X'
     """
     cvss2_metrics = CVSS2(cvssv2_vector).metrics
     cvss3_metrics = {}
@@ -520,16 +520,26 @@ def convert_cvssv2_vector_to_cvssv3_vector(cvssv2_vector):
         # L => (L|P) (usually L)
         cvss3_metrics["AV"] = "L"
 
+    elif cvss2_metrics["AV"] == "A":
+        # A => A
+        cvss3_metrics["AV"] = "A"
+
+    elif cvss2_metrics["AV"] == "N":
+        # N => N
+        cvss3_metrics["AV"] = "N"
+
     # AC split into AC and UI
+    cvss3_metrics["UI"] = "R"
     if cvss2_metrics["AC"] == "L":
         cvss3_metrics["AC"] = "L"
+        cvss3_metrics["UI"] = "N"
+
+    elif cvss2_metrics["AC"] == "M":
+        cvss3_metrics["AC"] = "L"
 
     elif cvss2_metrics["AC"] == "H":
         cvss3_metrics["AC"] = "H"
 
-    # What about M and UI ?
-    # TODO
-
     # Au => PR (needs manual optimization)
     if cvss2_metrics.get("Au") == "N":
         # N => N
@@ -567,8 +577,14 @@ def convert_cvssv2_vector_to_cvssv3_vector(cvssv2_vector):
     elif cvss2_metrics.get("E") == "ND":
         cvss3_metrics["E"] = "X"
 
-    else:
-        cvss3_metrics["E"] = cvss2_metrics.get("E")  # F => F, H => H, U => U
+    elif cvss2_metrics.get("E") == "F":
+        cvss3_metrics["E"] = "F"
+
+    elif cvss2_metrics.get("E") == "H":
+        cvss3_metrics["E"] = "H"
+
+    elif cvss2_metrics.get("E") == "U":
+        cvss3_metrics["E"] = "U"
 
     # RL
     # ND => X, OF => O, TF => T, W => W, U => U
@@ -580,8 +596,12 @@ def convert_cvssv2_vector_to_cvssv3_vector(cvssv2_vector):
 
     elif cvss2_metrics.get("RL") == "TF":
         cvss3_metrics["RL"] = "P"
-    else:
-        cvss3_metrics["RL"] = cvss2_metrics.get("RL")  # W => W, U => U
+
+    elif cvss2_metrics.get("RL") == "W":
+        cvss3_metrics["RL"] = "W"
+
+    elif cvss2_metrics.get("RL") == "U":
+        cvss3_metrics["RL"] = "U"
 
     # RC
     # C = > C, UR = > R, UC = > U, ND = > X
@@ -600,4 +620,4 @@ def convert_cvssv2_vector_to_cvssv3_vector(cvssv2_vector):
     cvssv3_vector = ""
     for k, v in cvss3_metrics.items():
         cvssv3_vector += f"/{k}:{v}"
-    return cvssv3_vector[1::]
+    return "CVSS:3.0/" + cvssv3_vector[1::]