CycloneDX / CycloneDX/cyclonedx-cli
Enhance validate command to point to the exact attribute and value
- Dominant language
- C#
- Stars
- 541
- Forks
- 82
- PR merge metrics
- No merged PRs in 30d
Description
The validation from cyclonedx validate command lacks details to troubleshoot the problematic part in large JSON files.
```
Validating JSON BOM...
[2621](https://github.com/AppThreat/dep-scan/actions/runs/3722912627/jobs/6314101443#step:7:2622)
Validation failed: Expected value to match one of the values specified by the enum
[2622](https://github.com/AppThreat/dep-scan/actions/runs/3722912627/jobs/6314101443#step:7:2623)
#/properties/vulnerabilities/items/$ref/properties/ratings/items/$ref/properties/severity/$ref/enum
[2623](https://github.com/AppThreat/dep-scan/actions/runs/3722912627/jobs/6314101443#step:7:2624)
BOM is not valid.
```
The same validation performed by a quick `jsonschema` python [script](https://github.com/AppThreat/dep-scan/blob/master/contrib/vex-validate.py) has the required detail.
```
'unspecified' is not one of ['critical', 'high', 'medium', 'low', 'info', 'none', 'unknown']
Failed validating 'enum' in schema['properties']['vulnerabilities']['items']['properties']['ratings']['items']['properties']['severity']:
{'description': 'Textual representation of the severity of the '
'vulnerability adopted by the analysis method. If the '
'analysis method uses values other than what is '
'provided, the user is expected to translate '
'appropriately.',
'enum': ['critical',
'high',
'medium',
'low',
'info',
'none',
'unknown'],
'title': 'Severity',
'type': 'string'}
On instance['vulnerabilities'][75]['ratings'][0]['severity']:
'unspecified'
```
Contributor guide
Assessment
This issue has not been assessed yet.