Repository: CycloneDX/cyclonedx-core-java
Pull request #208 (2022-06-09 01:13:46)

fix: add missing Vulnerability.properties types in schema 1.4
https://github.com/CycloneDX/cyclonedx-core-java/blob/6ed3a6894d68cf3a160d0d47e6ba042228837e89/src/test/resources/README.txt#L4-L5

Mirrors https://github.com/CycloneDX/specification/pull/148

Related: https://github.com/CycloneDX/specification/issues/147


Patch:
diff --git a/src/main/java/org/cyclonedx/model/vulnerability/Vulnerability.java b/src/main/java/org/cyclonedx/model/vulnerability/Vulnerability.java
index 548870cbb..2dfe9b7f6 100644
--- a/src/main/java/org/cyclonedx/model/vulnerability/Vulnerability.java
+++ b/src/main/java/org/cyclonedx/model/vulnerability/Vulnerability.java
@@ -254,6 +254,8 @@ public class Vulnerability
     this.affects = affects;
   }
 
+  @JacksonXmlElementWrapper(localName = "properties")
+  @JacksonXmlProperty(localName = "property")
   public List<Property> getProperties() {
     return properties;
   }
diff --git a/src/main/resources/bom-1.4.proto b/src/main/resources/bom-1.4.proto
index 35f5453b4..b59479650 100644
--- a/src/main/resources/bom-1.4.proto
+++ b/src/main/resources/bom-1.4.proto
@@ -526,6 +526,8 @@ message Vulnerability {
   optional VulnerabilityAnalysis analysis = 16;
   // affects
   repeated VulnerabilityAffects affects = 17;
+  // Specifies optional, custom, properties
+  repeated Property properties = 18;
 }
 
 message VulnerabilityReference {
diff --git a/src/main/resources/bom-1.4.xsd b/src/main/resources/bom-1.4.xsd
index 9b38b1cf5..621c2cfd4 100644
--- a/src/main/resources/bom-1.4.xsd
+++ b/src/main/resources/bom-1.4.xsd
@@ -2014,6 +2014,16 @@ limitations under the License.
                     </xs:sequence>
                 </xs:complexType>
             </xs:element>
+            <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1">
+                <xs:annotation>
+                    <xs:documentation>Provides the ability to document properties in a key/value store.
+                        This provides flexibility to include data not officially supported in the standard
+                        without having to use additional namespaces or create extensions. Property names
+                        of interest to the general public are encouraged to be registered in the
+                        CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy.
+                        Formal registration is OPTIONAL.</xs:documentation>
+                </xs:annotation>
+            </xs:element>
         </xs:sequence>
         <xs:attribute name="bom-ref" type="bom:refType">
             <xs:annotation>


Test patch:
diff --git a/src/test/resources/1.4/valid-vulnerability-1.4.json b/src/test/resources/1.4/valid-vulnerability-1.4.json
index b971cd046..667f5a616 100644
--- a/src/test/resources/1.4/valid-vulnerability-1.4.json
+++ b/src/test/resources/1.4/valid-vulnerability-1.4.json
@@ -116,6 +116,24 @@
             }
           ]
         }
+      ],
+      "properties": [
+        {
+          "name": "Foo",
+          "value": "Bar"
+        },
+        {
+          "name": "Foo",
+          "value": "You"
+        },
+        {
+          "name": "Foo",
+          "value": "Two"
+        },
+        {
+          "name": "Bar",
+          "value": "Foo"
+        }
       ]
     }
   ]
diff --git a/src/test/resources/1.4/valid-vulnerability-1.4.textproto b/src/test/resources/1.4/valid-vulnerability-1.4.textproto
index 6c0d0c66b..3b2305e6a 100644
--- a/src/test/resources/1.4/valid-vulnerability-1.4.textproto
+++ b/src/test/resources/1.4/valid-vulnerability-1.4.textproto
@@ -100,4 +100,20 @@ vulnerabilities {
       status: VULNERABILITY_AFFECTED_STATUS_AFFECTED
     }
   }
+  properties {
+    name: "Foo"
+    value: "Bar"
+  }
+  properties {
+    name: "Foo"
+    value: "You"
+  }
+  properties {
+    name: "Foo"
+    value: "Two"
+  }
+  properties {
+    name: "Bar"
+    value: "Foo"
+  }
 }
diff --git a/src/test/resources/1.4/valid-vulnerability-1.4.xml b/src/test/resources/1.4/valid-vulnerability-1.4.xml
index 131c7bacd..8e21f5522 100644
--- a/src/test/resources/1.4/valid-vulnerability-1.4.xml
+++ b/src/test/resources/1.4/valid-vulnerability-1.4.xml
@@ -116,6 +116,12 @@
                     </versions>
                 </target>
             </affects>
+            <properties>
+                <property name="Foo">Bar</property>
+                <property name="Foo">You</property>
+                <property name="Foo">Two</property>
+                <property name="Bar">Foo</property>
+            </properties>
         </vulnerability>
     </vulnerabilities>
 </bom>
diff --git a/src/test/resources/bom-1.4.json b/src/test/resources/bom-1.4.json
index c3f1b4ad4..af5658ce3 100644
--- a/src/test/resources/bom-1.4.json
+++ b/src/test/resources/bom-1.4.json
@@ -382,6 +382,24 @@
               }
             ]
         }
+      ],
+      "properties": [
+        {
+          "name": "Foo",
+          "value": "Bar"
+        },
+        {
+          "name": "Foo",
+          "value": "You"
+        },
+        {
+          "name": "Foo",
+          "value": "Two"
+        },
+        {
+          "name": "Bar",
+          "value": "Foo"
+        }
       ]
     }
   ]
diff --git a/src/test/resources/bom-1.4.xml b/src/test/resources/bom-1.4.xml
index 2b9fd2c54..25095bef2 100644
--- a/src/test/resources/bom-1.4.xml
+++ b/src/test/resources/bom-1.4.xml
@@ -277,6 +277,12 @@
                     </versions>
                 </target>
             </affects>
+            <properties>
+                <property name="Foo">Bar</property>
+                <property name="Foo">You</property>
+                <property name="Foo">Two</property>
+                <property name="Bar">Foo</property>
+            </properties>
         </vulnerability>
     </vulnerabilities>
 </bom>