Skip to content

[BUG] VulnerabilityReference contradicting definition in JSON and XML #154

New issue
New issue
Closed
#253
Closed
[BUG] VulnerabilityReference contradicting definition in JSON and XML#154
#253
Assignees
coderpatrosstevespringettDarthHater
Labels
defect
Milestone
1.6
@jkowalleck

Description

@jkowalleck
jkowalleck
opened on Aug 7, 2022

In XML schema definition for CDX-1.4 vulnerabilityType.references.reference the id and source are defined optional (minOccurs="0")
see

specification/schema/bom-1.4.xsd

Lines 1785 to 1797 in ef71717

<xs:sequence minOccurs="1" maxOccurs="1">
<xs:element name="id" type="xs:normalizedString" minOccurs="0" maxOccurs="1">
<xs:annotation>
<xs:documentation>The identifier that uniquely identifies the vulnerability. For example:
CVE-2021-39182, GHSA-35m5-8cvj-8783, and SNYK-PYTHON-ENROCRYPT-1912876.</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element name="source" type="bom:vulnerabilitySourceType" minOccurs="0" maxOccurs="1">
<xs:annotation>
<xs:documentation>The source that published the vulnerability.</xs:documentation>
</xs:annotation>
</xs:element>
</xs:sequence>

In JSON schema definition for CDX-1.4 the /definitions/vulnerability/properties/references/items the id and source are mandatory (they are in list of required)
see

specification/schema/bom-1.4.schema.json

Lines 1455 to 1458 in ef71717

"required": [
"id",
"source"
],

these both definitions contradict each other.

please clarify which one is correct (a discussion/comment in here would be great for the start)
and have the XSD & JSON-schema alligned.

Metadata

Metadata

Assignees

Labels

defect

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions