Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add optional severity field override for affected packages. #106

Merged
merged 8 commits into from
Jan 11, 2023
Merged

Add optional severity field override for affected packages. #106

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
93e89a9
Added optional "severity" component to affected package component.
oswalpalash Jan 5, 2023
6d0dc79
Update documentation to add optional severity field for packages
oswalpalash Jan 5, 2023
83a6f04
Change description based on PR feedback
oswalpalash Jan 5, 2023
02647ee
Update docs/schema.md
oswalpalash Jan 5, 2023
ea53e3c
Pull severity up one level in the affected tree
oswalpalash Jan 5, 2023
f3a5ba8
Update docs
oswalpalash Jan 5, 2023
bd76851
Bring up to the same level as package
oswalpalash Jan 5, 2023
df834d5
Doc clean up
oswalpalash Jan 6, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions docs/schema.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,10 @@ A JSON Schema for validation is also available
"name": string,
"purl": string
},
"severity": [ {
"type": string,
"score": string
} ],
"ranges": [ {
"type": string,
"repo": string,
Expand Down Expand Up @@ -297,6 +301,10 @@ on the selected `severity[].type`, as described above.
"name": string,
"purl": string
},
"severity": [ {
"type": string,
"score": string
} ],
"ranges": [ {
"type": string,
"repo": string,
Expand Down Expand Up @@ -394,6 +402,14 @@ It is permitted for a database name (the DB prefix in the `id` field) and an
ecosystem name to be the same, provided they have the same owner who can make
decisions about the meaning of the `ecosystem_specific` field (see below).

### affected[].severity field

The `severity` field is an optional element [defined here](#severity-field).
This `severity` field applies to a specific package, in cases where affected
packages have differing severities for the same vulnerability. If any package
level `severity` fields are set, the top level [`severity`](#severity-field)
must not be set.

### affected[].versions field

The `affected` object's `versions` field is a JSON array of strings. Each string
Expand Down
22 changes: 22 additions & 0 deletions validation/schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,28 @@
"name"
]
},
"severity": {
"type": ["array", "null"],
"items": {
"type": "object",
"properties": {
"type": {
"type": "string",
"enum": [
"CVSS_V2",
"CVSS_V3"
]
},
"score": {
"type": "string"
}
},
"required": [
"type",
"score"
]
}
},
"ranges": {
"type": "array",
"items": {
Expand Down