github-mirrors/DependencyCheck
1
0
Fork 0
mirror of https://github.com/ysoftdevs/DependencyCheck.git synced 2026-03-25 02:21:28 +01:00
Code Issues Packages Projects Releases Wiki Activity

updated bundle audit score to be more accurate

Browse Source
This commit is contained in:
Jeremy Long
2016-05-01 15:39:12 -04:00
parent d0ca800a23
commit 7a2e1fd221
1 changed files with 16 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/RubyBundleAuditAnalyzer.java
View File

@@ -314,23 +314,23 @@ public class RubyBundleAuditAnalyzer extends AbstractFileTypeAnalyzer {
private void addCriticalityToVulnerability(String parentName, Vulnerability vulnerability, String nextLine) { private void addCriticalityToVulnerability(String parentName, Vulnerability vulnerability, String nextLine) {
if (null != vulnerability) { if (null != vulnerability) {
final String criticality = nextLine.substring(CRITICALITY.length()).trim(); final String criticality = nextLine.substring(CRITICALITY.length()).trim();
if ("High".equals(criticality)) { float score = -1.0f;
vulnerability.setCvssScore(8.5f); Vulnerability v = null;
} else if ("Medium".equals(criticality)) {
vulnerability.setCvssScore(5.5f);
} else if ("Low".equals(criticality)) {
vulnerability.setCvssScore(2.0f);
} else {
try { try {
//TODO wouldn't we want to do this for all items from bundle-audit? This v = cvedb.getVulnerability(vulnerability.getName());
//should give a more correct CVSS
Vulnerability v = cvedb.getVulnerability(vulnerability.getName());
vulnerability.setCvssScore(v.getCvssScore());
} catch (DatabaseException ex) { } catch (DatabaseException ex) {
vulnerability.setCvssScore(-1.0f);
LOGGER.debug("Unable to look up vulnerability {}", vulnerability.getName()); LOGGER.debug("Unable to look up vulnerability {}", vulnerability.getName());
} }
if (v != null) {
score = v.getCvssScore();
} else if ("High".equalsIgnoreCase(criticality)) {
score = 8.5f;
} else if ("Medium".equalsIgnoreCase(criticality)) {
score = 5.5f;
} else if ("Low".equalsIgnoreCase(criticality)) {
score = 2.0f;
} }
vulnerability.setCvssScore(score);
} }
LOGGER.debug(String.format("bundle-audit (%s): %s", parentName, nextLine)); LOGGER.debug(String.format("bundle-audit (%s): %s", parentName, nextLine));
} }