summaryrefslogtreecommitdiff
path: root/macros/latex/contrib/cvss/cvss.dtx
diff options
context:
space:
mode:
Diffstat (limited to 'macros/latex/contrib/cvss/cvss.dtx')
-rw-r--r--macros/latex/contrib/cvss/cvss.dtx385
1 files changed, 203 insertions, 182 deletions
diff --git a/macros/latex/contrib/cvss/cvss.dtx b/macros/latex/contrib/cvss/cvss.dtx
index 522be904cb..dee4061ab7 100644
--- a/macros/latex/contrib/cvss/cvss.dtx
+++ b/macros/latex/contrib/cvss/cvss.dtx
@@ -77,7 +77,7 @@ and the derived files cvss.ins,
%</internal>
%<*package>
\NeedsTeXFormat{LaTeX2e}
-\ProvidesPackage{cvss}[2022/11/03 First Release]
+\ProvidesPackage{cvss}[2022/12/02 v1.1.0 ]
%</package>
%<*driver>
\documentclass{l3doc}
@@ -88,6 +88,7 @@ and the derived files cvss.ins,
\setlength{\parindent}{0pt}
\begin{document}
\DocInput{\jobname.dtx}
+ \newpage
\PrintChanges
\PrintIndex
\end{document}
@@ -111,9 +112,10 @@ and the derived files cvss.ins,
%\maketitle
% \tableofcontents
%
+% \newpage
% \section{Introduction}
%
-% The \textsf{cvss} package allows the user to compute CVSS3.1 base scores and use them in documents. The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the characteristics and severity of software vulnerabilities. CVSS consists of three metric groups: Base, Temporal, and Environmental.
+% The \textsf{cvss} package allows the user to compute CVSS 3.1 base scores and use them in documents. The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the characteristics and severity of software vulnerabilities. CVSS consists of three metric groups: Base, Temporal, and Environmental.
%
% This packages only deal with Base score. Temporal and Environental scores will be part of a future release.
%
@@ -143,104 +145,104 @@ and the derived files cvss.ins,
%
% \subsection{Direct Macros}
% \begin{function}{\cvssScore}
- % \begin{syntax}
- % \cs{cvssScore} \Arg{CVSS string}
- % \end{syntax}
+% \changes{v1.0.0}{2022/10/22}{Full CVSS vector as input is now supported}
+% \changes{v1.1.0}{2022/12/02}{Full CVSS vector as input is now supported}
+% \begin{syntax}
+% \cs{cvssScore} \Arg{CVSS string}
+% \end{syntax}
% This is the main macro of this package, responsible for computing the base CVSS 3.1 score of an \marg{input vector} (without \texttt{CVSS3.1/}). The output of this macro is a floating point CVSS score, for example \texttt{5.4}.
% \end{function}
%
-% \noindent\llap{\bfseries \textcolor{red}{Important!}\qquad}\indent
-% \textbf{The CVSS vector string must be stripped from the \texttt{CVSS3.1/}!}
%
%
% \begin{verbatim}
-% \cvssScore{AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}
+% \cvssScore{CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}
% \end{verbatim}
%
-% This will output the following CVSS base score: \texttt{\cvssScore{AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}}
+% This will output the following CVSS base score: \texttt{\cvssScore{CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}}
%
%
% \begin{function}{\cvssScorepretty}
- % \begin{syntax}
- % \cs{cvssScorepretty} \Arg{CVSS string}
- % \end{syntax}
- % This macro will print a \textbf{colored} base CVSS 3.1 score of an \marg{input vector} (without \texttt{CVSS3.1/}). The output of this macro is a floating point CVSS score.
- % \end{function}
+ % \begin{syntax}
+% \cs{cvssScorepretty} \Arg{CVSS string}
+% \end{syntax}
+% This macro will print a \textbf{colored} base CVSS 3.1 score of an \marg{input vector} (without \texttt{CVSS3.1/}). The output of this macro is a floating point CVSS score.
+ % \end{function}
%
% \begin{verbatim}
-% \cvssScorepretty{AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N}
+% \cvssScorepretty{CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N}
% \end{verbatim}
%
-% This will output the following CVSS score: \cvssScorepretty{AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N}
+% This will output the following CVSS score: \cvssScorepretty{CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N}
%
%
% \begin{function}{\cvssLevel}
- % \begin{syntax}
- % \cs{cvssLevel} \Arg{CVSS string}
- % \end{syntax}
+ % \begin{syntax}
+ % \cs{cvssLevel} \Arg{CVSS string}
+ % \end{syntax}
% This macro will output the CVSS level from an \marg{input vector} (without \texttt{CVSS3.1/}), for example \texttt{Info}.
% \end{function}
%
% \begin{verbatim}
-% \cvssLevel{AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N}
+% \cvssLevel{CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N}
% \end{verbatim}
%
-% This will output the following CVSS level: \cvssLevel{AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N}
+% This will output the following CVSS level: \cvssLevel{CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N}
%
%
% \begin{function}{\cvssLevelpretty}
- % \begin{syntax}
- % \cs{cvssLevelpretty} \Arg{CVSS string}
- % \end{syntax}
+ % \begin{syntax}
+ % \cs{cvssLevelpretty} \Arg{CVSS string}
+ % \end{syntax}
% This macro will output the \textbf{colored} CVSS level from an \marg{input vector} (without \texttt{CVSS3.1/}).
% \end{function}
%
% \begin{verbatim}
-% \cvssLevelpretty{AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N}
+% \cvssLevelpretty{CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N}
% \end{verbatim}
%
-% This will output the following CVSS level: \cvssLevelpretty{AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N}
+% This will output the following CVSS level: \cvssLevelpretty{CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N}
%
%
% \begin{function}{\cvssTag}
- % \begin{syntax}
- % \cs{cvssTag} \Arg{CVSS string}
- % \end{syntax}
+ % \begin{syntax}
+ % \cs{cvssTag} \Arg{CVSS string}
+ % \end{syntax}
% This macro will output a colored tag with the CVSS level inside, from an \marg{input vector} (without \texttt{CVSS3.1/}).
% \end{function}
%
% \begin{verbatim}
-% \cvssTag{AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N}
+% \cvssTag{CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N}
% \end{verbatim}
%
-% This will output the following CVSS level: \cvssTag{AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N}.
+% This will output the following CVSS level: \cvssTag{CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N}.
%
%
% \begin{function}{\cvssPrint}
- % \begin{syntax}
- % \cs{cvssPrint} \Arg{CVSS string}
- % \end{syntax}
- % This macro will print all details of a CVSS string: colored level, score, and hyperlink to FIRST calculator, from an \marg{input vector} (without \texttt{CVSS3.1/}).
- % \end{function}
+% \begin{syntax}
+% \cs{cvssPrint} \Arg{CVSS string}
+% \end{syntax}
+% This macro will print all details of a CVSS string: colored level, score, and hyperlink to FIRST calculator, from an \marg{input vector} (without \texttt{CVSS3.1/}).
+% \end{function}
%
% \begin{verbatim}
-% \cvssPrint{AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H}
+% \cvssPrint{CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H}
% \end{verbatim}
%
% This will output the following CVSS level:
%
-% \cvssPrint{AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H}
+% \cvssPrint{CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H}
%
%
%
% \subsection{Indirect Macros}
%
-% \changes{v1.0}{2022/11/03}{First public release}
+% \changes{v1.0.0}{2022/11/03}{First public release}
%
% \begin{function}{\category}
- % \begin{syntax}
- % \cs{category} \Arg{CVSS score}
- % \end{syntax}
+ % \begin{syntax}
+ % \cs{category} \Arg{CVSS score}
+ % \end{syntax}
% This macro will output the CVSS category (None, Info, Low, Medium, High or Critical) based on the input CVSS vector passed as argument \marg{numerical score}. The mandatory argument is a floating point CVSS score, for example \texttt{5.4}.
% \end{function}
%
@@ -252,11 +254,11 @@ and the derived files cvss.ins,
%
%
% \begin{function}{\cvssFrame}
- % \begin{syntax}
- % \cs{cvssFrame} \Arg{CVSS score}
- % \end{syntax}
- % This macro will output a CVSS tag based on a CVSS \textbf{level} passed as argument. The mandatory argument must be one of the defined CVSS levels (None, Info, Low, Medium, High or Critical), for example \texttt{Info}.
- % \end{function}
+% \begin{syntax}
+% \cs{cvssFrame} \Arg{CVSS score}
+% \end{syntax}
+% This macro will output a CVSS tag based on a CVSS \textbf{level} passed as argument. The mandatory argument must be one of the defined CVSS levels (None, Info, Low, Medium, High or Critical), for example \texttt{Info}.
+% \end{function}
%
% \begin{verbatim}
% \cvssFrame{High}
@@ -270,133 +272,138 @@ and the derived files cvss.ins,
%
% \subsection{Direct Form}
-%\begin{minipage}{.75\textwidth}
- % \begin{verbatim}
-%\\cvssScore{AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}
- % \end{verbatim}
- %\end{minipage}%
-%\begin{minipage}{0.25\textwidth}
-%\cvssScore{AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}
- %\end{minipage}
-
-%\begin{minipage}{.75\textwidth}
- % \begin{verbatim}
-%\\cvssLevel{AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}
- % \end{verbatim}
- %\end{minipage}%
-%\begin{minipage}{0.25\textwidth}
-%\cvssLevel{AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}
- %\end{minipage}
+%\begin{minipage}{.85\textwidth}
+% \begin{verbatim}
+%\\cvssScore{CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}
+% \end{verbatim}
+%\end{minipage}%
+%\begin{minipage}{0.15\textwidth}
+%\cvssScore{CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}
+%\end{minipage}
+%\begin{minipage}{.85\textwidth}
+% \begin{verbatim}
+%\\cvssLevel{CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}
+% \end{verbatim}
+%\end{minipage}%
+%\begin{minipage}{0.15\textwidth}
+%\cvssLevel{CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}
+%\end{minipage}
-%\begin{minipage}{.75\textwidth}
- % \begin{verbatim}
-%\\cvssLevelpretty{AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H}
- % \end{verbatim}
- %\end{minipage}%
-%\begin{minipage}{0.25\textwidth}
-%\cvssLevelpretty{AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H}
- %\end{minipage}
-%\begin{minipage}{.75\textwidth}
- % \begin{verbatim}
-%\\cvssTag{AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H}
- % \end{verbatim}
- %\end{minipage}%
-%\begin{minipage}{0.25\textwidth}
-%\cvssTag{AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H}
- %\end{minipage}
+%\begin{minipage}{.85\textwidth}
+% \begin{verbatim}
+%\\cvssLevelpretty{CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H}
+% \end{verbatim}
+%\end{minipage}%
+%\begin{minipage}{0.15\textwidth}
+%\cvssLevelpretty{CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H}
+%\end{minipage}
+%\begin{minipage}{.85\textwidth}
+% \begin{verbatim}
+%\\cvssTag{CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H}
+% \end{verbatim}
+%\end{minipage}%
+%\begin{minipage}{0.15\textwidth}
+%\cvssTag{CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H}
+%\end{minipage}%
+%\newline
%
-% The vuln has a \textbf{\cvssLevel{AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}}-level and we can output it inline.
+% We can thus embed this in text lines like this:
+% \begin{verbatim}
+%\\textbf{\cvssLevel{CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}}-level
+% \end{verbatim}
+%
+% Which will be rendered like this : \textit{the vuln has a \textbf{\cvssLevel{CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}}-level and we can output it inline.}
%\subsection{Imbricated Form}
%\begin{minipage}{.5\textwidth}
- % \begin{verbatim}
- %\cvssFrame{Low}
- % \end{verbatim}
- %\end{minipage}%
+% \begin{verbatim}
+%\\cvssFrame{Low}
+% \end{verbatim}
+%\end{minipage}%
%\begin{minipage}{0.5\textwidth}
- %\cvssFrame{Low}
+%\cvssFrame{Low}
%\end{minipage}
%\begin{minipage}{.5\textwidth}
% \begin{verbatim}
- %\category{9.9}
+%%\category{9.9}
% \end{verbatim}
%\end{minipage}%
%\begin{minipage}{0.5\textwidth}
- %\category{9.9}
+%\category{9.9}
%\end{minipage}
+%\newline
%
% We can even combine them:
% \begin{verbatim}
-%\\category{\cvssScore{AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}}
+%\\category{\cvssScore{CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}}
% \end{verbatim}
%
-%And this outputs: \category{\cvssScore{AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}}
+%And this outputs: \category{\cvssScore{CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}}
%
% \begin{verbatim}
-%\\cvssFrame{\category{\cvssScore{AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}}}
+%\\cvssFrame{\category{\cvssScore{CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}}}
% \end{verbatim}
-% And the result is: %\cvssFrame{\category{\cvssScore{AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}}}
+% And the result is: %\cvssFrame{\category{\cvssScore{CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N}}}
%
%\subsection{Test Computations}
% \begin{verbatim}
-% Should be 7.3: \cvssScore{AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L}
+% Should be 7.3: \cvssScore{CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L}
%
-% Should be 8.3: \cvssScore{AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L}
+% Should be 8.3: \cvssScore{CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L}
%
-% Should be 9.9: \cvssScore{AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H}
+% Should be 9.9: \cvssScore{CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H}
%
-% Should be 9.9: \cvssScore{AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L}
+% Should be 9.9: \cvssScore{CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L}
%
-% Should be 7.2: \cvssScore{AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N}
+% Should be 7.2: \cvssScore{CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N}
%
-% Should be 7.1: \cvssScore{AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L}
+% Should be 7.1: \cvssScore{CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L}
%
-% Should be 5.8: \cvssScore{AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L}
+% Should be 5.8: \cvssScore{CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L}
%
-% Should be 5.5: \cvssScore{AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L}
+% Should be 5.5: \cvssScore{CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L}
%
-% Should be 5.1: \cvssScore{AV:A/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L}
+% Should be 5.1: \cvssScore{CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L}
%
-% Should be 4.3: \cvssScore{AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L}
+% Should be 4.3: \cvssScore{CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L}
%
-% Should be 2.4: \cvssScore{AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N}
+% Should be 2.4: \cvssScore{CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N}
%
-% Should be 0.0: \cvssScore{AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:N}
+% Should be 0.0: \cvssScore{CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:N}
% \end{verbatim}
%
% And the results of the computations:
%
-%Should be 7.3: \cvssScore{AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L}
+%Should be 7.3: \cvssScore{CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L}
%
-%Should be 8.3: \cvssScore{AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L}%
+%Should be 8.3: \cvssScore{CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L}%
%
-%Should be 9.9: \cvssScore{AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H}%
+%Should be 9.9: \cvssScore{CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H}%
%
-%Should be 9.9: \cvssScore{AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L}%
+%Should be 9.9: \cvssScore{CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L}%
%
-%Should be 7.2: \cvssScore{AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N}%
+%Should be 7.2: \cvssScore{CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N}%
%
-%Should be 7.1: \cvssScore{AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L}%
+%Should be 7.1: \cvssScore{CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L}%
%
-%Should be 5.8: \cvssScore{AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L}%
+%Should be 5.8: \cvssScore{CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L}%
%
-%Should be 5.5: \cvssScore{AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L}%
+%Should be 5.5: \cvssScore{CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L}%
%
-%Should be 5.1: \cvssScore{AV:A/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L}%
+%Should be 5.1: \cvssScore{CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L}%
%
-%Should be 4.3: \cvssScore{AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L}%
+%Should be 4.3: \cvssScore{CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L}%
%
-%Should be 2.4: \cvssScore{AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N}
+%Should be 2.4: \cvssScore{CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N}
%
-%Should be 0.0: \cvssScore{AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:N}
+%Should be 0.0: \cvssScore{CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:N}
%
% \end{documentation}
%\newpage
-% \StopEventually{\setlength\IndexMin{200pt} \PrintIndex }
% \begin{implementation}
% \section{Implementation}
% \subsection{Initial set up}
@@ -447,6 +454,7 @@ and the derived files cvss.ins,
\msg_new:nnn { CVSS } { invalid-option }{ Value~'#2'~invalid~for~#1~#3.}
\msg_new:nnn { CVSS } { invalid-structure } { CVSS~metric~#1~is~not~correct~(#2)~#3.}
\msg_new:nnn { CVSS } { invalid-length } { CVSS~vector~"#1"~is~badly~formatted~#2.}
+\msg_new:nnn { CVSS } { wrong-version } { Wrong~CVSS~version~(#2)~#3.}
% \end{macrocode}%
%
%
@@ -709,70 +717,82 @@ and the derived files cvss.ins,
%\begin{macro}{\cvssScore}
% \begin{macrocode}
\NewExpandableDocumentCommand \cvssScore { m }{%
-
- % Check that there are 35 chars
- \int_compare:nNnTF { \str_count_ignore_spaces:n {#1} } = {35}{}{
- \msg_error:nnxx{CVSS}{invalid-length}{#1}{\msg_line_context:}
- }
- % Check AV value
- \str_if_eq:eeTF {\str_range:nnn {#1} {1} {3}} {AV:}
- {} {
- \msg_error:nnxxx{CVSS}{invalid-structure}{AV}{\str_range:nnn {#1} {1} {3}}{\msg_line_context:}
- }
-
- % Check AC value
- \str_if_eq:eeTF {\str_range:nnn {#1} {5} {8}} {/AC:}
- {} {
- \msg_error:nnxxx{CVSS}{invalid-structure}{AC}{\str_range:nnn {#1} {5} {8}}{\msg_line_context:}
- }
-
-
- % Check PR value
- \str_if_eq:eeTF {\str_range:nnn {#1} {10} {13}} {/PR:}
- {} {
- \msg_error:nnxxx{CVSS}{invalid-structure}{PR}{\str_range:nnn {#1} {10} {13}}{\msg_line_context:}
- }
-
- % Check UI value
- \str_if_eq:eeTF {\str_range:nnn {#1} {15} {18}} {/UI:}
- {} {
- \msg_error:nnxxx{CVSS}{invalid-structure}{UI}{\str_range:nnn {#1} {15} {18}}{\msg_line_context:}
- }
-
- % Check S value
- \str_if_eq:eeTF {\str_range:nnn {#1} {20} {22}} {/S:}
- {} {
- \msg_error:nnxxx{CVSS}{invalid-structure}{S}{\str_range:nnn {#1} {20} {22}}{\msg_line_context:}
- }
-
- % Check I value
- \str_if_eq:eeTF {\str_range:nnn {#1} {24} {26}} {/C:}
- {} {
- \msg_error:nnxxx{CVSS}{invalid-structure}{C}{\str_range:nnn {#1} {24} {26}}{\msg_line_context:}
- }
-
- % Check I value
- \str_if_eq:eeTF {\str_range:nnn {#1} {28} {30}} {/I:}
- {} {
- \msg_error:nnxxx{CVSS}{invalid-structure}{I}{\str_range:nnn {#1} {28} {30}}{\msg_line_context:}
- }
-
- % Check A value
- \str_if_eq:eeTF {\str_range:nnn {#1} {32} {34}} {/A:}
- {} {
- \msg_error:nnxxx{CVSS}{invalid-structure}{A}{\str_range:nnn {#1} {32} {34}}{\msg_line_context:}
- }
-
- \exp_args:Ne \__CVSS_cvssBaseScore:nnnnnnnn
- { \str_use:N \str_item_ignore_spaces:nn { #1 }{ 4 } }
- { \str_use:N \str_item_ignore_spaces:nn { #1 }{ 9 } }
- { \str_use:N \str_item_ignore_spaces:nn { #1 }{ 14 } }
- { \str_use:N \str_item_ignore_spaces:nn { #1 }{ 19 } }
- { \str_use:N \str_item_ignore_spaces:nn { #1 }{ 23 } }
- { \str_use:N \str_item_ignore_spaces:nn { #1 }{ 27 } }
- { \str_use:N \str_item_ignore_spaces:nn { #1 }{ 31 } }
- { \str_use:N \str_item_ignore_spaces:nn { #1 }{ 35 } }
-
+ % Check that there are 44 chars
+ \int_compare:nNnTF { \str_count_ignore_spaces:n {#1} } = {44}{}{
+ \msg_error:nnxx{CVSS}{invalid-length}{#1}{\msg_line_context:}
+ }
+ % Check CVSS: value
+ \str_if_eq:eeTF {\str_range:nnn {#1} {1} {5}} {CVSS:}
+ {} {
+ \msg_error:nnxxx{CVSS}{invalid-structure}{AV}{\str_range:nnn {#1} {1} {5}}{\msg_line_context:}
+ }
+ % Check 3.1 value
+ \str_if_eq:eeTF {\str_range:nnn {#1} {6} {8}} {3.1}
+ {} {
+ \msg_error:nnxxx{CVSS}{wrong-version}{3.1}{\str_range:nnn {#1} {6} {8}}{\msg_line_context:}
+ }
+ % Check 3.1 value
+ \str_if_eq:eeTF {\str_range:nnn {#1} {9} {9}} {/}
+ {} {
+ \msg_error:nnxxx{CVSS}{wrong-version}{/}{\str_range:nnn {#1} {9} {9}}{\msg_line_context:}
+ }
+ % Check AV value
+ \str_if_eq:eeTF {\str_range:nnn {#1} {10} {12}} {AV:}
+ {} {
+ \msg_error:nnxxx{CVSS}{invalid-structure}{AV}{\str_range:nnn {#1} {10} {12}}{\msg_line_context:}
+ }
+ % Check AC value
+ \str_if_eq:eeTF {\str_range:nnn {#1} {14} {17}} {/AC:}
+ {} {
+ \msg_error:nnxxx{CVSS}{invalid-structure}{AC}{\str_range:nnn {#1} {14} {17}}{\msg_line_context:}
+ }
+
+
+ % Check PR value
+ \str_if_eq:eeTF {\str_range:nnn {#1} {19} {22}} {/PR:}
+ {} {
+ \msg_error:nnxxx{CVSS}{invalid-structure}{PR}{\str_range:nnn {#1} {19} {22}}{\msg_line_context:}
+ }
+
+ % Check UI value
+ \str_if_eq:eeTF {\str_range:nnn {#1} {24} {27}} {/UI:}
+ {} {
+ \msg_error:nnxxx{CVSS}{invalid-structure}{UI}{\str_range:nnn {#1} {24} {27}}{\msg_line_context:}
+ }
+
+ % Check S value
+ \str_if_eq:eeTF {\str_range:nnn {#1} {29} {31}} {/S:}
+ {} {
+ \msg_error:nnxxx{CVSS}{invalid-structure}{S}{\str_range:nnn {#1} {29} {31}}{\msg_line_context:}
+ }
+
+ % Check I value
+ \str_if_eq:eeTF {\str_range:nnn {#1} {33} {35}} {/C:}
+ {} {
+ \msg_error:nnxxx{CVSS}{invalid-structure}{C}{\str_range:nnn {#1} {33} {35}}{\msg_line_context:}
+ }
+
+ % Check I value
+ \str_if_eq:eeTF {\str_range:nnn {#1} {37} {39}} {/I:}
+ {} {
+ \msg_error:nnxxx{CVSS}{invalid-structure}{I}{\str_range:nnn {#1} {37} {39}}{\msg_line_context:}
+ }
+
+ % Check A value
+ \str_if_eq:eeTF {\str_range:nnn {#1} {41} {43}} {/A:}
+ {} {
+ \msg_error:nnxxx{CVSS}{invalid-structure}{A}{\str_range:nnn {#1} {41} {43}}{\msg_line_context:}
+ }
+
+ \exp_args:Ne \__CVSS_cvssBaseScore:nnnnnnnn
+ { \str_use:N \str_item_ignore_spaces:nn { #1 }{ 13 } }
+ { \str_use:N \str_item_ignore_spaces:nn { #1 }{ 18 } }
+ { \str_use:N \str_item_ignore_spaces:nn { #1 }{ 23 } }
+ { \str_use:N \str_item_ignore_spaces:nn { #1 }{ 28 } }
+ { \str_use:N \str_item_ignore_spaces:nn { #1 }{ 32 } }
+ { \str_use:N \str_item_ignore_spaces:nn { #1 }{ 36 } }
+ { \str_use:N \str_item_ignore_spaces:nn { #1 }{ 40 } }
+ { \str_use:N \str_item_ignore_spaces:nn { #1 }{ 44 } }
}%
\ExplSyntaxOff
% \end{macrocode}
@@ -881,12 +901,13 @@ and the derived files cvss.ins,
% \subsubsection{Full CVSS display}
% We can even have a nice all-in display of the category, the scrore and a hyperlink to the FIRST calculator using a combination of all the functions we've defined:
%\begin{macro}{\cvssPrint}
+% {v1.1}{2022/11/30}{Full CVSS vector as input is now supported}
% This macro will output the \textbf{colored} CVSS level based on the numerical CVSS score.
% \begin{macrocode}
\newcommand{\cvssPrint}[1]{%
\def\CVSSscore{\cvssScore{#1}}
\cvssFrame{\category{\CVSSscore}} \quad \CVSSscore \quad%
- \href{https://www.first.org/cvss/calculator/3.1\#CVSS:3.1/#1}{CVSS:3.1/#1}
+ \href{https://www.first.org/cvss/calculator/3.1\##1}{#1}
}%
% \end{macrocode}
%\end{macro}