feat: `bom.vulnerabilities` JSON normalization by xmasoracle · Pull Request #548 · CycloneDX/cyclonedx-javascript-library

xmasoracle · 2023-03-16T11:01:06Z

Introduce normalization of vulnerabilities for JSON for CDX>=1.4 .
This is part of #164 .

~~⚠️ Note that:~~
* It only adds support for a subset of properties of Models.Vulnerability.
* I made some Models.Vulnerability.* comparable, to be able to copy the implementation of normalizeIterable, but I am not really confident in what I did, and was unsure how to test it.

jkowalleck

quick review.
marked with ❌ are wrong and need to be fixed.

src/models/vulnerability/source.ts

src/models/vulnerability/vulnerability.ts

src/models/vulnerability/reference.ts

tests/unit/Models.Vulnerability.Vulnerability.spec.js

tests/_data/models.js

src/serialize/json/types.ts

src/serialize/json/normalize.ts

jkowalleck · 2023-03-16T12:02:30Z

Thank you for your work, @xmasoracle .

Your implementation appears promising, please continue.
Your test method is sufficient, just some cases are missing.

Please be informed: I will not merge this into master, unless

all properties are normalized as expected
normalization for XML and JSON is in place

I'll set this PR to "draft" until it is finished.

src/serialize/json/normalize.ts

jkowalleck · 2023-03-19T09:12:07Z

@xmasoracle,
could you sign-off you commits? Read more here: https://github.com/CycloneDX/cyclonedx-javascript-library/blob/main/CONTRIBUTING.md#sign-off-your-commits
You can sign-off previous commits as described here: https://github.com/CycloneDX/cyclonedx-javascript-library/pull/548/checks?check_run_id=12055103222

jkowalleck · 2023-03-19T11:21:04Z

implementation detail: as new rendering for BomRefs is added, they need to be discriminated.
add them to the existing collector:

cyclonedx-javascript-library/src/serialize/baseSerializer.ts

Lines 25 to 41 in b2abc1b

    
           #getAllBomRefs (bom: Bom): Iterable<BomRef> { 
        
             const bomRefs = new Set<BomRef>() 
        
             function iterComponents (cs: Iterable<Component>): void { 
        
               for (const { bomRef, components } of cs) { 
        
                 bomRefs.add(bomRef) 
        
                 iterComponents(components) 
        
               } 
        
             } 
        
             if (bom.metadata.component !== undefined) { 
        
               bomRefs.add(bom.metadata.component.bomRef) 
        
               iterComponents(bom.metadata.component.components) 
        
             } 
        
             iterComponents(bom.components) 
        
             return bomRefs.values() 
        
           }

…DX#164) Signed-off-by: Xavier Maso <xavier.maso@oracle.com>

Signed-off-by: Xavier Maso <xavier.maso@oracle.com>

src/models/vulnerability/vulnerability.ts

Signed-off-by: Xavier Maso <xavier.maso@oracle.com>

xmasoracle · 2023-04-04T08:33:52Z

Hi @jkowalleck, I will not have time to work on the XML serialization part.
Could this be merged? I'm afraid it will linger here for months, and drift away from the main branch...

jkowalleck · 2023-04-04T09:59:03Z

nope, will not be merged any soon.

It contains breaking changes, and I do not want to release a set of breaking changes that is not complete.
Leave it open, and I might consider it for the next major release, if it was complete until then.
Time is not an issue.

PS: this is open source. Others might take it from here and complete the missing part.
Or even try it out and improve it in other ways.

jkowalleck · 2023-04-04T11:44:02Z

FYI: i will be working on #620 soon.

jkowalleck · 2023-04-23T12:26:42Z

BOM validators are now in place.
and they are part of existing integration tests. see #652

jkowalleck · 2023-04-26T10:19:52Z

JSON validation is now part of this library and all its test suites.

@xmasoracle please rebase your feature on latest ~~main~~ normalize-vulnerability branch and run the tests, to see if your feature passes the JSON schema. Your efforts are appreciated.

jkowalleck · 2023-05-08T11:09:24Z

adjusted PR target branch to be (normalize-vulnerability)[https://github.com/CycloneDX/cyclonedx-javascript-library/tree/normalize-vulnerability]

reason: multiple smaller PRs will come together to solve #164
see #722

jkowalleck · 2023-05-09T10:07:14Z

re: #issuecomment-1495568466
FYI: i will work on the XML serialization soon.

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

tests/_data/models.js

xmasoracle requested a review from a team as a code owner March 16, 2023 11:01

jkowalleck requested changes Mar 16, 2023

View reviewed changes

jkowalleck reviewed Mar 16, 2023

View reviewed changes

src/serialize/json/normalize.ts Outdated Show resolved Hide resolved

src/serialize/json/normalize.ts Outdated Show resolved Hide resolved

src/serialize/json/normalize.ts Outdated Show resolved Hide resolved

jkowalleck changed the title ~~feat: bom.vulnerabilities JSON normalization/serialization (#164)~~ feat: bom.vulnerabilities JSON normalization Mar 16, 2023

jkowalleck added the breaking change label Mar 16, 2023

jkowalleck marked this pull request as draft March 16, 2023 17:44

jkowalleck changed the title ~~feat: bom.vulnerabilities JSON normalization~~ [WIP] feat: bom.vulnerabilities JSON normalization Mar 16, 2023

jkowalleck added this to the Vulnerabilities - models, normalize, serialize, tests milestone Mar 19, 2023

xmasoracle force-pushed the feat/vulnerabilities_json branch from 04b963d to 3b491b7 Compare March 20, 2023 09:22

xmasoracle added 12 commits March 20, 2023 10:28

feat: bom.vulnerabilities JSON normalization/serialization (Cyclone…

7ffdd82

…DX#164) Signed-off-by: Xavier Maso <xavier.maso@oracle.com>

Address straightforward PR comments

a7a231c

Signed-off-by: Xavier Maso <xavier.maso@oracle.com>

Address comments on time-based properties

d8ba1f1

Signed-off-by: Xavier Maso <xavier.maso@oracle.com>

Add bom-ref to serialized vulnerability

999270a

Signed-off-by: Xavier Maso <xavier.maso@oracle.com>

Correct references of serialized vulnerability

dbb4a7a

Signed-off-by: Xavier Maso <xavier.maso@oracle.com>

Add ratings to serialized vulnerability

f93b2e4

Signed-off-by: Xavier Maso <xavier.maso@oracle.com>

Add cwes to serialized vulnerability

4650c24

Signed-off-by: Xavier Maso <xavier.maso@oracle.com>

Add advisories to serialized vulnerability

39eb58f

Signed-off-by: Xavier Maso <xavier.maso@oracle.com>

Add credits to serialized vulnerability

893fdff

Signed-off-by: Xavier Maso <xavier.maso@oracle.com>

Add tools to serialized vulnerability

acae6a9

Signed-off-by: Xavier Maso <xavier.maso@oracle.com>

Add analysis to serialized vulnerability

bdd43fc

Signed-off-by: Xavier Maso <xavier.maso@oracle.com>

Add properties to serialized vulnerability

6c0104a

Signed-off-by: Xavier Maso <xavier.maso@oracle.com>

xmasoracle force-pushed the feat/vulnerabilities_json branch from 3b491b7 to ab6809f Compare March 20, 2023 09:31

xmasoracle commented Mar 20, 2023

View reviewed changes

src/models/vulnerability/vulnerability.ts Show resolved Hide resolved

xmasoracle force-pushed the feat/vulnerabilities_json branch from 8a7f9cc to fad9573 Compare March 20, 2023 13:47

xmasoracle added 3 commits March 20, 2023 16:31

Add affects to serialized vulnerability

50f6482

Signed-off-by: Xavier Maso <xavier.maso@oracle.com>

Refactor type names for Normalized.Vulnerability.*

bb6036e

Signed-off-by: Xavier Maso <xavier.maso@oracle.com>

Discrimate Vulnerability.bomRefs

3ca1aed

Signed-off-by: Xavier Maso <xavier.maso@oracle.com>

xmasoracle force-pushed the feat/vulnerabilities_json branch from fad9573 to 3ca1aed Compare March 20, 2023 15:35

jkowalleck added 2 commits March 22, 2023 12:10

Merge branch 'main' into feat/vulnerabilities_json

21bdbff

Merge branch 'main' into feat/vulnerabilities_json

2e64e26

jkowalleck mentioned this pull request May 8, 2023

complete support for Bom.Vulnerabilities #164

Closed

12 tasks

jkowalleck changed the base branch from main to normalize-vulnerability May 8, 2023 10:11

jkowalleck added 3 commits May 9, 2023 12:15

Merge branch 'normalize-vulnerability' into feat/vulnerabilities_json

65ce0e0

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

cs-fix

0044582

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

tests: fix expected

effff62

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

jkowalleck marked this pull request as ready for review May 9, 2023 10:26

jkowalleck self-requested a review May 9, 2023 10:26

jkowalleck reviewed May 9, 2023

View reviewed changes

tests/_data/models.js Show resolved Hide resolved

jkowalleck changed the title ~~[WIP] feat: bom.vulnerabilities JSON normalization~~ feat: bom.vulnerabilities JSON normalization May 9, 2023

jkowalleck merged commit 37e88ad into CycloneDX:normalize-vulnerability May 9, 2023

Uh oh!

Conversation

xmasoracle commented Mar 16, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jkowalleck left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jkowalleck commented Mar 16, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jkowalleck commented Mar 19, 2023

Uh oh!

jkowalleck commented Mar 19, 2023

Uh oh!

Uh oh!

xmasoracle commented Apr 4, 2023

Uh oh!

jkowalleck commented Apr 4, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jkowalleck commented Apr 4, 2023

Uh oh!

jkowalleck commented Apr 23, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jkowalleck commented Apr 26, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jkowalleck commented May 8, 2023

Uh oh!

jkowalleck commented May 9, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

xmasoracle commented Mar 16, 2023 •

edited

Loading

jkowalleck commented Mar 16, 2023 •

edited

Loading

jkowalleck commented Apr 4, 2023 •

edited

Loading

jkowalleck commented Apr 23, 2023 •

edited

Loading

jkowalleck commented Apr 26, 2023 •

edited

Loading

jkowalleck commented May 9, 2023 •

edited

Loading