diff --git a/schema/2.0/model/cyclonedx-ai-modelcard-2.0.schema.json b/schema/2.0/model/cyclonedx-ai-modelcard-2.0.schema.json index 8eb6706fd..14b928fa9 100644 --- a/schema/2.0/model/cyclonedx-ai-modelcard-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-ai-modelcard-2.0.schema.json @@ -81,16 +81,7 @@ "additionalProperties": false, "properties": { "ref": { - "anyOf": [ - { - "title": "Ref", - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" - }, - { - "title": "BOM-Link Element", - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/bomLinkElementType" - } - ], + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/elementLink", "title": "Reference", "type": "string", "description": "References a data component by the components bom-ref attribute" diff --git a/schema/2.0/model/cyclonedx-annotation-2.0.schema.json b/schema/2.0/model/cyclonedx-annotation-2.0.schema.json index 2866b987f..7816fedbe 100644 --- a/schema/2.0/model/cyclonedx-annotation-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-annotation-2.0.schema.json @@ -33,16 +33,7 @@ "type": "array", "uniqueItems": true, "items": { - "anyOf": [ - { - "title": "Ref", - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" - }, - { - "title": "BOM-Link Element", - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/bomLinkElementType" - } - ] + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/elementLink" }, "title": "Subjects", "description": "The object in the BOM identified by its bom-ref. This is often a component or service, but may be any object type supporting bom-refs." diff --git a/schema/2.0/model/cyclonedx-common-2.0.schema.json b/schema/2.0/model/cyclonedx-common-2.0.schema.json index 88658a6a5..0b74c401d 100644 --- a/schema/2.0/model/cyclonedx-common-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-common-2.0.schema.json @@ -6,10 +6,10 @@ "$comment" : "OWASP CycloneDX is an Ecma International standard (ECMA-424) developed in collaboration between the OWASP Foundation and Ecma Technical Committee 54 (TC54). The standard is published under a royalty-free patent policy. This JSON schema is the reference implementation and is licensed under the Apache License 2.0.", "$defs": { "refType": { - "description": "Identifier for referable and therefore interlinkable elements.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links.", + "description": "Identifier for referable and therefore interlinkable elements.\nValue shall not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links.", "type": "string", "minLength": 1, - "$comment": "TODO (breaking change): add a format constraint that prevents the value from staring with 'urn:cdx:'" + "pattern": "^(?!urn:cdx:)" }, "refLinkType": { "description": "Descriptor for an element identified by the attribute 'bom-ref' in the same BOM document.\nIn contrast to `bomLinkElementType`.", @@ -45,6 +45,20 @@ } ] }, + "elementLink": { + "title": "Referenced Element", + "description": "Reference using bom-link or bom-ref to an element.", + "anyOf": [ + { + "title": "Ref", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + }, + { + "title": "BOM-Link Element", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/bomLinkElementType" + } + ] + }, "hash": { "type": "object", "title": "Hash", diff --git a/schema/2.0/model/cyclonedx-component-2.0.schema.json b/schema/2.0/model/cyclonedx-component-2.0.schema.json index 451d18b60..af1b29efd 100644 --- a/schema/2.0/model/cyclonedx-component-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-component-2.0.schema.json @@ -692,16 +692,7 @@ "type": "array", "uniqueItems": true, "items": { - "anyOf": [ - { - "title": "Ref", - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" - }, - { - "title": "BOM-Link Element", - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/bomLinkElementType" - } - ] + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/elementLink" }, "title": "BOM References", "description": "The object in the BOM identified by its bom-ref. This is often a component or service but may be any object type supporting bom-refs. Tools used for analysis should already be defined in the BOM, either in the metadata/tools, components, or formulation." diff --git a/schema/2.0/model/cyclonedx-composition-2.0.schema.json b/schema/2.0/model/cyclonedx-composition-2.0.schema.json index 0ad97d27d..6ff555a10 100644 --- a/schema/2.0/model/cyclonedx-composition-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-composition-2.0.schema.json @@ -34,16 +34,7 @@ "type": "array", "uniqueItems": true, "items": { - "anyOf": [ - { - "title": "Ref", - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" - }, - { - "title": "BOM-Link Element", - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/bomLinkElementType" - } - ] + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/elementLink" }, "title": "BOM references", "description": "The bom-ref identifiers of the components or services being described. Assemblies refer to nested relationships whereby a constituent part may include other constituent parts. References do not cascade to child parts. References are explicit for the specified constituent part only." diff --git a/schema/2.0/model/cyclonedx-formulation-2.0.schema.json b/schema/2.0/model/cyclonedx-formulation-2.0.schema.json index 2fb4d0a92..997dc6d9e 100644 --- a/schema/2.0/model/cyclonedx-formulation-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-formulation-2.0.schema.json @@ -802,16 +802,7 @@ "ref": { "title": "BOM Reference", "description": "References an object by its bom-ref attribute", - "anyOf": [ - { - "title": "Ref", - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" - }, - { - "title": "BOM-Link Element", - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/bomLinkElementType" - } - ] + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/elementLink" }, "externalReference": { "title": "External reference", diff --git a/schema/2.0/model/cyclonedx-party-2.0.schema.json b/schema/2.0/model/cyclonedx-party-2.0.schema.json index 80eac956b..b38625c8e 100644 --- a/schema/2.0/model/cyclonedx-party-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-party-2.0.schema.json @@ -492,7 +492,7 @@ "title": "Address" }, "affiliation": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/elementLink", "title": "Affiliation", "description": "Reference using bom-link or bom-ref to an organization party with which the person is affiliated." } @@ -836,7 +836,7 @@ "title": "Expiration Date" }, "issuer": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/elementLink", "title": "Issuer", "description": "Reference using bom-link or bom-ref to the party that issued the identifier." } diff --git a/schema/2.0/model/cyclonedx-vulnerability-2.0.schema.json b/schema/2.0/model/cyclonedx-vulnerability-2.0.schema.json index 2c5245866..a1a25a52a 100644 --- a/schema/2.0/model/cyclonedx-vulnerability-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-vulnerability-2.0.schema.json @@ -271,16 +271,7 @@ "additionalProperties": false, "properties": { "ref": { - "anyOf": [ - { - "title": "Ref", - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" - }, - { - "title": "BOM-Link Element", - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/bomLinkElementType" - } - ], + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/elementLink", "title": "Reference", "description": "References a component or service by the objects bom-ref" }, diff --git a/tools/src/test/resources/1.7/valid-refType-1.7.json b/tools/src/test/resources/1.7/valid-refType-1.7.json new file mode 100644 index 000000000..05da5c630 --- /dev/null +++ b/tools/src/test/resources/1.7/valid-refType-1.7.json @@ -0,0 +1,15 @@ +{ + "$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json", + "bomFormat": "CycloneDX", + "specVersion": "1.7", + "serialNumber": "urn:uuid:3e9eb9b0-9577-4116-ac17-fad73a27b572", + "version": 1, + "components": [ + { + "type": "library", + "name": "example", + "description": "`bom-ref` should not start with 'urn:uuid:' - but it does, what is quite valid", + "bom-ref": "urn:uuid:313ec7e9-a6bb-4274-8749-e6fa8559afab" + } + ] +} diff --git a/tools/src/test/resources/2.0/invalid-refType-2.0.json b/tools/src/test/resources/2.0/invalid-refType-2.0.json new file mode 100644 index 000000000..2d2bf9c19 --- /dev/null +++ b/tools/src/test/resources/2.0/invalid-refType-2.0.json @@ -0,0 +1,15 @@ +{ + "$schema": "https://cyclonedx.org/schema/2.0/cyclonedx-2.0.schema.json", + "specFormat": "CycloneDX", + "specVersion": "2.0", + "serialNumber": "urn:uuid:3e9eb9b0-9577-4116-ac17-fad73a27b572", + "version": "1", + "components": [ + { + "type": "library", + "name": "example", + "description": "`bom-ref` must not start with 'urn:uuid:'", + "bom-ref": "urn:uuid:313ec7e9-a6bb-4274-8749-e6fa8559afab" + } + ] +}