Add --cvss-fail-threshold
#123
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
See README for general description. New option is mutually exclusive to `--fail-on-result`; if both are specified, clj-watson fails fast with usage error and help. Conservatively derives score when missing or suspicious looking: - When severity is available, conservatively converts to score - Since we don't know if if score is CVSS2 or CVSS3/4 derives, High and Critical to 10.0, Medium and Low are converted to upper bound of their ranges. - The experimental github-advisory strategy seems to regularly populate score with `0.0` but with a valid looking severity; we treat a score of 0.0 as suspicious. - I've not seen cases of invalid severities in the wild, but we handle them just the same, when we can't make sense of things we derive to the most critical score which is 10.0. Also: - factored out table support from cli-spec ns to new table ns to reuse it for summary table. - renamed summarize fn to final-summary to better distinguish from our new summary fn - a new utils ns for `assoc-some` fn (cribbed clj-kondo which cribbed from medley). Closes clj-holmes#114
coyotesqrl
reviewed
Sep 1, 2024
|
Thanks for taking a peek @coyotesqrl. |
* main: maint: bump deps to current (clj-holmes#125)
|
@seancorfield when you have some time and some interest, this PR awaits your review. |
|
Sorry, last week got completely derailed which was when I said I would review this... |
|
Thanks! And no problem @seancorfield, I understand that folks get busy and distracted! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
See README for general description.
New option is mutually exclusive to
--fail-on-result; if both are specified, clj-watson fails fast with usage error and help.Conservatively derives score when missing or suspicious looking:
0.0but with a valid looking severity; we treat a score of 0.0 as suspicious.Also:
assoc-somefn (cribbed clj-kondo which cribbed from medley).Closes #114