// NewVulnerability creates a Vulnerability document from a match and the metadata provider
NewVulnerability creates a Vulnerability document from a match and the metadata provider
// NewVulnerability creates a Vulnerability document from a match and the metadata provider
func NewVulnerability(m match.Match, p vulnerability.MetadataProvider) (cyclonedx.Vulnerability, error) {
	metadata, err := p.GetMetadata(m.Vulnerability.ID, m.Vulnerability.Namespace)
	if err != nil {
		return cyclonedx.Vulnerability{}, fmt.Errorf("unable to fetch vuln=%q metadata: %+v", m.Vulnerability.ID, err)
	}
	severityMap := map[string]cyclonedx.Severity{
		"unknown":    cyclonedx.SeverityUnknown,
		"none":       cyclonedx.SeverityNone,
		"info":       cyclonedx.SeverityInfo,
		"negligible": cyclonedx.SeverityLow,
		"low":        cyclonedx.SeverityLow,
		"medium":     cyclonedx.SeverityMedium,
		"high":       cyclonedx.SeverityHigh,
		"critical":   cyclonedx.SeverityCritical,
	}
	severity, ok := severityMap[strings.ToLower(metadata.Severity)]
	if !ok {
		severity = cyclonedx.SeverityUnknown
	}
	var ratings = []cyclonedx.VulnerabilityRating{
		{
			Severity: severity,
		},
	}
	for _, cvss := range metadata.Cvss {
		method, err := cvssVersionToMethod(cvss.Version)
		if err != nil {
			log.Errorf("unable to parse CVSS version: %v", err)
			continue
		}
		rating := cyclonedx.VulnerabilityRating{
			Method: method,
			Vector: cvss.Vector,
			Score:  &cvss.Metrics.BaseScore,
		}
		ratings = append(ratings, rating)
	}
	advisories := []cyclonedx.Advisory{}
	for _, url := range metadata.URLs {
		advisories = append(advisories, cyclonedx.Advisory{
			URL: url,
		})
	}
	v := cyclonedx.Vulnerability{
		ID: m.Vulnerability.ID,
		Source: &cyclonedx.Source{
			Name: m.Vulnerability.Namespace,
			URL:  makeVulnerabilityURL(m.Vulnerability.ID),
		},
		Ratings:     &ratings,
		Description: metadata.Description,
		Advisories:  &advisories,
		Analysis: &cyclonedx.VulnerabilityAnalysis{
			State: cyclonedx.IASInTriage,
		},
	}
	return v, nil
}
func NewVulnerability ( m match . Match , p vulnerability . MetadataProvider ) ( cyclonedx . Vulnerability , error ) { metadata , err := p . GetMetadata ( m . Vulnerability . ID , m . Vulnerability . Namespace ) if err != nil { return cyclonedx . Vulnerability { } , fmt . Errorf ( " " , m . Vulnerability . ID , err ) } severityMap := map [ string ] cyclonedx . Severity { " " : cyclonedx . SeverityUnknown , " " : cyclonedx . SeverityNone , " " : cyclonedx . SeverityInfo , " " : cyclonedx . SeverityLow , " " : cyclonedx . SeverityLow , " " : cyclonedx . SeverityMedium , " " : cyclonedx . SeverityHigh , " " : cyclonedx . SeverityCritical , } severity , ok := severityMap [ strings . ToLower ( metadata . Severity ) ] if ! ok { severity = cyclonedx . SeverityUnknown } var ratings = [ ] cyclonedx . VulnerabilityRating { { Severity : severity , } , } for _ , cvss := range metadata . Cvss { method , err := cvssVersionToMethod ( cvss . Version ) if err != nil { log . Errorf ( " " , err ) continue } rating := cyclonedx . VulnerabilityRating { Method : method , Vector : cvss . Vector , Score : & cvss . Metrics . BaseScore , } ratings = append ( ratings , rating ) } advisories := [ ] cyclonedx . Advisory { } for _ , url := range metadata . URLs { advisories = append ( advisories , cyclonedx . Advisory { URL : url , } ) } v := cyclonedx . Vulnerability { ID : m . Vulnerability . ID , Source : & cyclonedx . Source { Name : m . Vulnerability . Namespace , URL : makeVulnerabilityURL ( m . Vulnerability . ID ) , } , Ratings : & ratings , Description : metadata . Description , Advisories : & advisories , Analysis : & cyclonedx . VulnerabilityAnalysis { State : cyclonedx . IASInTriage , } , } return v , nil }
NewVulnerability creates a Vulnerability document from a match and the metadata provider
NewVulnerability creates a Vulnerability document from a match and the metadata provider
// The schema does not allow "Negligible", only allowing the following: // 'None', 'Low', 'Medium', 'High', 'Critical', 'Unknown' // do not halt execution if one CVSS fails to provide an accurate Version