Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Addressing IllegalStateException in OssArtifactSecurityScore #822

Merged
merged 4 commits into from
Jun 8, 2022
Merged

Addressing IllegalStateException in OssArtifactSecurityScore #822

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2301352
Addressing IllegalStateException in OssArtifactSecurityScore
sourabhsparkala May 30, 2022
906c38d
OssArtifactSecurityScore should be co-dependenct on ArtifactVersionSe…
sourabhsparkala Jun 6, 2022
c37960d
Merge branch 'master' into issue_820
sourabhsparkala Jun 7, 2022
e5f68c9
Update the nist data mirror
sourabhsparkala Jun 7, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion src/main/java/com/sap/oss/phosphor/fosstars/model/score/oss/OssArtifactSecurityScore.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,9 @@ public ScoreValue calculate(Value<?>... values) {
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would suggest in case of an unknown score (either artifact or project) to return to combined score as unknown.
Because the OssArtifactSecurityScore take the project score and modify it based on the artifact version score.
If the project score is unknown it can not be modified and just returning the artifact version score is not correct (IMHO).

Other opinions?

As sample (which requires changes additional changes in line 91ff):

Suggested change
}
} else if (projectSecurityScore.isUnknown()) {
return scoreValue.withMinConfidence().makeUnknown();
}

Copy link
Member Author

@sourabhsparkala sourabhsparkala Jun 6, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with your argument. The artifact score should be co-dependent with the ProjectScore. @mibo please check the latest changes. It should reflect what we are discussing here.


final double updatedScore;
if (artifactVersionSecurityScore.get() >= 9.0) {
if (projectSecurityScore.isUnknown()) {
updatedScore = artifactVersionSecurityScore.get();
} else if (artifactVersionSecurityScore.get() >= 9.0) {
updatedScore = 0.11 * artifactVersionSecurityScore.get() * projectSecurityScore.get();
} else {
updatedScore = 0.1 * (0.9 + artifactVersionSecurityScore.get()) * projectSecurityScore.get();
Expand Down
15 changes: 15 additions & 0 deletions ...test/java/com/sap/oss/phosphor/fosstars/model/score/oss/OssArtifactSecurityScoreTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,21 @@ public void testCalculateForAllUnknown() {
ScoreValue scoreValue = score.calculate(Utils.allUnknown(score.allFeatures()));
assertTrue(scoreValue.isUnknown());
}

@Test
public void testCalculateOssSecurityScoreUnknown() {
Score ossSecurityScore = new OssSecurityScore();
Set<Value<?>> values = Utils.allUnknown(ossSecurityScore.allFeatures());

OssArtifactSecurityScore ossArtifactSecurityScore = new OssArtifactSecurityScore();
values.add(RELEASED_ARTIFACT_VERSIONS.value(testArtifactVersions(false)));
values.add(ARTIFACT_VERSION.value(new ArtifactVersion("1.2.0", LocalDateTime.now())));
values.add(VULNERABILITIES_IN_ARTIFACT.value(new Vulnerabilities()));

ScoreValue scoreValue = ossArtifactSecurityScore.calculate(values);
assertTrue(DoubleInterval.closed(7, 8).contains(scoreValue.get()));
checkUsedValues(scoreValue);
}

@Test
public void testCalculateWithCurrentVersion() {
Expand Down