feat: add mandatory test 6.1.48 - SSVC

README.md

@@ -313,7 +313,6 @@ The following tests are not yet implemented and therefore missing:
 
 - Mandatory Test 6.1.26
 - Mandatory Test 6.1.27.13
-- Mandatory Test 6.1.48
 - Mandatory Test 6.1.50
 - Mandatory Test 6.1.54
 - Mandatory Test 6.1.55
@@ -453,6 +452,7 @@ export const mandatoryTest_6_1_44: DocumentTest
 export const mandatoryTest_6_1_45: DocumentTest
 export const mandatoryTest_6_1_46: DocumentTest
 export const mandatoryTest_6_1_47: DocumentTest
+export const mandatoryTest_6_1_48: DocumentTest
 export const mandatoryTest_6_1_49: DocumentTest
 export const mandatoryTest_6_1_51: DocumentTest
 export const mandatoryTest_6_1_52: DocumentTest

csaf_2_1/mandatoryTests.js

@@ -64,6 +64,7 @@ export { mandatoryTest_6_1_44 } from './mandatoryTests/mandatoryTest_6_1_44.js'
 export { mandatoryTest_6_1_45 } from './mandatoryTests/mandatoryTest_6_1_45.js'
 export { mandatoryTest_6_1_46 } from './mandatoryTests/mandatoryTest_6_1_46.js'
 export { mandatoryTest_6_1_47 } from './mandatoryTests/mandatoryTest_6_1_47.js'
+export { mandatoryTest_6_1_48 } from './mandatoryTests/mandatoryTest_6_1_48.js'
 export { mandatoryTest_6_1_49 } from './mandatoryTests/mandatoryTest_6_1_49.js'
 export { mandatoryTest_6_1_51 } from './mandatoryTests/mandatoryTest_6_1_51.js'
 export { mandatoryTest_6_1_52 } from './mandatoryTests/mandatoryTest_6_1_52.js'

csaf_2_1/mandatoryTests/mandatoryTest_6_1_48.js

@@ -0,0 +1,233 @@
+import { Ajv } from 'ajv/dist/jtd.js'
+import ssvcDecisionPoints from '../../lib/ssvc/ssvc_decision_points.js'
+import {
+  getSsvcBaseNamespace,
+  isRegisteredSsvcNamespace,
+  isInvalidNamespace,
+} from '../shared/ssvcNamespaces.js'
+
+const ajv = new Ajv()
+
+/*
+  This is the jtd schema that needs to match the input document so that the
+  test is activated. If this schema doesn't match it normally means that the input
+  document does not validate against the csaf json schema or optional fields that
+  the test checks are not present.
+ */
+const inputSchema = /** @type {const} */ ({
+  additionalProperties: true,
+  properties: {
+    vulnerabilities: {
+      elements: {
+        additionalProperties: true,
+        optionalProperties: {
+          metrics: {
+            elements: {
+              additionalProperties: true,
+              optionalProperties: {
+                content: {
+                  additionalProperties: true,
+                  optionalProperties: {
+                    ssvc_v2: {
+                      additionalProperties: true,
+                      optionalProperties: {
+                        id: { type: 'string' },
+                        schemaVersion: { type: 'string' },
+                        timestamp: { type: 'string' },
+                        selections: {
+                          elements: {
+                            additionalProperties: true,
+                            optionalProperties: {
+                              key: { type: 'string' },
+                              name: { type: 'string' },
+                              namespace: { type: 'string' },
+                              values: {
+                                elements: {
+                                  additionalProperties: true,
+                                  optionalProperties: {
+                                    key: { type: 'string' },
+                                    name: { type: 'string' },
+                                  },
+                                },
+                              },
+                              version: { type: 'string' },
+                            },
+                          },
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    },
+  },
+})
+
+/** @typedef {import('ajv/dist/jtd.js').JTDDataType<typeof inputSchema>['vulnerabilities'][number]} Vulnerability */
+
+const validateInput = ajv.compile(inputSchema)
+
+/**
+ * @param {string | undefined} key
+ * @param {string | undefined} namespace
+ * @param {string | undefined} version
+ */
+function decisionPointIdentifier(key, namespace, version) {
+  return JSON.stringify({
+    key: key ?? '',
+    namespace: namespace ?? '',
+    version: version ?? '',
+  })
+}
+
+/** @type {Map<string,{ name: string; namespace: string; version: string; key?: string; values: { key: string; name: string; definition: string; }[]; }>} */
+const decisionPointMap = new Map(
+  ssvcDecisionPoints.decisionPoints.map((obj) => [
+    decisionPointIdentifier(
+      obj.key,
+      getSsvcBaseNamespace(obj.namespace),
+      obj.version
+    ),
+    obj,
+  ])
+)
+
+/**
+ * This implements the mandatory test 6.1.48 of the CSAF 2.1 standard.
+ *
+ * @param {any} doc
+ */
+export function mandatoryTest_6_1_48(doc) {
+  const ctx = {
+    errors:
+      /** @type {Array<{ instancePath: string; message: string }>} */ ([]),
+    isValid: true,
+  }
+
+  if (!validateInput(doc)) {
+    return ctx
+  }
+
+  /** @type {Array<Vulnerability>} */
+  const vulnerabilities = doc.vulnerabilities
+  vulnerabilities.forEach((vulnerability, vulnerabilityIndex) => {
+    vulnerability.metrics?.forEach((metric, metricIndex) => {
+      metric.content?.ssvc_v2?.selections?.forEach(
+        (selection, selectionIndex) => {
+          if (selection.namespace === undefined) {
+            return
+          }
+
+          if (isInvalidNamespace(selection.namespace)) {
+            ctx.isValid = false
+            ctx.errors.push({
+              instancePath: `/vulnerabilities/${vulnerabilityIndex}/metrics/${metricIndex}/content/ssvc_v2/selections/${selectionIndex}`,
+              message: `invalid namespace ${selection.namespace} used in selection`,
+            })
+            return
+          }
+
+          if (!isRegisteredSsvcNamespace(selection.namespace)) {
+            return
+          }
+
+          const baseNamespace = getSsvcBaseNamespace(selection.namespace)
+          // check if a decision point with these properties exists
+          const selectedDecisionPnt = decisionPointMap.get(
+            decisionPointIdentifier(
+              selection.key,
+              baseNamespace,
+              selection.version
+            )
+          )
+
+          if (!selectedDecisionPnt) {
+            ctx.isValid = false
+            ctx.errors.push({
+              instancePath: `/vulnerabilities/${vulnerabilityIndex}/metrics/${metricIndex}/content/ssvc_v2/selections/${selectionIndex}`,
+              message: `there exists no decision point with key ${selection.key} and version ${selection.version} in the namespace ${selection.namespace}`,
+            })
+          } else {
+            if (!areValuesValid(selectedDecisionPnt.values, selection.values)) {
+              ctx.isValid = false
+              ctx.errors.push({
+                instancePath: `/vulnerabilities/${vulnerabilityIndex}/metrics/${metricIndex}/content/ssvc_v2/selections/${selectionIndex}`,
+                message: `this decision point contains invalid values`,
+              })
+            } else if (
+              !areValuesInOrder(selectedDecisionPnt.values, selection.values)
+            ) {
+              ctx.isValid = false
+              ctx.errors.push({
+                instancePath: `/vulnerabilities/${vulnerabilityIndex}/metrics/${metricIndex}/content/ssvc_v2/selections/${selectionIndex}`,
+                message: `this decision point values are not in order`,
+              })
+            }
+          }
+        }
+      )
+    })
+  })
+
+  return ctx
+}
+
+/**
+ * Check if the elements in the values array of the decision point are valid and if they are in the right order
+ * according to the specification.
+ * If values are missing, this is not an issue.
+ *
+ * @param {{ key: string; name: string; definition: string; }[]} decisionPointValues the valid elements of the values array of the respective decision point
+ *                                   and their order according to the SSVC specification
+ * @param {{ key?: string; name?: string; }[] | undefined} usedValues the actual used values of the decision point
+ */
+function areValuesInOrder(decisionPointValues, usedValues) {
+  if (usedValues) {
+    const specifiedValues = decisionPointValues.map((value) => value.key)
+
+    // check for the correct order
+    for (let valueIndex = 0; valueIndex < usedValues.length; valueIndex++) {
+      const value = usedValues[valueIndex].key ?? ''
+      if (valueIndex === 0) {
+        continue
+      }
+      const specifiedIndexCurrentElement = specifiedValues.indexOf(value)
+      const previousValue = usedValues[valueIndex - 1].key ?? ''
+      const specifiedIndexPreviousElement =
+        specifiedValues.indexOf(previousValue)
+
+      if (specifiedIndexCurrentElement < specifiedIndexPreviousElement) {
+        return false
+      }
+    }
+  }
+  return true
+}
+
+/**
+ * Check if the elements in the values array of the decision point are valid
+ * according to the specification.
+ * If values are missing, this is not an issue.
+ *
+ * @param {{ key: string; name: string; definition: string; }[]} decisionPointValues the valid elements of the values array of the respective decision point
+ *                                   and their order according to the SSVC specification
+ * @param {{ key?: string; name?: string; }[] | undefined } usedValues the actual used values of the decision point
+ */
+function areValuesValid(decisionPointValues, usedValues) {
+  if (usedValues) {
+    const specifiedValues = decisionPointValues.map((value) => value.key)
+    //check if there is an invalid value used
+    for (let i = 0; i < usedValues.length; i++) {
+      const element = usedValues[i].key
+      if (element === undefined || !specifiedValues.includes(element)) {
+        return false
+      }
+    }
+  }
+
+  return true
+}

csaf_2_1/shared/ssvcNamespaces.js

@@ -0,0 +1,68 @@
+/**
+ *  https://certcc.github.io/SSVC/reference/code/namespaces/
+ */
+
+/**
+ * Registered SSVC base namespaces for production use, according to the SSVC
+ * Registered Namespace specification (SSVC-RNS):
+ * https://certcc.github.io/SSVC/reference/code/namespaces/#registered-namespace
+ */
+export const registeredSsvcNamespaces = [
+  'ssvc',
+  'cvss',
+  'cisa',
+  'basic',
+  'example',
+  'test',
+  'nist',
+]
+/**
+ * Namespace strings that must never be used at all, regardless of context (SSVC-RNS):
+ * https://certcc.github.io/SSVC/reference/code/namespaces/#base-namespace
+ *
+ * - `invalid` / `x_invalid` — must not be used at all; always an error.
+ */
+export const invalidNamespace = ['invalid', 'x_invalid']
+
+/**
+ * Extracts the base namespace from a full SSVC namespace string.
+ * Strips everything after the first '#' or '/'.
+ * @param {string} namespace
+ * @returns {string}
+ */
+export function getSsvcBaseNamespace(namespace) {
+  const hashIdx = namespace.indexOf('#')
+  const slashIdx = namespace.indexOf('/')
+
+  let endIdx = namespace.length
+  if (hashIdx !== -1) endIdx = Math.min(endIdx, hashIdx)
+  if (slashIdx !== -1) endIdx = Math.min(endIdx, slashIdx)
+
+  return namespace.substring(0, endIdx)
+}
+
+/**
+ * Returns true if the namespace belongs to a registered SSVC base namespace.
+ * @param {string} namespace - full namespace string
+ * @returns {boolean}
+ */
+export function isRegisteredSsvcNamespace(namespace) {
+  const base = getSsvcBaseNamespace(namespace)
+  if (base.startsWith('x_')) return false
+  return registeredSsvcNamespaces.includes(base)
+}
+
+/**
+ * Returns true if `namespace` uses one of the invalid base namespace strings.
+ * @param {string} namespace - full namespace string
+ * @returns {boolean}
+ */
+export function isInvalidNamespace(namespace) {
+  const preExtension = namespace.split('/')[0]
+  return invalidNamespace.some(
+    (invalid) =>
+      preExtension === invalid ||
+      preExtension.startsWith(`${invalid}.`) ||
+      preExtension.startsWith(`${invalid}#`)
+  )
+}