Merge pull request #509 from ColonelThirtyTwo/cvssv4-2

Add CVSS v4 Support

ghostwriter/reporting/migrations/0055_auto_20240924_2108.py

@@ -0,0 +1,33 @@
+# Generated by Django 3.2.19 on 2024-09-24 21:08
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('reporting', '0054_set_text_defaults'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='finding',
+            name='cvss_score',
+            field=models.FloatField(blank=True, help_text='Set the CVSS score for this finding', null=True, verbose_name='CVSS Score'),
+        ),
+        migrations.AlterField(
+            model_name='finding',
+            name='cvss_vector',
+            field=models.CharField(blank=True, default='', help_text='Set the CVSS vector for this finding', max_length=255, verbose_name='CVSS Vector'),
+        ),
+        migrations.AlterField(
+            model_name='reportfindinglink',
+            name='cvss_score',
+            field=models.FloatField(blank=True, help_text='Set the CVSS score for this finding', null=True, verbose_name='CVSS Score'),
+        ),
+        migrations.AlterField(
+            model_name='reportfindinglink',
+            name='cvss_vector',
+            field=models.CharField(blank=True, default='', help_text='Set the CVSS vector for this finding', max_length=255, verbose_name='CVSS Vector'),
+        ),
+    ]

ghostwriter/reporting/models.py

@@ -193,16 +193,16 @@ class Finding(models.Model):
         help_text="Provide notes for your team that describes how the finding is intended to be used or edited during editing",
     )
     cvss_score = models.FloatField(
-        "CVSS Score v3.0",
+        "CVSS Score",
         blank=True,
         null=True,
         help_text="Set the CVSS score for this finding",
     )
     cvss_vector = models.CharField(
-        "CVSS Vector v3.0",
+        "CVSS Vector",
         blank=True,
         default="",
-        max_length=54,
+        max_length=255,
         help_text="Set the CVSS vector for this finding",
     )
     tags = TaggableManager(blank=True)
@@ -644,16 +644,16 @@ class ReportFindingLink(models.Model):
         help_text="Assign the task of editing this finding to a specific operator - defaults to the operator that added it to the report",
     )
     cvss_score = models.FloatField(
-        "CVSS Score v3.0",
+        "CVSS Score",
         blank=True,
         null=True,
         help_text="Set the CVSS score for this finding",
     )
     cvss_vector = models.CharField(
-        "CVSS Vector v3.0",
+        "CVSS Vector",
         blank=True,
         default="",
-        max_length=54,
+        max_length=255,
         help_text="Set the CVSS vector for this finding",
     )
     extra_fields = models.JSONField(default=dict)

ghostwriter/reporting/templates/reporting/finding_form.html

@@ -1,8 +1,6 @@
 {% extends "base_generic.html" %}
 
-{% load crispy_forms_tags %}
-
-{% load custom_tags %}
+{% load crispy_forms_tags custom_tags static %}
 
 {% block pagetitle %}Finding Form{% endblock %}
 
@@ -56,11 +54,6 @@
 {% endblock %}
 
 {%  block morescripts %}
-    <script>
-      {%  comment %} Prepare CVSS calculator {% endcomment %}
-      $(document).ready(function () {
-        prepareCVSSCalc()
-      });
-    </script>
+    {% include "snippets/cvss_scripts.html" %}
 {% endblock %}
 

ghostwriter/reporting/templates/reporting/local_edit.html

@@ -184,6 +184,7 @@
 {% endblock %}
 
 {% block morescripts %}
+  {% include "snippets/cvss_scripts.html" %}
   <script>
     {% comment %} Connect to channel for finding-specific notifications {% endcomment %}
     const ws_finding = new WebSocket(
@@ -201,11 +202,6 @@
       console.error('Finding notification WebSocket closed unexpectedly');
     };
 
-    {%  comment %} Prepare CVSS calculator {% endcomment %}
-    $(document).ready(function () {
-      prepareCVSSCalc()
-    });
-
     {% comment %} Script for the WYSIWYG editor's AutoComplete {% endcomment %}
     let evidenceFiles = [
       {text: '\{\{.caption\}\}', value: '\{\{.caption\}\}'},

ghostwriter/reporting/templates/snippets/cvss_scripts.html

@@ -0,0 +1,55 @@
+{% load static %}
+
+<!-- CVSS V3 Calculator -->
+<!--
+    Copyright (c) 2019, FIRST.ORG, INC.
+    All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without modification, are permitted provided that the
+    following conditions are met:
+    1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following
+    disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the
+    following disclaimer in the documentation and/or other materials provided with the distribution.
+    3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote
+    products derived from this software without specific prior written permission.
+
+    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+    DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+    SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+    SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+    WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+    OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+-->
+<!-- CVSS V4 Calculator -->
+<!--
+    Copyright (c) 2023 FIRST.ORG, Inc., Red Hat, and contributors
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+
+    1. Redistributions of source code must retain the above copyright notice, this
+    list of conditions and the following disclaimer.
+
+    2. Redistributions in binary form must reproduce the above copyright notice,
+    this list of conditions and the following disclaimer in the documentation
+    and/or other materials provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+    AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+    IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+    DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+    FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+    DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+    SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+    CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+    OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+    OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+-->
+
+<link rel="stylesheet" href="{% static 'css/cvss_styles.css' %}">
+<script src="{% static 'js/cvss/v3_calc.js' %}"></script>
+<script src="{% static 'js/cvss/v4_score.js' %}"></script>
+<script src="{% static 'js/cvss/v4_vector.js' %}"></script>
+<script src="{% static 'js/cvss/ui.js' %}"></script>

ghostwriter/reporting/templates/snippets/cvss_ui.html

@@ -0,0 +1,50 @@
+<!-- CVSS -->
+<!--
+Copyright (c) 2015, FIRST.ORG, INC.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the
+following conditions are met:
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following
+disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the
+following disclaimer in the documentation and/or other materials provided with the distribution.
+3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote
+products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+-->
+
+<div id="cvss-v3-calculator" class="form-row cvss-calculator">
+    <h2>CVSS v3.1</h2>
+    <button class="mt-2 mb-2 btn btn-outline-secondary cvss-switch">Switch to v4</button>
+
+    <div class="cvss-buttons">
+        {% include "snippets/cvss_ui_v3.html" %}
+    </div>
+
+    <div class="scoreRating">
+        <span class="baseMetricScore"></span>
+        <span class="baseSeverity">Select values for all base metrics</span>
+    </div>
+</div>
+
+<div id="cvss-v4-calculator" class="form-row cvss-calculator" style="display: none">
+    <h2>CVSS v4</h2>
+    <button class="mt-2 mb-2 btn btn-outline-secondary cvss-switch">Switch to v3</button>
+
+    <div class="cvss-buttons">
+        {% include "snippets/cvss_ui_v4.html" %}
+    </div>
+
+    <div class="scoreRating">
+        <span class="baseMetricScore"></span>
+        <span class="baseSeverity">Select values for all base metrics</span>
+    </div>
+</div>