CycloneDX / CycloneDX/specification

[FEATURE]:Support for digital accessibility

Open
#542 0 comments 0 reactions 0 assignees View on GitHub
proposed core enhancement
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

## Describe the feature

xBOM specification is currently optimized for automation and integration purposes. Despite this goal, xBOM documents are often consumed in the following ad-hoc ways:

- Consumption via GUI tools like Dependency-Track that can present the information as tables and charts.
- Manual handling using XML and JSON viewer tools.

To improve digital accessibility & inclusion and ensure consistency among the ecosystem, the xBOM specification could be improved to refer to alternative content (in TEXT/HTML/YAML/JSON/bom-link formats) for various attributes. An [externalReference](https://cyclonedx.org/docs/1.6/json/#externalReferences_items_type) of type `accessible-description` could be added to aid voiceover and screen reader tools to better present in the information belonging to a particular section of an xBOM.

For instance, consider the below metadata in an SBOM.

```json
{
"metadata": {
"timestamp": "2024-10-24T09:21:23Z",
"tools": {
"components": [
{
"group": "@cyclonedx",
"name": "cdxgen",
"version": "10.11.0",
"purl": "pkg:npm/%40cyclonedx/cdxgen@10.11.0",
"type": "application",
"bom-ref": "pkg:npm/@cyclonedx/cdxgen@10.11.0",
"publisher": "OWASP Foundation",
"authors": [
{
"name": "OWASP Foundation"
}
]
}
]
},
"authors": [
{
"name": "OWASP Foundation"
}
],
"lifecycles": [
{
"phase": "build"
}
],
"externalReferences" : [
{"url": "url:cdx:fbef273d-0bce-4931-a748-0bf547cf7575/1/accessible-metadata.txt", "type": "accessible-description", "comment": ""}
]
}
```

The accessible alternative content for this metadata section in text format could be:

```text
This Software Bill-of-Materials (SBOM) document was generated at 24th October, 2024 using the tool cdxgen from OWASP Foundation. The document represents the lifecycles: build.

The document has 10 components and 20 services.
```

xBOM tools such as cdxgen could be improved to auto-generate the accessible description and automatically link the content to reduce the generation effort.

Tools such as Dependency-Track could be enhanced to present the information from this external reference using compatible ARIA [tags](https://developer.mozilla.org/en-US/docs/Web/Accessibility/ARIA/ARIA_Guides).

When bom-link is used instead of file urls, the accessible content could be stored under the annotations [attribute](https://cyclonedx.org/docs/1.6/json/#annotations_items_text).

## Alternatives

There are currently no alternatives to include ARIA tags in a JSON document.

## Additional context

- [quick reference to Web Content Accessibility Guidelines (WCAG) 2 requirements](https://www.w3.org/WAI/WCAG22/quickref/?versions=2.1&showtechniques=111#principle1)
- [ARIA guides](https://developer.mozilla.org/en-US/docs/Web/Accessibility/ARIA/ARIA_Guides)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.