cvss/v3/base/
s.rs

1//! Scope (S)
2
3use crate::{Error, Metric, MetricType, Result};
4use alloc::borrow::ToOwned;
5use core::{fmt, str::FromStr};
6
7/// Scope (S) - CVSS v3.1 Base Metric Group
8///
9/// Described in CVSS v3.1 Specification: Section 2.2:
10/// <https://www.first.org/cvss/specification-document#t8>
11///
12/// > The Scope metric captures whether a vulnerability in one vulnerable
13/// > component impacts resources in components beyond its security scope.
14/// >
15/// > Formally, a security authority is a mechanism (e.g., an application,
16/// > an operating system, firmware, a sandbox environment) that defines and
17/// > enforces access control in terms of how certain subjects/actors
18/// > (e.g., human users, processes) can access certain restricted
19/// > objects/resources (e.g., files, CPU, memory) in a controlled manner.
20/// > All the subjects and objects under the jurisdiction of a single security
21/// > authority are considered to be under one security scope. If a
22/// > vulnerability in a vulnerable component can affect a component which is
23/// > in a different security scope than the vulnerable component, a Scope
24/// > change occurs. Intuitively, whenever the impact of a vulnerability
25/// > breaches a security/trust boundary and impacts components outside the
26/// > security scope in which vulnerable component resides, a Scope change occurs.
27/// >
28/// > The security scope of a component encompasses other components that
29/// > provide functionality solely to that component, even if these other
30/// > components have their own security authority. For example, a database
31/// > used solely by one application is considered part of that application’s
32/// > security scope even if the database has its own security authority,
33/// > e.g., a mechanism controlling access to database records based on
34/// > database users and associated database privileges.
35/// >
36/// > The Base Score is greatest when a scope change occurs.
37#[derive(Copy, Clone, Debug, Eq, PartialEq, PartialOrd, Ord)]
38pub enum Scope {
39    /// Unchanged (U)
40    ///
41    /// > An exploited vulnerability can only affect resources managed by the
42    /// > same security authority. In this case, the vulnerable component and
43    /// > the impacted component are either the same, or both are managed by
44    /// > the same security authority.
45    Unchanged,
46
47    /// Changed (C)
48    ///
49    /// > An exploited vulnerability can affect resources beyond the security
50    /// > scope managed by the security authority of the vulnerable component.
51    /// > In this case, the vulnerable component and the impacted component
52    /// > are different and managed by different security authorities.
53    Changed,
54}
55
56impl Scope {
57    /// Has the scope changed?
58    pub fn is_changed(self) -> bool {
59        self == Scope::Changed
60    }
61}
62
63impl Metric for Scope {
64    const TYPE: MetricType = MetricType::S;
65
66    fn score(self) -> f64 {
67        unimplemented!()
68    }
69
70    fn as_str(self) -> &'static str {
71        match self {
72            Scope::Unchanged => "U",
73            Scope::Changed => "C",
74        }
75    }
76}
77
78impl fmt::Display for Scope {
79    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
80        write!(f, "{}:{}", Self::name(), self.as_str())
81    }
82}
83
84impl FromStr for Scope {
85    type Err = Error;
86
87    fn from_str(s: &str) -> Result<Self> {
88        match s {
89            "U" => Ok(Scope::Unchanged),
90            "C" => Ok(Scope::Changed),
91            _ => Err(Error::InvalidMetric {
92                metric_type: Self::TYPE,
93                value: s.to_owned(),
94            }),
95        }
96    }
97}
cvss/v3/base/s.rs

cvss/v3/base/
s.rs
