CVE Validation Library - providerMetadata

[ccoffin]

Purpose:

This will be one of multiple discussions to query the QWG and others on how best to use the upcoming CVE Services Validation Library for performing additional or more accurate CVE Record Format JSON schema validation during record ingest. The Validation Library will allow the CVE Program to perform programmatic validations beyond what the current JSON schema validation can provide. A simple example might be where we want to validate that a provided CWE ID actually exists by referencing the current CWE List. This is not possible using JSON schema validation, but would be possible with the Validation Library.

Discussion:

The providerMetadata is a required object within the current CVE Record Format JSON schema. The providerMetadata has three properties: orgId, shortName, and dateUpdated. Only the orgId is required during CNA submission of a CVE Record, shortName and dateUpdated are optional. The current CVE Services implementation will overwrite all of these properties upon submission using the correct values based on the CNA that is submitting the CVE Record/CNA container. Even though these properties are overwritten, we may still want to define the validation for viewing/output purposes.

Schema Location(s):

https://github.com/CVEProject/cve-schema/blob/main/schema/CVE_Record_Format.json#L505

Question(s):

• Can we use the Validation Library to improve the quality and accuracy of the data provided by CNAs within the providerMetadata object?
• Can the proposed validation be implemented using only the Validation library, or could it also be accomplished using the JSON schema?
• Should the validation focus only on the ingest of the object and properties, or should we also consider viewing/output?

Examples:

• Fail validation when the orgId property does does not use the correct uuid syntax. (Schema and Validation Library)
• Fail validation when the orgId property value references a non-existing organization. (Validation Library only)
• Fail validation when the orgId property value references a different organization than the one submitting the CVE record. (Validation Library only)
• When it exists, fail validation when the shortName property value references a non-existing organization. (Validation Library only)
• When it exists, fail validation when the shortName property does not contain at least one character. (Schema and Validation Library)
• When it exists, fail validation when the dateUpdated property does not use the correct timestamp syntax. (Schema and Validation Library)

[darakian]

From the QWG call today; if we want to validate on the timestamp field we should formalize the appropriate timestamp format. There's an RFD for that here #475