CycloneDX / CycloneDX/cyclonedx-dotnet-library

Nullability on enums broken

Open
#445 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
28
Forks
35
PR merge metrics
No merged PRs in 30d

Description

I tried to create an VEX for a SBOM document. The analysis is `In_Triage` and therefore no justification is given right now. According to the 1.6 specification, this is fine.

```csharp
var bom = new Bom
{
SpecVersion = SpecificationVersion.v1_6,
SerialNumber = $"urn:uuid:{Guid.NewGuid()}",
Version = 1,
Vulnerabilities =
[
new()
{
Analysis = new()
{
State = ImpactAnalysisState.In_Triage
}
}
]
};
```

When serializing it to JSON using `CycloneDX.Json.Serializer.SerializeAsync` I will get:
```json
{
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:be8f9457-aaf8-48ae-8f9e-b914f4b7cee1",
"version": 1,
"vulnerabilities": [
{
"analysis": {
"state": "in_triage",
"justification": "null"
}
}
]
}
```

`cyclonedx-cli validate --input-file ` will show:
```
Validating JSON BOM...
Validation failed:
Some properties did not match the required schema
http://cyclonedx.org/schema/bom-1.6.schema.json#
On instance: :
{
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:be8f9457-aaf8-48ae-8f9e-b914f4b7cee1",
"version": 1,
"vulnerabilities": [
{
"analysis": {
"state": "in_triage",
"justification": "null"
}
}
]
}
Some items do not match the required schema; failing indexes: [0]
http://cyclonedx.org/schema/bom-1.6.schema.json#/properties/vulnerabilities
On instance: /vulnerabilities:
[
{
"analysis": {
"state": "in_triage",
"justification": "null"
}
}
]
Some properties did not match the required schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/definitions/vulnerability
On instance: /vulnerabilities/0:
{
"analysis": {
"state": "in_triage",
"justification": "null"
}
}
Some properties did not match the required schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/definitions/vulnerability/properties/analysis
On instance: /vulnerabilities/0/analysis:
{
"state": "in_triage",
"justification": "null"
}
Value should match one of the values specified by the enum
http://cyclonedx.org/schema/bom-1.6.schema.json#/definitions/impactAnalysisJustification
On instance: /vulnerabilities/0/analysis/justification:
null
BOM is not valid.
```

Manually removing the `justification` line results in
```
Validating JSON BOM...
BOM validated successfully.
```

I therefore assume, that any enum with `Null` as protobuf helper should not be serialized at all. Can you please fix all types?

Contributor guide

Open the contributing guide

Research direction

Start at CycloneDX.Json.Serializer.SerializeAsync and reproduce the provided C# example with an In_Triage analysis. Check how nullable enum values are emitted, then verify that omitted null helper values produce JSON accepted by cyclonedx-cli validate; the fix should cover the requested enum types rather than only justification.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
api
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
62/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.