diff --git a/strix/report/writer.py b/strix/report/writer.py index ec592f14..794a23a5 100644 --- a/strix/report/writer.py +++ b/strix/report/writer.py @@ -215,6 +215,14 @@ def render_vulnerability_md(report: dict[str, Any]) -> str: # noqa: PLR0912, PL cvss = report.get("cvss") if cvss is not None: metadata.append(("CVSS", cvss)) + contextual_metrics = dep_meta.get("contextual_cvss_metrics") + if isinstance(contextual_metrics, dict) and contextual_metrics: + metadata.append( + ( + "Contextual CVSS Metrics", + "/".join(f"{metric}:{value}" for metric, value in contextual_metrics.items()), + ) + ) if report.get("fix_effort"): metadata.append(("Fix Effort", str(report["fix_effort"]).title())) for label, value in metadata: @@ -241,6 +249,11 @@ def render_vulnerability_md(report: dict[str, Any]) -> str: # noqa: PLR0912, PL lines.append(str(report["technical_analysis"])) lines.append("") + if dep_meta.get("contextual_cvss_reasoning"): + lines.append("## Contextual CVSS\n") + lines.append(str(dep_meta["contextual_cvss_reasoning"])) + lines.append("") + if report.get("poc_description") or report.get("poc_script_code"): lines.append("## Proof of Concept\n") if report.get("poc_description"): diff --git a/strix/tools/reporting/tool.py b/strix/tools/reporting/tool.py index 49a082d6..d0685119 100644 --- a/strix/tools/reporting/tool.py +++ b/strix/tools/reporting/tool.py @@ -948,7 +948,9 @@ async def _do_create_dependency( # noqa: PLR0912 "govulncheck call path). Never claim a reachability level without evidence." ) - if contextual_cvss_metrics and not (contextual_cvss_reasoning or "").strip(): + if _clean_contextual_cvss_metrics(contextual_cvss_metrics) and not ( + contextual_cvss_reasoning or "" + ).strip(): errors.append( "contextual_cvss_reasoning is required when contextual_cvss_metrics is set: " "state in one or two sentences what you observed in this codebase that "