CycloneDX / CycloneDX/cyclonedx-rust-cargo

Trailing zeros in fractional digits of timestamp fails validation.

Open
#353 7 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
178
Forks
66
PR merge metrics
No merged PRs in 30d

Description

JSON Timestamps in cyclone-dx use the `date-time` format:

```
"timestamp": {
"type": "string",
"format": "date-time",
"title": "Timestamp",
"description": "The timestamp in which the action occurred"
}
```

The `date-time` format is described [here](https://json-schema.org/understanding-json-schema/reference/string.html#dates-and-times):

"date-time": Date and time together, for example, 2018-11-13T20:20:39+00:00

![image](https://user-images.githubusercontent.com/305813/209026575-0ea4e3ee-8e30-4fc7-8cf5-7c3fbff59f81.png)

Using OWASP tools:

```
cyclonedx-win-x64.exe validate --input-file .\bom.json
Unable to validate against any JSON schemas.
BOM is not valid.
```

**The BOM will validate using both tools if I remove the trailing zeros from the fractional digits in output manually**:

E.g. going from:

`2022-12-21T23:54:20.218381200Z`
to
`2022-12-21T23:54:20.2183812Z`

Contributor guide

Open the contributing guide

Research direction

Reproduce the validation failure with the timestamp shown in the issue, then locate the Rust entry point that serializes timestamps in generated CycloneDX BOMs. Compare output with and without trailing fractional zeros and verify the resulting BOM using the OWASP validation tools; done means timestamps with trailing zeros validate without manual editing.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.