Skip to content

Commit 6de0ebe

Browse files
stevespringettstevespringett
committed
Updated json and xml schemas to account for tool usage in vulnerability objects. Updated vulnerability examples with new structure.
Signed-off-by: Steve Springett <[email protected]>
1 parent e06981d commit 6de0ebe

File tree

5 files changed

+92
-58
lines changed

5 files changed

+92
-58
lines changed

‎schema/bom-1.5.schema.json‎

Lines changed: 31 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1763,35 +1763,39 @@
17631763
}
17641764
},
17651765
"tools": {
1766-
"type": "array",
1767-
"title": "Creation Tools",
1768-
"description": "The tool(s) used to identify, confirm, or score the vulnerability.",
1769-
"additionalItems": false,
1770-
"items": {
1771-
"properties": {
1772-
"component": {
1773-
"$ref": "#/definitions/component"
1774-
},
1775-
"service": {
1776-
"$ref": "#/definitions/service"
1777-
},
1778-
"tool": {
1779-
"description": "[Deprecated - Use `component` and `service` instead]",
1780-
"$ref": "#/definitions/tool"
1766+
"oneOf": [
1767+
{
1768+
"type": "object",
1769+
"title": "Tools",
1770+
"description": "The tool(s) used to identify, confirm, or score the vulnerability.",
1771+
"additionalProperties": false,
1772+
"properties": {
1773+
"components": {
1774+
"type": "array",
1775+
"additionalItems": false,
1776+
"items": {"$ref": "#/definitions/component"},
1777+
"uniqueItems": true,
1778+
"title": "Components",
1779+
"description": "A list of software and hardware components used as tools"
1780+
},
1781+
"services": {
1782+
"type": "array",
1783+
"additionalItems": false,
1784+
"items": {"$ref": "#/definitions/service"},
1785+
"uniqueItems": true,
1786+
"title": "Services",
1787+
"description": "A list of services used as tools. This may include microservices, function-as-a-service, and other types of network or intra-process services."
1788+
}
17811789
}
17821790
},
1783-
"oneOf":[
1784-
{
1785-
"required": ["component"]
1786-
},
1787-
{
1788-
"required": ["service"]
1789-
},
1790-
{
1791-
"required": ["tool"]
1792-
}
1793-
]
1794-
}
1791+
{
1792+
"type": "array",
1793+
"title": "Tools (legacy)",
1794+
"description": "[Deprecated] The tool(s) used to identify, confirm, or score the vulnerability.",
1795+
"additionalItems": false,
1796+
"items": {"$ref": "#/definitions/tool"}
1797+
}
1798+
]
17951799
},
17961800
"analysis": {
17971801
"type": "object",

‎schema/bom-1.5.xsd‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2187,9 +2187,27 @@ limitations under the License.
21872187
<xs:documentation>The tool(s) used to identify, confirm, or score the vulnerability.</xs:documentation>
21882188
</xs:annotation>
21892189
<xs:complexType>
2190-
<xs:sequence minOccurs="0" maxOccurs="unbounded">
2191-
<xs:element name="tool" minOccurs="0" type="bom:toolType"/>
2192-
</xs:sequence>
2190+
<xs:choice>
2191+
<xs:sequence minOccurs="0" maxOccurs="unbounded">
2192+
<xs:element name="tool" minOccurs="0" type="bom:toolType">
2193+
<xs:annotation>
2194+
<xs:documentation>DEPRECATED. Use tools\components or tools\services instead.</xs:documentation>
2195+
</xs:annotation>
2196+
</xs:element>
2197+
</xs:sequence>
2198+
<xs:sequence minOccurs="0" maxOccurs="1">
2199+
<xs:element name="components" type="bom:componentsType" minOccurs="0" maxOccurs="1">
2200+
<xs:annotation>
2201+
<xs:documentation>A list of software and hardware components used as tools.</xs:documentation>
2202+
</xs:annotation>
2203+
</xs:element>
2204+
<xs:element name="services" type="bom:servicesType" minOccurs="0" maxOccurs="1">
2205+
<xs:annotation>
2206+
<xs:documentation>A list of services used as tools.</xs:documentation>
2207+
</xs:annotation>
2208+
</xs:element>
2209+
</xs:sequence>
2210+
</xs:choice>
21932211
</xs:complexType>
21942212
</xs:element>
21952213
<xs:element name="analysis" minOccurs="0" maxOccurs="1">

‎tools/src/test/resources/1.5/valid-vulnerability-1.5.json‎

Lines changed: 16 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -80,19 +80,22 @@
8080
}
8181
]
8282
},
83-
"tools": [
84-
{
85-
"vendor": "Snyk",
86-
"name": "Snyk CLI (Linux)",
87-
"version": "1.729.0",
88-
"hashes": [
89-
{
90-
"alg": "SHA-256",
91-
"content": "2eaf8c62831a1658c95d41fdc683cd177c147733c64a93e59cb2362829e45b7d"
92-
}
93-
]
94-
}
95-
],
83+
"tools": {
84+
"components": [
85+
{
86+
"type": "application",
87+
"group": "Snyk",
88+
"name": "Snyk CLI (Linux)",
89+
"version": "1.729.0",
90+
"hashes": [
91+
{
92+
"alg": "SHA-256",
93+
"content": "2eaf8c62831a1658c95d41fdc683cd177c147733c64a93e59cb2362829e45b7d"
94+
}
95+
]
96+
}
97+
]
98+
},
9699
"analysis": {
97100
"state": "not_affected",
98101
"justification": "code_not_reachable",

‎tools/src/test/resources/1.5/valid-vulnerability-1.5.textproto‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -74,13 +74,20 @@ vulnerabilities {
7474
}
7575
}
7676
tools: {
77-
vendor: "Snyk"
78-
name: "Snyk CLI (Linux)"
79-
version: "1.729.0"
80-
hashes: {
81-
alg: HASH_ALG_SHA_256
82-
value: "2eaf8c62831a1658c95d41fdc683cd177c147733c64a93e59cb2362829e45b7d"
83-
}
77+
components: [
78+
{
79+
type: CLASSIFICATION_APPLICATION,
80+
group: "Snyk",
81+
name: "Snyk CLI (Linux)",
82+
version: "1.729.0",
83+
hashes: [
84+
{
85+
alg: HASH_ALG_SHA_256
86+
value: "2eaf8c62831a1658c95d41fdc683cd177c147733c64a93e59cb2362829e45b7d"
87+
}
88+
]
89+
}
90+
]
8491
}
8592
analysis: {
8693
state: IMPACT_ANALYSIS_STATE_NOT_AFFECTED

‎tools/src/test/resources/1.5/valid-vulnerability-1.5.xml‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -80,14 +80,16 @@
8080
</individuals>
8181
</credits>
8282
<tools>
83-
<tool>
84-
<vendor>Snyk</vendor>
85-
<name>Snyk CLI (Linux)</name>
86-
<version>1.729.0</version>
87-
<hashes>
88-
<hash alg="SHA-256">2eaf8c62831a1658c95d41fdc683cd177c147733c64a93e59cb2362829e45b7d</hash>
89-
</hashes>
90-
</tool>
83+
<components>
84+
<component type="application">
85+
<group>Snyk</group>
86+
<name>Snyk CLI (Linux)</name>
87+
<version>1.729.0</version>
88+
<hashes>
89+
<hash alg="SHA-256">2eaf8c62831a1658c95d41fdc683cd177c147733c64a93e59cb2362829e45b7d</hash>
90+
</hashes>
91+
</component>
92+
</components>
9193
</tools>
9294
<analysis>
9395
<state>not_affected</state>

0 commit comments

Comments
 (0)