fix: validate CVSS Scope metric to prevent silent mis-scoring

cvssScoring.ts read `v.S` directly into the `s === 'C' ? ... : ...`
branches but never validated it. A vector missing `S` or carrying an
invalid value like `S:X` would silently take the Scope:Unchanged
branch in every formula and return a wrong numeric score instead of
null. The 10 reference-vector tests didn't catch it because every
test vector had a valid S:U or S:C.

This is the exact failure mode ADR-0005 named as the headline risk
of choosing inline scoring over the cvss npm package — wrong scores
feed advisories.is_critical and packages.has_critical_vulnerability,
i.e. the entire security overlay.

Fix: validate `s` against {U, C} up front and return null otherwise.
Added two regression tests covering the missing-S and invalid-S
paths.

Caught by Cursor's bot review on cbaf41d.

Signed-off-by: Joan Reyero <joan@reyero.io>

Author: joanreyero

services/apps/packages_worker/src/osv/__tests__/cvssScoring.test.ts

@@ -42,6 +42,16 @@ describe('computeV3Score', () => {
     expect(computeV3Score('CVSS:3.1/AV:Z/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H')).toBeNull() // bad enum
   })
 
+  // Regression guards for the unvalidated-Scope bug: missing or invalid S used
+  // to silently produce a Scope:Unchanged score instead of returning null.
+  it('returns null when the Scope metric is missing', () => {
+    expect(computeV3Score('CVSS:3.1/AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H')).toBeNull()
+  })
+
+  it('returns null when the Scope metric is invalid', () => {
+    expect(computeV3Score('CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:X/C:H/I:H/A:H')).toBeNull()
+  })
+
   it('handles scope-changed PR remapping', () => {
     // PR:L scores higher under Scope:Changed than under Scope:Unchanged.
     const unchanged = computeV3Score('CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H')

services/apps/packages_worker/src/osv/cvssScoring.ts

@@ -13,6 +13,7 @@ const PR_U: Record<string, number> = { N: 0.85, L: 0.62, H: 0.27 }
 const PR_C: Record<string, number> = { N: 0.85, L: 0.68, H: 0.5 }
 const UI: Record<string, number> = { N: 0.85, R: 0.62 }
 const CIA: Record<string, number> = { N: 0, L: 0.22, H: 0.56 }
+const S_VALUES = new Set(['U', 'C'])
 
 function parseVector(vector: string): Record<string, string> | null {
   const parts = vector.split('/').filter(Boolean)
@@ -41,7 +42,13 @@ export function computeV3Score(vector: string): number | null {
   const av = AV[v.AV]
   const ac = AC[v.AC]
   const ui = UI[v.UI]
+  // Scope is read directly because the metric is qualitative, not numeric, so
+  // it does not slot into the undefined-check below. Validate it explicitly
+  // here — an invalid or missing S would otherwise silently fall through to
+  // the Scope:Unchanged formula and produce a wrong numeric score instead of
+  // null, which is the headline risk flagged in ADR-0005.
   const s = v.S
+  if (!S_VALUES.has(s)) return null
   const pr = s === 'C' ? PR_C[v.PR] : PR_U[v.PR]
   const c = CIA[v.C]
   const i = CIA[v.I]