Interface VulnerabilityDetails

Vulnerability details

Data related to a specific vulnerability in a specific workspace that the vulnerability is present in. Must specify at least one association.

interface VulnerabilityDetails {
    addAssociations?: ({
        associationType: "issueIdOrKeys";
        values: string[];
    } & {
        [key: string]: unknown;
    })[];
    additionalInfo?: {
        content: string;
        url?: string;
    } & {
        [key: string]: unknown;
    };
    associationsLastUpdated?: string;
    associationsUpdateSequenceNumber?: number;
    containerId: string;
    description: string;
    displayName: string;
    id: string;
    identifiers?: unknown[];
    introducedDate: string;
    lastUpdated: string;
    removeAssociations?: ({
        associationType: "issueIdOrKeys";
        values: string[];
    } & {
        [key: string]: unknown;
    })[];
    schemaVersion: "1.0";
    severity: unknown;
    status:
        | "closed"
        | "open"
        | "unknown"
        | "ignored";
    type:
        | "unknown"
        | "sca"
        | "sast"
        | "dast";
    updateSequenceNumber: number;
    url: string;
}

Properties

addAssociations? additionalInfo? associationsLastUpdated? associationsUpdateSequenceNumber? containerId description displayName id identifiers? introducedDate lastUpdated removeAssociations? schemaVersion severity status type updateSequenceNumber url

Properties

OptionaladdAssociations

addAssociations?: ({
    associationType: "issueIdOrKeys";
    values: string[];
} & {
    [key: string]: unknown;
})[]

The associations (e.g. Jira issue) to add in addition to the currently stored associations of the Security Vulnerability.

OptionaladditionalInfo

additionalInfo?: {
    content: string;
    url?: string;
} & {
    [key: string]: unknown;
}

VulnerabilityAdditionalInfo

Extra information (optional). This data will be shown in the security feature under the vulnerability displayName.

Type declaration

  • content: string

    The content of the additionalInfo.

    Example

    More information on the vulnerability, as a string
  • Optionalurl?: string

    Optional URL linking to the information

    Example

    https://example.com/project/CWE-123/additionalInfo

OptionalassociationsLastUpdated

associationsLastUpdated?: string

An ISO-8601 Date-time string representing the last time the provider updated associations on this entity.

Expected format is an RFC3339 formatted string.

Example

2018-01-20T23:27:25.000Z

OptionalassociationsUpdateSequenceNumber

associationsUpdateSequenceNumber?: number

A sequence number to compare when writing entity associations to the database.

This can be any monotonically increasing number. A highly recommended implementation is to use epoch millis.

This is an optional field. If it is not provided it will default to being equal to the corresponding entity's updateSequenceNumber.

Associations are written following a LastWriteWins strategy, association that are received with an associationsUpdateSequenceNumber lower than what is currently stored will be ignored.

Example

1523494301448

containerId

containerId: string

The identifier of the Container where this Vulnerability was found. Must be unique for a given Provider. This must follow this regex pattern: [a-zA-Z0-9\\-_.~@:{}=]+(/[a-zA-Z0-9\\-_.~@:{}=]+)*

Example

111-222-333

description

description: string

A description of the issue in markdown format that will be shown in the UI and used when creating Jira Issues. HTML tags are not supported in the markdown format. For creating a new line \n can be used. Read more about the accepted markdown transformations here.

Example

## Overview


Affected versions of this package are vulnerable to MeltLeak

displayName

displayName: string

The human-readable name for the Vulnerability. Will be shown in the UI.

If not provided, will use the ID for display.

Example

curl/libcurl3 - Buffer Override

id

id: string

The identifier for the Vulnerability. Must be unique for a given Provider.

Example

111-222-333

Optionalidentifiers

identifiers?: unknown[]

The identifying information for the Vulnerability.

introducedDate

introducedDate: string

The timestamp to present to the user that shows when the Vulnerability was introduced.

Expected format is an RFC3339 formatted string.

Example

2018-01-20T23:27:25.000Z

lastUpdated

lastUpdated: string

The last-updated timestamp to present to the user the last time the Vulnerability was updated.

Expected format is an RFC3339 formatted string.

Example

2018-01-20T23:27:25.000Z

OptionalremoveAssociations

removeAssociations?: ({
    associationType: "issueIdOrKeys";
    values: string[];
} & {
    [key: string]: unknown;
})[]

The associations (e.g. Jira issue) to remove from currently stored associations of the Security Vulnerability.

schemaVersion

schemaVersion

The VulnerabilityData schema version used for this vulnerability data.

Placeholder to support potential schema changes in the future.

Example

1

severity

severity: unknown

VulnerabilitySeverity

Severity information for a single Vulnerability.

This is the severity information that will be presented to the user on e.g. the Jira Security screen.

status

status:
    | "closed"
    | "open"
    | "unknown"
    | "ignored"

VulnerabilityStatus

The current status of the Vulnerability.

Example

open

type

type:
    | "unknown"
    | "sca"
    | "sast"
    | "dast"

The type of Vulnerability detected.

Example

sca

updateSequenceNumber

updateSequenceNumber: number

An ID used to apply an ordering to updates for this Vulnerability in the case of out-of-order receipt of update requests.

This can be any monotonically increasing number. A suggested implementation is to use epoch millis from the Provider system, but other alternatives are valid (e.g. a Provider could store a counter against each Vulnerability and increment that on each update to Jira).

Updates for a Vulnerability that are received with an updateSequenceId lower than what is currently stored will be ignored.

Example

1523494301448

url

url: string

A URL users can use to link to a summary view of this vulnerability, if appropriate.

This could be any location that makes sense in the Provider system (e.g. if the summary information comes from a specific project, it might make sense to link the user to the vulnerability in that project).

Example

https://example.com/project/CWE-123/summary

Settings

Member Visibility

On This Page

Properties