CSAF 2.1 Format Validation

Files Used

Previous version before the metaschema change, revision:

• Schema: https://raw.githubusercontent.com/oasis-tcs/csaf/79422452b0a244660596664bfb843576e9b127c1/csaf_2.1/json_schema/csaf_json_schema.json
• CSAF Example: https://raw.githubusercontent.com/oasis-tcs/csaf/79422452b0a244660596664bfb843576e9b127c1/csaf_2.1/examples/csaf/cisco-sa-20180328-smi2.json

New version, revision:

• Schema: https://raw.githubusercontent.com/oasis-tcs/csaf/27af37f5c9a107abb166e855fa6505fc4ffaade8/csaf_2.1/json_schema/csaf.json
• Metaschema: https://raw.githubusercontent.com/oasis-tcs/csaf/27af37f5c9a107abb166e855fa6505fc4ffaade8/csaf_2.1/json_schema/meta.json
• CSAF Example: https://raw.githubusercontent.com/oasis-tcs/csaf/27af37f5c9a107abb166e855fa6505fc4ffaade8/csaf_2.1/examples/csaf/cisco-sa-20180328-smi2.json

The files are located locally under fixtures/old and fixtures/new.

Changes to the Example

Two invalid files were created from the valid example:

• In invalid-format.json, only /document/tracking/current_release_date was changed:

  "current_release_date": "heute-04-17T15:08:41Z"

• In invalid-structure.json, only the required field /document/title was removed. This case checks whether the library applies the schema at all.

The new main schema references the new CSAF metaschema through $schema. There, the vocabulary https://json-schema.org/draft/2020-12/vocab/format-assertion is marked with true.

Results

The libraries evaluated here were found through search engines or searches of the relevant package indexes and were selected because they appeared reasonably mature.

Library	Schema	Valid Document	Missing Title	Invalid Date
Rust (jsonschema 0.51.0)	old	accepted	rejected	accepted
Rust (jsonschema 0.51.0)	new	accepted	rejected	rejected
Python (jsonschema 4.26.0)	old	accepted	rejected	accepted
Python (jsonschema 4.26.0)	new	accepted	rejected	accepted
C++ CLI (sourcemeta/jsonschema 16.9.0)	old	accepted	rejected	accepted
C++ CLI (sourcemeta/jsonschema 16.9.0)	new	accepted	rejected	rejected
Go (kaptinlin/jsonschema 0.9.9)	old	accepted	rejected	accepted
Go (kaptinlin/jsonschema 0.9.9)	new	error	error	error
Go (santhosh-tekuri/jsonschema 6.0.3)	old	accepted	rejected	accepted
Go (santhosh-tekuri/jsonschema 6.0.3)	new	accepted	rejected	rejected
Kotlin (networknt/json-schema-validator 3.0.6)	old	accepted	rejected	accepted
Kotlin (networknt/json-schema-validator 3.0.6)	new	accepted	rejected	rejected
Kotlin (erosb/json-sKema 0.28.0)	old	accepted	rejected	accepted
Kotlin (erosb/json-sKema 0.28.0)	new	accepted	rejected	rejected

Additional research:

• Rust
  • serde_valid 2.0.3 is a derive-based validator for Rust data types. It does not compile external JSON Schema documents.
  • boon 0.6.1 uses regex-syntax 0.8.2 which does not support look-around and does not allow changing the engine from it's API. Therefore it is incompatible with the expressions used
  • jsonschema-valid 0.5.2 and valico 4.0.0 don't have 2020-12 support
• Go
  • github.com/kaptinlin/jsonschema 0.9.8 accepts the invalid date with both schemas. Version 0.9.9 closes issue #130 by recognizing the mandatory format-assertion vocabulary as unsupported and refusing to compile the new schema with an unsupported required vocabulary error. This behavior is intentional and conforms to the JSON Schema specification.
  • github.com/invopop/jsonschema 0.14.0 has the same name as the other packages, but does not implement schema validation
  • github.com/google/jsonschema-go/jsonschema 0.4.3 calls regexp.Compile which does not support the patterns used and does not allow changing the engine from it's API. Therefore any validation fails
• Kotlin/Java
  • dev.harrel:json-schema 1.9.1 throws an exception if the schema uses format-assertion vocabulary
  • org.leadpony.justify:justify 3.1.0 supports JSON Schema drafts 4, 6, and 7, but not Draft 2020-12, so it does not support the CSAF schema used here.
  • io.github.optimumcode:json-schema-validator 0.5.5 likely supports the required behavior because its Draft 2020-12 loader enables format assertions from the format-assertion vocabulary and the README mentions it. It was not tested because it does not support loading schemas from remote URLs; upstream lists remote schema loading as future work.

Notes

The validators require Internet access for the external schema references.

Rust jsonschema issue: Stranger6667/jsonschema#1496

PR #962: oasis-tcs/csaf#962

CSAF 2.1 Draft, section 2.2: https://github.com/oasis-tcs/csaf/blob/master/csaf_2.1/prose/share/csaf-v2.1-draft.md#22-format-validation-