CycloneDX / CycloneDX/specification

BC: `proofOfConcept.reproductionSteps` should be array reuse `step` object

Open
#274 0 comments 0 reactions 0 assignees View on GitHub
breaking-changes CDX 1.5
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

Within the "vulnerabilities" a new v1.5 field "proofOfConcept` object was added with a field "reproductionSteps" which is a single string; it should be an array by implied name; however, it would be better to adopt the "formulation" concept of (set of tasks) "step" which itself is an object which can provide detailed information around each step and (any) commands used:

```
"step": {
"type": "object",
"description": "Executes specific commands or tools in order to accomplish its owning task as part of a sequence.",
"additionalProperties": false,
"properties": {
"name": {
"title": "Name",
"description": "A name for the step.",
"type": "string"
},
"description": {
"title": "Description",
"description": "A description of the step.",
"type": "string"
},
"commands": {
"title": "Commands",
"description": "Ordered list of commands or directives for the step",
"type": "array",
"items": {
"$ref": "#/definitions/command"
}
},
"properties": {
"type": "array",
"title": "Properties",
"items": {
"$ref": "#/definitions/property"
}
}
}
},
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.