gitlab-security_report_schemas 0.1.0.min0.0.0.max0.0.0 → 0.1.0.min15.0.0.max15.1.4

Sign up to get free protection for your applications and to get access to all the features.
Files changed (106) hide show
  1. checksums.yaml +4 -4
  2. data/Gemfile.lock +3 -3
  3. data/README.md +27 -4
  4. data/RUNBOOK.md +28 -0
  5. data/Rakefile +14 -3
  6. data/gem_version +1 -1
  7. data/gitlab-security_report_schemas.gemspec +33 -0
  8. data/lib/gitlab/security_report_schemas/cli/schema_checker/remote_file.rb +9 -2
  9. data/lib/gitlab/security_report_schemas/cli/schema_downloader.rb +1 -3
  10. data/lib/gitlab/security_report_schemas/configuration.rb +27 -2
  11. data/lib/gitlab/security_report_schemas/release/bundler.rb +34 -0
  12. data/lib/gitlab/security_report_schemas/release/gemfile.rb +49 -0
  13. data/lib/gitlab/security_report_schemas/release/issue.rb +77 -0
  14. data/lib/gitlab/security_report_schemas/release/merge_request.rb +84 -0
  15. data/lib/gitlab/security_report_schemas/release/templates/issue_description.erb +13 -0
  16. data/lib/gitlab/security_report_schemas/release/workflow.rb +108 -0
  17. data/lib/gitlab/security_report_schemas/schema_ver.rb +7 -4
  18. data/lib/gitlab/security_report_schemas/version.rb +0 -2
  19. data/lib/gitlab/security_report_schemas.rb +7 -3
  20. data/schemas/15.0.0/cluster-image-scanning-report-format.json +946 -0
  21. data/schemas/15.0.0/container-scanning-report-format.json +880 -0
  22. data/schemas/15.0.0/coverage-fuzzing-report-format.json +836 -0
  23. data/schemas/15.0.0/dast-report-format.json +1241 -0
  24. data/schemas/15.0.0/dependency-scanning-report-format.json +944 -0
  25. data/schemas/15.0.0/sast-report-format.json +831 -0
  26. data/schemas/15.0.0/secret-detection-report-format.json +854 -0
  27. data/schemas/15.0.1/cluster-image-scanning-report-format.json +980 -0
  28. data/schemas/15.0.1/container-scanning-report-format.json +914 -0
  29. data/schemas/15.0.1/coverage-fuzzing-report-format.json +870 -0
  30. data/schemas/15.0.1/dast-report-format.json +1275 -0
  31. data/schemas/15.0.1/dependency-scanning-report-format.json +978 -0
  32. data/schemas/15.0.1/sast-report-format.json +865 -0
  33. data/schemas/15.0.1/secret-detection-report-format.json +888 -0
  34. data/schemas/15.0.2/cluster-image-scanning-report-format.json +980 -0
  35. data/schemas/15.0.2/container-scanning-report-format.json +912 -0
  36. data/schemas/15.0.2/coverage-fuzzing-report-format.json +870 -0
  37. data/schemas/15.0.2/dast-report-format.json +1275 -0
  38. data/schemas/15.0.2/dependency-scanning-report-format.json +978 -0
  39. data/schemas/15.0.2/sast-report-format.json +865 -0
  40. data/schemas/15.0.2/secret-detection-report-format.json +888 -0
  41. data/schemas/15.0.4/cluster-image-scanning-report-format.json +984 -0
  42. data/schemas/15.0.4/container-scanning-report-format.json +916 -0
  43. data/schemas/15.0.4/coverage-fuzzing-report-format.json +874 -0
  44. data/schemas/15.0.4/dast-report-format.json +1279 -0
  45. data/schemas/15.0.4/dependency-scanning-report-format.json +982 -0
  46. data/schemas/15.0.4/sast-report-format.json +869 -0
  47. data/schemas/15.0.4/secret-detection-report-format.json +893 -0
  48. data/schemas/15.0.5/cluster-image-scanning-report-format.json +1035 -0
  49. data/schemas/15.0.5/container-scanning-report-format.json +967 -0
  50. data/schemas/15.0.5/coverage-fuzzing-report-format.json +925 -0
  51. data/schemas/15.0.5/dast-report-format.json +1330 -0
  52. data/schemas/15.0.5/dependency-scanning-report-format.json +1033 -0
  53. data/schemas/15.0.5/sast-report-format.json +920 -0
  54. data/schemas/15.0.5/secret-detection-report-format.json +944 -0
  55. data/schemas/15.0.6/cluster-image-scanning-report-format.json +1035 -0
  56. data/schemas/15.0.6/container-scanning-report-format.json +967 -0
  57. data/schemas/15.0.6/coverage-fuzzing-report-format.json +925 -0
  58. data/schemas/15.0.6/dast-report-format.json +1330 -0
  59. data/schemas/15.0.6/dependency-scanning-report-format.json +1033 -0
  60. data/schemas/15.0.6/sast-report-format.json +920 -0
  61. data/schemas/15.0.6/secret-detection-report-format.json +944 -0
  62. data/schemas/15.0.7/cluster-image-scanning-report-format.json +1085 -0
  63. data/schemas/15.0.7/container-scanning-report-format.json +1017 -0
  64. data/schemas/15.0.7/coverage-fuzzing-report-format.json +975 -0
  65. data/schemas/15.0.7/dast-report-format.json +1380 -0
  66. data/schemas/15.0.7/dependency-scanning-report-format.json +1083 -0
  67. data/schemas/15.0.7/sast-report-format.json +970 -0
  68. data/schemas/15.0.7/secret-detection-report-format.json +994 -0
  69. data/schemas/15.1.0/cluster-image-scanning-report-format.json +1065 -0
  70. data/schemas/15.1.0/container-scanning-report-format.json +997 -0
  71. data/schemas/15.1.0/coverage-fuzzing-report-format.json +975 -0
  72. data/schemas/15.1.0/dast-report-format.json +1380 -0
  73. data/schemas/15.1.0/dependency-scanning-report-format.json +986 -0
  74. data/schemas/15.1.0/sast-report-format.json +970 -0
  75. data/schemas/15.1.0/secret-detection-report-format.json +994 -0
  76. data/schemas/15.1.1/cluster-image-scanning-report-format.json +1065 -0
  77. data/schemas/15.1.1/container-scanning-for-registry-report-format.json +0 -0
  78. data/schemas/15.1.1/container-scanning-report-format.json +998 -0
  79. data/schemas/15.1.1/coverage-fuzzing-report-format.json +975 -0
  80. data/schemas/15.1.1/dast-report-format.json +1380 -0
  81. data/schemas/15.1.1/dependency-scanning-report-format.json +986 -0
  82. data/schemas/15.1.1/sast-report-format.json +970 -0
  83. data/schemas/15.1.1/secret-detection-report-format.json +994 -0
  84. data/schemas/15.1.2/cluster-image-scanning-report-format.json +1190 -0
  85. data/schemas/15.1.2/container-scanning-report-format.json +1123 -0
  86. data/schemas/15.1.2/coverage-fuzzing-report-format.json +1100 -0
  87. data/schemas/15.1.2/dast-report-format.json +1505 -0
  88. data/schemas/15.1.2/dependency-scanning-report-format.json +1111 -0
  89. data/schemas/15.1.2/sast-report-format.json +1095 -0
  90. data/schemas/15.1.2/secret-detection-report-format.json +1119 -0
  91. data/schemas/15.1.3/cluster-image-scanning-report-format.json +1190 -0
  92. data/schemas/15.1.3/container-scanning-report-format.json +1123 -0
  93. data/schemas/15.1.3/coverage-fuzzing-report-format.json +1100 -0
  94. data/schemas/15.1.3/dast-report-format.json +1505 -0
  95. data/schemas/15.1.3/dependency-scanning-report-format.json +1111 -0
  96. data/schemas/15.1.3/sast-report-format.json +1095 -0
  97. data/schemas/15.1.3/secret-detection-report-format.json +1119 -0
  98. data/schemas/15.1.4/cluster-image-scanning-report-format.json +1190 -0
  99. data/schemas/15.1.4/container-scanning-report-format.json +1123 -0
  100. data/schemas/15.1.4/coverage-fuzzing-report-format.json +1100 -0
  101. data/schemas/15.1.4/dast-report-format.json +1505 -0
  102. data/schemas/15.1.4/dependency-scanning-report-format.json +1111 -0
  103. data/schemas/15.1.4/sast-report-format.json +1095 -0
  104. data/schemas/15.1.4/secret-detection-report-format.json +1119 -0
  105. data/supported_versions +12 -0
  106. metadata +112 -12
@@ -0,0 +1,978 @@
1
+ {
2
+ "$schema": "http://json-schema.org/draft-07/schema#",
3
+ "$id": "https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/raw/master/dist/dependency-scanning-report-format.json",
4
+ "title": "Report format for GitLab Dependency Scanning",
5
+ "description": "This schema provides the the report format for Dependency Scanning analyzers (https://docs.gitlab.com/ee/user/application_security/dependency_scanning).",
6
+ "definitions": {
7
+ "detail_type": {
8
+ "oneOf": [
9
+ {
10
+ "$ref": "#/definitions/named_list"
11
+ },
12
+ {
13
+ "$ref": "#/definitions/list"
14
+ },
15
+ {
16
+ "$ref": "#/definitions/table"
17
+ },
18
+ {
19
+ "$ref": "#/definitions/text"
20
+ },
21
+ {
22
+ "$ref": "#/definitions/url"
23
+ },
24
+ {
25
+ "$ref": "#/definitions/code"
26
+ },
27
+ {
28
+ "$ref": "#/definitions/value"
29
+ },
30
+ {
31
+ "$ref": "#/definitions/diff"
32
+ },
33
+ {
34
+ "$ref": "#/definitions/markdown"
35
+ },
36
+ {
37
+ "$ref": "#/definitions/commit"
38
+ },
39
+ {
40
+ "$ref": "#/definitions/file_location"
41
+ },
42
+ {
43
+ "$ref": "#/definitions/module_location"
44
+ }
45
+ ]
46
+ },
47
+ "text_value": {
48
+ "type": "string"
49
+ },
50
+ "named_field": {
51
+ "type": "object",
52
+ "required": [
53
+ "name"
54
+ ],
55
+ "properties": {
56
+ "name": {
57
+ "$ref": "#/definitions/text_value",
58
+ "minLength": 1
59
+ },
60
+ "description": {
61
+ "$ref": "#/definitions/text_value"
62
+ }
63
+ }
64
+ },
65
+ "named_list": {
66
+ "type": "object",
67
+ "description": "An object with named and typed fields",
68
+ "required": [
69
+ "type",
70
+ "items"
71
+ ],
72
+ "properties": {
73
+ "type": {
74
+ "const": "named-list"
75
+ },
76
+ "items": {
77
+ "type": "object",
78
+ "patternProperties": {
79
+ "^.*$": {
80
+ "allOf": [
81
+ {
82
+ "$ref": "#/definitions/named_field"
83
+ },
84
+ {
85
+ "$ref": "#/definitions/detail_type"
86
+ }
87
+ ]
88
+ }
89
+ }
90
+ }
91
+ }
92
+ },
93
+ "list": {
94
+ "type": "object",
95
+ "description": "A list of typed fields",
96
+ "required": [
97
+ "type",
98
+ "items"
99
+ ],
100
+ "properties": {
101
+ "type": {
102
+ "const": "list"
103
+ },
104
+ "items": {
105
+ "type": "array",
106
+ "items": {
107
+ "$ref": "#/definitions/detail_type"
108
+ }
109
+ }
110
+ }
111
+ },
112
+ "table": {
113
+ "type": "object",
114
+ "description": "A table of typed fields",
115
+ "required": [
116
+ "type",
117
+ "rows"
118
+ ],
119
+ "properties": {
120
+ "type": {
121
+ "const": "table"
122
+ },
123
+ "header": {
124
+ "type": "array",
125
+ "items": {
126
+ "$ref": "#/definitions/detail_type"
127
+ }
128
+ },
129
+ "rows": {
130
+ "type": "array",
131
+ "items": {
132
+ "type": "array",
133
+ "items": {
134
+ "$ref": "#/definitions/detail_type"
135
+ }
136
+ }
137
+ }
138
+ }
139
+ },
140
+ "text": {
141
+ "type": "object",
142
+ "description": "Raw text",
143
+ "required": [
144
+ "type",
145
+ "value"
146
+ ],
147
+ "properties": {
148
+ "type": {
149
+ "const": "text"
150
+ },
151
+ "value": {
152
+ "$ref": "#/definitions/text_value"
153
+ }
154
+ }
155
+ },
156
+ "url": {
157
+ "type": "object",
158
+ "description": "A single URL",
159
+ "required": [
160
+ "type",
161
+ "href"
162
+ ],
163
+ "properties": {
164
+ "type": {
165
+ "const": "url"
166
+ },
167
+ "text": {
168
+ "$ref": "#/definitions/text_value"
169
+ },
170
+ "href": {
171
+ "type": "string",
172
+ "minLength": 1,
173
+ "examples": [
174
+ "http://mysite.com"
175
+ ]
176
+ }
177
+ }
178
+ },
179
+ "code": {
180
+ "type": "object",
181
+ "description": "A codeblock",
182
+ "required": [
183
+ "type",
184
+ "value"
185
+ ],
186
+ "properties": {
187
+ "type": {
188
+ "const": "code"
189
+ },
190
+ "value": {
191
+ "type": "string"
192
+ },
193
+ "lang": {
194
+ "type": "string",
195
+ "description": "A programming language"
196
+ }
197
+ }
198
+ },
199
+ "value": {
200
+ "type": "object",
201
+ "description": "A field that can store a range of types of value",
202
+ "required": [
203
+ "type",
204
+ "value"
205
+ ],
206
+ "properties": {
207
+ "type": {
208
+ "const": "value"
209
+ },
210
+ "value": {
211
+ "type": [
212
+ "number",
213
+ "string",
214
+ "boolean"
215
+ ]
216
+ }
217
+ }
218
+ },
219
+ "diff": {
220
+ "type": "object",
221
+ "description": "A diff",
222
+ "required": [
223
+ "type",
224
+ "before",
225
+ "after"
226
+ ],
227
+ "properties": {
228
+ "type": {
229
+ "const": "diff"
230
+ },
231
+ "before": {
232
+ "type": "string"
233
+ },
234
+ "after": {
235
+ "type": "string"
236
+ }
237
+ }
238
+ },
239
+ "markdown": {
240
+ "type": "object",
241
+ "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
242
+ "required": [
243
+ "type",
244
+ "value"
245
+ ],
246
+ "properties": {
247
+ "type": {
248
+ "const": "markdown"
249
+ },
250
+ "value": {
251
+ "$ref": "#/definitions/text_value",
252
+ "examples": [
253
+ "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
254
+ ]
255
+ }
256
+ }
257
+ },
258
+ "commit": {
259
+ "type": "object",
260
+ "description": "A commit/tag/branch within the GitLab project",
261
+ "required": [
262
+ "type",
263
+ "value"
264
+ ],
265
+ "properties": {
266
+ "type": {
267
+ "const": "commit"
268
+ },
269
+ "value": {
270
+ "type": "string",
271
+ "description": "The commit SHA",
272
+ "minLength": 1
273
+ }
274
+ }
275
+ },
276
+ "file_location": {
277
+ "type": "object",
278
+ "description": "A location within a file in the project",
279
+ "required": [
280
+ "type",
281
+ "file_name",
282
+ "line_start"
283
+ ],
284
+ "properties": {
285
+ "type": {
286
+ "const": "file-location"
287
+ },
288
+ "file_name": {
289
+ "type": "string",
290
+ "minLength": 1
291
+ },
292
+ "line_start": {
293
+ "type": "integer"
294
+ },
295
+ "line_end": {
296
+ "type": "integer"
297
+ }
298
+ }
299
+ },
300
+ "module_location": {
301
+ "type": "object",
302
+ "description": "A location within a binary module of the form module+relative_offset",
303
+ "required": [
304
+ "type",
305
+ "module_name",
306
+ "offset"
307
+ ],
308
+ "properties": {
309
+ "type": {
310
+ "const": "module-location"
311
+ },
312
+ "module_name": {
313
+ "type": "string",
314
+ "minLength": 1,
315
+ "examples": [
316
+ "compiled_binary"
317
+ ]
318
+ },
319
+ "offset": {
320
+ "type": "integer",
321
+ "examples": [
322
+ 100
323
+ ]
324
+ }
325
+ }
326
+ }
327
+ },
328
+ "self": {
329
+ "version": "15.0.1"
330
+ },
331
+ "required": [
332
+ "dependency_files",
333
+ "scan",
334
+ "version",
335
+ "vulnerabilities"
336
+ ],
337
+ "additionalProperties": true,
338
+ "properties": {
339
+ "scan": {
340
+ "type": "object",
341
+ "required": [
342
+ "analyzer",
343
+ "end_time",
344
+ "scanner",
345
+ "start_time",
346
+ "status",
347
+ "type"
348
+ ],
349
+ "properties": {
350
+ "end_time": {
351
+ "type": "string",
352
+ "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
353
+ "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}$",
354
+ "examples": [
355
+ "2020-01-28T03:26:02"
356
+ ]
357
+ },
358
+ "messages": {
359
+ "type": "array",
360
+ "items": {
361
+ "type": "object",
362
+ "description": "Communication intended for the initiator of a scan.",
363
+ "required": [
364
+ "level",
365
+ "value"
366
+ ],
367
+ "properties": {
368
+ "level": {
369
+ "type": "string",
370
+ "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
371
+ "enum": [
372
+ "info",
373
+ "warn",
374
+ "fatal"
375
+ ],
376
+ "examples": [
377
+ "info"
378
+ ]
379
+ },
380
+ "value": {
381
+ "type": "string",
382
+ "description": "The message to communicate.",
383
+ "minLength": 1,
384
+ "examples": [
385
+ "Permission denied, scanning aborted"
386
+ ]
387
+ }
388
+ }
389
+ }
390
+ },
391
+ "analyzer": {
392
+ "type": "object",
393
+ "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
394
+ "required": [
395
+ "id",
396
+ "name",
397
+ "version",
398
+ "vendor"
399
+ ],
400
+ "properties": {
401
+ "id": {
402
+ "type": "string",
403
+ "description": "Unique id that identifies the analyzer.",
404
+ "minLength": 1,
405
+ "examples": [
406
+ "gitlab-dast"
407
+ ]
408
+ },
409
+ "name": {
410
+ "type": "string",
411
+ "description": "A human readable value that identifies the analyzer, not required to be unique.",
412
+ "minLength": 1,
413
+ "examples": [
414
+ "GitLab DAST"
415
+ ]
416
+ },
417
+ "url": {
418
+ "type": "string",
419
+ "pattern": "^https?://.+",
420
+ "description": "A link to more information about the analyzer.",
421
+ "examples": [
422
+ "https://docs.gitlab.com/ee/user/application_security/dast"
423
+ ]
424
+ },
425
+ "vendor": {
426
+ "description": "The vendor/maintainer of the analyzer.",
427
+ "type": "object",
428
+ "required": [
429
+ "name"
430
+ ],
431
+ "properties": {
432
+ "name": {
433
+ "type": "string",
434
+ "description": "The name of the vendor.",
435
+ "minLength": 1,
436
+ "examples": [
437
+ "GitLab"
438
+ ]
439
+ }
440
+ }
441
+ },
442
+ "version": {
443
+ "type": "string",
444
+ "description": "The version of the analyzer.",
445
+ "minLength": 1,
446
+ "examples": [
447
+ "1.0.2"
448
+ ]
449
+ }
450
+ }
451
+ },
452
+ "scanner": {
453
+ "type": "object",
454
+ "description": "Object defining the scanner used to perform the scan.",
455
+ "required": [
456
+ "id",
457
+ "name",
458
+ "version",
459
+ "vendor"
460
+ ],
461
+ "properties": {
462
+ "id": {
463
+ "type": "string",
464
+ "description": "Unique id that identifies the scanner.",
465
+ "minLength": 1,
466
+ "examples": [
467
+ "my-sast-scanner"
468
+ ]
469
+ },
470
+ "name": {
471
+ "type": "string",
472
+ "description": "A human readable value that identifies the scanner, not required to be unique.",
473
+ "minLength": 1,
474
+ "examples": [
475
+ "My SAST Scanner"
476
+ ]
477
+ },
478
+ "url": {
479
+ "type": "string",
480
+ "description": "A link to more information about the scanner.",
481
+ "examples": [
482
+ "https://scanner.url"
483
+ ]
484
+ },
485
+ "version": {
486
+ "type": "string",
487
+ "description": "The version of the scanner.",
488
+ "minLength": 1,
489
+ "examples": [
490
+ "1.0.2"
491
+ ]
492
+ },
493
+ "vendor": {
494
+ "description": "The vendor/maintainer of the scanner.",
495
+ "type": "object",
496
+ "required": [
497
+ "name"
498
+ ],
499
+ "properties": {
500
+ "name": {
501
+ "type": "string",
502
+ "description": "The name of the vendor.",
503
+ "minLength": 1,
504
+ "examples": [
505
+ "GitLab"
506
+ ]
507
+ }
508
+ }
509
+ }
510
+ }
511
+ },
512
+ "start_time": {
513
+ "type": "string",
514
+ "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
515
+ "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}$",
516
+ "examples": [
517
+ "2020-02-14T16:01:59"
518
+ ]
519
+ },
520
+ "status": {
521
+ "type": "string",
522
+ "description": "Result of the scan.",
523
+ "enum": [
524
+ "success",
525
+ "failure"
526
+ ]
527
+ },
528
+ "type": {
529
+ "type": "string",
530
+ "description": "Type of the scan.",
531
+ "enum": [
532
+ "dependency_scanning"
533
+ ]
534
+ },
535
+ "primary_identifiers": {
536
+ "type": "array",
537
+ "description": "An array containing an exhaustive list of primary identifiers for which the analyzer may return results",
538
+ "items": {
539
+ "type": "object",
540
+ "required": [
541
+ "type",
542
+ "name",
543
+ "value"
544
+ ],
545
+ "properties": {
546
+ "type": {
547
+ "type": "string",
548
+ "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
549
+ "minLength": 1
550
+ },
551
+ "name": {
552
+ "type": "string",
553
+ "description": "Human-readable name of the identifier.",
554
+ "minLength": 1
555
+ },
556
+ "url": {
557
+ "type": "string",
558
+ "description": "URL of the identifier's documentation.",
559
+ "pattern": "^https?://.+"
560
+ },
561
+ "value": {
562
+ "type": "string",
563
+ "description": "Value of the identifier, for matching purpose.",
564
+ "minLength": 1
565
+ }
566
+ }
567
+ }
568
+ }
569
+ }
570
+ },
571
+ "schema": {
572
+ "type": "string",
573
+ "description": "URI pointing to the validating security report schema.",
574
+ "pattern": "^https?://.+"
575
+ },
576
+ "version": {
577
+ "type": "string",
578
+ "description": "The version of the schema to which the JSON report conforms.",
579
+ "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
580
+ },
581
+ "vulnerabilities": {
582
+ "type": "array",
583
+ "description": "Array of vulnerability objects.",
584
+ "items": {
585
+ "type": "object",
586
+ "description": "Describes the vulnerability using GitLab Flavored Markdown",
587
+ "required": [
588
+ "id",
589
+ "identifiers",
590
+ "location"
591
+ ],
592
+ "properties": {
593
+ "id": {
594
+ "type": "string",
595
+ "minLength": 1,
596
+ "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
597
+ "examples": [
598
+ "642735a5-1425-428d-8d4e-3c854885a3c9"
599
+ ]
600
+ },
601
+ "name": {
602
+ "type": "string",
603
+ "maxLength": 255,
604
+ "description": "The name of the vulnerability. This must not include the finding's specific information."
605
+ },
606
+ "description": {
607
+ "type": "string",
608
+ "maxLength": 1048576,
609
+ "description": "A long text section describing the vulnerability more fully."
610
+ },
611
+ "severity": {
612
+ "type": "string",
613
+ "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
614
+ "enum": [
615
+ "Info",
616
+ "Unknown",
617
+ "Low",
618
+ "Medium",
619
+ "High",
620
+ "Critical"
621
+ ]
622
+ },
623
+ "solution": {
624
+ "type": "string",
625
+ "maxLength": 7000,
626
+ "description": "Explanation of how to fix the vulnerability."
627
+ },
628
+ "identifiers": {
629
+ "type": "array",
630
+ "minItems": 1,
631
+ "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
632
+ "items": {
633
+ "type": "object",
634
+ "required": [
635
+ "type",
636
+ "name",
637
+ "value"
638
+ ],
639
+ "properties": {
640
+ "type": {
641
+ "type": "string",
642
+ "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
643
+ "minLength": 1
644
+ },
645
+ "name": {
646
+ "type": "string",
647
+ "description": "Human-readable name of the identifier.",
648
+ "minLength": 1
649
+ },
650
+ "url": {
651
+ "type": "string",
652
+ "description": "URL of the identifier's documentation.",
653
+ "pattern": "^https?://.+"
654
+ },
655
+ "value": {
656
+ "type": "string",
657
+ "description": "Value of the identifier, for matching purpose.",
658
+ "minLength": 1
659
+ }
660
+ }
661
+ }
662
+ },
663
+ "links": {
664
+ "type": "array",
665
+ "description": "An array of references to external documentation or articles that describe the vulnerability.",
666
+ "items": {
667
+ "type": "object",
668
+ "required": [
669
+ "url"
670
+ ],
671
+ "properties": {
672
+ "name": {
673
+ "type": "string",
674
+ "description": "Name of the vulnerability details link."
675
+ },
676
+ "url": {
677
+ "type": "string",
678
+ "description": "URL of the vulnerability details document.",
679
+ "pattern": "^https?://.+"
680
+ }
681
+ }
682
+ }
683
+ },
684
+ "details": {
685
+ "$ref": "#/definitions/named_list/properties/items"
686
+ },
687
+ "tracking": {
688
+ "description": "Describes how this vulnerability should be tracked as the project changes.",
689
+ "oneOf": [
690
+ {
691
+ "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
692
+ "required": [
693
+ "items"
694
+ ],
695
+ "properties": {
696
+ "type": {
697
+ "const": "source"
698
+ },
699
+ "items": {
700
+ "type": "array",
701
+ "items": {
702
+ "description": "An item that should be tracked using source-specific tracking methods.",
703
+ "type": "object",
704
+ "required": [
705
+ "signatures"
706
+ ],
707
+ "properties": {
708
+ "file": {
709
+ "type": "string",
710
+ "description": "Path to the file where the vulnerability is located."
711
+ },
712
+ "start_line": {
713
+ "type": "number",
714
+ "description": "The first line of the file that includes the vulnerability."
715
+ },
716
+ "end_line": {
717
+ "type": "number",
718
+ "description": "The last line of the file that includes the vulnerability."
719
+ },
720
+ "signatures": {
721
+ "type": "array",
722
+ "description": "An array of calculated tracking signatures for this tracking item.",
723
+ "minItems": 1,
724
+ "items": {
725
+ "description": "A calculated tracking signature value and metadata.",
726
+ "required": [
727
+ "algorithm",
728
+ "value"
729
+ ],
730
+ "properties": {
731
+ "algorithm": {
732
+ "type": "string",
733
+ "description": "The algorithm used to generate the signature."
734
+ },
735
+ "value": {
736
+ "type": "string",
737
+ "description": "The result of this signature algorithm."
738
+ }
739
+ }
740
+ }
741
+ }
742
+ }
743
+ }
744
+ }
745
+ }
746
+ }
747
+ ],
748
+ "properties": {
749
+ "type": {
750
+ "type": "string",
751
+ "description": "Each tracking type must declare its own type."
752
+ }
753
+ }
754
+ },
755
+ "flags": {
756
+ "description": "Flags that can be attached to vulnerabilities.",
757
+ "type": "array",
758
+ "items": {
759
+ "type": "object",
760
+ "description": "Informational flags identified and assigned to a vulnerability.",
761
+ "required": [
762
+ "type",
763
+ "origin",
764
+ "description"
765
+ ],
766
+ "properties": {
767
+ "type": {
768
+ "type": "string",
769
+ "minLength": 1,
770
+ "description": "Result of the scan.",
771
+ "enum": [
772
+ "flagged-as-likely-false-positive"
773
+ ]
774
+ },
775
+ "origin": {
776
+ "minLength": 1,
777
+ "description": "Tool that issued the flag.",
778
+ "type": "string"
779
+ },
780
+ "description": {
781
+ "minLength": 1,
782
+ "description": "What the flag is about.",
783
+ "type": "string"
784
+ }
785
+ }
786
+ }
787
+ },
788
+ "location": {
789
+ "type": "object",
790
+ "description": "Identifies the vulnerability's location.",
791
+ "required": [
792
+ "file",
793
+ "dependency"
794
+ ],
795
+ "properties": {
796
+ "file": {
797
+ "type": "string",
798
+ "minLength": 1,
799
+ "description": "Path to the manifest or lock file where the dependency is declared (such as yarn.lock)."
800
+ },
801
+ "dependency": {
802
+ "type": "object",
803
+ "description": "Describes the dependency of a project where the vulnerability is located.",
804
+ "required": [
805
+ "package",
806
+ "version"
807
+ ],
808
+ "properties": {
809
+ "package": {
810
+ "type": "object",
811
+ "description": "Provides information on the package where the vulnerability is located.",
812
+ "required": [
813
+ "name"
814
+ ],
815
+ "properties": {
816
+ "name": {
817
+ "type": "string",
818
+ "description": "Name of the package where the vulnerability is located."
819
+ }
820
+ }
821
+ },
822
+ "version": {
823
+ "type": "string",
824
+ "description": "Version of the vulnerable package."
825
+ },
826
+ "iid": {
827
+ "description": "ID that identifies the dependency in the scope of a dependency file.",
828
+ "type": "number"
829
+ },
830
+ "direct": {
831
+ "type": "boolean",
832
+ "description": "Tells whether this is a direct, top-level dependency of the scanned project."
833
+ },
834
+ "dependency_path": {
835
+ "type": "array",
836
+ "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
837
+ "items": {
838
+ "type": "object",
839
+ "required": [
840
+ "iid"
841
+ ],
842
+ "properties": {
843
+ "iid": {
844
+ "type": "number",
845
+ "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
846
+ }
847
+ }
848
+ }
849
+ }
850
+ }
851
+ }
852
+ }
853
+ }
854
+ }
855
+ }
856
+ },
857
+ "remediations": {
858
+ "type": "array",
859
+ "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
860
+ "items": {
861
+ "type": "object",
862
+ "required": [
863
+ "fixes",
864
+ "summary",
865
+ "diff"
866
+ ],
867
+ "properties": {
868
+ "fixes": {
869
+ "type": "array",
870
+ "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
871
+ "items": {
872
+ "type": "object",
873
+ "required": [
874
+ "id"
875
+ ],
876
+ "properties": {
877
+ "id": {
878
+ "type": "string",
879
+ "minLength": 1,
880
+ "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
881
+ "examples": [
882
+ "642735a5-1425-428d-8d4e-3c854885a3c9"
883
+ ]
884
+ }
885
+ }
886
+ }
887
+ },
888
+ "summary": {
889
+ "type": "string",
890
+ "minLength": 1,
891
+ "description": "An overview of how the vulnerabilities were fixed."
892
+ },
893
+ "diff": {
894
+ "type": "string",
895
+ "minLength": 1,
896
+ "description": "A base64-encoded remediation code diff, compatible with git apply."
897
+ }
898
+ }
899
+ }
900
+ },
901
+ "dependency_files": {
902
+ "type": "array",
903
+ "description": "List of dependency files identified in the project.",
904
+ "items": {
905
+ "type": "object",
906
+ "required": [
907
+ "path",
908
+ "package_manager",
909
+ "dependencies"
910
+ ],
911
+ "properties": {
912
+ "path": {
913
+ "type": "string",
914
+ "minLength": 1
915
+ },
916
+ "package_manager": {
917
+ "type": "string",
918
+ "minLength": 1
919
+ },
920
+ "dependencies": {
921
+ "type": "array",
922
+ "items": {
923
+ "type": "object",
924
+ "description": "Describes the dependency of a project where the vulnerability is located.",
925
+ "required": [
926
+ "package",
927
+ "version"
928
+ ],
929
+ "properties": {
930
+ "package": {
931
+ "type": "object",
932
+ "description": "Provides information on the package where the vulnerability is located.",
933
+ "required": [
934
+ "name"
935
+ ],
936
+ "properties": {
937
+ "name": {
938
+ "type": "string",
939
+ "description": "Name of the package where the vulnerability is located."
940
+ }
941
+ }
942
+ },
943
+ "version": {
944
+ "type": "string",
945
+ "description": "Version of the vulnerable package."
946
+ },
947
+ "iid": {
948
+ "description": "ID that identifies the dependency in the scope of a dependency file.",
949
+ "type": "number"
950
+ },
951
+ "direct": {
952
+ "type": "boolean",
953
+ "description": "Tells whether this is a direct, top-level dependency of the scanned project."
954
+ },
955
+ "dependency_path": {
956
+ "type": "array",
957
+ "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
958
+ "items": {
959
+ "type": "object",
960
+ "required": [
961
+ "iid"
962
+ ],
963
+ "properties": {
964
+ "iid": {
965
+ "type": "number",
966
+ "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
967
+ }
968
+ }
969
+ }
970
+ }
971
+ }
972
+ }
973
+ }
974
+ }
975
+ }
976
+ }
977
+ }
978
+ }