Skip to content

Commit 0ba1779

Browse files
attzonkoattzonko
committed
Renaming entites to address review comments
Signed-off-by: Alex Tzonkov <4975715+attzonko@users.noreply.github.com>
1 parent c6662d6 commit 0ba1779

7 files changed

Lines changed: 34 additions & 34 deletions

File tree

‎Documentation/corim_profile/OCP-SAFE-CoRIM-Extension-Profile-Specification.md‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -193,15 +193,15 @@ Security issues identified during the review are represented using the `issue-en
193193
issue-entry = {
194194
&(title: 0) => tstr
195195
&(description: 1) => tstr
196-
&(assessment-scheme: 2) => $assessment-scheme
196+
&(assessment: 2) => $assessment
197197
?&(cwe: 3) => tstr
198198
?&(cve: 4) => tstr
199199
* $$ocp-safe-issue-entry-ext
200200
}
201201
202-
$assessment-scheme /= cvss-scheme
202+
$assessment /= cvss
203203
204-
cvss-scheme = {
204+
cvss = {
205205
&(cvss-score: 0) => tstr
206206
&(cvss-vector: 1) => tstr
207207
? &(cvss-version: 2) => tstr
@@ -214,15 +214,15 @@ cvss-scheme = {
214214
|-------|-----|------|----------|-------------|
215215
| title | 0 | tstr | Yes | Brief title describing the security issue |
216216
| description | 1 | tstr | Yes | Detailed description of the security issue |
217-
| assessment-scheme | 2 | $assessment-scheme | Yes | Assessment scheme used (e.g., CVSS) |
217+
| assessment | 2 | $assessment | Yes | Assessment used (e.g., CVSS) |
218218
| cwe | 3 | tstr | No | Common Weakness Enumeration identifier |
219219
| cve | 4 | tstr | No | CVE identifier if assigned |
220220

221-
### Assessment Schemes
221+
### Assessments
222222

223-
The specification supports various assessment schemes for vulnerability scoring. Currently, CVSS is the primary supported scheme:
223+
The specification supports various assessments for vulnerability scoring. Currently, CVSS is the primary supported assesment:
224224

225-
**CVSS Scheme Structure**
225+
**CVSS Structure**
226226

227227
| Field | Key | Type | Required | Description |
228228
|-------|-----|------|----------|-------------|
@@ -438,7 +438,7 @@ The following example demonstrates a complete CoRIM structure containing OCP S.A
438438
/ issue-entry / {
439439
/ 0: title / 0: "Memory corruption when reading record from SPI flash",
440440
/ 1: description / 1: "Due to insufficient input validation in the firmware, a local attacker who tampers with a configuration structure in SPI flash, can cause stack-based memory corruption.",
441-
/ 2: assessment-scheme / 2: {
441+
/ 2: assessment / 2: {
442442
/ 0: cvss-score / 0: "7.9",
443443
/ 1: cvss-vector / 1: "AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L",
444444
/ 2: cvss-version / 2: "3.1"
@@ -448,7 +448,7 @@ The following example demonstrates a complete CoRIM structure containing OCP S.A
448448
/ issue-entry / {
449449
/ 0: title / 0: "Debug commands enable arbitrary memory read/write",
450450
/ 1: description / 1: "The firmware exposes debug command handlers that enable host-side drivers to read and write arbitrary regions of the device's SRAM.",
451-
/ 2: assessment-scheme / 2: {
451+
/ 2: assessment / 2: {
452452
/ 0: cvss-score / 0: "8.7",
453453
/ 1: cvss-vector / 1: "AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
454454
/ 2: cvss-version / 2: "3.1"

‎Documentation/corim_profile/examples/ocp-safe-sfr-fw-example.diag‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@
7272
/ issue-entry / {
7373
/ 0: title / 0: "Memory corruption when reading record from SPI flash",
7474
/ 1: description / 1: "Due to insufficient input validation in the firmware, a local attacker who tampers with a configuration structure in SPI flash, can cause stack-based memory corruption.",
75-
/ 2: assessment-scheme / 2: {
75+
/ 2: assessment / 2: {
7676
/ 0: cvss-score / 0: "7.9",
7777
/ 1: cvss-vector / 1: "AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L",
7878
/ 2: cvss-version / 2: "3.1"
@@ -82,7 +82,7 @@
8282
/ issue-entry / {
8383
/ 0: title / 0: "Debug commands enable arbitrary memory read/write",
8484
/ 1: description / 1: "The firmware exposes debug command handlers that enable host-side drivers to read and write arbitrary regions of the device's SRAM.",
85-
/ 2: assessment-scheme / 2: {
85+
/ 2: assessment / 2: {
8686
/ 0: cvss-score / 0: "8.7",
8787
/ 1: cvss-vector / 1: "AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
8888
/ 2: cvss-version / 2: "3.1"

‎Documentation/corim_profile/ocp-safe-sfr-profile.cddl‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,15 +18,15 @@ ocp-safe-sfr-map = {
1818
issue-entry = {
1919
&(title: 0) => tstr
2020
&(description: 1) => tstr
21-
&(assessment-scheme: 2) => $assessment-scheme
21+
&(assessment: 2) => $assessment
2222
?&(cwe: 3) => tstr
2323
?&(cve: 4) => tstr
2424
* $$ocp-safe-issue-entry-ext
2525
}
2626

27-
$assessment-scheme /= cvss-scheme
27+
$assessment /= cvss
2828

29-
cvss-scheme = {
29+
cvss = {
3030
&(cvss-score: 0) => tstr
3131
&(cvss-vector: 1) => tstr
3232
? &(cvss-version: 2) => tstr

‎shortform_report-main/OcpReportLib.py‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -340,21 +340,21 @@ def _convert_to_corim_structure(self) -> Dict[str, Any]:
340340
# Convert issues
341341
corim_issues = []
342342
for issue in self.report["audit"]["issues"]:
343-
# Build nested cvss-scheme structure
344-
cvss_scheme = {
343+
# Build nested cvss structure
344+
cvss = {
345345
0: issue["cvss_score"], # cvss-score
346346
1: issue["cvss_vector"], # cvss-vector
347347
}
348348

349349
# Add optional cvss-version
350350
if "cvss_version" in self.report["audit"]:
351-
cvss_scheme[2] = self.report["audit"]["cvss_version"] # cvss-version
351+
cvss[2] = self.report["audit"]["cvss_version"] # cvss-version
352352

353-
# Build issue-entry with nested assessment-scheme
353+
# Build issue-entry with nested assessment
354354
corim_issue = {
355355
0: issue["title"], # title
356356
1: issue["description"], # description
357-
2: cvss_scheme, # assessment-scheme (nested cvss-scheme)
357+
2: cvss, # assessment (nested cvss)
358358
3: issue["cwe"], # cwe
359359
}
360360

‎shortform_report-main/cbor_human_inspector.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -845,10 +845,10 @@ def inspect_sfr_data(sfr_data, indent=""):
845845
if len(desc) > 100:
846846
desc = desc[:100] + "..."
847847
print(f"{indent} Description: {desc}")
848-
if 2 in issue: # assessment-scheme (nested cvss-scheme)
848+
if 2 in issue: # assessment (nested cvss)
849849
assessment = issue[2]
850850
if isinstance(assessment, dict):
851-
print(f"{indent} Assessment Scheme: CVSS")
851+
print(f"{indent} Assessment: CVSS")
852852
if 0 in assessment: # cvss-score
853853
print(f"{indent} CVSS Score: {assessment[0]}")
854854
if 1 in assessment: # cvss-vector

‎shortform_report-main/tests/final_validation_summary.py‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -234,26 +234,26 @@ def validate_corim_compliance():
234234
# Validate first issue structure
235235
if len(issues) > 0:
236236
first_issue = issues[0]
237-
required_issue_fields = [0, 1, 2, 3] # title, description, assessment-scheme, cwe
237+
required_issue_fields = [0, 1, 2, 3] # title, description, assessment, cwe
238238
for field in required_issue_fields:
239239
if field in first_issue:
240240
print(f"✓ Issue field {field} present")
241241
else:
242242
print(f"✗ Issue field {field} missing")
243243
return False
244244

245-
# Validate nested assessment-scheme structure
245+
# Validate nested assessment structure
246246
if 2 in first_issue:
247247
assessment = first_issue[2]
248248
if isinstance(assessment, dict):
249-
print("✓ Assessment-scheme is properly nested")
249+
print("✓ assessment is properly nested")
250250
if 0 in assessment and 1 in assessment:
251-
print("✓ Assessment-scheme contains cvss-score and cvss-vector")
251+
print("✓ assessment contains cvss-score and cvss-vector")
252252
else:
253-
print("✗ Assessment-scheme missing required CVSS fields")
253+
print("✗ assessment missing required CVSS fields")
254254
return False
255255
else:
256-
print("✗ Assessment-scheme is not a dict")
256+
print("✗ assessment is not a dict")
257257
return False
258258
else:
259259
print("✗ Issues not properly structured as list")

‎shortform_report-main/tests/test_corim_generation.py‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -166,19 +166,19 @@ def test_schema_compliance():
166166
for issue in issues:
167167
assert 0 in issue # title
168168
assert 1 in issue # description
169-
assert 2 in issue # assessment-scheme
169+
assert 2 in issue # assessment
170170

171-
# Validate nested assessment-scheme structure
172-
assessment_scheme = issue[2]
173-
assert isinstance(assessment_scheme, dict), "assessment-scheme must be a dict"
174-
assert 0 in assessment_scheme # cvss-score
175-
assert 1 in assessment_scheme # cvss-vector
171+
# Validate nested assessment structure
172+
assessment = issue[2]
173+
assert isinstance(assessment, dict), "assessment must be a dict"
174+
assert 0 in assessment # cvss-score
175+
assert 1 in assessment # cvss-vector
176176
# cvss-version is optional (key 2)
177177

178178
assert 3 in issue # cwe
179179
# cve is optional (key 4)
180180

181-
print("✓ Issues structure with nested assessment-scheme: PASS")
181+
print("✓ Issues structure with nested assessment: PASS")
182182

183183
return True
184184

0 commit comments

Comments
 (0)