Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve clarity of "Public At" input field to prevent accidental publishing d/t "scheduling" assumption #163

Closed
openmorse opened this issue Nov 29, 2023 · 1 comment
Assignees

Comments

@openmorse
Copy link

The CVE schema field "datePublic" is intended to record the date (if known) that the vulnerability may have become public in the past, not in the future:

"datePublic": { "$ref": "#/definitions/timestamp", "description": "If known, the date/time the vulnerability was disclosed publicly." },

There is no mechanism in CVE Services to "schedule" a record for future publication. Some users have misunderstood this and published their records early by accident after setting a future date in Vulnogram's "Public At" input field:

vulnogram-public-at-field

Suggest either renaming the GUI input field or adding a note or otherwise making it more clear that it does not provide scheduling of record publishing.

@ElectricNroff
Copy link
Collaborator

Setting a future date in Vulnogram's "Public At" input field will no longer publish the CVE Record because of this CVE Services change: CVEProject/cve-services#1097 from https://github.com/CVEProject/cve-services/projects/59

The current behavior of Vulnogram, with the CVE Services test instance, is that the future date leads to this error window:

BAD_INPUT

Parameters were invalid
body/ cnaContainer.datePublic: datePublic cannot be a future date

and the CVE Record is not published. The error message will be similar for any client because the CVE Services server refuses the API call:

HTTP/1.1 400 Bad Request

{"error":"BAD_INPUT","message":"Parameters were invalid","details":[{"msg":"datePublic cannot be a future date","param":"cnaContainer.datePublic","location":"body"}]}

This server behavior will be moved form the test instance into CVE Services production in early January 2024.

@chandanbn chandanbn self-assigned this Mar 1, 2024
chandanbn added a commit that referenced this issue Mar 7, 2024
add a check for future datePublic.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants