add missing cvss_v3 scores during github sync

Author: skipkayhil

lib/github_advisory_sync.rb

@@ -226,7 +226,7 @@ def withdrawn?
     end
 
     def cvss
-      return "<FILL IN IF AVAILABLE>" if advisory["cvss"]["vectorString"].nil?
+      return if advisory["cvss"]["vectorString"].nil?
 
       advisory["cvss"]["score"].to_f
     end
@@ -245,6 +245,30 @@ def filename_for(package_name)
       File.join("gems", package_name, "#{primary_id}.yml")
     end
 
+    def update_file
+      saved_data = YAML.load_file(rubysec_filename)
+
+      return if saved_data.key?("cvss_v3") || cvss.nil?
+
+      cvss_added = false
+      File.open("#{rubysec_filename}.tmp", "w") do |f| 
+        IO.foreach(rubysec_filename) do |line|
+          if (line.include?('unaffected_versions:') || line.include?('patched_versions:')) && !cvss_added
+            f.write("cvss_v3: #{cvss}\n\n")
+              cvss_added = true
+          end
+          f.write(line)
+        end
+      end
+
+      File.delete(rubysec_filename)
+      File.rename("#{rubysec_filename}.tmp", rubysec_filename)
+
+      puts "Updated: #{rubysec_filename}"
+
+      rubysec_filename
+    end
+
     def write_file
       packages_to_write = package_names.filter { |name| !File.exist?(filename_for(name)) }