diff --git a/cvss/src/v3/mod.rs b/cvss/src/v3/mod.rs index d3e1d1e..08744a8 100644 --- a/cvss/src/v3/mod.rs +++ b/cvss/src/v3/mod.rs @@ -19,9 +19,7 @@ use crate::metric::Metric; use crate::severity::SeverityType; use crate::v3::attack_complexity::AttackComplexityType; use crate::v3::attack_vector::AttackVectorType; -use crate::v3::impact_metrics::{ - AvailabilityImpactType, ConfidentialityImpactType, Impact, IntegrityImpactType, -}; +use crate::v3::impact_metrics::{AvailabilityImpactType, ConfidentialityImpactType, Impact, IntegrityImpactType}; use crate::v3::privileges_required::PrivilegesRequiredType; use crate::v3::scope::ScopeType; use crate::v3::user_interaction::UserInteractionType; diff --git a/cvss/src/v4/exploit_maturity.rs b/cvss/src/v4/exploit_maturity.rs index bb0d0cd..3023470 100644 --- a/cvss/src/v4/exploit_maturity.rs +++ b/cvss/src/v4/exploit_maturity.rs @@ -12,7 +12,7 @@ pub enum ExploitMaturity { /// Attacked(A) 已报告针对此漏洞的攻击;简化利用该漏洞的尝试解决方案已公开(或私下可用)。 Attacked, /// POC(P) POC已公开;且未感知到针对此漏洞的利用尝试;且未感知到简化利用该漏洞的尝试的公开可用解决方案 - POC, + Poc, /// Unreported(U) 未感知到POC公开;且未感知到针对此漏洞的利用尝试;且未感知到简化利用该漏洞的尝试的公开可用解决方案。 Unreported, } @@ -31,7 +31,7 @@ impl ExploitMaturity { match self { Self::NotDefined => None, Self::Attacked => Some(0), - Self::POC => Some(1), + Self::Poc => Some(1), Self::Unreported => Some(2), } } @@ -53,7 +53,7 @@ impl FromStr for ExploitMaturity { let c = v.chars().next(); match c { Some('A') => Ok(Self::Attacked), - Some('P') => Ok(Self::POC), + Some('P') => Ok(Self::Poc), Some('U') => Ok(Self::Unreported), Some('X') => Ok(Self::NotDefined), _ => Err(CVSSError::InvalidCVSS { @@ -84,7 +84,7 @@ impl Metric for ExploitMaturity { worth: Worth::Worst, des: "".to_string(), }, - Self::POC => Help { + Self::Poc => Help { worth: Worth::Worst, des: "".to_string(), }, @@ -99,7 +99,7 @@ impl Metric for ExploitMaturity { match self { Self::NotDefined => 0.0, Self::Attacked => 0.0, - Self::POC => 0.1, + Self::Poc => 0.1, Self::Unreported => 0.2, } } @@ -108,7 +108,7 @@ impl Metric for ExploitMaturity { match self { Self::NotDefined => "X", Self::Attacked => "A", - Self::POC => "P", + Self::Poc => "P", Self::Unreported => "N", } } diff --git a/cvss/src/v4/mod.rs b/cvss/src/v4/mod.rs index 3f51cf3..886db0f 100644 --- a/cvss/src/v4/mod.rs +++ b/cvss/src/v4/mod.rs @@ -100,7 +100,7 @@ impl ExploitAbility { // 2: ["AV:P/PR:N/UI:N/", "AV:A/PR:L/UI:P/"] return Some(2); } - return None; + None } // EQ2: 0-(AC:L and AT:N) // 1-(not(AC:L and AT:N)) @@ -110,7 +110,7 @@ impl ExploitAbility { } else if !(self.attack_complexity.is_low() && self.attack_requirements.is_none()) { return Some(1); } - return None; + None } } @@ -247,43 +247,42 @@ impl CVSS { let (eq1, eq2, eq3, eq4, eq5, eq6) = self.macro_vector(); let mv = format!("{}{}{}{}{}{}", eq1, eq2, eq3, eq4, eq5, eq6); let score = lookup(&eq1, &eq2, &eq3, &eq4, &eq5, &eq6) - .unwrap_or(0.0) - .clone(); + .unwrap_or(0.0); let mut lower = 0; let score_eq1_next_lower = if eq1 < 2 { - lower = lower + 1; + lower += 1; lookup(&(eq1 + 1), &eq2, &eq3, &eq4, &eq5, &eq6) } else { None }; let score_eq2_next_lower = if eq2 < 1 { - lower = lower + 1; + lower += 1; lookup(&eq1, &(eq2 + 1), &eq3, &eq4, &eq5, &eq6) } else { None }; let score_eq4_next_lower = if eq4 < 2 { - lower = lower + 1; + lower += 1; lookup(&eq1, &eq2, &eq3, &(eq4 + 1), &eq5, &eq6) } else { None }; let score_eq5_next_lower = if eq5 < 2 { - lower = lower + 1; + lower += 1; lookup(&eq1, &eq2, &eq3, &eq4, &(eq5 + 1), &eq6) } else { None }; - let score_eq3eq6_next_lower = if (eq3 == 1 && eq6 == 1) || (eq3 == 0 && eq6 == 1) { - lower = lower + 1; + let score_eq3eq6_next_lower = if (eq3 == 0 || eq3 == 1) && eq6 == 1 { + lower += 1; lookup(&eq1, &eq2, &(eq3 + 1), &eq4, &eq5, &eq6) } else if eq3 == 1 && eq6 == 0 { - lower = lower + 1; + lower += 1; lookup(&eq1, &eq2, &eq3, &eq4, &eq5, &(eq6 + 1)) } else if eq3 == 0 && eq6 == 0 { // multiple path take the one with higher score // 如果存在多个分数,取最大的分数 - lower = lower + 1; + lower += 1; let left = lookup(&eq1, &eq2, &eq3, &eq4, &eq5, &(eq6 + 1)).unwrap_or(0.0); let right = lookup(&eq1, &eq2, &(eq3 + 1), &eq4, &eq5, &eq6).unwrap_or(0.0); let max_score = right.max(left); @@ -348,8 +347,8 @@ impl CVSS { + normalized_severity_eq5) / lower as f32; } - let score = roundup(score - mean_distance); - score + + roundup(score - mean_distance) } // EQ6: 0-(CR:H and VC:H) or (IR:H and VI:H) or (AR:H and VA:H) // 1-not[(CR:H and VC:H) or (IR:H and VI:H) or (AR:H and VA:H)] @@ -370,7 +369,7 @@ impl CVSS { { return Some(1); } - return None; + None } fn max_vectors(&self, macro_vector: String) -> Vec { let mut vectors = vec![]; @@ -402,7 +401,7 @@ impl CVSS { } } } - return vectors; + vectors } fn severity_distances(&self, vectors: Vec) -> (f32, f32, f32, f32, f32) { // 每个都和self这个cvss的分数比较,返回第一个大于self本身的 @@ -478,13 +477,13 @@ impl CVSS { let current_severity_distance_eq3eq6 = vc + vi + va + cr + ir + ar; let current_severity_distance_eq4 = sc + si + sa; let current_severity_distance_eq5 = 0.0; - return ( + ( current_severity_distance_eq1, current_severity_distance_eq2, current_severity_distance_eq3eq6, current_severity_distance_eq4, current_severity_distance_eq5, - ); + ) } fn macro_vector(&self) -> (u32, u32, u32, u32, u32, u32) { let eq1 = self.exploit_ability.eq1().unwrap_or_default(); @@ -493,7 +492,7 @@ impl CVSS { let eq4 = self.subsequent_impact.eq4().unwrap_or_default(); let eq5 = self.exploit.eq5().unwrap_or_default(); let eq6 = self.eq6().unwrap_or_default(); - return (eq1, eq2, eq3, eq4, eq5, eq6); + (eq1, eq2, eq3, eq4, eq5, eq6) } } /// Roundup保留小数点后一位,小数点后第二位四舍五入。 例如, Roundup(4.02) = 4.0; 或者 Roundup(4.00) = 4.0 diff --git a/cvss/src/v4/subsequent_impact_metrics.rs b/cvss/src/v4/subsequent_impact_metrics.rs index 0f665f7..7709633 100644 --- a/cvss/src/v4/subsequent_impact_metrics.rs +++ b/cvss/src/v4/subsequent_impact_metrics.rs @@ -358,6 +358,6 @@ impl SubsequentImpact { { return Some(2); } - return None; + None } } diff --git a/cvss/src/v4/vulnerable_impact_metrics.rs b/cvss/src/v4/vulnerable_impact_metrics.rs index 6872b97..811ae2e 100644 --- a/cvss/src/v4/vulnerable_impact_metrics.rs +++ b/cvss/src/v4/vulnerable_impact_metrics.rs @@ -365,6 +365,6 @@ impl VulnerableImpact { { return Some(2); } - return None; + None } } diff --git a/helper/src/bin/cve_to_db.rs b/helper/src/bin/cve_to_db.rs index 45d03ce..0cd3e95 100644 --- a/helper/src/bin/cve_to_db.rs +++ b/helper/src/bin/cve_to_db.rs @@ -5,12 +5,12 @@ use cvss::v2::ImpactMetricV2; use cvss::v3::ImpactMetricV3; use diesel::mysql::MysqlConnection; use helper::init_db_pool; -use nvd_api::error::DBResult; -use nvd_api::modules::cve_db::CreateCve; -use nvd_api::modules::cve_product_db::CreateCveProductByName; -use nvd_api::modules::product_db::{CreateProduct, QueryProductById}; -use nvd_api::modules::vendor_db::CreateVendors; -use nvd_api::modules::{Cve, CveProduct, Product, Vendor}; +use nvd_server::error::DBResult; +use nvd_server::modules::cve_db::CreateCve; +use nvd_server::modules::cve_product_db::CreateCveProductByName; +use nvd_server::modules::product_db::{CreateProduct, QueryProductById}; +use nvd_server::modules::vendor_db::CreateVendors; +use nvd_server::modules::{Cve, CveProduct, Product, Vendor}; use std::fs::File; use std::io::BufReader; use std::ops::DerefMut; diff --git a/helper/src/bin/cwe_to_db.rs b/helper/src/bin/cwe_to_db.rs index 594ee9f..04f65e0 100644 --- a/helper/src/bin/cwe_to_db.rs +++ b/helper/src/bin/cwe_to_db.rs @@ -1,8 +1,8 @@ use cwe::weakness_catalog::WeaknessCatalog; use diesel::mysql::MysqlConnection; use helper::init_db_pool; -use nvd_api::modules::cwe_db::CreateCwe; -use nvd_api::modules::Cwe; +use nvd_server::modules::cwe_db::CreateCwe; +use nvd_server::modules::Cwe; use std::fs::File; use std::io::BufReader; use std::ops::DerefMut; diff --git a/helper/src/bin/query.rs b/helper/src/bin/query.rs index 8af35a5..ac42406 100644 --- a/helper/src/bin/query.rs +++ b/helper/src/bin/query.rs @@ -1,9 +1,9 @@ use helper::init_db_pool; -use nvd_api::modules::cve_db::QueryCve; -use nvd_api::modules::cve_product_db::QueryCveProduct; -use nvd_api::modules::product_db::QueryProduct; -use nvd_api::modules::vendor_db::QueryVendor; -use nvd_api::modules::{Cve, CveProduct, Product, Vendor}; +use nvd_server::modules::cve_db::QueryCve; +use nvd_server::modules::cve_product_db::QueryCveProduct; +use nvd_server::modules::product_db::QueryProduct; +use nvd_server::modules::vendor_db::QueryVendor; +use nvd_server::modules::{Cve, CveProduct, Product, Vendor}; use std::ops::DerefMut; fn main() { diff --git a/helper/tests/tests_cvss.rs b/helper/tests/tests_cvss.rs index ecbd42c..1e5306c 100644 --- a/helper/tests/tests_cvss.rs +++ b/helper/tests/tests_cvss.rs @@ -3,13 +3,11 @@ mod tests { use cvss::severity::SeverityType; use cvss::v3::attack_complexity::AttackComplexityType; use cvss::v3::attack_vector::AttackVectorType; - use cvss::v3::impact_metrics::{ - AvailabilityImpactType, ConfidentialityImpactType, IntegrityImpactType, - }; + use cvss::v3::impact_metrics::{AvailabilityImpactType, ConfidentialityImpactType, Impact, IntegrityImpactType}; use cvss::v3::privileges_required::PrivilegesRequiredType; use cvss::v3::scope::ScopeType; use cvss::v3::user_interaction::UserInteractionType; - use cvss::v3::{ExploitAbility, Impact}; + use cvss::v3::ExploitAbility; use cvss::version::Version; use std::collections::HashMap; use std::str::FromStr; diff --git a/nvd-server/src/main.rs b/nvd-server/src/main.rs index 6b1ca6b..eafdfa5 100644 --- a/nvd-server/src/main.rs +++ b/nvd-server/src/main.rs @@ -1,7 +1,7 @@ use actix_cors::Cors; use actix_web::{http, middleware, web, App, HttpServer}; -use nvd_api::api::api_route; -use nvd_api::init_db_pool; +use nvd_server::api::api_route; +use nvd_server::init_db_pool; #[actix_web::main] // or #[tokio::main] async fn main() -> std::io::Result<()> {