florian/pdf-reporting
1
0 Fork 1
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Improve naming different metrics.

Browse Source
This commit is contained in:
Florian Frank committed 2026-09-21 22:09:01 +02:00
1 parent 9247608a9f
commit f775e1f1ed
2 files changed
+25 -17
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

report_generator/context.py
+22 -15
View File
@@ -270,22 +270,34 @@ def _metric_cards(dependencies: dict[str, Any]) -> list[dict[str, Any]]:
return [
{
"title": "Severity & impact",
"note": "CVSS is the mean base score of the scored dependency findings. Impact values are normalized averages from 0 to 10; higher means greater potential damage.",
"rows": [
_fact("CVSS", _metric(scores.get("cvss"), "mean")),
_fact("Severity band", (scores.get("cvss") or {}).get("band"), kind="severity"),
_fact("Confidentiality", _metric(impact.get("scores"), "confidentiality")),
_fact("Integrity", _metric(impact.get("scores"), "integrity")),
_fact("Availability", _metric(impact.get("scores"), "availability")),
_fact("Average CVSS score (0-10)", _metric(scores.get("cvss"), "mean")),
_fact("Average CVSS severity", (scores.get("cvss") or {}).get("band"), kind="severity"),
_fact("Average confidentiality impact (0-10)", _metric(impact.get("scores"), "confidentiality")),
_fact("Average integrity impact (0-10)", _metric(impact.get("scores"), "integrity")),
_fact("Average availability impact (0-10)", _metric(impact.get("scores"), "availability")),
],
},
{
"title": "Exploitability",
"rows": [_fact(_label(axis), _metric(exploitability.get(axis), "score")) for axis in (
"attack_vector", "attack_complexity", "privileges_required", "user_interaction"
)],
"note": "These are normalized averages of the CVSS vector dimensions across scored findings. Higher values indicate fewer obstacles for an attacker, not a probability of exploitation.",
"rows": [
_fact(
label,
_metric(exploitability.get(axis), "score"),
)
for axis, label in (
("attack_vector", "Average attack vector exposure (0-10)"),
("attack_complexity", "Average attack complexity exposure (0-10)"),
("privileges_required", "Average privilege exposure (0-10)"),
("user_interaction", "Average user-interaction exposure (0-10)"),
)
],
},
{
"title": "Temporal",
"note": "Published dates and vulnerability age are calculated from the advisory timestamps. Time-to-exploit and volume trends require historical exploitation or scan data that this export does not contain.",
"rows": [
_fact("Newest published", _published(published.get("newest"))),
_fact("Mean vulnerability age", _days(published.get("mean_days"))),
@@ -296,10 +308,9 @@ def _metric_cards(dependencies: dict[str, Any]) -> list[dict[str, Any]]:
},
{
"title": "Surface & taxonomy",
"note": "Surface counts describe the packages represented by the findings. CWE coverage counts findings with a CWE classification; it does not measure CWE quality or abstraction depth.",
"rows": [
_fact("Affected products", surface.get("products")),
_fact("Affected versions", surface.get("versions")),
_fact("Vendors", ", ".join(surface.get("vendors") or []) or None),
_fact("Affected dependencies", surface.get("products")),
_fact("Potential remedies", _remedy(upgrades)),
_fact("CWE coverage", taxonomy.get("coverage")),
_fact("CWE abstraction level", taxonomy.get("abstraction_level")),
@@ -329,10 +340,6 @@ def _remedy(value: dict[str, Any]) -> str | None:
return None
def _label(value: str) -> str:
return value.replace("_", " ").title()
def _issue_types(sast: SarifReport | None, sca: VdrReport | None) -> list[str]:
"""How many distinct kinds of issue each half of the pipeline found."""
counted = []