## Purpose Identify, build and release the next major version of the [Secure schemas](https://gitlab.com/gitlab-org/security-products/security-report-schemas). Currently each new field to the report is added as an optional field. At some point, these fields be added as `required` in the schema if it makes sense to do so. Similarly there are fields that can be deprecated, deprecated fields can be removed, and constraints of certain fields may also change. Each change should be evaluated for the impact to ~"group::threat insights" and ~"section::sec" analyzers. Changes will be implemented and merged when stakeholders are ready. ## How to contribute MRs See https://gitlab.com/gitlab-org/gitlab/-/issues/339812#note_847042725 ## Proposed schema changes Acceptance for each group is given by their representative using the following emoji: :white_check_mark: (accepted), :warning: (no choice), :x: (rejected). Quorum for section-wide consensus is TBD. | Field | Change | Affects schemas | Impact on ~"group::threat insights" / Rails | Impact on ~"section::sec" / Analyzers | TI | CS | DAST | SCA | SAST | | ------ | ------ | ------ | ------ | ------ | ------ | ------ | ------ | ------ | ------ | | `scan` (done in [v15_wip](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/tree/v15_wip)) | Mark as `required` | all | None, scan is already optionally parsed | Must produce `scan` object, most do this already | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | | `scan.analyzer` (done in [v15_wip](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/tree/v15_wip)) | Mark as `required` | all | None, analyzer is already optionally parsed | Must produce `scan.analyzer` object, most don't do this already | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | | `scan.scanner` | Remove | all | :point_down: | :point_down: | :x: | :x: | :x: | :x: | :x: | | `scan.scanners[]` | New field | all | Rails will need to parse it if it exists, and save many scanners per scan, not just one. Tracking must be updated to track many scanners. UI must be updated to show a list. | Must replace `scan.scanner` with `scan.scanners[]`, ensure `scan.scanner[]` contains information about scanners, not the analyzer | :x: | :x: | :x: | :x: | :x: | | `vulnerabilities[].cve` (done in [v15_wip](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/tree/v15_wip)) | Remove field, remove from `required` | all | TBD | :point_down: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | | `vulnerabilities.id` (done in [v15_wip](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/tree/v15_wip)) | Mark as `required` | all | None, field is already parsed | Must produce `vulnerabilities[].id` | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | | `vulnerabilities[].scanner` (done in [v15_wip](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/tree/v15_wip)) | Remove field, remove from `required` | all | TBD, will need to rely on `scan.analyzer` | Should remove field | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | | `vulnerabilities[].category` (done in [v15_wip](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/tree/v15_wip)) | Remove field, remove from `required` | all | TBD, will need to rely on `scan.type` | Should remove field | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | | `vulnerabilities[].discovered_at` (done in [v15_wip](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/tree/v15_wip)) | Remove field (see [comment](https://gitlab.com/gitlab-org/gitlab/-/issues/339812#note_854345817)) | `dast` | None, the field is not parsed | DAST analyzers will need to update the format of the field | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | | `headers[].value` in the following places in `vulnerabilities[].evidence`: `request`, `response`, `supporting_messages.request`, `supporting_messages.response` (done in [v15_wip](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/tree/v15_wip)) | Remove `minLength: 1` constraint as HTTP spec allows empty values | `dast` | TBD | DAST analyzers should remove filtering of headers with empty value | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | | `vulnerabilities[].confidence` (done in [v15_wip](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/tree/v15_wip)) | Remove field, remove from `required` | all | TBD | Should remove field | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | | `vulnerabilities[].message` (done in [v15_wip](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/tree/v15_wip)) | Remove field, remove from `required` | all | Update references to rely off `name` in shorted form, truncated `description` for longer needs | Should remove field | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | | `vulnerabilities[].name` (done in [v15_wip](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/tree/v15_wip)) | Add `maxLength` constraint | all | None | None, but should align with Rails field limits | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | | `vulnerabilities[].description` (done in [v15_wip](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/tree/v15_wip)) | Add `maxLength` constraint | all | None | None, but should align with Rails field limits | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | | `$id` (done in [v15_wip](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/tree/v15_wip)) | New field (see [comment](https://gitlab.com/gitlab-org/gitlab/-/issues/339812#note_810760710)) | all | None | None | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | | `scan.start_time`, `scan.end_time` (done in [v15_wip](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/tree/v15_wip)) | Update `pattern` (see [comment](https://gitlab.com/gitlab-org/gitlab/-/issues/339812#note_810760710)) | all | None | None | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | | [`dependency.version`](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/blob/v14.0.3/src/security-report-format.json#L167) (done in [v15_wip](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/tree/v15_wip)) | Mark as `required` | `dependency_scanning` | None | None | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | | [`dependency.package`](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/blob/v14.0.3/src/security-report-format.json#L167) (done in [v15_wip](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/tree/v15_wip)) | Mark as `required` | `dependency_scanning` | None | None | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | | [`dependency.package.name`](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/blob/v14.0.3/src/security-report-format.json#L292) (done in [v15_wip](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/tree/v15_wip)) | Mark as `required` | `dependency_scanning` | None | None | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |