schema.json "score" pattern too strict in metric ordering, optional metrics not recognised

[frasertweedale]

osv-schema/validation/schema.json

Lines 326 to 328 in b3ae8f1

	"score": {
	"pattern": "CVSS:3\\.[0-9]\\/AV:[NALP]\\/AC:[LH]\\/PR:[NLH]\\/UI:[NR]\\/S:[UC]\\/C:[NLH]\\/I:[NLH]\\/A:[NLH]"
	}

Per CVSS v3.1 spec ( https://www.first.org/cvss/specification-document ) - emphasis mine:

A vector string should contain metrics in the order shown in Table 15, though other orderings are valid. All Base metrics must be included in a vector string. Temporal and Environmental metrics are optional, and omitted metrics are considered to have the value of Not Defined (X). Metrics with a value of Not Defined can be explicitly included in a vector string if desired. Programs reading CVSS v3.1 vector strings must accept metrics in any order and treat unspecified Temporal and Environmental as Not Defined. A vector string must not include the same metric more than once.

The JSON schema regex rejects many valid CVSS vector values.

[oliverchang]

Thanks for reporting! Seems like this is very hard to validate with a regex then. @kurtseifried thoughts?

[kurtseifried]

This is why I made CVSS in the CVE schema a series of fields from day one:

https://github.com/CVEProject/cve-schema/blob/master/schema/v1.0/JSON-file-format-v1.md

{
"CVSSv2": {
"VERSION": "1.2",
"BM": {
"AV": "X",
"AC": "X",
"AU": "X",
"C": "X",
"I": "X",
"A": "X",
"SCORE": "N.N",
"NOTES": "string"
},
"TM": {
"E": "X",
"RL": "X",
"RC": "X",
"SCORE": "N.N",
"NOTES": "string"
},
"EM": {
"CDP": "X",
"TD": "X",
"CR": "X",
"IR": "X",
"AR": "X",
"SCORE": "N.N",
"NOTES": "string"
},
"NOTES": "string"
}
}

I guess a regex conditional expression could do the trick