mirror of
https://github.com/anchore/grype
synced 2024-09-20 06:21:56 +00:00
tests: add cyclonedx schema check
Signed-off-by: Alfredo Deza <adeza@anchore.com>
This commit is contained in:
Alfredo Deza
parent
2c1ddbecc4
commit
57d777cf04
8 changed files with 4340 additions and 2 deletions
8
Makefile
8
Makefile
|
|
@ -53,13 +53,13 @@ all: clean static-analysis test ## Run all checks (linting, license check, unit,
|
|||
@printf '$(SUCCESS)All checks pass!$(RESET)\n'
|
||||
|
||||
.PHONY: test
|
||||
test: unit integration acceptance-linux ## Run all tests (unit, integration, and linux acceptance tests )
|
||||
test: unit validate-cyclonedx-schema integration acceptance-linux ## Run all tests (unit, integration, and linux acceptance tests )
|
||||
|
||||
help:
|
||||
@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "$(BOLD)$(CYAN)%-25s$(RESET)%s\n", $$1, $$2}'
|
||||
|
||||
ci-bootstrap: bootstrap
|
||||
sudo apt update && sudo apt install -y bc jq
|
||||
DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y bc jq libxml2-utils
|
||||
|
||||
.PHONY: boostrap
|
||||
bootstrap: ## Download and install all go dependencies (+ prep tooling in the ./tmp dir)
|
||||
|
|
@ -97,6 +97,10 @@ validate-schema:
|
|||
# ensure the codebase is only referencing a single grype-db schema version, multiple is not allowed
|
||||
python test/validate_schema.py
|
||||
|
||||
.PHONY: validate-cyclonedx-schema
|
||||
validate-cyclonedx-schema:
|
||||
cd schema/cyclonedx && make
|
||||
|
||||
.PHONY: lint-fix
|
||||
lint-fix: ## Auto-format all source code + run golangci lint fixers
|
||||
$(call title,Running lint fixers)
|
||||
|
|
|
|||
1
schema/cyclonedx/.gitignore
vendored
Normal file
1
schema/cyclonedx/.gitignore
vendored
Normal file
|
|
@ -0,0 +1 @@
|
|||
bom.xml
|
||||
5
schema/cyclonedx/Makefile
Normal file
5
schema/cyclonedx/Makefile
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
.DEFAULT_GOAL := validate-schema
|
||||
.PHONY: validate-schema
|
||||
validate-schema:
|
||||
go run ../../main.go ubuntu:latest -vv -o cyclonedx > bom.xml
|
||||
xmllint --noout --schema ./cyclonedx.xsd bom.xml
|
||||
5
schema/cyclonedx/README.md
Normal file
5
schema/cyclonedx/README.md
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
# CycloneDX Schemas
|
||||
|
||||
`grype` generates a CycloneDX BOm output with the vulnerability extension. This validation is similar to what is done in `syft`, validating output against CycloneDX schemas.
|
||||
|
||||
Validation is done with `xmllint`, which requires a copy of all schemas because it can't work with HTTP references. The schemas are modified to reference local copies of dependent schemas.
|
||||
184
schema/cyclonedx/bd.xsd
Normal file
184
schema/cyclonedx/bd.xsd
Normal file
|
|
@ -0,0 +1,184 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!--
|
||||
CycloneDX BOM Descriptor Extension
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
-->
|
||||
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
|
||||
xmlns:vc="http://www.w3.org/2007/XMLSchema-versioning"
|
||||
xmlns:bom="http://cyclonedx.org/schema/bom/1.1"
|
||||
xmlns:bd="http://cyclonedx.org/schema/ext/bom-descriptor/1.0"
|
||||
xmlns:v="http://cyclonedx.org/schema/ext/vulnerability/1.0"
|
||||
elementFormDefault="qualified"
|
||||
targetNamespace="http://cyclonedx.org/schema/ext/bom-descriptor/1.0"
|
||||
vc:minVersion="1.0"
|
||||
vc:maxVersion="1.1"
|
||||
version="1.0">
|
||||
|
||||
<xs:annotation>
|
||||
<xs:documentation>
|
||||
<name>CycloneDX BOM Descriptor Extension</name>
|
||||
<url>https://cyclonedx.org/ext/bom-descriptor</url>
|
||||
<license uri="http://www.apache.org/licenses/LICENSE-2.0"
|
||||
version="2.0">Apache License, Version 2.0</license>
|
||||
<authors>
|
||||
<author>Steve Springett</author>
|
||||
</authors>
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
|
||||
<xs:import namespace="http://cyclonedx.org/schema/bom/1.1" schemaLocation="http://cyclonedx.org/schema/bom/1.1"/>
|
||||
|
||||
<xs:complexType name="metadata">
|
||||
<xs:sequence minOccurs="0" maxOccurs="1">
|
||||
<xs:element name="timestamp" type="xs:dateTime" minOccurs="0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The date and time (timestamp) when the document was created.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element name="tool" minOccurs="0" type="bd:toolType">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The tool used to create the BOM.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element name="authors" minOccurs="0" maxOccurs="1">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The person(s) who created the BOM. Authors are common in BOMs created through
|
||||
manual processes. BOMs created through automated means may not have authors.</xs:documentation>
|
||||
</xs:annotation>
|
||||
<xs:complexType>
|
||||
<xs:sequence minOccurs="0" maxOccurs="unbounded">
|
||||
<xs:element name="author" type="bd:organizationalPerson"/>
|
||||
</xs:sequence>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
<xs:element name="component" type="bom:component" minOccurs="0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The component that the BOM describes.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element name="manufacture" type="bd:organizationalEntity" minOccurs="0" maxOccurs="unbounded">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The organization that manufactured the component that the BOM describes.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element name="supplier" type="bd:organizationalEntity" minOccurs="0" maxOccurs="unbounded">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The organization that supplied the component that the BOM describes. The
|
||||
supplier may often be the manufacture, but may also be a distributor or repackager.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
</xs:sequence>
|
||||
<xs:anyAttribute namespace="##other" processContents="lax">
|
||||
<xs:annotation>
|
||||
<xs:documentation>User-defined attributes may be used on this element as long as they
|
||||
do not have the same name as an existing attribute used by the schema.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:anyAttribute>
|
||||
</xs:complexType>
|
||||
|
||||
<xs:complexType name="organizationalEntity">
|
||||
<xs:sequence minOccurs="0" maxOccurs="1">
|
||||
<xs:element name="name" type="xs:normalizedString" minOccurs="0" maxOccurs="1">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The name of the organization</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element name="url" type="xs:anyURI" minOccurs="0" maxOccurs="unbounded">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The URL of the organization. Multiple URLs are allowed.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element name="contact" type="bd:organizationalPerson" minOccurs="0" maxOccurs="unbounded">
|
||||
<xs:annotation>
|
||||
<xs:documentation>A contact person at the organization. Multiple contacts are allowed.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
</xs:sequence>
|
||||
<xs:anyAttribute namespace="##other" processContents="lax">
|
||||
<xs:annotation>
|
||||
<xs:documentation>User-defined attributes may be used on this element as long as they
|
||||
do not have the same name as an existing attribute used by the schema.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:anyAttribute>
|
||||
</xs:complexType>
|
||||
|
||||
<xs:complexType name="toolType">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Specifies a tool (manual or automated).</xs:documentation>
|
||||
</xs:annotation>
|
||||
<xs:sequence minOccurs="0" maxOccurs="1">
|
||||
<xs:element name="vendor" minOccurs="0" maxOccurs="1" type="xs:normalizedString">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The vendor of the tool used to create the BOM.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element name="name" minOccurs="0" maxOccurs="1" type="xs:normalizedString">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The name of the tool used to create the BOM.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element name="version" minOccurs="0" maxOccurs="1" type="xs:normalizedString">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The version of the tool used to create the BOM.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element name="hashes" minOccurs="0" maxOccurs="1">
|
||||
<xs:complexType>
|
||||
<xs:sequence minOccurs="0" maxOccurs="unbounded">
|
||||
<xs:element name="hash" type="bom:hashType"/>
|
||||
</xs:sequence>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
</xs:sequence>
|
||||
<xs:anyAttribute namespace="##other" processContents="lax">
|
||||
<xs:annotation>
|
||||
<xs:documentation>User-defined attributes may be used on this element as long as they
|
||||
do not have the same name as an existing attribute used by the schema.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:anyAttribute>
|
||||
</xs:complexType>
|
||||
|
||||
<xs:complexType name="organizationalPerson">
|
||||
<xs:sequence minOccurs="0" maxOccurs="1">
|
||||
<xs:element name="name" type="xs:normalizedString" minOccurs="0" maxOccurs="1">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The name of the person</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element name="email" type="xs:normalizedString" minOccurs="0" maxOccurs="unbounded">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The email address of the person. Multiple email addresses are allowed.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element name="phone" type="xs:normalizedString" minOccurs="0" maxOccurs="unbounded">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The phone number of the person. Multiple phone numbers are allowed.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
</xs:sequence>
|
||||
<xs:anyAttribute namespace="##other" processContents="lax">
|
||||
<xs:annotation>
|
||||
<xs:documentation>User-defined attributes may be used on this element as long as they
|
||||
do not have the same name as an existing attribute used by the schema.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:anyAttribute>
|
||||
</xs:complexType>
|
||||
|
||||
<xs:element name="metadata" type="bd:metadata">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Provides additional information about a BOM.</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
|
||||
</xs:schema>
|
||||
1419
schema/cyclonedx/cyclonedx.xsd
Normal file
1419
schema/cyclonedx/cyclonedx.xsd
Normal file
File diff suppressed because it is too large
Load diff
2429
schema/cyclonedx/spdx.xsd
Normal file
2429
schema/cyclonedx/spdx.xsd
Normal file
File diff suppressed because it is too large
Load diff
291
schema/cyclonedx/vulnerability.xsd
Normal file
291
schema/cyclonedx/vulnerability.xsd
Normal file
|
|
@ -0,0 +1,291 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!--
|
||||
CycloneDX Vulnerability Extension
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
-->
|
||||
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
|
||||
xmlns:vc="http://www.w3.org/2007/XMLSchema-versioning"
|
||||
xmlns:vuln="http://cyclonedx.org/schema/ext/vulnerability/1.0"
|
||||
elementFormDefault="qualified"
|
||||
targetNamespace="http://cyclonedx.org/schema/ext/vulnerability/1.0"
|
||||
vc:minVersion="1.0"
|
||||
vc:maxVersion="1.1"
|
||||
version="1.0.0">
|
||||
|
||||
<xs:annotation>
|
||||
<xs:documentation>
|
||||
<name>CycloneDX Vulnerability Extension</name>
|
||||
<url>https://cyclonedx.org/ext/vulnerability</url>
|
||||
<license uri="http://www.apache.org/licenses/LICENSE-2.0"
|
||||
version="2.0">Apache License, Version 2.0</license>
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
|
||||
<xs:simpleType name="severityType" final="restriction">
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
Textual representation of the severity of the vulnerability adopted by the risk analysis method.
|
||||
If an other risk analysis method is used other than whats defined in scoreSourceType,
|
||||
the user is expected to translate appropriately to match with an element value below.
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
<xs:restriction base="xs:string">
|
||||
<xs:enumeration value="None"/>
|
||||
<xs:enumeration value="Low"/>
|
||||
<xs:enumeration value="Medium"/>
|
||||
<xs:enumeration value="High"/>
|
||||
<xs:enumeration value="Critical"/>
|
||||
<xs:enumeration value="Unknown"/>
|
||||
</xs:restriction>
|
||||
</xs:simpleType>
|
||||
|
||||
<xs:simpleType name="scoreValueType">
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
Numerical representation of the vulnerability score.
|
||||
Must be a number between 0 - 10 (maps to lowest severity - highest severity)
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
<xs:restriction base="xs:decimal">
|
||||
<xs:minInclusive value="0"/>
|
||||
<xs:fractionDigits value="1"/>
|
||||
<xs:maxInclusive value="10"/>
|
||||
</xs:restriction>
|
||||
</xs:simpleType>
|
||||
|
||||
<xs:simpleType name="scoreSourceType" final="restriction">
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
Specifies the risk scoring methodology/standard used.
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
<xs:restriction base="xs:string">
|
||||
<xs:enumeration value="CVSSv2">
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
The rating is based on CVSS v2 standard
|
||||
https://www.first.org/cvss/v2/guide
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="CVSSv3">
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
The rating is based on CVSS v3 standard
|
||||
https://www.first.org/cvss/v3.1/specification-document
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="OWASP Risk">
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
The rating is based on OWASP Risk Rating
|
||||
https://www.owasp.org/index.php/OWASP_Risk_Rating_Methodology
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Open FAIR">
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
The rating is based on Open FAIR specification
|
||||
http://www.opengroup.org/subjectareas/security/risk
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Other">
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
Use this if the risk scoring methodology is not based on any of the options above
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
</xs:restriction>
|
||||
</xs:simpleType>
|
||||
|
||||
<xs:complexType name="scoreType">
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
Defines the numerical risk score of a vulnerability
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
<xs:sequence>
|
||||
<xs:element name="score" minOccurs="0" maxOccurs="1">
|
||||
<xs:complexType>
|
||||
<xs:sequence>
|
||||
<xs:element name="base" type="vuln:scoreValueType" minOccurs="0" maxOccurs="1">
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
The base score of the security vulnerability (Refer CVSS standard for example)
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element name="impact" type="vuln:scoreValueType" minOccurs="0" maxOccurs="1">
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
The impact subscore of the security vulnerability (Refer CVSS standard for example)
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element name="exploitability" type="vuln:scoreValueType" minOccurs="0" maxOccurs="1">
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
The exploitability subscore of the security vulnerability (Refer CVSS standard for
|
||||
example)
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
</xs:sequence>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
<xs:element name="severity" type="vuln:severityType" minOccurs="0" maxOccurs="1"/>
|
||||
<xs:element name="method" type="vuln:scoreSourceType" minOccurs="0" maxOccurs="1"/>
|
||||
<xs:element name="vector" type="xs:string" minOccurs="0" maxOccurs="1">
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
Textual representation of the metric values used to score the vulnerability
|
||||
see attack vector in https://www.first.org/cvss/v3.1/specification-document
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
</xs:sequence>
|
||||
</xs:complexType>
|
||||
|
||||
<xs:complexType name="vulnerability">
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
Defines the structure of a vulnerability.
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
<xs:sequence>
|
||||
<xs:element name="id" type="xs:normalizedString" minOccurs="1" maxOccurs="1">
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
The id of the vulnerability as defined by the risk scoring methodology
|
||||
For example CVE-2019-15842 (of https://nvd.nist.gov/vuln/detail/CVE-2019-15842)
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element name="source" minOccurs="0" maxOccurs="1">
|
||||
<xs:complexType>
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
The source of the vulnerability where it is documented.
|
||||
Usually the name of the organization publishing vulnerability information
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
<xs:sequence>
|
||||
<xs:element name="url" minOccurs="0" type="xs:anyURI" maxOccurs="1">
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
The url of the vulnerability documentation as provided by the source
|
||||
For example https://nvd.nist.gov/vuln/detail/CVE-2019-15842
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
</xs:sequence>
|
||||
<xs:attribute name="name" type="xs:normalizedString" use="required">
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
The name of the source. For example "National Vulnerability Database"
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
<xs:element name="ratings" minOccurs="0" maxOccurs="1">
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
List of the vulnerability ratings as defined by various risk rating methodologies.
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
<xs:complexType>
|
||||
<xs:sequence>
|
||||
<xs:element name="rating" type="vuln:scoreType" minOccurs="0" maxOccurs="unbounded"/>
|
||||
</xs:sequence>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
<xs:element name="cwes" minOccurs="0" maxOccurs="1">
|
||||
<xs:complexType>
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
List of Common Weaknesses Enumerations (CWEs) codes that describes this vulnerability.
|
||||
For example 399 (of https://cwe.mitre.org/data/definitions/399.html)
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
<xs:sequence minOccurs="0" maxOccurs="unbounded">
|
||||
<xs:element name="cwe" type="xs:integer" minOccurs="0" maxOccurs="1"/>
|
||||
</xs:sequence>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
<xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1">
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
Description of the vulnerability as provided by the source organization
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
<xs:element name="recommendations" minOccurs="0" maxOccurs="1">
|
||||
<xs:complexType>
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
The remediation options for the vulnerability if available
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
<xs:sequence minOccurs="0" maxOccurs="unbounded">
|
||||
<xs:element name="recommendation" type="xs:string">
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
A recommendation of how the particular vulnerability can be avoided/mitigated.
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
</xs:sequence>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
<xs:element name="advisories" minOccurs="0" maxOccurs="1">
|
||||
<xs:complexType>
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
Published advisories of the vulnerability if provided
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
<xs:sequence minOccurs="0" maxOccurs="unbounded">
|
||||
<xs:element name="advisory" type="xs:string"/>
|
||||
</xs:sequence>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
</xs:sequence>
|
||||
<xs:attribute name="ref" type="xs:string" use="required">
|
||||
<xs:annotation>
|
||||
<xs:documentation>References a component by the components bom-ref attribute</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:attribute>
|
||||
</xs:complexType>
|
||||
|
||||
<xs:element name="vulnerabilities">
|
||||
<xs:annotation>
|
||||
<xs:documentation xml:lang="en">
|
||||
Defines a list of vulnerabilities.
|
||||
Vulnerabilities are intended to be used inside the BOM component element.
|
||||
Extending a component ability to declare associated vulnerability information.
|
||||
Each component element optionally can add a vulnerabilities element.
|
||||
</xs:documentation>
|
||||
</xs:annotation>
|
||||
<xs:complexType>
|
||||
<xs:sequence minOccurs="0" maxOccurs="unbounded">
|
||||
<xs:element name="vulnerability" type="vuln:vulnerability"/>
|
||||
</xs:sequence>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
</xs:schema>
|
||||
Loading…
Reference in a new issue