You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This repository contains services that support the [CVE Program's mission](https://www.cve.org/About/Overview) to "identify, define, and catalog publicly disclosed cybersecurity vulnerabilities."
23
+
This repository contains services that support the [CVE Program's
24
+
mission][cve_mission] to "identify, define, and catalog publicly disclosed
25
+
cybersecurity vulnerabilities."
24
26
25
27
There are many ways one can assist:
26
28
27
29
### OSS Contributor
28
30
29
-
Developers can contribute code directly. Getting started can be as fast as choosing an issue on our [board](https://github.com/CVEProject/cve-services/issues?q=is%3Aissue+is%3Aopen).
31
+
Developers can contribute code directly. Getting started can be as fast as
32
+
choosing an issue on our [board][cve_issue_tracker].
30
33
31
-
Please read our [contributor's guide](https://github.com/CVEProject/cve-services/blob/dev/CONTRIBUTING.md) for more details. We welcome all contributions!
34
+
Please read our [contributor's guide](./CONTRIBUTING.md) for more details. We
35
+
welcome all contributions!
32
36
33
37
### Working Groups
34
38
35
-
The CVE project operates as multiple focused working groups. Visit the CVE Website [working groups page](https://www.cve.org/ProgramOrganization/WorkingGroups) for more information.
39
+
The CVE project operates as multiple focused working groups. Visit the CVE
40
+
Website [working groups page](cve_wg) for more information.
36
41
37
42
### Security
38
43
@@ -41,34 +46,37 @@ The CVE project operates as multiple focused working groups. Visit the CVE Websi
41
46
>**Warning**
42
47
>Do not put vulnerability information in a GitHub issue.
43
48
44
-
Please consult our [SECURITY.md](https://github.com/CVEProject/cve-services/blob/dev/SECURITY.md) for specific instructions on reporting a vulnerability that exists in the CVE Services.
49
+
Please consult our [SECURITY.md](./SECURITY.md) for specific instructions on
50
+
reporting a vulnerability that exists in the CVE Services.
45
51
46
52
## Development
47
53
48
54
### Technologies
49
55
50
56
This project uses or depends on software from
51
57
52
-
-[NodeJS](https://nodejs.org/)
53
-
-[Express](https://github.com/expressjs)
54
-
-[MongoDB for locally run instances](https://www.mongodb.com/)
55
-
-[Mongoose.js](https://mongoosejs.com)
58
+
-[NodeJS][nodejs]
59
+
-[Express][express]
60
+
-[MongoDB for locally run instances][mongodb]
61
+
-[Mongoose.js][mongoose]
56
62
57
63
### Style Guidelines
58
64
59
-
This project follows the [JavaScript Standard Style](https://github.com/standard/standard).
65
+
This project follows the [JavaScript Standard Style][js_standard].
60
66
61
67
### Setup
62
68
63
69
#### Docker
64
70
65
-
See the Docker README found in the repo here: https://github.com/CVEProject/cve-services/blob/dev/docker/README.md
71
+
See [the Docker README found in the repo](./docker/README.md).
66
72
67
73
#### Local Development
68
74
69
-
>**Warning**
75
+
>**Warning**
70
76
>
71
-
>DO NOT use the dev configuration on a public network. The dev environment includes credentials to enable rapid development and is not secure for public deployment.
77
+
> DO NOT use the dev configuration on a public network. The dev environment
78
+
> includes credentials to enable rapid development and is not secure for public
For transaction support, MongoDB needs to be configured with a replica set. You
101
+
can do this by setting [`replication.replSetName`][mongodb_replset] in the
102
+
`mongod.conf` file and restarting the MongoDB service.
91
103
92
-
Create a `cve_dev` database in Compass. The collections will be automatically created when the API starts storing documents.
104
+
Create a `cve_dev` database in Compass. The collections will be automatically
105
+
created when the API starts storing documents.
93
106
94
107
You can populate the database with test data using:
95
108
@@ -108,34 +121,48 @@ npm run start:dev
108
121
109
122
### API Documentation
110
123
111
-
API documentation is generated using [swagger-autogen](https://github.com/davibaltar/swagger-autogen) which ensures that we keep the API specification up to date with any major changes to API routes. Extra information for each API route is defined as a comment in the `index.js` files under the respective controller and all request and response schemas are stored under the `schemas` folder served up by `schemas.controller`.
124
+
API documentation is generated using [swagger-autogen][swagger_autogen] which
125
+
ensures that we keep the API specification up to date with any major changes to
126
+
API routes. Extra information for each API route is defined as a comment in the
127
+
`index.js` files under the respective controller and all request and response
128
+
schemas are stored under the `schemas` folder served up by
129
+
`schemas.controller`.
112
130
113
-
To ensure you are using the correct API specification the following endpoints can be used:
To ensure you are using the correct API specification the following endpoints
132
+
can be used:
116
133
117
-
Note: The specification file stored in GitHub will only be correct for that branch; there could be differences between branches and production.
134
+
-[Test Instance][cve_instance_test]
135
+
-[Production][cve_instance_prod]
118
136
119
-
If you are developer and want to test changes to the API specification you can generate a specification in one of two ways:
137
+
Note: The specification file stored in GitHub will only be correct for that
138
+
branch; there could be differences between branches and production.
139
+
140
+
If you are developer and want to test changes to the API specification you can
141
+
generate a specification in one of two ways:
120
142
121
143
1. Preferred
122
144
123
-
When you start your local development server using `npm run start:dev` the specification file will be generated. Subsequent changes require reloading the server.
145
+
When you start your local development server using `npm run start:dev` the
146
+
specification file will be generated. Subsequent changes require reloading the
147
+
server.
124
148
125
149
2. Manual
126
150
127
151
You can use `npm run swagger-autogen` to generate a new specification file.
128
152
129
153
### CVE Record Submission Validation Rules
130
154
131
-
As part of the submission processing, CVE Services "validates" that specific requirements are met prior to accepting the submission and posting the CVE Record to the CVE List. Validation rules for CVE Record Submission are noted [here](https://github.com/CVEProject/automation-working-group/blob/master/meeting-notes/files/CVERules.md).
155
+
As part of the submission processing, CVE Services "validates" that specific
156
+
requirements are met prior to accepting the submission and posting the CVE
157
+
Record to the CVE List. Validation rules for CVE Record Submission are noted
158
+
[here][cve_validation_rules].
132
159
133
160
### Unit Testing
134
161
135
162
This project uses the following for unit testing
136
163
137
-
-https://mochajs.org/
138
-
-https://www.chaijs.com/
164
+
-<https://mochajs.org/>
165
+
-<https://www.chaijs.com/>
139
166
140
167
In order to run the unit tests:
141
168
@@ -145,31 +172,73 @@ npm run start:test
145
172
146
173
### User Registry
147
174
148
-
The CVE Automation Working Group (on behalf of the CVE Program) is currently working on a new automation capability: the User Registry. The objective of the User Registry is to modernize how CVE Program Organizations (e.g., CNAs, Roots, Top level Roots, the Secretariat) manage/update their organizational properties and user pools. The new capability will ultimately allow CNAs, Roots, Top Level Roots to better manage their own data/user pools with more robust information. It is targeted to be implemented in a series of incremental deployments to CVE Services in the Fall/2025 through Summer/2026.
175
+
The CVE Automation Working Group (on behalf of the CVE Program) is currently
176
+
working on a new automation capability: the User Registry. The objective of the
177
+
User Registry is to modernize how CVE Program Organizations (e.g., CNAs, Roots,
178
+
Top level Roots, the Secretariat) manage/update their organizational properties
179
+
and user pools. The new capability will ultimately allow CNAs, Roots,
180
+
Top Level Roots to better manage their own data/user pools with more robust
181
+
information. It is targeted to be implemented in a series of incremental
182
+
deployments to CVE Services in the Fall/2025 through Summer/2026.
149
183
150
184
#### Current Status:
151
185
152
-
The release candidate for the first User Registry increment (termed the User Registry MVP) is now available for testing/review in the CVE Program Testing Environment. (Note that this release IS NOT a PRODUCTION Release and will not be visible in the CVE Program PRODUCTION environment).
153
-
This release candidate establishes a new, more robust User/Organizations databases (and associated APIs) while maintaining full backwards compatibility with the current User/Organizational management functions (meaning that current CVE Services clients will not be required to be modified with the deployment of this candidate). It was discussed at the [6/10/2025 CVE Program AWG meeting](https://github.com/CVEProject/automation-working-group/blob/master/meeting-notes/2025-06-10.md).
186
+
The release candidate for the first User Registry increment (termed the User
187
+
Registry MVP) is now available for testing/review in the CVE Program Testing
188
+
Environment. (Note that this release IS NOT a PRODUCTION Release and will not
189
+
be visible in the CVE Program PRODUCTION environment).
154
190
155
-
#### HowTo:
191
+
This release candidate establishes a new, more robust User/Organizations
192
+
databases (and associated APIs) while maintaining full backwards compatibility
193
+
with the current User/Organizational management functions (meaning that current
194
+
CVE Services clients will not be required to be modified with the deployment of
195
+
this candidate). It was discussed at the [6/10/2025 CVE Program AWG
196
+
meeting][cve_awg_meeting].
156
197
157
-
Credentialed users of CVE Services Test Environment will be able to use the new capabilities via the API endpoints which are described [here](https://cveawg-test.mitre.org/api-docs/) (Be sure to scroll down to the bottom of the page to review the new User Registry interfaces).
198
+
#### How To:
158
199
159
-
Credentialed users can access the APIs by
200
+
Credentialed users of CVE Services Test Environment will be able to use the new
201
+
capabilities via the API endpoints which are described
202
+
[here][cve_instance_test] (Be sure to scroll down to the bottom of the page to
203
+
review the new User Registry interfaces).
160
204
161
-
- installing/using common web application API testing tools such as [curl](https://curl.se/) or [postman](https://www.postman.com/) OR
205
+
Credentialed users can access the APIs by
162
206
163
-
- installing/using the [User Registry Client](https://github.com/CVEProject/cve-user-registry-client) which provides a GUI interface to exercise the basic functions of the User Registry.
207
+
- installing/using common web application API testing tools such as [curl] or
208
+
[postman] OR
209
+
- installing/using the [User Registry Client][cve_ur_client] which provides a
210
+
GUI interface to exercise the basic functions of the User Registry.
164
211
165
-
Note that there is no support for these new endpoints in many currently available CVE Services “client” tools (e.g, Vulnogram) and hence they should not be relied upon to examine/test these interfaces.
212
+
Note that there is no support for these new endpoints in many currently
213
+
available CVE Services “client” tools (e.g, Vulnogram) and hence they should
214
+
not be relied upon to examine/test these interfaces.
166
215
167
216
#### Next Steps:
168
217
169
-
The AWG is taking comments/questions on this release candidate. You can provide feedback in three ways:
170
-
171
-
- Send comments/questions to AWG+owner@CVE-CWE-Programs.groups.io,
172
-
173
-
- Post Issues/Questions to the CVE Services Issue Board (please attach a “user registry” label to your post).
174
-
175
-
- Attend (virtually) an AWG meeting which meets every week on Tuesday at 4:00 PM Eastern US Time. Send a request for the link to AWG+owner@CVE-CWE-Programs.groups.io.
218
+
The AWG is taking comments/questions on this release candidate. You can provide
219
+
feedback in three ways:
220
+
221
+
- Send comments/questions to `AWG+owner@CVE-CWE-Programs.groups.io`,
222
+
- Post Issues/Questions to the CVE Services Issue Board (please attach a “user
223
+
registry” label to your post).
224
+
- Attend (virtually) an AWG meeting which meets every week on Tuesday at 4:00
225
+
PM Eastern US Time. Send a request for the link to
0 commit comments