Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: ignore trailing slash in GH CVSS strings #357

Merged
merged 2 commits into from
Oct 24, 2023

Conversation

willmurphyscode
Copy link
Contributor

Sometimes these strings have a trailing slash; ignore the trailing slash rather than throwing away the entire CVSS info because of it.

I think that an otherwise well-formed CVSS that happens to have a / on the end shouldn't be thrown away just because of the /.

Previously, there were a lot of log entries like this:

[ERROR] error transforming CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N/, skipping it for GHSA-gr4j-r575-g665
Traceback (most recent call last):
  File "/home/runner/work/vunnel/vunnel/src/vunnel/providers/github/parser.py", line 551, in _make_cvss
    cvss3_obj = CVSS3(cvss_vector)
  File "/home/runner/.virtualenvs/vunnel-A95CY2kd-py3.10/lib/python3.10/site-packages/cvss/cvss3.py", line 114, in __init__
    self.parse_vector()
  File "/home/runner/.virtualenvs/vunnel-A95CY2kd-py3.10/lib/python3.10/site-packages/cvss/cvss3.py", line 133, in parse_vector

Sometimes these strings have a trailing slash; ignore the trailing slash
rather than throwing away the entire CVSS info because of it.

Signed-off-by: Will Murphy <[email protected]>
@willmurphyscode willmurphyscode added the run-pr-quality-gate Triggers running of quality gate on PRs label Oct 24, 2023
@willmurphyscode willmurphyscode merged commit eaf006f into main Oct 24, 2023
6 checks passed
@willmurphyscode willmurphyscode deleted the fix/ignore-trailing-slash-gh-cvss branch October 24, 2023 15:33
@wagoodman wagoodman removed the run-pr-quality-gate Triggers running of quality gate on PRs label Oct 27, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants