search

RedHatProductSecurity / cvss

CVSS2/3/4 library with interactive calculator for Python 2 and Python 3
GNU Lesser General Public License v3.0
79 stars 28 forks source link

clean_vector only sorts and cleans original vector string #43

Open bp4151 opened 1 year ago

bp4151 commented 1 year ago

I noticed there is a clean_vector function that returns the vector string from the object dictionary in correct CVSS order. Unfortunately, this only acts on the original vector string, and I am not seeing anything that acts on the modified vector string in the same way. This acts more like a reset_to_original_vector than a clean_vector

Suggestions:

  1. add a sort_vector_metrics that takes the cvss dictionary object and returns the vector string in the proper cvss order according to cvss.constants METRICS_ABBREVIATIONS. This way, regardless of changes to the cvss object, the new vector string is returned in the order expected by information security tooling.

Happy to code this myself if you folks have a contribution policy.

mprpic commented 1 year ago

@bp4151 So essentially you want the sorted version of CVSS3.vector, right? Yea, I think adding a new sorted_vector() method that compiles a full vector using the sorted values in METRICS_ABBREVIATIONS makes sense.

As for a contribution policy, is these something specific you're looking for? As long as your changes pass the automated linting and testing and a code review, then we're happy to merge your change.

bp4151 commented 1 year ago

@mprpic Awesome. I'll take a stab at these changes in a fork and try to create a PR. Usually I refrain from doing so unless the repo has a declared contributor program, but as long as you folks are OK, I'll give it a run...