feat(CSAF2.1): #302 add recommendedTest_6_2_20.js

README.md

@@ -356,7 +356,6 @@ The following tests are not yet implemented and therefore missing:
 
 **Recommended Tests**
 
-- Recommended Test 6.2.20
 - Recommended Test 6.2.24
 - Recommended Test 6.2.26
 - Recommended Test 6.2.31
@@ -502,6 +501,7 @@ export const recommendedTest_6_2_16: DocumentTest
 export const recommendedTest_6_2_17: DocumentTest
 export const recommendedTest_6_2_18: DocumentTest
 export const recommendedTest_6_2_19: DocumentTest
+export const recommendedTest_6_2_20: DocumentTest
 export const recommendedTest_6_2_21: DocumentTest
 export const recommendedTest_6_2_22: DocumentTest
 export const recommendedTest_6_2_23: DocumentTest

csaf_2_1/csafAjv.js

@@ -1,8 +1,8 @@
 import addFormats from 'ajv-formats'
 import { Ajv2020 } from 'ajv/dist/2020.js'
-import cvss_v2_0 from '../schemas/cvss-v2.0.js'
-import cvss_v3_0 from '../schemas/cvss-v3.0.js'
-import cvss_v3_1 from '../schemas/cvss-v3.1.js'
+import cvss_v2_0 from './csafAjv/cvss-v2.0.js'
+import cvss_v3_0 from './csafAjv/cvss-v3.0.js'
+import cvss_v3_1 from './csafAjv/cvss-v3.1.js'
 import cvss_v4_0_0 from './csafAjv/cvss-v4.0.0.js'
 import extension_content from './csafAjv/extension-content.js'
 import content_schema from './csafAjv/content_schema.js'
@@ -11,6 +11,7 @@ import cvss_meta from './csafAjv/cvss_meta.js'
 import meta_format_assertion from './csafAjv/meta-format-assertion.js'
 import draft_07_schema from './csafAjv/draft-07-schema.js'
 import selectionList_2_0_0Schema from './csafAjv/SelectionList_2_0_0.schema.js'
+import { registerExtensionSchemas } from './csafAjv/extensionSchemas/index.js'
 
 import { validateTimestamp } from './dateHelper.js'
 
@@ -45,6 +46,7 @@ csafAjv.addSchema(
   selectionList_2_0_0Schema,
   'https://certcc.github.io/SSVC/data/schema/v2/SelectionList_2_0_0.schema.json'
 )
+registerExtensionSchemas(csafAjv)
 
 csafAjv.addFormat('date-time', {
   type: 'string',

csaf_2_1/csafAjv/cvss-v2.0.js

@@ -24,6 +24,7 @@ export default {
   title: 'JSON Schema for Common Vulnerability Scoring System version 2.0',
   $id: 'https://www.first.org/cvss/cvss-v2.0.json?20170531',
   type: 'object',
+  additionalProperties: false,
   $defs: {
     accessVectorType: {
       type: 'string',

csaf_2_1/csafAjv/cvss-v3.0.js

@@ -24,6 +24,7 @@ export default {
   title: 'JSON Schema for Common Vulnerability Scoring System version 3.0',
   $id: 'https://www.first.org/cvss/cvss-v3.0.json?20170531',
   type: 'object',
+  additionalProperties: false,
   $defs: {
     attackVectorType: {
       type: 'string',

csaf_2_1/csafAjv/cvss-v3.1.js

@@ -25,6 +25,7 @@ export default {
   title: 'JSON Schema for Common Vulnerability Scoring System version 3.1',
   $id: 'https://www.first.org/cvss/cvss-v3.1.json?20190610',
   type: 'object',
+  additionalProperties: false,
   $defs: {
     attackVectorType: {
       type: 'string',

csaf_2_1/csafAjv/extensionSchemas/documentation-11.js

@@ -0,0 +1,54 @@
+// https://raw.githubusercontent.com/oasis-tcs/csaf/refs/heads/master/csaf_2.1/extension/data/valid/documentation-11/documentation-11-content_1.0.0.json
+// Copied from ../../../csaf/csaf_2.1/test/extension/data/valid/documentation-11/documentation-11-content_1.0.0.json
+export default {
+  $schema:
+    'https://docs.oasis-open.org/csaf/csaf/v2.1/schema/extension-metaschema.json',
+  $id: 'https://raw.githubusercontent.com/oasis-tcs/csaf/refs/heads/master/csaf_2.1/extension/data/valid/documentation-11/documentation-11-content_1.0.0.json',
+  title: 'CSAF Extension: Documentation 11',
+  description:
+    'Representation of a valid extension used for documentation purposes.',
+  type: 'object',
+  required: ['$schema', 'category', 'critical', 'content'],
+  properties: {
+    $schema: {
+      title: 'CSAF Extension Schema',
+      description:
+        'Contains the URL of the CSAF Extension JSON schema which the JSON object promises to be valid for.',
+      type: 'string',
+      format: 'uri',
+      const:
+        'https://raw.githubusercontent.com/oasis-tcs/csaf/refs/heads/master/csaf_2.1/extension/data/valid/documentation-11/documentation-11-content_1.0.0.json',
+    },
+    category: {
+      title: 'Extension Category',
+      description: 'Holds the category of the extension content.',
+      type: 'string',
+      enum: ['essential', 'significant', 'supplementary'],
+    },
+    content: {
+      title: 'Content',
+      description: 'Contains the additional information in its properties.',
+      type: 'object',
+      minProperties: 1,
+      properties: {
+        documentation: {
+          title: 'Documentation content',
+          description:
+            'Contains a constant string to clarify that this is for documentation purposes only and not to be used in production.',
+          type: 'string',
+          const:
+            'This extension is for documentation and test purposed only. It is valid. It is not allowed to be used in a production CSAF.',
+        },
+      },
+      unevaluatedProperties: false,
+    },
+    critical: {
+      title: 'Critical',
+      description:
+        'Determines whether using the extension would fail a mandatory test.',
+      type: 'boolean',
+      const: false,
+    },
+  },
+  additionalProperties: false,
+}

csaf_2_1/csafAjv/extensionSchemas/documentation-12.js

@@ -0,0 +1,68 @@
+// https://raw.githubusercontent.com/oasis-tcs/csaf/refs/heads/master/csaf_2.1/extension/data/valid/documentation-12/documentation-12-content_1.0.0.json
+// Copied from ../../../csaf/csaf_2.1/test/extension/data/valid/documentation-12/documentation-12-content_1.0.0.json
+export default {
+  $schema:
+    'https://docs.oasis-open.org/csaf/csaf/v2.1/schema/extension-metaschema.json',
+  $id: 'https://raw.githubusercontent.com/oasis-tcs/csaf/refs/heads/master/csaf_2.1/extension/data/valid/documentation-12/documentation-12-content_1.0.0.json',
+  title: 'CSAF Extension: Documentation 12',
+  description:
+    'Representation of a valid extension used for documentation purposes.',
+  type: 'object',
+  required: ['$schema', 'category', 'critical', 'content'],
+  properties: {
+    $schema: {
+      title: 'CSAF Extension Schema',
+      description:
+        'Contains the URL of the CSAF Extension JSON schema which the JSON object promises to be valid for.',
+      type: 'string',
+      format: 'uri',
+      const:
+        'https://raw.githubusercontent.com/oasis-tcs/csaf/refs/heads/master/csaf_2.1/extension/data/valid/documentation-12/documentation-12-content_1.0.0.json',
+    },
+    category: {
+      title: 'Extension Category',
+      description: 'Holds the category of the extension content.',
+      type: 'string',
+      enum: ['essential', 'significant', 'supplementary'],
+    },
+    content: {
+      title: 'Content',
+      description: 'Contains the additional information in its properties.',
+      type: 'object',
+      minProperties: 1,
+      required: ['documentation'],
+      properties: {
+        documentation: {
+          title: 'Documentation content',
+          description:
+            'Contains a constant string to clarify that this is for documentation purposes only and not to be used in production.',
+          type: 'string',
+          const:
+            'This extension is for documentation and test purposed only. It is valid. It is not allowed to be used in a production CSAF.',
+        },
+        notes: {
+          title: 'Notes',
+          description:
+            'Contains a list of notes to convey a more complex structure.',
+          type: 'array',
+          minItems: 1,
+          items: {
+            title: 'Entry',
+            description: 'Contains a single entry.',
+            type: 'string',
+            minLength: 1,
+          },
+        },
+      },
+      unevaluatedProperties: false,
+    },
+    critical: {
+      title: 'Critical',
+      description:
+        'Determines whether using the extension would fail a mandatory test.',
+      type: 'boolean',
+      const: false,
+    },
+  },
+  additionalProperties: false,
+}

csaf_2_1/csafAjv/extensionSchemas/documentation-13.js

@@ -0,0 +1,129 @@
+// https://raw.githubusercontent.com/oasis-tcs/csaf/refs/heads/master/csaf_2.1/extension/data/valid/documentation-13/documentation-13-content_1.0.0.json
+// Copied from ../../../csaf/csaf_2.1/test/extension/data/valid/documentation-13/documentation-13-content_1.0.0.json
+export default {
+  $schema:
+    'https://docs.oasis-open.org/csaf/csaf/v2.1/schema/extension-metaschema.json',
+  $id: 'https://raw.githubusercontent.com/oasis-tcs/csaf/refs/heads/master/csaf_2.1/extension/data/valid/documentation-13/documentation-13-content_1.0.0.json',
+  title: 'CSAF Extension: Documentation 13',
+  description:
+    'Representation of a valid extension for configurations used for documentation purposes.',
+  type: 'object',
+  $defs: {
+    configuration_id_t: {
+      title: 'Reference token for configuration instance',
+      description:
+        'Token required to identify a configuration so that it can be referred to from other parts in the document. There is no predefined or required format for the configuration_id as long as it uniquely identifies a configuration in the context of the current document.',
+      type: 'string',
+      minLength: 1,
+      examples: ['CSAFCID-0001', 'CSAFCID-0002'],
+    },
+    configuration_t: {
+      title: 'Configuration',
+      description:
+        'Contains the description of a configuration and assigns it a configuration id.',
+      type: 'object',
+      required: ['configuration_id', 'details'],
+      properties: {
+        configuration_id: { $ref: '#/$defs/configuration_id_t' },
+        details: {
+          title: 'Details of the Configuration',
+          description:
+            'Contains all details as human-readable description on how to identify the configuration.',
+          type: 'string',
+          minLength: 1,
+        },
+      },
+      additionalProperties: false,
+    },
+    relationship_t: {
+      title: 'Relationship',
+      description:
+        'Establishes a link between an existing full_product_name_t element and a configuration, allowing the document producer to define a combination that form a new full_product_name entry.',
+      type: 'object',
+      required: [
+        'configuration_reference',
+        'full_product_name',
+        'product_reference',
+      ],
+      properties: {
+        configuration_reference: {
+          title: 'Configuration Reference',
+          description:
+            'Holds a Configuration ID that refers to the Configuration element, which is referenced as the second element of the relationship.',
+          $ref: '#/$defs/configuration_id_t',
+        },
+        full_product_name: {
+          $ref: 'https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json#/$defs/full_product_name_t',
+        },
+        product_reference: {
+          title: 'Product reference',
+          description:
+            'Holds a Product ID that refers to the Full Product Name element, which is referenced as the first element of the relationship.',
+          $ref: 'https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json#/$defs/product_id_t',
+        },
+      },
+      additionalProperties: false,
+    },
+  },
+  required: ['$schema', 'category', 'critical', 'content'],
+  properties: {
+    $schema: {
+      title: 'CSAF Extension Schema',
+      description:
+        'Contains the URL of the CSAF Extension JSON schema which the JSON object promises to be valid for.',
+      type: 'string',
+      format: 'uri',
+      const:
+        'https://raw.githubusercontent.com/oasis-tcs/csaf/refs/heads/master/csaf_2.1/extension/data/valid/documentation-13/documentation-13-content_1.0.0.json',
+    },
+    category: {
+      title: 'Extension Category',
+      description: 'Holds the category of the extension content.',
+      type: 'string',
+      enum: ['essential', 'significant', 'supplementary'],
+    },
+    content: {
+      title: 'Content',
+      description: 'Contains the additional information in its properties.',
+      type: 'object',
+      minProperties: 1,
+      properties: {
+        configuration_tree: {
+          title: 'Configuration Tree',
+          description:
+            'Contains configurations and their bindings to products.',
+          type: 'object',
+          required: ['configurations', 'relationships'],
+          properties: {
+            configurations: {
+              title: 'List of Configurations',
+              description: 'Contains a list of configuration elements.',
+              type: 'array',
+              minItems: 1,
+              uniqueItems: true,
+              items: { $ref: '#/$defs/configuration_t' },
+            },
+            relationships: {
+              title: 'List of Relationships',
+              description:
+                'Contains a list of product-configuration combinations.',
+              type: 'array',
+              minItems: 1,
+              uniqueItems: true,
+              items: { $ref: '#/$defs/relationship_t' },
+            },
+          },
+        },
+      },
+      unevaluatedProperties: false,
+    },
+    critical: {
+      title: 'Critical',
+      description:
+        'Determines whether using the extension would fail a mandatory test.',
+      type: 'boolean',
+      const: true,
+    },
+  },
+  additionalProperties: false,
+}