);
}
/* A field the feed left blank says so. An empty value used to render as a bare label
over nothing, which read as a layout fault rather than as missing data. The API
sends "—" for some unknowns, so that counts as empty too. */
function Field({ label, children, wide, mono }) {
const empty = children == null || children === false ||
(typeof children === "string" && (!children.trim() || children.trim() === "—"));
return (
{label}{empty ? "Not specified" : children}
);
}
function Section({ icon, title, kicker, children, tone }) {
return (
{title}
{kicker && {kicker}}
{children}
);
}
function CvssGauge({ cvss, sev, compact }) {
const pct = cvss / 10;
const r = 52, c = Math.PI * r; // semicircle
return (
{cvss.toFixed(1)}CVSS v3.1
);
}
/* Risk strip — the four numbers that decide how urgent this finding is, directly under
the title. They used to live in the side rail, which on a phone put them BELOW the
comments, so the one thing a reader needs first came last. Same idea and the same
surface as the component page's strip.
EPSS is a probability [0..1] of exploitation in the wild within 30 days (FIRST.org
feed), shown as a percentage because 0.0123 means nothing at a glance and 1.23%
does; the raw score stays in the tooltip. Rows outside the backfill have epss_score
null and read "Not scored" — never 0%, since a genuine 0.00x score is real signal. */
function VulnRiskStrip({ v }) {
const scored = v.epss_score != null;
const pct = scored ? v.epss_score * 100 : 0;
const pctText = !scored ? "" : pct > 0 && pct < 0.01 ? "<0.01%" : pct.toFixed(pct < 1 ? 2 : 1) + "%";
return (
// .vd-strip is the size container; the grid is the inner div, because a container
// query can restyle a container's children but never the container itself.
{scored ? pctText : "Not scored"}EPSS · chance of exploitation in the next 30 days
);
}
function Detail({ v: initialV, statusOf, setStatus, assigneesOf, toggleAssignee, clearAssignees,
jiraOf, jiraReady, createJiraIssue, unlinkJiraIssue,
deadlineOf, setDeadline, onBack, onOpen, backLabel, sbomHits = [] }) {
const [assignOpen, setAssignOpen] = useState(false);
// Administrator action — see the ledger, and ForbidNonAdmin server-side.
const canAssign = canAssignOwners();
// Owned here rather than in the chip: the create is deliberately not optimistic, so
// something has to hold "in flight" for the round trip to Jira.
const [jiraBusy, setJiraBusy] = useState(false);
// The detail page owns its own endpoint: one record + its related items by id.
// The clicked record is already a full catalog object, so it renders immediately
// while /api/detail/{id} fills in the "related" list.
const { data } = useApi((signal) => window.VCApi.detail(initialV.id, signal), [initialV.id]);
const v = (data && data.vuln) || initialV;
const related = (data && data.related) || [];
const st = statusOf(v);
const jiraLink = jiraOf ? jiraOf(v) : null;
const auto = v.kind === "automotive";
// Enrichment completeness = share of analysis fields actually populated (dynamic).
const enrich = useMemo(() => {
const fields = [v.attack_path, v.damage_scenario, v.countermeasures, v.tools_used,
v.feasibility, v.types_of_attack, v.level_of_attack, v.impact,
v.cia && (v.cia.c === "High" || v.cia.i === "High" || v.cia.a === "High") ? "y" : ""];
const filled = fields.filter(x => x && String(x).trim() && String(x).trim() !== "—").length;
return Math.round(filled / fields.length * 100);
}, [v]);
// The same SBOM entry usually appears in several ECU builds (one row per build),
// so collapse to one line per distinct name+version and list the builds it sits in.
// Sorted by name for a stable order — the incoming array follows component load
// order, which is not meaningful to the reader.
const sbomRows = useMemo(() => {
const byLib = new Map();
(sbomHits || []).forEach(({ comp, lib }) => {
if (!lib || !lib.name) return;
const key = lib.name + "@" + (lib.version || "");
let row = byLib.get(key);
if (!row) byLib.set(key, (row = { key, name: lib.name, version: lib.version || "", builds: [] }));
// comp.name usually ALREADY carries the version ("01_Appl-build 1.0"), so a
// naive join renders "01_Appl-build 1.0 1.0". Same guard applySbomUpdate uses.
const cname = (comp && comp.name) || "";
const cver = (comp && comp.ecuVersion) || "";
const build = cver && !cname.endsWith(" " + cver) ? (cname + " " + cver).trim() : cname.trim();
if (build && row.builds.indexOf(build) === -1) row.builds.push(build);
});
return Array.from(byLib.values()).sort((a, b) => a.name.localeCompare(b.name));
}, [sbomHits]);
// The name(s) THIS customer uses, for the "Affected component" line. Falls back to
// the advisory's own string when the match came from outside the loaded component
// set (a deep link opened before components finish loading, or a catalog-only view).
const sbomNames = sbomRows.map(r => r.name).join(", ");
// Header tags, each with its label: bare values ("Amazon Web Services") left the
// reader guessing whether a tag was the vendor, the supplier or the ECU. A value
// the feed does not have is left out rather than drawn as an empty tag (the
// supplier was an icon with nothing beside it); "—" is the API's "unknown".
const known = (x) => x != null && String(x).trim() !== "" && String(x).trim() !== "—";
const headTags = [
[auto ? "ECU" : "Product", auto ? v.ecu : v.product_name],
[v.interface ? "Interface" : "Protocol", v.interface || v.protocol],
["Supplier", v.supplier],
].filter(([, val]) => known(val));
// The analysis grids are two columns; an odd field count left a blank grey cell
// beside the last one, so that field takes the full row instead.
const vendorAsPublished = sbomNames && v.affected_component && sbomNames !== v.affected_component;
return (
{/* comp-head: the component page's header treatment (labelled tags, title wrap,
kicker line), reused so the two detail pages read as one product. */}
via {v.source}
{known(v.published) && · published {v.published}}
{v.id}
{v.description}
{headTags.length > 0 && (
{headTags.map(([k, val]) => (
{k}{val}
))}
)}
{/* Workflow bar, in two rows: WHERE the finding is (the status track and Accept
risk), then WHO and WHEN (deadline, owners, the Jira issue) and the export.
It used to be one row that wrapped wherever the space ran out, which put the
actions under the track at some widths and off the screen on a phone. */}
Remediation status setStatus(v.id, s)} />
Tracking
{/* Both the deadline and the assignees are set in the same dialog — the
date is a property of the remediation, the people are who's doing it. */}
setAssignOpen(true) : undefined} />
setAssignOpen(true) : undefined} />
{canAssign && assignOpen &&
toggleAssignee(v.id, u.userId, on)}
onClearAll={() => clearAssignees(v.id)}
deadline={deadlineOf ? deadlineOf(v) : null}
status={st}
onSetDeadline={setDeadline}
onClose={() => setAssignOpen(false)} />}
{/* Jira: the issue key once filed, a File-issue action while the company has
a working connection, and nothing at all when it does not. Unlink sits
beside the key rather than inside it — the chip's job is to open Jira. */}
{
if (!createJiraIssue) return;
setJiraBusy(true);
await createJiraIssue(v.id);
setJiraBusy(false);
}} />
{/* With Jira off for the company the key stays as history, and the server
refuses to unlink it until Jira is back. */}
{jiraLink && unlinkJiraIssue && FEATURES.jira &&
}
{v.vendor}{v.product_name}{v.protocol}{v.firmware_version}
{/* The customer's own name for the thing, not the vendor's internal
one. CVE-2021-27468 publishes "AosService.rem service"; the SBOM
that matched it calls the entry "Service". Showing the vendor
string here made findings untraceable to the build they came from. */}
{sbomNames || v.affected_component}
{vendorAsPublished && (
{v.affected_component}
)}
{v.library_name}{v.supplier}{(v.brands || []).join(", ")}
)}
{/* Why this finding is on this tenant's ledger at all. Rendered for both
kinds: the automotive branch above has no component field of its own, so
without this there is nothing on the page tying a CVE to the build it
came from. Hidden entirely when the components are not loaded yet rather
than showing an empty shell. */}
{sbomRows.length > 0 && (
{/* Shared team discussion on THIS finding, server-side, so it is the same
thread for everyone in the organisation on every device. Scoped to the
vulnerability rather than the component: a CVE matched by four ECUs is
one conversation, not four.
Hidden entirely when a superadmin has switched comments off. That is
not the enforcement — the server refuses a post regardless, which is what
covers a session whose cached config predates the change. */}
{/* sidebar. The CVSS / EPSS / CIA card that used to open it is the risk strip
under the header now. */}