File Coverage

blib/lib/CVSS/Base.pm

Criterion	Covered	Total	%
statement	131	166	78.9
branch	34	56	60.7
condition	13	20	65.0
subroutine	30	53	56.6
pod	28	38	73.6
total	236	333	70.8

package CVSS::Base;

use feature ':5.10';
use strict;
use utf8;
use warnings;

use Carp ();

our $VERSION = '1.14';
$VERSION =~ tr/_//d;    ## no critic

use overload '""' => \&to_string, fallback => 1;

use constant DEBUG => $ENV{CVSS_DEBUG};

sub import {

    my $class = shift;

    my $ATTRIBUTES = $class->ATTRIBUTES;

    for my $method (keys %{$ATTRIBUTES}) {

        no strict 'refs';
        no warnings 'uninitialized';
        no warnings 'redefine';

        my $metric = $ATTRIBUTES->{$method};

        # Long method name
        *{"${class}::${method}"} = sub {
            @_ > 1 ? $_[0]->_metric_name_to_value($metric, $_[1]) : $_[0]->_metric_value_to_name($metric);
        };

        # Create metric alias
        *{"${class}::${metric}"} = sub { $_[0]->M($metric) };

    }

}

sub new {

    my ($class, %params) = @_;

    $params{metrics}       //= {};
    $params{scores}        //= {};
    $params{vector_string} //= undef;

    my $self = bless {%params}, $class;

    if ($self->version !~ /(2.0|3.[0-1]|4.0)/) {
        Carp::croak 'Invalid CVSS version';
    }

    if ($self->{vector_string}) {

        DEBUG and say STDERR sprintf('-- Validate vector string: %s', $self->VECTOR_STRING_REGEX);

        if ($self->{vector_string} !~ $self->VECTOR_STRING_REGEX) {
            Carp::croak 'Invalid CVSS vector string';
        }

        $self->calculate_score;

    }

    return $self;

}

sub from_vector_string {

    my ($class, $vector_string) = @_;

    my %metrics = split /[\/:]/, $vector_string;
    my $version = delete $metrics{CVSS} || '2.0';

    DEBUG and say STDERR "-- Vector String: $vector_string";
    return $class->new(version => $version, metrics => \%metrics, vector_string => $vector_string);

}

sub ATTRIBUTES          { {} }
sub SCORE_SEVERITY      { {} }
sub NOT_DEFINED_VALUE   { }
sub VECTOR_STRING_REGEX {qw{}}
sub METRIC_GROUPS       { {} }
sub METRIC_NAMES        { {} }
sub METRIC_VALUES       { {} }


sub _metric_name_to_value {
    my ($self, $metric, $name) = @_;
    $name =~ s/\s/_/g;
    $self->metrics->{$metric} = $self->METRIC_NAMES->{$metric}->{names}->{$name};
    return $self;
}

sub _metric_value_to_name {
    my ($self, $metric) = @_;
    $self->METRIC_NAMES->{$metric}->{values}->{$self->metrics->{$metric}};
}

sub version       { shift->{version}       || Carp::croak 'Missing CVSS version' }
sub vector_string { $_[0]->{vector_string} || $_[0]->to_vector_string }
sub metrics       { shift->{metrics} }
sub scores        { shift->{scores} }


# Scores & severities
sub base_score    { shift->{scores}->{base} }
sub base_severity { $_[0]->score_to_severity($_[0]->base_score) }

# CVSS 2.0/3.x scores & severities
sub temporal_score         { shift->{scores}->{temporal} }
sub temporal_severity      { $_[0]->score_to_severity($_[0]->temporal_score) }
sub environmental_score    { shift->{scores}->{environmental} }
sub environmental_severity { $_[0]->score_to_severity($_[0]->environmental_score) }

# Extra 2.0/3.x scores
sub exploitability_score  { shift->{scores}->{exploitability} }
sub impact_score          { shift->{scores}->{impact} }
sub modified_impact_score { shift->{scores}->{modified_impact} }


# JSON-style alias
sub vectorString          { shift->vector_string }
sub baseScore             { shift->base_score }
sub baseSeverity          { shift->base_severity }
sub temporalScore         { shift->temporal_score }
sub temporalSeverity      { shift->temporal_severity }
sub environmentalScore    { shift->environmental_score }
sub environmentalSeverity { shift->environmental_severity }


sub metric_group_is_set {

    my ($self, $type) = @_;

    for (@{$self->METRIC_GROUPS->{$type}}) {
        return 1 if ($self->M($_) && $self->M($_) ne $self->NOT_DEFINED_VALUE);
    }

}

sub metric {
    my ($self, $metric) = @_;
    my $value = $self->M($metric);

    return $self->METRIC_NAMES->{$metric}->{values}->{$value};
}

sub M { $_[0]->metrics->{$_[1]} }

sub score_to_severity {

    my ($self, $score) = @_;

    return unless (!!$score);

    my $SCORE_SEVERITY = $self->SCORE_SEVERITY;

    foreach (keys %{$SCORE_SEVERITY}) {
        my $range = $SCORE_SEVERITY->{$_};
        if ($score >= $range->{min} && $score <= $range->{max}) {
            return $_;
        }
    }

    Carp::croak 'Unknown severity';

}

sub calculate_score { Carp::croak sprintf('%s->calculate_score() is not implemented in subclass', ref(shift)) }

sub to_xml { Carp::croak sprintf('%s->to_xml() is not implemented in subclass', ref(shift)) }

sub to_string { shift->to_vector_string }

sub to_vector_string {

    my ($self) = @_;

    my $metrics = $self->metrics;
    my @vectors = ();

    if ($self->version > 2.0) {
        push @vectors, sprintf('CVSS:%s', $self->version);
    }

    foreach my $metric (@{$self->METRIC_GROUPS->{base}}) {
        return if (!$metrics->{$metric});
        push @vectors, sprintf('%s:%s', $metric, $metrics->{$metric});
    }

    my @other_metrics = ();

    push @other_metrics, @{$self->METRIC_GROUPS->{threat}        || []};    # CVSS 4.0
    push @other_metrics, @{$self->METRIC_GROUPS->{temporal}      || []};    # CVSS 2.0-3.x
    push @other_metrics, @{$self->METRIC_GROUPS->{environmental} || []};    # CVSS 2.0-3.x-4.0
    push @other_metrics, @{$self->METRIC_GROUPS->{supplemental}  || []};    # CVSS 4.0

    foreach my $metric (@other_metrics) {
        if (defined $metrics->{$metric} && $metrics->{$metric} ne $self->NOT_DEFINED_VALUE) {
            push @vectors, sprintf('%s:%s', $metric, $metrics->{$metric});
        }
    }

    return join '/', @vectors;

}

sub TO_JSON {

    my ($self) = @_;

    # Required JSON fields:
    #   CVSS == v2.0: version, vectorString and baseScore
    #   CVSS >= v3.0: version, vectorString, baseScore and baseSeverity

    $self->calculate_score unless ($self->base_score);

    my $json = {
        version      => sprintf('%.1f', $self->version),
        vectorString => $self->vector_string,
        baseScore    => $self->base_score
    };

    if ($self->version > 2.0) {
        $json->{baseSeverity} = $self->base_severity;
    }

    my $metrics    = $self->metrics;
    my %attributes = reverse(%{$self->ATTRIBUTES});

    foreach my $metric (@{$self->METRIC_GROUPS->{base}}) {
        $json->{$attributes{$metric}} = $self->METRIC_NAMES->{$metric}->{values}->{$metrics->{$metric}};
    }

    my @other_metrics = ();

    push @other_metrics, @{$self->METRIC_GROUPS->{threat}        || []};    # CVSS 4.0
    push @other_metrics, @{$self->METRIC_GROUPS->{temporal}      || []};    # CVSS 2.0-3.x
    push @other_metrics, @{$self->METRIC_GROUPS->{environmental} || []};    # CVSS 2.0-3.x-4.0
    push @other_metrics, @{$self->METRIC_GROUPS->{supplemental}  || []};    # CVSS 4.0

    foreach my $metric (@other_metrics) {
        if ($metrics->{$metric} && $metrics->{$metric} ne $self->NOT_DEFINED_VALUE) {
            $json->{$attributes{$metric}} = $self->METRIC_NAMES->{$metric}->{values}->{$metrics->{$metric}};
        }
    }

    if ($self->version <= 3.1) {

        if ($self->metric_group_is_set('temporal')) {

            $json->{temporalScore} = $self->temporal_score;

            if ($self->version != 2.0) {
                $json->{temporalSeverity} = $self->temporal_severity;
            }

        }

        if ($self->metric_group_is_set('environmental')) {

            $json->{environmentalScore} = $self->environmental_score;

            if ($self->version != 2.0) {
                $json->{environmentalSeverity} = $self->environmental_severity;
            }

        }

    }

    # CVSS 4.0 ???

    # environmentalScore
    # environmentalSeverity
    # threatScore
    # threatSeverity

    return $json;

}

1;
__END__