Repository: CycloneDX/cyclonedx-core-java
Pull request #265 (2023-02-02 20:53:51)

1.5 support rejected vex
This adds support for: https://github.com/CycloneDX/specification/issues/142


Patch:
diff --git a/src/main/java/org/cyclonedx/model/vulnerability/Vulnerability.java b/src/main/java/org/cyclonedx/model/vulnerability/Vulnerability.java
index c26ca41d9..dcb64da53 100644
--- a/src/main/java/org/cyclonedx/model/vulnerability/Vulnerability.java
+++ b/src/main/java/org/cyclonedx/model/vulnerability/Vulnerability.java
@@ -54,6 +54,7 @@ import org.cyclonedx.util.CustomDateSerializer;
     "created",
     "published",
     "updated",
+    "rejected",
     "credits",
     "tools",
     "analysis",
@@ -86,6 +87,9 @@ public class Vulnerability
   @JsonSerialize(using = CustomDateSerializer.class)
   @VersionFilter(versions = {"1.0", "1.1", "1.2", "1.3"})
   private Date updated;
+  @JsonSerialize(using = CustomDateSerializer.class)
+  @VersionFilter(versions = {"1.0", "1.1", "1.2", "1.3", "1.4"})
+  private Date rejected;
   private Credits credits;
   @JacksonXmlElementWrapper(localName = "tools")
   @JacksonXmlProperty(localName = "tool")
@@ -220,6 +224,14 @@ public class Vulnerability
     this.updated = updated;
   }
 
+  public Date getRejected() {
+    return rejected;
+  }
+
+  public void setRejected(final Date rejected) {
+    this.rejected = rejected;
+  }
+
   public Credits getCredits() {
     return credits;
   }


Test patch:
diff --git a/src/test/java/org/cyclonedx/parsers/JsonParserTest.java b/src/test/java/org/cyclonedx/parsers/JsonParserTest.java
index bfca40d0c..7cdb3600c 100644
--- a/src/test/java/org/cyclonedx/parsers/JsonParserTest.java
+++ b/src/test/java/org/cyclonedx/parsers/JsonParserTest.java
@@ -365,8 +365,8 @@ public class JsonParserTest {
         assertNotNull(d1);
         assertEquals("pkg:npm/acme/component@1.0.0", d1.getRef());
     }
-
-    private void assertVulnerabilities(final Bom bom, Version version) {
+    
+    private void assertVulnerabilities(final Bom bom, final Version version) {
         final List<Vulnerability> vulnerabilities = bom.getVulnerabilities();
         assertEquals(1, vulnerabilities.size());
         Vulnerability vuln = vulnerabilities.get(0);
@@ -381,6 +381,14 @@ public class JsonParserTest {
         assertNotNull(vuln.getPublished());
         assertNotNull(vuln.getUpdated());
 
+        //Assert Vulnerability Rejected
+        if (version != Version.VERSION_14) {
+            assertNotNull(vuln.getRejected());
+        }
+        else {
+            assertNull(vuln.getRejected());
+        }
+
         //Source
         assertEquals("Sonatype", vuln.getSource().getName());
         assertEquals("https://www.vuln.com", vuln.getSource().getUrl());
diff --git a/src/test/java/org/cyclonedx/parsers/XmlParserTest.java b/src/test/java/org/cyclonedx/parsers/XmlParserTest.java
index 6c531d0d8..beffabdad 100644
--- a/src/test/java/org/cyclonedx/parsers/XmlParserTest.java
+++ b/src/test/java/org/cyclonedx/parsers/XmlParserTest.java
@@ -524,6 +524,14 @@ public class XmlParserTest {
         assertNotNull(vuln.getPublished());
         assertNotNull(vuln.getUpdated());
 
+        //Assert Vulnerability Rejected
+        if (version != Version.VERSION_14) {
+            assertNotNull(vuln.getRejected());
+        }
+        else {
+            assertNull(vuln.getRejected());
+        }
+
         //Source
         assertEquals("Sonatype", vuln.getSource().getName());
         assertEquals("https://www.vuln.com", vuln.getSource().getUrl());
diff --git a/src/test/resources/bom-1.5.json b/src/test/resources/bom-1.5.json
index 1f2f1a60b..2ee6f2834 100644
--- a/src/test/resources/bom-1.5.json
+++ b/src/test/resources/bom-1.5.json
@@ -346,6 +346,7 @@
       "created": "2020-04-07T07:01:00Z",
       "published": "2020-04-07T07:01:00Z",
       "updated": "2020-04-07T07:01:00Z",
+      "rejected": "2023-02-13T07:01:00Z",
       "credits": {
         "organizations": [
           {
diff --git a/src/test/resources/bom-1.5.xml b/src/test/resources/bom-1.5.xml
index a4a2567d5..97e810bbc 100644
--- a/src/test/resources/bom-1.5.xml
+++ b/src/test/resources/bom-1.5.xml
@@ -234,6 +234,7 @@
             <created>2020-04-07T07:01:00Z</created>
             <published>2020-04-07T07:01:00Z</published>
             <updated>2020-04-07T07:01:00Z</updated>
+            <rejected>2023-02-16T07:01:00Z</rejected>
             <credits>
                 <organizations>
                     <organization>