Skip to content

Commit 68ee653

Browse files
stevespringettstevespringett
authored
Merge pull request #194 from CycloneDX/v1.5-dev-service-dataflows
Extend service dataflow support
2 parents cb12e32 + 5ca7232 commit 68ee653

File tree

6 files changed

+846
-15
lines changed

6 files changed

+846
-15
lines changed

‎schema/bom-1.5.proto‎

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -123,16 +123,24 @@ message Component {
123123
optional ReleaseNotes releaseNotes = 24;
124124
}
125125

126-
// Specifies the data classification.
127-
message DataClassification {
126+
// Specifies the data flow.
127+
message DataFlow {
128128
// Specifies the flow direction of the data.
129-
DataFlow flow = 1;
130-
// SimpleContent value of element
129+
DataFlowDirection flow = 1;
130+
// Data classification tags data according to its type, sensitivity, and value if altered, stolen, or destroyed.
131131
string value = 2;
132+
// Name for the defined data
133+
optional string name = 3;
134+
// Short description of the data content and usage
135+
optional string description = 4;
136+
// The URI, URL, or BOM-Link of the components or services the data came in from
137+
repeated string source = 5;
138+
// The URI, URL, or BOM-Link of the components or services the data is sent to
139+
repeated string destination = 6;
132140
}
133141

134142
// Specifies the flow direction of the data. Valid values are: inbound, outbound, bi-directional, and unknown. Direction is relative to the service. Inbound flow states that data enters the service. Outbound flow states that data leaves the service. Bi-directional states that data flows both ways, and unknown states that the direction is not known.
135-
enum DataFlow {
143+
enum DataFlowDirection {
136144
DATA_FLOW_NULL = 0;
137145
DATA_FLOW_INBOUND = 1;
138146
DATA_FLOW_OUTBOUND = 2;
@@ -481,7 +489,7 @@ message Service {
481489
optional bool authenticated = 8;
482490
// A boolean value indicating if use of the service crosses a trust zone or boundary. A value of true indicates that by using the service, a trust boundary is crossed. A value of false indicates that by using the service, a trust boundary is not crossed.
483491
optional bool x_trust_boundary = 9;
484-
repeated DataClassification data = 10;
492+
repeated DataFlow data = 10;
485493
repeated LicenseChoice licenses = 11;
486494
// Provides the ability to document external references related to the service.
487495
repeated ExternalReference external_references = 12;
@@ -491,6 +499,8 @@ message Service {
491499
repeated Property properties = 14;
492500
// Specifies optional release notes.
493501
optional ReleaseNotes releaseNotes = 15;
502+
// The name of the trust zone the service resides in.
503+
optional string trustZone = 16;
494504
}
495505

496506
message Swid {

‎schema/bom-1.5.schema.json‎

Lines changed: 47 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1160,12 +1160,17 @@
11601160
"title": "Crosses Trust Boundary",
11611161
"description": "A boolean value indicating if use of the service crosses a trust zone or boundary. A value of true indicates that by using the service, a trust boundary is crossed. A value of false indicates that by using the service, a trust boundary is not crossed."
11621162
},
1163+
"trustZone": {
1164+
"type": "string",
1165+
"title": "Trust Zone",
1166+
"description": "The name of the trust zone the service resides in."
1167+
},
11631168
"data": {
11641169
"type": "array",
11651170
"additionalItems": false,
1166-
"items": {"$ref": "#/definitions/dataClassification"},
1167-
"title": "Data Classification",
1168-
"description": "Specifies the data classification."
1171+
"items": {"$ref": "#/definitions/dataFlow"},
1172+
"title": "Data",
1173+
"description": "Specifies the data flow, classification, and other relevant information."
11691174
},
11701175
"licenses": {
11711176
"type": "array",
@@ -1207,7 +1212,7 @@
12071212
}
12081213
}
12091214
},
1210-
"dataClassification": {
1215+
"dataFlow": {
12111216
"type": "object",
12121217
"title": "Hash Objects",
12131218
"required": [
@@ -1217,18 +1222,54 @@
12171222
"additionalProperties": false,
12181223
"properties": {
12191224
"flow": {
1220-
"$ref": "#/definitions/dataFlow",
1225+
"$ref": "#/definitions/dataFlowDirection",
12211226
"title": "Directional Flow",
12221227
"description": "Specifies the flow direction of the data. Direction is relative to the service. Inbound flow states that data enters the service. Outbound flow states that data leaves the service. Bi-directional states that data flows both ways, and unknown states that the direction is not known."
12231228
},
12241229
"classification": {
12251230
"type": "string",
12261231
"title": "Classification",
12271232
"description": "Data classification tags data according to its type, sensitivity, and value if altered, stolen, or destroyed."
1233+
},
1234+
"name": {
1235+
"type": "string",
1236+
"title": "Name",
1237+
"description": "Name for the defined data",
1238+
"examples": [
1239+
"Credit card reporting"
1240+
]
1241+
},
1242+
"description": {
1243+
"type": "string",
1244+
"title": "Description",
1245+
"description": "Short description of the data content and usage",
1246+
"examples": [
1247+
"Credit card information being exchanged in between the web app and the database"
1248+
]
1249+
},
1250+
"source": {
1251+
"type": "array",
1252+
"additionalItems": false,
1253+
"items": {
1254+
"type": "string",
1255+
"format": "iri-reference"
1256+
},
1257+
"title": "Source",
1258+
"description": "The URI, URL, or BOM-Link of the components or services the data came in from"
1259+
},
1260+
"destination": {
1261+
"type": "array",
1262+
"additionalItems": false,
1263+
"items": {
1264+
"type": "string",
1265+
"format": "iri-reference"
1266+
},
1267+
"title": "Destination",
1268+
"description": "The URI, URL, or BOM-Link of the components or services the data is sent to"
12281269
}
12291270
}
12301271
},
1231-
"dataFlow": {
1272+
"dataFlowDirection": {
12321273
"type": "string",
12331274
"enum": [
12341275
"inbound",

‎schema/bom-1.5.xsd‎

Lines changed: 64 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1620,15 +1620,76 @@ limitations under the License.
16201620
A value of false indicates that by using the service, a trust boundary is not crossed.</xs:documentation>
16211621
</xs:annotation>
16221622
</xs:element>
1623+
<xs:element name="trustZone" type="xs:string" minOccurs="0" maxOccurs="1">
1624+
<xs:annotation>
1625+
<xs:documentation>The name of the trust zone the service resides in.</xs:documentation>
1626+
</xs:annotation>
1627+
</xs:element>
16231628
<xs:element name="data" minOccurs="0" maxOccurs="1">
16241629
<xs:complexType>
1625-
<xs:sequence minOccurs="0" maxOccurs="unbounded">
1626-
<xs:element name="classification" type="bom:dataClassificationType">
1630+
<xs:choice>
1631+
<xs:sequence minOccurs="0" maxOccurs="unbounded">
1632+
<xs:element name="classification" type="bom:dataClassificationType">
1633+
<xs:annotation>
1634+
<xs:documentation>DEPRECATED: Specifies the data classification. THIS FIELD IS DEPRECATED AS OF v1.5. Use dataflow\classification instead</xs:documentation>
1635+
</xs:annotation>
1636+
</xs:element>
1637+
</xs:sequence>
1638+
<xs:element name="dataflow" minOccurs="0" maxOccurs="unbounded">
16271639
<xs:annotation>
16281640
<xs:documentation>Specifies the data classification.</xs:documentation>
16291641
</xs:annotation>
1642+
<xs:complexType>
1643+
<xs:sequence>
1644+
<xs:element name="classification" type="bom:dataClassificationType" minOccurs="0" maxOccurs="1">
1645+
<xs:annotation>
1646+
<xs:documentation>Specifies the data classification.</xs:documentation>
1647+
</xs:annotation>
1648+
</xs:element>
1649+
<xs:element name="source" minOccurs="0" maxOccurs="1">
1650+
<xs:annotation>
1651+
<xs:documentation>The URI, URL, or BOM-Link of the components or services the data came in from.</xs:documentation>
1652+
</xs:annotation>
1653+
<xs:complexType>
1654+
<xs:sequence minOccurs="0" maxOccurs="unbounded">
1655+
<xs:element name="url" type="xs:anyURI"/>
1656+
</xs:sequence>
1657+
</xs:complexType>
1658+
</xs:element>
1659+
<xs:element name="destination" minOccurs="0" maxOccurs="1">
1660+
<xs:annotation>
1661+
<xs:documentation>The URI, URL, or BOM-Link of the components or services the data is sent to.</xs:documentation>
1662+
</xs:annotation>
1663+
<xs:complexType>
1664+
<xs:sequence minOccurs="0" maxOccurs="unbounded">
1665+
<xs:element name="url" type="xs:anyURI"/>
1666+
</xs:sequence>
1667+
</xs:complexType>
1668+
</xs:element>
1669+
</xs:sequence>
1670+
<xs:attribute name="name" type="xs:string" use="optional">
1671+
<xs:annotation>
1672+
<xs:documentation>
1673+
Name for the defined data.
1674+
</xs:documentation>
1675+
</xs:annotation>
1676+
</xs:attribute>
1677+
<xs:attribute name="description" type="xs:string" use="optional">
1678+
<xs:annotation>
1679+
<xs:documentation>
1680+
Short description of the data content and usage.
1681+
</xs:documentation>
1682+
</xs:annotation>
1683+
</xs:attribute>
1684+
<xs:anyAttribute namespace="##any" processContents="lax">
1685+
<xs:annotation>
1686+
<xs:documentation>User-defined attributes may be used on this element as long as they
1687+
do not have the same name as an existing attribute used by the schema.</xs:documentation>
1688+
</xs:annotation>
1689+
</xs:anyAttribute>
1690+
</xs:complexType>
16301691
</xs:element>
1631-
</xs:sequence>
1692+
</xs:choice>
16321693
</xs:complexType>
16331694
</xs:element>
16341695
<xs:element name="licenses" type="bom:licenseChoiceType" minOccurs="0" maxOccurs="1"/>

0 commit comments

Comments
 (0)