CycloneDX / CycloneDX/specification
[FEATURE]: Include function as a component type
- Dominant language
- XSLT
- Stars
- 547
- Forks
- 93
- Avg merge
- 7h 11m
- Merged PRs (30d)
- 37
Description
## Describe the feature
Currently there is no way to describe the functions used within a library. When using a SBOM for vulnerability management, it would be useful to have a finer level of granularity than a library component and identify the actual functions used. Vulnerabilities in a library are typically associated with a vulnerable function and by including the functions actually used, this will aid the vulnerabity management process.
## Possible solutions
Make functions as a component type. A function can then be associated with a library (or other component) to show the relationship.
## Alternatives
It is possible to use the callstack within evidence object (as this has function as one of the attributes) but it is abusing the original intent of the object
## Additional context
When constructing SBOMs from a binary artafect (e.g. ELF binary), the function names used within each dynamic libraries can easily be extracted. By capturing this information in an SBOM, it will improve the efficiency of the vulnerability management triage process.
Contributor guide
Assessment
This issue has not been assessed yet.