CycloneDX / CycloneDX/cyclonedx-dotnet-library
Nullability on enums broken
- Dominant language
- C#
- Stars
- 28
- Forks
- 35
- PR merge metrics
- No merged PRs in 30d
Description
I tried to create an VEX for a SBOM document. The analysis is `In_Triage` and therefore no justification is given right now. According to the 1.6 specification, this is fine.
```csharp
var bom = new Bom
{
SpecVersion = SpecificationVersion.v1_6,
SerialNumber = $"urn:uuid:{Guid.NewGuid()}",
Version = 1,
Vulnerabilities =
[
new()
{
Analysis = new()
{
State = ImpactAnalysisState.In_Triage
}
}
]
};
```
When serializing it to JSON using `CycloneDX.Json.Serializer.SerializeAsync` I will get:
```json
{
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:be8f9457-aaf8-48ae-8f9e-b914f4b7cee1",
"version": 1,
"vulnerabilities": [
{
"analysis": {
"state": "in_triage",
"justification": "null"
}
}
]
}
```
`cyclonedx-cli validate --input-file ` will show:
```
Validating JSON BOM...
Validation failed:
Some properties did not match the required schema
http://cyclonedx.org/schema/bom-1.6.schema.json#
On instance: :
{
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:be8f9457-aaf8-48ae-8f9e-b914f4b7cee1",
"version": 1,
"vulnerabilities": [
{
"analysis": {
"state": "in_triage",
"justification": "null"
}
}
]
}
Some items do not match the required schema; failing indexes: [0]
http://cyclonedx.org/schema/bom-1.6.schema.json#/properties/vulnerabilities
On instance: /vulnerabilities:
[
{
"analysis": {
"state": "in_triage",
"justification": "null"
}
}
]
Some properties did not match the required schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/definitions/vulnerability
On instance: /vulnerabilities/0:
{
"analysis": {
"state": "in_triage",
"justification": "null"
}
}
Some properties did not match the required schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/definitions/vulnerability/properties/analysis
On instance: /vulnerabilities/0/analysis:
{
"state": "in_triage",
"justification": "null"
}
Value should match one of the values specified by the enum
http://cyclonedx.org/schema/bom-1.6.schema.json#/definitions/impactAnalysisJustification
On instance: /vulnerabilities/0/analysis/justification:
null
BOM is not valid.
```
Manually removing the `justification` line results in
```
Validating JSON BOM...
BOM validated successfully.
```
I therefore assume, that any enum with `Null` as protobuf helper should not be serialized at all. Can you please fix all types?
Contributor guide
Research direction
Start at CycloneDX.Json.Serializer.SerializeAsync and reproduce the provided C# example with an In_Triage analysis. Check how nullable enum values are emitted, then verify that omitted null helper values produce JSON accepted by cyclonedx-cli validate; the fix should cover the requested enum types rather than only justification.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- api
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 62/100