Closed NIGCH closed 8 months ago
Perhaps I was too hasty with the request to split the pull request.
I think it is necessary that the constants are also required in this pull request. https://github.com/dependency-check/dependency-check-sonar-plugin/pull/894/files#diff-ce8ce310fb93461c861183d57d10967a8bf3d7a2de59aa4053436ef5ef661817R38-R41
It seems that in the current code the score of CVSS and SonarQube has been mixed.
I think that makes sense, doesn't it?
I think that makes sense, doesn't it?
Yes, thanks, it looks good to me. Is the compatibility entry I've added correct?
I think that makes sense, doesn't it?
Yes, thanks, it looks good to me. Is the compatibility entry I've added correct?
Looks good.
Thank you @Reamer - much appreciated.
Thank you very much for your work. Is there any more code from the first pull request https://github.com/dependency-check/dependency-check-sonar-plugin/pull/894?
No, that's everything.
A tentative fix for https://github.com/dependency-check/dependency-check-sonar-plugin/issues/870.
A change to DependencyCheckUtils.severityToScore() also appears to be needed to always use the CVSS scores in the specification to map a severity string to a CVSS score, rather than the configurable thresholds which determine how CVSS scores map to SonarQube severities. However, this will be addressed in a later pull request.