Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

clean_vector only sorts and cleans original vector string #43

Open
bp4151 opened this issue Mar 17, 2023 · 2 comments
Open

clean_vector only sorts and cleans original vector string #43

bp4151 opened this issue Mar 17, 2023 · 2 comments

Comments

@bp4151
Copy link

bp4151 commented Mar 17, 2023

I noticed there is a clean_vector function that returns the vector string from the object dictionary in correct CVSS order. Unfortunately, this only acts on the original vector string, and I am not seeing anything that acts on the modified vector string in the same way. This acts more like a reset_to_original_vector than a clean_vector

Suggestions:

  1. add a sort_vector_metrics that takes the cvss dictionary object and returns the vector string in the proper cvss order according to cvss.constants METRICS_ABBREVIATIONS. This way, regardless of changes to the cvss object, the new vector string is returned in the order expected by information security tooling.

Happy to code this myself if you folks have a contribution policy.

@mprpic
Copy link
Collaborator

mprpic commented Mar 17, 2023

@bp4151 So essentially you want the sorted version of CVSS3.vector, right? Yea, I think adding a new sorted_vector() method that compiles a full vector using the sorted values in METRICS_ABBREVIATIONS makes sense.

As for a contribution policy, is these something specific you're looking for? As long as your changes pass the automated linting and testing and a code review, then we're happy to merge your change.

@bp4151
Copy link
Author

bp4151 commented Mar 17, 2023

@mprpic Awesome. I'll take a stab at these changes in a fork and try to create a PR. Usually I refrain from doing so unless the repo has a declared contributor program, but as long as you folks are OK, I'll give it a run...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants