Skip to content

Commit 4a1299b

Browse files
rainer-exxcellentrainer-exxcellent
authored
Merge pull request #338 from secvisogram/add-meta-schema
fix: add meta schemas for csaf 2.1
2 parents 612c1e9 + 74c4e60 commit 4a1299b

File tree

6 files changed

+278
-0
lines changed

6 files changed

+278
-0
lines changed

‎lib/shared/csafAjv.js‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,32 @@ import cvss_v2_0 from './csafAjv/cvss-v2.0.js'
44
import cvss_v3_0 from './csafAjv/cvss-v3.0.js'
55
import cvss_v3_1 from './csafAjv/cvss-v3.1.js'
66
import cvss_v4_0 from './csafAjv/cvss-v4.0.js'
7+
import meta from './csafAjv/meta.js'
8+
import formatAssertion from './csafAjv/format-assertion.js'
9+
import ssvcDecisionPointValueSelection from './csafAjv/Decision_Point_Value_Selection-1-0-1.js'
10+
import ssvcDecisionPoint from './csafAjv/Decision_Point-1-0-1.js'
711

812
const csafAjv = new Ajv2020({ strict: false, allErrors: true })
913
addFormats(csafAjv)
1014
csafAjv.addSchema(cvss_v2_0, 'https://www.first.org/cvss/cvss-v2.0.json')
1115
csafAjv.addSchema(cvss_v3_0, 'https://www.first.org/cvss/cvss-v3.0.json')
1216
csafAjv.addSchema(cvss_v3_1, 'https://www.first.org/cvss/cvss-v3.1.json')
1317
csafAjv.addSchema(cvss_v4_0, 'https://www.first.org/cvss/cvss-v4.0.json')
18+
csafAjv.addSchema(
19+
meta,
20+
'https://docs.oasis-open.org/csaf/csaf/v2.1/schema/meta.json'
21+
)
22+
csafAjv.addSchema(
23+
formatAssertion,
24+
'https://json-schema.org/draft/2020-12/meta/format-assertion'
25+
)
26+
csafAjv.addSchema(
27+
ssvcDecisionPointValueSelection,
28+
'https://certcc.github.io/SSVC/data/schema/v1/Decision_Point_Value_Selection-1-0-1.schema.json'
29+
)
30+
csafAjv.addSchema(
31+
ssvcDecisionPoint,
32+
'https://certcc.github.io/SSVC/data/schema/v1/Decision_Point-1-0-1.schema.json'
33+
)
1434

1535
export default csafAjv

‎lib/shared/csafAjv/Decision_Point-1-0-1.js‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
export default {
2+
$schema: 'https://json-schema.org/draft/2020-12/schema',
3+
title: 'Decision Point schema definition',
4+
$id: 'https://certcc.github.io/SSVC/data/schema/v1/Decision_Point-1-0-1.schema.json',
5+
description:
6+
'Decision points are the basic building blocks of SSVC decision functions. Individual decision points describe a single aspect of the input to a decision function.',
7+
$defs: {
8+
schemaVersion: {
9+
description: 'Schema version used to represent this Decision Point.',
10+
type: 'string',
11+
enum: ['1-0-1'],
12+
},
13+
decision_point_value: {
14+
type: 'object',
15+
additionalProperties: false,
16+
properties: {
17+
key: {
18+
type: 'string',
19+
description:
20+
'A short, unique string (or key) used as a shorthand identifier for a Decision Point Value.',
21+
minLength: 1,
22+
examples: ['P', 'Y'],
23+
},
24+
name: {
25+
type: 'string',
26+
description: 'A short label that identifies a Decision Point Value',
27+
minLength: 1,
28+
examples: ['Public PoC', 'Yes'],
29+
},
30+
description: {
31+
type: 'string',
32+
description: 'A full description of the Decision Point Value.',
33+
minLength: 1,
34+
examples: [
35+
'One of the following is true: (1) Typical public PoC exists in sources such as Metasploit or websites like ExploitDB; or (2) the vulnerability has a well-known method of exploitation.',
36+
'Attackers can reliably automate steps 1-4 of the kill chain.',
37+
],
38+
},
39+
},
40+
required: ['key', 'name', 'description'],
41+
},
42+
decision_point: {
43+
type: 'object',
44+
additionalProperties: false,
45+
properties: {
46+
schemaVersion: {
47+
$ref: '#/$defs/schemaVersion',
48+
},
49+
namespace: {
50+
type: 'string',
51+
description:
52+
'Namespace (a short, unique string): The value must be one of the official namespaces, currenlty "ssvc", "cvss" OR can start with \'x_\' for private namespaces. See SSVC Documentation for details.',
53+
pattern: '^(?=.{3,100}$)(x_)?[a-z0-9]{3}([/.-]?[a-z0-9]+){0,97}$',
54+
examples: ['ssvc', 'cvss', 'x_custom', 'x_custom/extension'],
55+
},
56+
version: {
57+
type: 'string',
58+
description:
59+
'Version (a semantic version string) that identifies the version of a Decision Point.',
60+
pattern:
61+
'^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$',
62+
examples: ['1.0.1', '1.0.1-alpha'],
63+
},
64+
key: {
65+
type: 'string',
66+
description:
67+
'A short, unique string (or key) used as a shorthand identifier for a Decision Point.',
68+
69+
minLength: 1,
70+
examples: ['E', 'A'],
71+
},
72+
name: {
73+
type: 'string',
74+
description: 'A short label that identifies a Decision Point.',
75+
minLength: 1,
76+
examples: ['Exploitation', 'Automatable'],
77+
},
78+
description: {
79+
type: 'string',
80+
description:
81+
'A full description of the Decision Point, explaining what it represents and how it is used in SSVC.',
82+
minLength: 1,
83+
},
84+
values: {
85+
description: 'A set of possible answers for a given Decision Point',
86+
uniqueItems: true,
87+
type: 'array',
88+
minItems: 1,
89+
items: {
90+
$ref: '#/$defs/decision_point_value',
91+
},
92+
},
93+
},
94+
required: [
95+
'namespace',
96+
'version',
97+
'key',
98+
'name',
99+
'description',
100+
'values',
101+
'schemaVersion',
102+
],
103+
},
104+
},
105+
$ref: '#/$defs/decision_point',
106+
}

‎lib/shared/csafAjv/Decision_Point_Value_Selection-1-0-1.js‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
export default {
2+
$schema: 'https://json-schema.org/draft/2020-12/schema',
3+
$id: 'https://certcc.github.io/SSVC/data/schema/v1/Decision_Point_Value_Selection-1-0-1.schema.json',
4+
description:
5+
'This schema defines the structure for selecting SSVC Decision Points and their evaluated values for a given vulnerability. Each vulnerability can have multiple Decision Points, and each Decision Point can have multiple selected values when full certainty is not available.',
6+
$defs: {
7+
id: {
8+
type: 'string',
9+
description:
10+
'Identifier for the vulnerability that was evaluation, such as CVE, CERT/CC VU#, OSV id, Bugtraq, GHSA etc.',
11+
examples: ['CVE-1900-1234', 'VU#11111', 'GHSA-11a1-22b2-33c3'],
12+
minLength: 1,
13+
},
14+
role: {
15+
type: 'string',
16+
description:
17+
'The role of the stakeholder performing the evaluation (e.g., Supplier, Deployer, Coordinator). See SSVC documentation for a currently identified list: https://certcc.github.io/SSVC/topics/enumerating_stakeholders/',
18+
examples: ['Supplier', 'Deployer', 'Coordinator'],
19+
minLength: 1,
20+
},
21+
timestamp: {
22+
description:
23+
'Date and time when the evaluation of the Vulnerability was performed according to RFC 3339, section 5.6.',
24+
type: 'string',
25+
format: 'date-time',
26+
},
27+
SsvcdecisionpointselectionSchema: {
28+
description:
29+
'A down-selection of SSVC Decision Points that represent an evaluation at a specific time of a Vulnerability evaluation.',
30+
properties: {
31+
name: {
32+
$ref: 'https://certcc.github.io/SSVC/data/schema/v1/Decision_Point-1-0-1.schema.json#/$defs/decision_point/properties/name',
33+
},
34+
namespace: {
35+
$ref: 'https://certcc.github.io/SSVC/data/schema/v1/Decision_Point-1-0-1.schema.json#/$defs/decision_point/properties/namespace',
36+
},
37+
values: {
38+
description:
39+
'One or more Decision Point Values that were selected for this Decision Point. If the evaluation is uncertain, multiple values may be listed to reflect the potential range of possibilities.',
40+
title: 'values',
41+
type: 'array',
42+
minItems: 1,
43+
items: {
44+
$ref: 'https://certcc.github.io/SSVC/data/schema/v1/Decision_Point-1-0-1.schema.json#/$defs/decision_point_value/properties/name',
45+
},
46+
},
47+
version: {
48+
$ref: 'https://certcc.github.io/SSVC/data/schema/v1/Decision_Point-1-0-1.schema.json#/$defs/decision_point/properties/version',
49+
},
50+
},
51+
type: 'object',
52+
required: ['name', 'namespace', 'values', 'version'],
53+
additionalProperties: false,
54+
},
55+
},
56+
properties: {
57+
id: {
58+
$ref: '#/$defs/id',
59+
},
60+
role: {
61+
$ref: '#/$defs/role',
62+
},
63+
schemaVersion: {
64+
$ref: 'https://certcc.github.io/SSVC/data/schema/v1/Decision_Point-1-0-1.schema.json#/$defs/schemaVersion',
65+
},
66+
timestamp: {
67+
$ref: '#/$defs/timestamp',
68+
},
69+
selections: {
70+
description:
71+
'An array of Decision Points and their selected values for the identified Vulnerability. If a clear evaluation is uncertain, multiple values may be listed for a Decision Point instead of waiting for perfect clarity.',
72+
title: 'selections',
73+
type: 'array',
74+
minItems: 1,
75+
items: {
76+
$ref: '#/$defs/SsvcdecisionpointselectionSchema',
77+
},
78+
},
79+
},
80+
type: 'object',
81+
required: ['selections', 'id', 'timestamp', 'schemaVersion'],
82+
additionalProperties: false,
83+
}

‎lib/shared/csafAjv/format-assertion.js‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
export default {
2+
$schema: 'https://json-schema.org/draft/2020-12/schema',
3+
$id: 'https://json-schema.org/draft/2020-12/meta/format-assertion',
4+
$dynamicAnchor: 'meta',
5+
6+
title: 'Format vocabulary meta-schema for assertion results',
7+
type: ['object', 'boolean'],
8+
properties: {
9+
format: { type: 'string' },
10+
},
11+
}

‎lib/shared/csafAjv/meta.js‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
export default {
2+
$schema: 'https://json-schema.org/draft/2020-12/schema',
3+
$id: 'https://docs.oasis-open.org/csaf/csaf/v2.1/schema/meta.json',
4+
$dynamicAnchor: 'meta',
5+
$vocabulary: {
6+
'https://json-schema.org/draft/2020-12/vocab/core': true,
7+
'https://json-schema.org/draft/2020-12/vocab/format-assertion': true,
8+
},
9+
allOf: [
10+
{ $ref: 'https://json-schema.org/draft/2020-12/meta/core' },
11+
{ $ref: 'https://json-schema.org/draft/2020-12/meta/format-assertion' },
12+
],
13+
}

‎tests/csaf_2_1/schemaTests.js‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
import assert from 'node:assert/strict'
2+
import { csaf_2_1, csaf_2_1_strict } from '../../csaf_2_1/schemaTests.js'
3+
4+
const minimalValidDocument = {
5+
$schema: 'https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json',
6+
document: {
7+
title: 'Basic CSAF document',
8+
csaf_version: '2.1',
9+
category: 'csaf_base',
10+
distribution: {
11+
tlp: { label: 'AMBER' },
12+
},
13+
publisher: {
14+
name: 'Some publisher',
15+
namespace: 'https://example.com',
16+
category: 'coordinator',
17+
},
18+
tracking: {
19+
id: 'some-id',
20+
initial_release_date: '2025-02-18T14:37:32.671Z',
21+
current_release_date: '2025-06-18T14:37:32.671Z',
22+
revision_history: [
23+
{
24+
date: '2025-02-18T14:37:32.671Z',
25+
number: '1',
26+
summary: 'Initial release',
27+
},
28+
],
29+
version: '1',
30+
status: 'draft',
31+
},
32+
},
33+
}
34+
35+
describe('csaf_2_1_strict', function () {
36+
it('validates a basic document', function () {
37+
assert.ok(csaf_2_1_strict(minimalValidDocument).isValid)
38+
})
39+
})
40+
41+
describe('csaf_2_1', function () {
42+
it('validates a basic document', function () {
43+
assert.ok(csaf_2_1(minimalValidDocument).isValid)
44+
})
45+
})

0 commit comments

Comments
 (0)