ossf / ossf/osv-schema

Severity schema should it be a map rather than an array?

Open
#34 3 comments 0 reactions 1 assignee View on GitHub

@oliverchang is already working on this.

Since Mar 3, 2022.

Dominant language
Go
Stars
271
Forks
129
Avg merge
3h 46m
Merged PRs (30d)
4

Description

I noted in latest version of schema the addition of severity but seems to allow for multiple score of the same type without a means to distinguish so if you wanted to favour a severity say from a source it is challenging to work out. Currently there are only in database CVSS_V3 because of this lack of being able to distinguish identical score types should the data struct instead of being

"severity" : [
    {
         "type":"string",
         "score":"string"
    }
]

as types really should be unique base don this

"severity" : {
     "type_key" : "score"
     ....
}

You could even enumerate the types supported but this allows same flexibility bit avoids the doubt around duplicate values as that is simply not valid.

So what is done today in the database would be;

"severity" : {
    "CVSS_V3": "CVSS v3 score uri"
    "CVSS_V2":"CVSS v3 score uri"
    "ANotherseverityscore": "An other score"
}

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.