diff --git a/cyclonedx/model/vulnerability.py b/cyclonedx/model/vulnerability.py index 5f3bf024..1c4e55e9 100644 --- a/cyclonedx/model/vulnerability.py +++ b/cyclonedx/model/vulnerability.py @@ -59,6 +59,11 @@ ) from .tool import Tool, ToolRepository, _ToolRepositoryHelper +_VSS_VECTOR_RE_CVSS_V4 = re.compile(r'^CVSS:4\.\d/?') +_VSS_VECTOR_RE_CVSS_V3 = re.compile(r'^CVSS:3\.\d/?') +_VSS_VECTOR_RE_CVSS_V2 = re.compile(r'^CVSS:2\.\d/?') +_VSS_VECTOR_RE_OWASP = re.compile(r'^OWASP/?') + @serializable.serializable_class(ignore_unknown_during_deserialization=True) class BomTargetVersionRange: @@ -643,15 +648,15 @@ def get_localised_vector(self, vector: str) -> str: The vector without any scheme prefix as a `str`. """ if self is VulnerabilityScoreSource.CVSS_V4 and vector.startswith('CVSS:4.'): - return re.sub(r'^CVSS:4\.\d/?', '', vector) + return _VSS_VECTOR_RE_CVSS_V4.sub('', vector) if ( self in (VulnerabilityScoreSource.CVSS_V3_1, VulnerabilityScoreSource.CVSS_V3) ) and vector.startswith('CVSS:3.'): - return re.sub(r'^CVSS:3\.\d/?', '', vector) + return _VSS_VECTOR_RE_CVSS_V3.sub('', vector) if self is VulnerabilityScoreSource.CVSS_V2 and vector.startswith('CVSS:2.'): - return re.sub(r'^CVSS:2\.\d/?', '', vector) + return _VSS_VECTOR_RE_CVSS_V2.sub('', vector) if self is VulnerabilityScoreSource.OWASP and vector.startswith('OWASP'): - return re.sub(r'^OWASP/?', '', vector) + return _VSS_VECTOR_RE_OWASP.sub('', vector) return vector def get_value_pre_1_4(self) -> str: