Return line that fail validate

[DavidLambertCyber]

Requesting enhancement to return the line/s that failed validation for json/xml.

• Go from this current output
• badType_log4j_2.17.2_cyclonedx_1.3_sbom.json

->$ cyclonedx-cli validate --input-file ./badType_log4j_2.17.2_cyclonedx_1.3_sbom.json 
Unable to validate against any JSON schemas.
BOM is not valid.

• to something like this, whatever makes sense and what is available,

->$ cyclonedx-cli validate --input-file ./badType_log4j_2.17.2_cyclonedx_1.3_sbom.json 
Unable to validate against any JSON schemas.
Schema Error | line 25671 | "ref" : true,
BOM is not valid.
JSON Error | line 5 | "version" : 1,{

• If you get this far, output as JSON would be awesome!

[andreas-hilti]

@DavidLambertCyber I noticed that if you explicitly specify the CycloneDX schema version (i.e. use the --input-version argument), you get more detailed error messages. In your case:

cyclonedx-win-x64.exe validate --input-file badType_log4j_2.17.2_cyclonedx_1.3_sbom.json --input-version v1_3
Validating JSON BOM...
'{' is an invalid start of a property name. Expected a '"'. LineNumber: 4 | BytePositionInLine: 16.
BOM is not valid.

Probably one would need to first figure out the schema version and not just try to validate against all versions:

cyclonedx-cli/src/cyclonedx/Commands/ValidateCommand.cs

Lines 103 to 121 in 5de8d19

	else if (options.InputFormat == ValidationBomFormat.json)
	{
	validationResult = Json.Validator.Validate(inputBom, SpecificationVersion.v1_4);
	if (!validationResult.Valid)
	{
	validationResult = Json.Validator.Validate(inputBom, SpecificationVersion.v1_3);
	}
	if (!validationResult.Valid)
	{
	validationResult = Json.Validator.Validate(inputBom, SpecificationVersion.v1_2);
	}
	if (!validationResult.Valid)
	{
	validationResult.Messages = new List<string>
	{
	"Unable to validate against any JSON schemas."
	};
	}
	}

[andreas-hilti]

In addition, here one should also return the result.InstanceLocation, not only the result.SchemaLocation:
https://github.com/CycloneDX/cyclonedx-dotnet-library/blob/18c00b708834215484d43ffcf393889764dbdb69/src/CycloneDX.Core/Json/Validator.cs#L141-L142
to know on which element the validation failed, for instance not only

Validation failed: Value is "boolean" but should be "string"
#/properties/dependencies/items/$ref/properties/ref/type

but also include #/dependencies/0/ref in the validation message.

[andreas-hilti]

This should be improved in release 0.26.0.