gitlab-security_report_schemas 0.1.0.min0.0.0.max0.0.0 → 0.1.0.min15.0.0.max15.1.4

Sign up to get free protection for your applications and to get access to all the features.
Files changed (106) hide show
  1. checksums.yaml +4 -4
  2. data/Gemfile.lock +3 -3
  3. data/README.md +27 -4
  4. data/RUNBOOK.md +28 -0
  5. data/Rakefile +14 -3
  6. data/gem_version +1 -1
  7. data/gitlab-security_report_schemas.gemspec +33 -0
  8. data/lib/gitlab/security_report_schemas/cli/schema_checker/remote_file.rb +9 -2
  9. data/lib/gitlab/security_report_schemas/cli/schema_downloader.rb +1 -3
  10. data/lib/gitlab/security_report_schemas/configuration.rb +27 -2
  11. data/lib/gitlab/security_report_schemas/release/bundler.rb +34 -0
  12. data/lib/gitlab/security_report_schemas/release/gemfile.rb +49 -0
  13. data/lib/gitlab/security_report_schemas/release/issue.rb +77 -0
  14. data/lib/gitlab/security_report_schemas/release/merge_request.rb +84 -0
  15. data/lib/gitlab/security_report_schemas/release/templates/issue_description.erb +13 -0
  16. data/lib/gitlab/security_report_schemas/release/workflow.rb +108 -0
  17. data/lib/gitlab/security_report_schemas/schema_ver.rb +7 -4
  18. data/lib/gitlab/security_report_schemas/version.rb +0 -2
  19. data/lib/gitlab/security_report_schemas.rb +7 -3
  20. data/schemas/15.0.0/cluster-image-scanning-report-format.json +946 -0
  21. data/schemas/15.0.0/container-scanning-report-format.json +880 -0
  22. data/schemas/15.0.0/coverage-fuzzing-report-format.json +836 -0
  23. data/schemas/15.0.0/dast-report-format.json +1241 -0
  24. data/schemas/15.0.0/dependency-scanning-report-format.json +944 -0
  25. data/schemas/15.0.0/sast-report-format.json +831 -0
  26. data/schemas/15.0.0/secret-detection-report-format.json +854 -0
  27. data/schemas/15.0.1/cluster-image-scanning-report-format.json +980 -0
  28. data/schemas/15.0.1/container-scanning-report-format.json +914 -0
  29. data/schemas/15.0.1/coverage-fuzzing-report-format.json +870 -0
  30. data/schemas/15.0.1/dast-report-format.json +1275 -0
  31. data/schemas/15.0.1/dependency-scanning-report-format.json +978 -0
  32. data/schemas/15.0.1/sast-report-format.json +865 -0
  33. data/schemas/15.0.1/secret-detection-report-format.json +888 -0
  34. data/schemas/15.0.2/cluster-image-scanning-report-format.json +980 -0
  35. data/schemas/15.0.2/container-scanning-report-format.json +912 -0
  36. data/schemas/15.0.2/coverage-fuzzing-report-format.json +870 -0
  37. data/schemas/15.0.2/dast-report-format.json +1275 -0
  38. data/schemas/15.0.2/dependency-scanning-report-format.json +978 -0
  39. data/schemas/15.0.2/sast-report-format.json +865 -0
  40. data/schemas/15.0.2/secret-detection-report-format.json +888 -0
  41. data/schemas/15.0.4/cluster-image-scanning-report-format.json +984 -0
  42. data/schemas/15.0.4/container-scanning-report-format.json +916 -0
  43. data/schemas/15.0.4/coverage-fuzzing-report-format.json +874 -0
  44. data/schemas/15.0.4/dast-report-format.json +1279 -0
  45. data/schemas/15.0.4/dependency-scanning-report-format.json +982 -0
  46. data/schemas/15.0.4/sast-report-format.json +869 -0
  47. data/schemas/15.0.4/secret-detection-report-format.json +893 -0
  48. data/schemas/15.0.5/cluster-image-scanning-report-format.json +1035 -0
  49. data/schemas/15.0.5/container-scanning-report-format.json +967 -0
  50. data/schemas/15.0.5/coverage-fuzzing-report-format.json +925 -0
  51. data/schemas/15.0.5/dast-report-format.json +1330 -0
  52. data/schemas/15.0.5/dependency-scanning-report-format.json +1033 -0
  53. data/schemas/15.0.5/sast-report-format.json +920 -0
  54. data/schemas/15.0.5/secret-detection-report-format.json +944 -0
  55. data/schemas/15.0.6/cluster-image-scanning-report-format.json +1035 -0
  56. data/schemas/15.0.6/container-scanning-report-format.json +967 -0
  57. data/schemas/15.0.6/coverage-fuzzing-report-format.json +925 -0
  58. data/schemas/15.0.6/dast-report-format.json +1330 -0
  59. data/schemas/15.0.6/dependency-scanning-report-format.json +1033 -0
  60. data/schemas/15.0.6/sast-report-format.json +920 -0
  61. data/schemas/15.0.6/secret-detection-report-format.json +944 -0
  62. data/schemas/15.0.7/cluster-image-scanning-report-format.json +1085 -0
  63. data/schemas/15.0.7/container-scanning-report-format.json +1017 -0
  64. data/schemas/15.0.7/coverage-fuzzing-report-format.json +975 -0
  65. data/schemas/15.0.7/dast-report-format.json +1380 -0
  66. data/schemas/15.0.7/dependency-scanning-report-format.json +1083 -0
  67. data/schemas/15.0.7/sast-report-format.json +970 -0
  68. data/schemas/15.0.7/secret-detection-report-format.json +994 -0
  69. data/schemas/15.1.0/cluster-image-scanning-report-format.json +1065 -0
  70. data/schemas/15.1.0/container-scanning-report-format.json +997 -0
  71. data/schemas/15.1.0/coverage-fuzzing-report-format.json +975 -0
  72. data/schemas/15.1.0/dast-report-format.json +1380 -0
  73. data/schemas/15.1.0/dependency-scanning-report-format.json +986 -0
  74. data/schemas/15.1.0/sast-report-format.json +970 -0
  75. data/schemas/15.1.0/secret-detection-report-format.json +994 -0
  76. data/schemas/15.1.1/cluster-image-scanning-report-format.json +1065 -0
  77. data/schemas/15.1.1/container-scanning-for-registry-report-format.json +0 -0
  78. data/schemas/15.1.1/container-scanning-report-format.json +998 -0
  79. data/schemas/15.1.1/coverage-fuzzing-report-format.json +975 -0
  80. data/schemas/15.1.1/dast-report-format.json +1380 -0
  81. data/schemas/15.1.1/dependency-scanning-report-format.json +986 -0
  82. data/schemas/15.1.1/sast-report-format.json +970 -0
  83. data/schemas/15.1.1/secret-detection-report-format.json +994 -0
  84. data/schemas/15.1.2/cluster-image-scanning-report-format.json +1190 -0
  85. data/schemas/15.1.2/container-scanning-report-format.json +1123 -0
  86. data/schemas/15.1.2/coverage-fuzzing-report-format.json +1100 -0
  87. data/schemas/15.1.2/dast-report-format.json +1505 -0
  88. data/schemas/15.1.2/dependency-scanning-report-format.json +1111 -0
  89. data/schemas/15.1.2/sast-report-format.json +1095 -0
  90. data/schemas/15.1.2/secret-detection-report-format.json +1119 -0
  91. data/schemas/15.1.3/cluster-image-scanning-report-format.json +1190 -0
  92. data/schemas/15.1.3/container-scanning-report-format.json +1123 -0
  93. data/schemas/15.1.3/coverage-fuzzing-report-format.json +1100 -0
  94. data/schemas/15.1.3/dast-report-format.json +1505 -0
  95. data/schemas/15.1.3/dependency-scanning-report-format.json +1111 -0
  96. data/schemas/15.1.3/sast-report-format.json +1095 -0
  97. data/schemas/15.1.3/secret-detection-report-format.json +1119 -0
  98. data/schemas/15.1.4/cluster-image-scanning-report-format.json +1190 -0
  99. data/schemas/15.1.4/container-scanning-report-format.json +1123 -0
  100. data/schemas/15.1.4/coverage-fuzzing-report-format.json +1100 -0
  101. data/schemas/15.1.4/dast-report-format.json +1505 -0
  102. data/schemas/15.1.4/dependency-scanning-report-format.json +1111 -0
  103. data/schemas/15.1.4/sast-report-format.json +1095 -0
  104. data/schemas/15.1.4/secret-detection-report-format.json +1119 -0
  105. data/supported_versions +12 -0
  106. metadata +112 -12
@@ -0,0 +1,1033 @@
1
+ {
2
+ "$schema": "http://json-schema.org/draft-07/schema#",
3
+ "$id": "https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/raw/master/dist/dependency-scanning-report-format.json",
4
+ "title": "Report format for GitLab Dependency Scanning",
5
+ "description": "This schema provides the the report format for Dependency Scanning analyzers (https://docs.gitlab.com/ee/user/application_security/dependency_scanning).",
6
+ "definitions": {
7
+ "detail_type": {
8
+ "oneOf": [
9
+ {
10
+ "$ref": "#/definitions/named_list"
11
+ },
12
+ {
13
+ "$ref": "#/definitions/list"
14
+ },
15
+ {
16
+ "$ref": "#/definitions/table"
17
+ },
18
+ {
19
+ "$ref": "#/definitions/text"
20
+ },
21
+ {
22
+ "$ref": "#/definitions/url"
23
+ },
24
+ {
25
+ "$ref": "#/definitions/code"
26
+ },
27
+ {
28
+ "$ref": "#/definitions/value"
29
+ },
30
+ {
31
+ "$ref": "#/definitions/diff"
32
+ },
33
+ {
34
+ "$ref": "#/definitions/markdown"
35
+ },
36
+ {
37
+ "$ref": "#/definitions/commit"
38
+ },
39
+ {
40
+ "$ref": "#/definitions/file_location"
41
+ },
42
+ {
43
+ "$ref": "#/definitions/module_location"
44
+ }
45
+ ]
46
+ },
47
+ "text_value": {
48
+ "type": "string"
49
+ },
50
+ "named_field": {
51
+ "type": "object",
52
+ "required": [
53
+ "name"
54
+ ],
55
+ "properties": {
56
+ "name": {
57
+ "$ref": "#/definitions/text_value",
58
+ "type": "string",
59
+ "minLength": 1
60
+ },
61
+ "description": {
62
+ "$ref": "#/definitions/text_value"
63
+ }
64
+ }
65
+ },
66
+ "named_list": {
67
+ "type": "object",
68
+ "description": "An object with named and typed fields",
69
+ "required": [
70
+ "type",
71
+ "items"
72
+ ],
73
+ "properties": {
74
+ "type": {
75
+ "const": "named-list"
76
+ },
77
+ "items": {
78
+ "type": "object",
79
+ "patternProperties": {
80
+ "^.*$": {
81
+ "allOf": [
82
+ {
83
+ "$ref": "#/definitions/named_field"
84
+ },
85
+ {
86
+ "$ref": "#/definitions/detail_type"
87
+ }
88
+ ]
89
+ }
90
+ }
91
+ }
92
+ }
93
+ },
94
+ "list": {
95
+ "type": "object",
96
+ "description": "A list of typed fields",
97
+ "required": [
98
+ "type",
99
+ "items"
100
+ ],
101
+ "properties": {
102
+ "type": {
103
+ "const": "list"
104
+ },
105
+ "items": {
106
+ "type": "array",
107
+ "items": {
108
+ "$ref": "#/definitions/detail_type"
109
+ }
110
+ }
111
+ }
112
+ },
113
+ "table": {
114
+ "type": "object",
115
+ "description": "A table of typed fields",
116
+ "required": [
117
+ "type",
118
+ "rows"
119
+ ],
120
+ "properties": {
121
+ "type": {
122
+ "const": "table"
123
+ },
124
+ "header": {
125
+ "type": "array",
126
+ "items": {
127
+ "$ref": "#/definitions/detail_type"
128
+ }
129
+ },
130
+ "rows": {
131
+ "type": "array",
132
+ "items": {
133
+ "type": "array",
134
+ "items": {
135
+ "$ref": "#/definitions/detail_type"
136
+ }
137
+ }
138
+ }
139
+ }
140
+ },
141
+ "text": {
142
+ "type": "object",
143
+ "description": "Raw text",
144
+ "required": [
145
+ "type",
146
+ "value"
147
+ ],
148
+ "properties": {
149
+ "type": {
150
+ "const": "text"
151
+ },
152
+ "value": {
153
+ "$ref": "#/definitions/text_value"
154
+ }
155
+ }
156
+ },
157
+ "url": {
158
+ "type": "object",
159
+ "description": "A single URL",
160
+ "required": [
161
+ "type",
162
+ "href"
163
+ ],
164
+ "properties": {
165
+ "type": {
166
+ "const": "url"
167
+ },
168
+ "text": {
169
+ "$ref": "#/definitions/text_value"
170
+ },
171
+ "href": {
172
+ "type": "string",
173
+ "minLength": 1,
174
+ "examples": [
175
+ "http://mysite.com"
176
+ ]
177
+ }
178
+ }
179
+ },
180
+ "code": {
181
+ "type": "object",
182
+ "description": "A codeblock",
183
+ "required": [
184
+ "type",
185
+ "value"
186
+ ],
187
+ "properties": {
188
+ "type": {
189
+ "const": "code"
190
+ },
191
+ "value": {
192
+ "type": "string"
193
+ },
194
+ "lang": {
195
+ "type": "string",
196
+ "description": "A programming language"
197
+ }
198
+ }
199
+ },
200
+ "value": {
201
+ "type": "object",
202
+ "description": "A field that can store a range of types of value",
203
+ "required": [
204
+ "type",
205
+ "value"
206
+ ],
207
+ "properties": {
208
+ "type": {
209
+ "const": "value"
210
+ },
211
+ "value": {
212
+ "type": [
213
+ "number",
214
+ "string",
215
+ "boolean"
216
+ ]
217
+ }
218
+ }
219
+ },
220
+ "diff": {
221
+ "type": "object",
222
+ "description": "A diff",
223
+ "required": [
224
+ "type",
225
+ "before",
226
+ "after"
227
+ ],
228
+ "properties": {
229
+ "type": {
230
+ "const": "diff"
231
+ },
232
+ "before": {
233
+ "type": "string"
234
+ },
235
+ "after": {
236
+ "type": "string"
237
+ }
238
+ }
239
+ },
240
+ "markdown": {
241
+ "type": "object",
242
+ "description": "GitLab flavoured markdown, see https://docs.gitlab.com/ee/user/markdown.html",
243
+ "required": [
244
+ "type",
245
+ "value"
246
+ ],
247
+ "properties": {
248
+ "type": {
249
+ "const": "markdown"
250
+ },
251
+ "value": {
252
+ "$ref": "#/definitions/text_value",
253
+ "examples": [
254
+ "Here is markdown `inline code` #1 [test](gitlab.com)\n\n![GitLab Logo](https://about.gitlab.com/images/press/logo/preview/gitlab-logo-white-preview.png)"
255
+ ]
256
+ }
257
+ }
258
+ },
259
+ "commit": {
260
+ "type": "object",
261
+ "description": "A commit/tag/branch within the GitLab project",
262
+ "required": [
263
+ "type",
264
+ "value"
265
+ ],
266
+ "properties": {
267
+ "type": {
268
+ "const": "commit"
269
+ },
270
+ "value": {
271
+ "type": "string",
272
+ "description": "The commit SHA",
273
+ "minLength": 1
274
+ }
275
+ }
276
+ },
277
+ "file_location": {
278
+ "type": "object",
279
+ "description": "A location within a file in the project",
280
+ "required": [
281
+ "type",
282
+ "file_name",
283
+ "line_start"
284
+ ],
285
+ "properties": {
286
+ "type": {
287
+ "const": "file-location"
288
+ },
289
+ "file_name": {
290
+ "type": "string",
291
+ "minLength": 1
292
+ },
293
+ "line_start": {
294
+ "type": "integer"
295
+ },
296
+ "line_end": {
297
+ "type": "integer"
298
+ }
299
+ }
300
+ },
301
+ "module_location": {
302
+ "type": "object",
303
+ "description": "A location within a binary module of the form module+relative_offset",
304
+ "required": [
305
+ "type",
306
+ "module_name",
307
+ "offset"
308
+ ],
309
+ "properties": {
310
+ "type": {
311
+ "const": "module-location"
312
+ },
313
+ "module_name": {
314
+ "type": "string",
315
+ "minLength": 1,
316
+ "examples": [
317
+ "compiled_binary"
318
+ ]
319
+ },
320
+ "offset": {
321
+ "type": "integer",
322
+ "examples": [
323
+ 100
324
+ ]
325
+ }
326
+ }
327
+ }
328
+ },
329
+ "self": {
330
+ "version": "15.0.6"
331
+ },
332
+ "type": "object",
333
+ "required": [
334
+ "dependency_files",
335
+ "scan",
336
+ "version",
337
+ "vulnerabilities"
338
+ ],
339
+ "additionalProperties": true,
340
+ "properties": {
341
+ "scan": {
342
+ "type": "object",
343
+ "required": [
344
+ "analyzer",
345
+ "end_time",
346
+ "scanner",
347
+ "start_time",
348
+ "status",
349
+ "type"
350
+ ],
351
+ "properties": {
352
+ "end_time": {
353
+ "type": "string",
354
+ "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan finished.",
355
+ "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}$",
356
+ "examples": [
357
+ "2020-01-28T03:26:02"
358
+ ]
359
+ },
360
+ "messages": {
361
+ "type": "array",
362
+ "items": {
363
+ "type": "object",
364
+ "description": "Communication intended for the initiator of a scan.",
365
+ "required": [
366
+ "level",
367
+ "value"
368
+ ],
369
+ "properties": {
370
+ "level": {
371
+ "type": "string",
372
+ "description": "Describes the severity of the communication. Use info to communicate normal scan behaviour; warn to communicate a potentially recoverable problem, or a partial error; fatal to communicate an issue that causes the scan to halt.",
373
+ "enum": [
374
+ "info",
375
+ "warn",
376
+ "fatal"
377
+ ],
378
+ "examples": [
379
+ "info"
380
+ ]
381
+ },
382
+ "value": {
383
+ "type": "string",
384
+ "description": "The message to communicate.",
385
+ "minLength": 1,
386
+ "examples": [
387
+ "Permission denied, scanning aborted"
388
+ ]
389
+ }
390
+ }
391
+ }
392
+ },
393
+ "options": {
394
+ "type": "array",
395
+ "items": {
396
+ "type": "object",
397
+ "description": "A configuration option used for this scan.",
398
+ "required": [
399
+ "name",
400
+ "value"
401
+ ],
402
+ "properties": {
403
+ "name": {
404
+ "type": "string",
405
+ "description": "The configuration option name.",
406
+ "maxLength": 255,
407
+ "minLength": 1,
408
+ "examples": [
409
+ "DAST_FF_ENABLE_BAS",
410
+ "DOCKER_TLS_CERTDIR",
411
+ "DS_MAX_DEPTH",
412
+ "SECURE_LOG_LEVEL"
413
+ ]
414
+ },
415
+ "source": {
416
+ "type": "string",
417
+ "description": "The source of this option.",
418
+ "enum": [
419
+ "argument",
420
+ "file",
421
+ "env_variable",
422
+ "other"
423
+ ]
424
+ },
425
+ "value": {
426
+ "type": [
427
+ "boolean",
428
+ "integer",
429
+ "null",
430
+ "string"
431
+ ],
432
+ "description": "The value used for this scan.",
433
+ "examples": [
434
+ true,
435
+ 2,
436
+ null,
437
+ "fatal",
438
+ ""
439
+ ]
440
+ }
441
+ }
442
+ }
443
+ },
444
+ "analyzer": {
445
+ "type": "object",
446
+ "description": "Object defining the analyzer used to perform the scan. Analyzers typically delegate to an underlying scanner to run the scan.",
447
+ "required": [
448
+ "id",
449
+ "name",
450
+ "version",
451
+ "vendor"
452
+ ],
453
+ "properties": {
454
+ "id": {
455
+ "type": "string",
456
+ "description": "Unique id that identifies the analyzer.",
457
+ "minLength": 1,
458
+ "examples": [
459
+ "gitlab-dast"
460
+ ]
461
+ },
462
+ "name": {
463
+ "type": "string",
464
+ "description": "A human readable value that identifies the analyzer, not required to be unique.",
465
+ "minLength": 1,
466
+ "examples": [
467
+ "GitLab DAST"
468
+ ]
469
+ },
470
+ "url": {
471
+ "type": "string",
472
+ "pattern": "^https?://.+",
473
+ "description": "A link to more information about the analyzer.",
474
+ "examples": [
475
+ "https://docs.gitlab.com/ee/user/application_security/dast"
476
+ ]
477
+ },
478
+ "vendor": {
479
+ "description": "The vendor/maintainer of the analyzer.",
480
+ "type": "object",
481
+ "required": [
482
+ "name"
483
+ ],
484
+ "properties": {
485
+ "name": {
486
+ "type": "string",
487
+ "description": "The name of the vendor.",
488
+ "minLength": 1,
489
+ "examples": [
490
+ "GitLab"
491
+ ]
492
+ }
493
+ }
494
+ },
495
+ "version": {
496
+ "type": "string",
497
+ "description": "The version of the analyzer.",
498
+ "minLength": 1,
499
+ "examples": [
500
+ "1.0.2"
501
+ ]
502
+ }
503
+ }
504
+ },
505
+ "scanner": {
506
+ "type": "object",
507
+ "description": "Object defining the scanner used to perform the scan.",
508
+ "required": [
509
+ "id",
510
+ "name",
511
+ "version",
512
+ "vendor"
513
+ ],
514
+ "properties": {
515
+ "id": {
516
+ "type": "string",
517
+ "description": "Unique id that identifies the scanner.",
518
+ "minLength": 1,
519
+ "examples": [
520
+ "my-sast-scanner"
521
+ ]
522
+ },
523
+ "name": {
524
+ "type": "string",
525
+ "description": "A human readable value that identifies the scanner, not required to be unique.",
526
+ "minLength": 1,
527
+ "examples": [
528
+ "My SAST Scanner"
529
+ ]
530
+ },
531
+ "url": {
532
+ "type": "string",
533
+ "description": "A link to more information about the scanner.",
534
+ "examples": [
535
+ "https://scanner.url"
536
+ ]
537
+ },
538
+ "version": {
539
+ "type": "string",
540
+ "description": "The version of the scanner.",
541
+ "minLength": 1,
542
+ "examples": [
543
+ "1.0.2"
544
+ ]
545
+ },
546
+ "vendor": {
547
+ "description": "The vendor/maintainer of the scanner.",
548
+ "type": "object",
549
+ "required": [
550
+ "name"
551
+ ],
552
+ "properties": {
553
+ "name": {
554
+ "type": "string",
555
+ "description": "The name of the vendor.",
556
+ "minLength": 1,
557
+ "examples": [
558
+ "GitLab"
559
+ ]
560
+ }
561
+ }
562
+ }
563
+ }
564
+ },
565
+ "start_time": {
566
+ "type": "string",
567
+ "description": "ISO8601 UTC value with format yyyy-mm-ddThh:mm:ss, representing when the scan started.",
568
+ "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}$",
569
+ "examples": [
570
+ "2020-02-14T16:01:59"
571
+ ]
572
+ },
573
+ "status": {
574
+ "type": "string",
575
+ "description": "Result of the scan.",
576
+ "enum": [
577
+ "success",
578
+ "failure"
579
+ ]
580
+ },
581
+ "type": {
582
+ "type": "string",
583
+ "description": "Type of the scan.",
584
+ "enum": [
585
+ "dependency_scanning"
586
+ ]
587
+ },
588
+ "primary_identifiers": {
589
+ "type": "array",
590
+ "description": "An unordered array containing an exhaustive list of primary identifiers for which the analyzer may return results",
591
+ "items": {
592
+ "type": "object",
593
+ "required": [
594
+ "type",
595
+ "name",
596
+ "value"
597
+ ],
598
+ "properties": {
599
+ "type": {
600
+ "type": "string",
601
+ "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
602
+ "minLength": 1
603
+ },
604
+ "name": {
605
+ "type": "string",
606
+ "description": "Human-readable name of the identifier.",
607
+ "minLength": 1
608
+ },
609
+ "url": {
610
+ "type": "string",
611
+ "description": "URL of the identifier's documentation.",
612
+ "pattern": "^(https?|ftp)://.+"
613
+ },
614
+ "value": {
615
+ "type": "string",
616
+ "description": "Value of the identifier, for matching purpose.",
617
+ "minLength": 1
618
+ }
619
+ }
620
+ }
621
+ }
622
+ }
623
+ },
624
+ "schema": {
625
+ "type": "string",
626
+ "description": "URI pointing to the validating security report schema.",
627
+ "pattern": "^https?://.+"
628
+ },
629
+ "version": {
630
+ "type": "string",
631
+ "description": "The version of the schema to which the JSON report conforms.",
632
+ "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
633
+ },
634
+ "vulnerabilities": {
635
+ "type": "array",
636
+ "description": "Array of vulnerability objects.",
637
+ "items": {
638
+ "type": "object",
639
+ "description": "Describes the vulnerability using GitLab Flavored Markdown",
640
+ "required": [
641
+ "id",
642
+ "identifiers",
643
+ "location"
644
+ ],
645
+ "properties": {
646
+ "id": {
647
+ "type": "string",
648
+ "minLength": 1,
649
+ "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
650
+ "examples": [
651
+ "642735a5-1425-428d-8d4e-3c854885a3c9"
652
+ ]
653
+ },
654
+ "name": {
655
+ "type": "string",
656
+ "maxLength": 255,
657
+ "description": "The name of the vulnerability. This must not include the finding's specific information."
658
+ },
659
+ "description": {
660
+ "type": "string",
661
+ "maxLength": 1048576,
662
+ "description": "A long text section describing the vulnerability more fully."
663
+ },
664
+ "severity": {
665
+ "type": "string",
666
+ "description": "How much the vulnerability impacts the software. Possible values are Info, Unknown, Low, Medium, High, or Critical. Note that some analyzers may not report all these possible values.",
667
+ "enum": [
668
+ "Info",
669
+ "Unknown",
670
+ "Low",
671
+ "Medium",
672
+ "High",
673
+ "Critical"
674
+ ]
675
+ },
676
+ "solution": {
677
+ "type": "string",
678
+ "maxLength": 7000,
679
+ "description": "Explanation of how to fix the vulnerability."
680
+ },
681
+ "identifiers": {
682
+ "type": "array",
683
+ "minItems": 1,
684
+ "description": "An ordered array of references that identify a vulnerability on internal or external databases. The first identifier is the Primary Identifier, which has special meaning.",
685
+ "items": {
686
+ "type": "object",
687
+ "required": [
688
+ "type",
689
+ "name",
690
+ "value"
691
+ ],
692
+ "properties": {
693
+ "type": {
694
+ "type": "string",
695
+ "description": "for example, cve, cwe, osvdb, usn, or an analyzer-dependent type such as gemnasium).",
696
+ "minLength": 1
697
+ },
698
+ "name": {
699
+ "type": "string",
700
+ "description": "Human-readable name of the identifier.",
701
+ "minLength": 1
702
+ },
703
+ "url": {
704
+ "type": "string",
705
+ "description": "URL of the identifier's documentation.",
706
+ "pattern": "^(https?|ftp)://.+"
707
+ },
708
+ "value": {
709
+ "type": "string",
710
+ "description": "Value of the identifier, for matching purpose.",
711
+ "minLength": 1
712
+ }
713
+ }
714
+ }
715
+ },
716
+ "links": {
717
+ "type": "array",
718
+ "description": "An array of references to external documentation or articles that describe the vulnerability.",
719
+ "items": {
720
+ "type": "object",
721
+ "required": [
722
+ "url"
723
+ ],
724
+ "properties": {
725
+ "name": {
726
+ "type": "string",
727
+ "description": "Name of the vulnerability details link."
728
+ },
729
+ "url": {
730
+ "type": "string",
731
+ "description": "URL of the vulnerability details document.",
732
+ "pattern": "^(https?|ftp)://.+"
733
+ }
734
+ }
735
+ }
736
+ },
737
+ "details": {
738
+ "$ref": "#/definitions/named_list/properties/items"
739
+ },
740
+ "tracking": {
741
+ "type": "object",
742
+ "description": "Describes how this vulnerability should be tracked as the project changes.",
743
+ "oneOf": [
744
+ {
745
+ "description": "Declares that a series of items should be tracked using source-specific tracking methods.",
746
+ "required": [
747
+ "items"
748
+ ],
749
+ "properties": {
750
+ "type": {
751
+ "const": "source"
752
+ },
753
+ "items": {
754
+ "type": "array",
755
+ "items": {
756
+ "description": "An item that should be tracked using source-specific tracking methods.",
757
+ "type": "object",
758
+ "required": [
759
+ "signatures"
760
+ ],
761
+ "properties": {
762
+ "file": {
763
+ "type": "string",
764
+ "description": "Path to the file where the vulnerability is located."
765
+ },
766
+ "start_line": {
767
+ "type": "number",
768
+ "description": "The first line of the file that includes the vulnerability."
769
+ },
770
+ "end_line": {
771
+ "type": "number",
772
+ "description": "The last line of the file that includes the vulnerability."
773
+ },
774
+ "signatures": {
775
+ "type": "array",
776
+ "description": "An array of calculated tracking signatures for this tracking item.",
777
+ "minItems": 1,
778
+ "items": {
779
+ "description": "A calculated tracking signature value and metadata.",
780
+ "type": "object",
781
+ "required": [
782
+ "algorithm",
783
+ "value"
784
+ ],
785
+ "properties": {
786
+ "algorithm": {
787
+ "type": "string",
788
+ "description": "The algorithm used to generate the signature."
789
+ },
790
+ "value": {
791
+ "type": "string",
792
+ "description": "The result of this signature algorithm."
793
+ }
794
+ }
795
+ }
796
+ }
797
+ }
798
+ }
799
+ }
800
+ }
801
+ }
802
+ ],
803
+ "properties": {
804
+ "type": {
805
+ "type": "string",
806
+ "description": "Each tracking type must declare its own type."
807
+ }
808
+ }
809
+ },
810
+ "flags": {
811
+ "description": "Flags that can be attached to vulnerabilities.",
812
+ "type": "array",
813
+ "items": {
814
+ "type": "object",
815
+ "description": "Informational flags identified and assigned to a vulnerability.",
816
+ "required": [
817
+ "type",
818
+ "origin",
819
+ "description"
820
+ ],
821
+ "properties": {
822
+ "type": {
823
+ "type": "string",
824
+ "minLength": 1,
825
+ "description": "Result of the scan.",
826
+ "enum": [
827
+ "flagged-as-likely-false-positive"
828
+ ]
829
+ },
830
+ "origin": {
831
+ "minLength": 1,
832
+ "description": "Tool that issued the flag.",
833
+ "type": "string"
834
+ },
835
+ "description": {
836
+ "minLength": 1,
837
+ "description": "What the flag is about.",
838
+ "type": "string"
839
+ }
840
+ }
841
+ }
842
+ },
843
+ "location": {
844
+ "type": "object",
845
+ "description": "Identifies the vulnerability's location.",
846
+ "required": [
847
+ "file",
848
+ "dependency"
849
+ ],
850
+ "properties": {
851
+ "file": {
852
+ "type": "string",
853
+ "minLength": 1,
854
+ "description": "Path to the manifest or lock file where the dependency is declared (such as yarn.lock)."
855
+ },
856
+ "dependency": {
857
+ "type": "object",
858
+ "description": "Describes the dependency of a project where the vulnerability is located.",
859
+ "required": [
860
+ "package",
861
+ "version"
862
+ ],
863
+ "properties": {
864
+ "package": {
865
+ "type": "object",
866
+ "description": "Provides information on the package where the vulnerability is located.",
867
+ "required": [
868
+ "name"
869
+ ],
870
+ "properties": {
871
+ "name": {
872
+ "type": "string",
873
+ "description": "Name of the package where the vulnerability is located."
874
+ }
875
+ }
876
+ },
877
+ "version": {
878
+ "type": "string",
879
+ "description": "Version of the vulnerable package."
880
+ },
881
+ "iid": {
882
+ "description": "ID that identifies the dependency in the scope of a dependency file.",
883
+ "type": "number"
884
+ },
885
+ "direct": {
886
+ "type": "boolean",
887
+ "description": "Tells whether this is a direct, top-level dependency of the scanned project."
888
+ },
889
+ "dependency_path": {
890
+ "type": "array",
891
+ "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
892
+ "items": {
893
+ "type": "object",
894
+ "required": [
895
+ "iid"
896
+ ],
897
+ "properties": {
898
+ "iid": {
899
+ "type": "number",
900
+ "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
901
+ }
902
+ }
903
+ }
904
+ }
905
+ }
906
+ }
907
+ }
908
+ }
909
+ }
910
+ }
911
+ },
912
+ "remediations": {
913
+ "type": "array",
914
+ "description": "An array of objects containing information on available remediations, along with patch diffs to apply.",
915
+ "items": {
916
+ "type": "object",
917
+ "required": [
918
+ "fixes",
919
+ "summary",
920
+ "diff"
921
+ ],
922
+ "properties": {
923
+ "fixes": {
924
+ "type": "array",
925
+ "description": "An array of strings that represent references to vulnerabilities fixed by this remediation.",
926
+ "items": {
927
+ "type": "object",
928
+ "required": [
929
+ "id"
930
+ ],
931
+ "properties": {
932
+ "id": {
933
+ "type": "string",
934
+ "minLength": 1,
935
+ "description": "Unique identifier of the vulnerability. This is recommended to be a UUID.",
936
+ "examples": [
937
+ "642735a5-1425-428d-8d4e-3c854885a3c9"
938
+ ]
939
+ }
940
+ }
941
+ }
942
+ },
943
+ "summary": {
944
+ "type": "string",
945
+ "minLength": 1,
946
+ "description": "An overview of how the vulnerabilities were fixed."
947
+ },
948
+ "diff": {
949
+ "type": "string",
950
+ "minLength": 1,
951
+ "description": "A base64-encoded remediation code diff, compatible with git apply."
952
+ }
953
+ }
954
+ }
955
+ },
956
+ "dependency_files": {
957
+ "type": "array",
958
+ "description": "List of dependency files identified in the project.",
959
+ "items": {
960
+ "type": "object",
961
+ "required": [
962
+ "path",
963
+ "package_manager",
964
+ "dependencies"
965
+ ],
966
+ "properties": {
967
+ "path": {
968
+ "type": "string",
969
+ "minLength": 1
970
+ },
971
+ "package_manager": {
972
+ "type": "string",
973
+ "minLength": 1
974
+ },
975
+ "dependencies": {
976
+ "type": "array",
977
+ "items": {
978
+ "type": "object",
979
+ "description": "Describes the dependency of a project where the vulnerability is located.",
980
+ "required": [
981
+ "package",
982
+ "version"
983
+ ],
984
+ "properties": {
985
+ "package": {
986
+ "type": "object",
987
+ "description": "Provides information on the package where the vulnerability is located.",
988
+ "required": [
989
+ "name"
990
+ ],
991
+ "properties": {
992
+ "name": {
993
+ "type": "string",
994
+ "description": "Name of the package where the vulnerability is located."
995
+ }
996
+ }
997
+ },
998
+ "version": {
999
+ "type": "string",
1000
+ "description": "Version of the vulnerable package."
1001
+ },
1002
+ "iid": {
1003
+ "description": "ID that identifies the dependency in the scope of a dependency file.",
1004
+ "type": "number"
1005
+ },
1006
+ "direct": {
1007
+ "type": "boolean",
1008
+ "description": "Tells whether this is a direct, top-level dependency of the scanned project."
1009
+ },
1010
+ "dependency_path": {
1011
+ "type": "array",
1012
+ "description": "Ancestors of the dependency, starting from a direct project dependency, and ending with an immediate parent of the dependency. The dependency itself is excluded from the path. Direct dependencies have no path.",
1013
+ "items": {
1014
+ "type": "object",
1015
+ "required": [
1016
+ "iid"
1017
+ ],
1018
+ "properties": {
1019
+ "iid": {
1020
+ "type": "number",
1021
+ "description": "ID that is unique in the scope of a parent object, and specific to the resource type."
1022
+ }
1023
+ }
1024
+ }
1025
+ }
1026
+ }
1027
+ }
1028
+ }
1029
+ }
1030
+ }
1031
+ }
1032
+ }
1033
+ }