CycloneDX / CycloneDX/cyclonedx-cli

Enhance validate command to point to the exact attribute and value

Open
#292 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
541
Forks
82
PR merge metrics
No merged PRs in 30d

Description

The validation from cyclonedx validate command lacks details to troubleshoot the problematic part in large JSON files.
```
Validating JSON BOM...
[2621](https://github.com/AppThreat/dep-scan/actions/runs/3722912627/jobs/6314101443#step:7:2622)
Validation failed: Expected value to match one of the values specified by the enum
[2622](https://github.com/AppThreat/dep-scan/actions/runs/3722912627/jobs/6314101443#step:7:2623)
#/properties/vulnerabilities/items/$ref/properties/ratings/items/$ref/properties/severity/$ref/enum
[2623](https://github.com/AppThreat/dep-scan/actions/runs/3722912627/jobs/6314101443#step:7:2624)
BOM is not valid.
```

The same validation performed by a quick `jsonschema` python [script](https://github.com/AppThreat/dep-scan/blob/master/contrib/vex-validate.py) has the required detail.

```
'unspecified' is not one of ['critical', 'high', 'medium', 'low', 'info', 'none', 'unknown']

Failed validating 'enum' in schema['properties']['vulnerabilities']['items']['properties']['ratings']['items']['properties']['severity']:
{'description': 'Textual representation of the severity of the '
'vulnerability adopted by the analysis method. If the '
'analysis method uses values other than what is '
'provided, the user is expected to translate '
'appropriately.',
'enum': ['critical',
'high',
'medium',
'low',
'info',
'none',
'unknown'],
'title': 'Severity',
'type': 'string'}

On instance['vulnerabilities'][75]['ratings'][0]['severity']:
'unspecified'
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.