Documentation
¶
Overview ¶
Package scoring centralizes the composite risk-score formula and the tiny helpers analyzers share for score clamping and severity thresholding.
Composite formula (spec §8.3):
score = base × exploitability × blast_radius + chain_modifier
Analyzers populate Factors (or a raw Score for legacy callers); the engine's post-run pass fills in ChainModifier from privilege-escalation paths and then calls Compose so ordering across modules is meaningful.
Index ¶
- func AboveThreshold(f models.Finding, threshold models.Severity) bool
- func ChainModifier(highestReachable models.Severity) float64
- func Clamp(score float64) float64
- func Compose(f Factors) float64
- func ComposeWithFactors(f Factors) (float64, *models.ScoreFactors)
- func MinScoreForSeverity(s models.Severity) float64
- func SeverityForScore(score float64) models.Severity
- type Factors
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AboveThreshold ¶
AboveThreshold reports whether a finding's severity meets or exceeds the given threshold, using Severity.Rank ordering.
func ChainModifier ¶
ChainModifier returns the score bump to apply to a finding whose subject can reach a privilege-escalation sink of the given (highest) severity. Non-chain findings get 0.
func Compose ¶
Compose applies the composite formula and clamps the result to [0, 10]. Zero-valued Exploitability or BlastRadius are treated as 1.0 so callers can leave them unset.
func ComposeWithFactors ¶ added in v1.1.0
func ComposeWithFactors(f Factors) (float64, *models.ScoreFactors)
ComposeWithFactors is the analyzer-side companion to Compose: it returns both the composite score and a pointer to a JSON-serializable models.ScoreFactors snapshot of the inputs (with the same zero-to-1.0 defaulting Compose applies). Analyzers that want the HTML report's scoring tooltip to render a breakdown call this and assign the returned pointer to Finding.ScoreFactors. The score itself is unchanged from Compose.
Returns a fresh *models.ScoreFactors on every call so callers can mutate or replace it without worrying about shared state.
func MinScoreForSeverity ¶
MinScoreForSeverity returns the lower bound of the score range for a severity bucket (the inverse of SeverityForScore boundaries). Used by the admission-aware reweight stage to snap an attenuated finding's score to the floor of its new severity bucket so Score and Severity stay consistent for downstream consumers.
func SeverityForScore ¶
SeverityForScore maps a numeric 0–10 score to the corresponding severity bucket.
Source Files