Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

schema/v5.0: introduce computable version ranges #100

Merged
merged 1 commit into from
Aug 27, 2021

Conversation

rsc
Copy link
Contributor

@rsc rsc commented Aug 23, 2021

The shorthand version of this schema is:

defaultStatus: $status
versions: [{
    version: $version
    status: $status  // unknown, affected, unaffected

    versionType: string (‘semver’, ‘git’, ..., to define meaning of <)
    repo: string (optional, intended for versionType ‘git’)
    lessThan/lessThanOrEqual: $version (can use * for “infinity” aka "maxuint")
    changes: [{
        at: version where status changes
        status: ...
    }]
}]

An object in the versions list can be either:

  • a simple {version: V, status: S},
    which indicates the status of the single version V.
  • a range {version: V, versionType: T, lessThan: L OR lessThanOrEqual: LE, status: S, changes: C},
    which indicates the status of the half-open interval [V, L) or closed interval [V, LE].
    The range starts with V having status S and then changes over time according to the events listed in C.

The algorithm for deciding the status of a particular version V is then:

for entry in product.versions {
    if entry.lessThan is not present and entry.lessThanOrEqual is not present and v == entry.version {
        return entry.status
    }
    if (entry.lessThan is present and entry.version <= v and v < entry.lessThan) or
       (entry.lessThanOrEqual is present and entry.version <= v and v <= entry.lessThanOrEqual) {
        status = entry.status
        for change in entry.changes {
            if change.at <= v {
                status = change.status
            }
        }
        return status
    }
}
return product.defaultStatus

Fixes #87.
Fixes #12.
Fixes #77.

@rsc
Copy link
Contributor Author

rsc commented Aug 23, 2021

I've posted this as supporting material for my latest draft schema in #87 (comment). Discussion is probably better there than on this PR.

@rsc rsc force-pushed the computable-versions branch from 9959205 to 7aa7ad2 Compare August 23, 2021 15:29
schema/v5.0/CVE_JSON_5.0.schema Outdated Show resolved Hide resolved
schema/v5.0/CVE_JSON_5.0.schema Outdated Show resolved Hide resolved
schema/v5.0/CVE_JSON_5.0.schema Outdated Show resolved Hide resolved
schema/v5.0/CVE_JSON_5.0.schema Outdated Show resolved Hide resolved
@rsc rsc force-pushed the computable-versions branch from 7aa7ad2 to 34e14be Compare August 23, 2021 18:41
@rsc
Copy link
Contributor Author

rsc commented Aug 23, 2021

Made suggested changes. Not sure whether the other two additionalProperties: false should be kept or deleted.

@chandanbn
Copy link
Collaborator

I suggest deleting the other two additionalProperties: false as well.

@rsc rsc force-pushed the computable-versions branch 2 times, most recently from 19d2c94 to 83dfecd Compare August 24, 2021 16:50
@rsc
Copy link
Contributor Author

rsc commented Aug 24, 2021

Pushed a new commit that deletes the other two additionalProperties: false and also fixes an inverted comparison in the algorithm, pointed out by Oliver.

@rsc
Copy link
Contributor Author

rsc commented Aug 24, 2021

Based on Tuesday meeting discussion, pushed a new version and updated the comment at the top of this PR.
Will summarize the changes on #87.

@rsc rsc force-pushed the computable-versions branch 2 times, most recently from c43ca8d to ca1c1a6 Compare August 26, 2021 19:59
@rsc
Copy link
Contributor Author

rsc commented Aug 26, 2021

Updated as requested. Also defined that default defaultStatus is unknown. And fixed bug where "limit" was still defined as the field instead of "lessThan" and "lessThanOrEqual", despite mentioning the new names everywhere else.

@rsc rsc force-pushed the computable-versions branch from ca1c1a6 to 1c10f5d Compare August 26, 2021 20:45
@rsc
Copy link
Contributor Author

rsc commented Aug 26, 2021

Changed to allow either defaultStatus or versions to be omitted, but not both.

The shorthand version of this schema is:

	defaultStatus: $status  (default 'unknown')
	versions: [{
	    version: $version
	    status: $status  // unknown, affected, unaffected

	    versionType: string (‘semver’, ‘git’, ..., to define meaning of <)
	    repo: string (optional, intended for versionType ‘git’)
	    lessThan/lessThanOrEqual: $version (can use * for “infinity” aka "maxuint")
	    changes: [{
	        at: version where status changes
	        status: ...
	    }]
	}]

An object in the versions list can be either:

 - a simple {version: V, status: S},
   which indicates the status of the single version V.
 - a range {version: V, versionType: T, lessThan: L OR lessThanOrEqual: LE, status: S, changes: C},
   which indicates the status of the half-open interval [V, L) or closed interval [V, LE].
   The range starts with V having status S and then changes over time according to the events listed in C.

The algorithm for deciding the status of a particular version V is then:

	for entry in product.versions {
	    if entry.lessThan is not present and entry.lessThanOrEqual is not present and v == entry.version {
	        return entry.status
	    }
	    if (entry.lessThan is present and entry.version <= v and v < entry.lessThan) or
	       (entry.lessThanOrEqual is present and entry.version <= v and v <= entry.lessThanOrEqual) {
	        status = entry.status
	        for change in entry.changes {
	            if change.at <= v {
	                status = change.status
	            }
	        }
	        return status
	    }
	}
	return product.defaultStatus

Versions or defaultStatus may be omitted, but not both,

Fixes CVEProject#87.
Fixes CVEProject#12.
Fixes CVEProject#77.
@rsc rsc force-pushed the computable-versions branch from 1c10f5d to e3d43c6 Compare August 26, 2021 20:49
@rsc
Copy link
Contributor Author

rsc commented Aug 26, 2021

Also updated to mention version 0 as the earliest possible start of a range.

@chandanbn chandanbn merged commit 16cb1e9 into CVEProject:master Aug 27, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
4 participants