Merge pull request #263 from rubysec/cvssv3

reedloden · web-flow · commit 9261c15025c0 · 2016-06-24T21:01:33.000+02:00
Add CVSSv3 to the spec
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -49,8 +49,11 @@ bundle exec rspec
 * `date` \[Date\]: Disclosure date of the advisory.
 * `description` \[String\]: Multi-paragraph description of the vulnerability.
 * `cvss_v2` \[Float\]: The [CVSSv2] score for the vulnerability.
+* `cvss_v3` \[Float\]: The [CVSSv3] score for the vulnerability.
 * `unaffected_versions` \[Array\<String\>\] (optional): The version requirements for the
   unaffected versions of the Ruby library.
 * `patched_versions` \[Array\<String\>\]: The version requirements for the
   patched versions of the Ruby library.
 
+[CVSSv2]: https://www.first.org/cvss/v2/guide
+[CVSSv3]: https://www.first.org/cvss/user-guide
diff --git a/README.md b/README.md
@@ -61,6 +61,7 @@ Each advisory file contains the advisory information in [YAML] format:
 * `date` \[Date\]: Disclosure date of the advisory.
 * `description` \[String\]: Multi-paragraph description of the vulnerability.
 * `cvss_v2` \[Float\]: The [CVSSv2] score for the vulnerability.
+* `cvss_v3` \[Float\]: The [CVSSv3] score for the vulnerability.
 * `unaffected_versions` \[Array\<String\>\] (optional): The version requirements for the
   unaffected versions of the Ruby library.
 * `patched_versions` \[Array\<String\>\]: The version requirements for the
@@ -77,6 +78,6 @@ developed by the Open Security Foundation (OSF) and its contributors.
 [CVE]: http://cve.mitre.org/
 [OSVDB]: http://www.osvdb.org/
 [CVSSv2]: https://www.first.org/cvss/v2/guide
-[OSVDB]: http://www.osvdb.org/
+[CVSSv3]: https://www.first.org/cvss/user-guide
 [YAML]: http://www.yaml.org/
 [CONTRIBUTORS.md]: https://github.com/rubysec/ruby-advisory-db/blob/master/CONTRIBUTORS.md
diff --git a/spec/advisory_example.rb b/spec/advisory_example.rb
@@ -112,6 +112,21 @@
       end
     end
 
+    describe "cvss_v3" do
+      subject { advisory['cvss_v3'] }
+
+      it "may be nil or a Float" do
+        expect(subject).to be_kind_of(Float).or(be_nil)
+      end
+
+      case advisory['cvss_v3']
+      when Float
+        context "when a Float" do
+          it { expect((0.0)..(10.0)).to include(subject) }
+        end
+      end
+    end
+
     describe "patched_versions" do
       subject { advisory['patched_versions'] }
 
