Skip to content

VEX Improvements #203

@dlg1206

Description

@dlg1206

Overview

There could be a number of improvements to the VEXBuilder I found while working with it for the new VEXController / Service for the API

Acceptance Criteria

  • Factory to create new clients
    Current implementation is a switch statement, which worked for the short timeline. We can redevelop this to function similarly to the SerializerFactory
    Example
String client = osv;
VulnerabilityDBClient vc = VulnerabilityDBClientFacotry.createClient(client);

This can help abstract the code and make it expandable for new clients

  • VEX Builders constructors
    Currently the builders are static classes, but they could be made to be their own classes. Cases like this:
        vb.setVEXIdentifier(sbom.getName());
        vb.setDocVersion("1.0");
        vb.setTimeFirstIssued(creationTime);
        vb.setTimeLastUpdated(creationTime);

can be solved with constructors.

  • VEX Builders Factories
    This may be too much but we need a more expandable way to add new VEX standards. The current implementation is limiting
switch (format.toLowerCase()) {
    case "cyclonedx" -> {
        vb.setOriginType(VEXType.CYCLONE_DX);
        vb.setSpecVersion("1.4");
    }
    case "csaf" -> {
        vb.setOriginType(VEXType.CSAF);
        vb.setSpecVersion("2.0");
    }
}
  • Optional Key method
    NVD and future databases may have a key option. All VEX generations statements should be able to handle key or no key cases to prevent if-else trees
if (client.equalsIgnoreCase("nvd") && apiKey != null)
    statements = vc.getVEXStatements((SBOMPackage) c, apiKey);
else
    statements = vc.getVEXStatements((SBOMPackage) c);

A better solution would be:

statements = vc.getVEXStatements((SBOMPackage) c, apiKey);

And let the client handle the key. As a note: the API key should NOT be a field in the client. We want to limit storing the key as much as possible, so the scope should be restricted to the method

  • AddAll VEXStatements method
    Utility in builders to prevent looping through statements to add them one at a time
if (!statements.isEmpty())
    for (VEXStatement vs : statements)
        vb.addVEXStatement(vs);
  • ~80% Code Coverage

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions