CycloneDX / CycloneDX/specification

All required properties should have `"minLength": 1`

Open
#461 3 comments 5 reactions 1 assignee Claimed by @stevespringett View on GitHub
breaking-changes defect
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

If a property is required, it should also not be an empty string. There are many places in the BOM schema where we use `"required": [...]` but do not also verify that these properties have `"minLength": 1`.

An example is `.components[].name`: https://github.com/CycloneDX/specification/blob/8e131b1688ccfe41e1bfdd4b3280f33dcc06d04c/schema/bom-1.6.schema.json#L831

It may be that optional properties should have this constraint as well. Consider the following example:

```json
{
"type": "library",
"name": "whatever",
"version": ""
}
```

If `whatever` does not have a version, it would be more clear if that key were to be omitted rather than provided as an empty string.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.