Fix Node_Validator build path and regenerate stale dist#482
Open
asheshv wants to merge 1 commit intoCVEProject:mainfrom
Open
Fix Node_Validator build path and regenerate stale dist#482asheshv wants to merge 1 commit intoCVEProject:mainfrom
asheshv wants to merge 1 commit intoCVEProject:mainfrom
Conversation
build.js still required ../../docs/CVE_JSON_bundled.json, but that file was renamed to CVE_Record_Format_bundled.json in commit a9e9fa9 (April 2024), so `node build.js` has failed ever since. The checked-in dist (dist/cve5validator.js) has been frozen against the pre-rename schema for the same reason. That stale dist still expresses CVSS score types via multipleOf: 0.1 instead of the enum lists the current bundled schema uses. AJV's multipleOf check is unreliable against IEEE-754 representations of some decimals (4.8, 7.1, 7.6, 8.1, 8.7, ...) and rejects valid CVSS base scores that the live CVE Services backend accepts without issue. Pointing build.js at the current bundled file and regenerating the dist resolves both problems. The regenerated dist still validates the in-repo full-record example files.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
schema/support/Node_Validator/build.jsstill required../../docs/CVE_JSON_bundled.json, but that file was renamed toCVE_Record_Format_bundled.jsonin commit a9e9fa9 (April 2024).node build.jshas failed withCannot find moduleever since, so the checked-indist/cve5validator.jshas been frozen against the pre-rename schema.multipleOf: 0.1instead of theenumlists the current bundled schema uses. AJV'smultipleOfcheck is unreliable against IEEE-754 representations of certain decimals, so valid CVSS base scores like4.8,7.1,7.6,8.1,8.7are rejected even though they are produced by the official CVSS v4.0 calculator and accepted by the live CVE Services backend.build.jsat the current bundled filename and ships the regenerateddist/cve5validator.js.Reproduction (before this PR)
A minimal CVE record with
cvssV4_0.baseScore: 4.8(vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N, the score the official calculator produces) fails validation against the existing dist with:This cascades into a spurious
cveMetadataadditionalProperty: requesterUserIderror, because the top-leveloneOffalls through fromcveMetadataPublished(which permitsrequesterUserId) tocveMetadataRejected(which does not).After this PR
node build.jssucceeds and writes a freshdist/cve5validator.js.schema/docs/full-record-basic-example.jsonandschema/docs/full-record-advanced-example.jsoncleanly.0.0-10.0range — including the values previously rejected.Test plan
node schema/support/Node_Validator/build.jsruns without errornode schema/support/Node_Validator/validate.js schema/docs/full-record-basic-example.json schema/docs/full-record-advanced-example.jsonreports both files validcvssV4_0.baseScorevalues that previously failed (4.8,7.1,8.7) now validate, with no other behaviour change observed