Security.OSV

This module contains the OSV datatype and its ToJSON instance. The module was initialized with http://json-to-haskell.chrispenner.ca/

Top-level data type

data Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific

OSV model parameterised over database-specific and ecosystem-specific fields.

A naïve consumer can parse Model Value Value Value Value for no loss of information.

A producer can instantiate unused database/ecosystem-specific fields at Data.Void.Void. () is not recommended, because Just () will serialise as an empty JSON array.

Constructors

Model

Fields

• modelSchemaVersion :: Text
• modelId :: Text
• modelModified :: UTCTime
• modelPublished :: Maybe UTCTime
• modelWithdrawn :: Maybe UTCTime
• modelAliases :: [Text]
• modelRelated :: [Text]
• modelSummary :: Maybe Text

  A one-line, English textual summary of the vulnerability. It is recommended that this field be kept short, on the order of no more than 120 characters.

• modelDetails :: Maybe Text

  CommonMark markdown giving additional English textual details about the vulnerability.

• modelSeverity :: [Severity]
• modelAffected :: [Affected affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific]
• modelReferences :: [Reference]
• modelCredits :: [Credit]
• modelDatabaseSpecific :: Maybe dbSpecific

Instances

(FromJSON dbSpecific, FromJSON affectedEcosystemSpecific, FromJSON affectedDbSpecific, FromJSON rangeDbSpecific) => FromJSON (Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific)

Defined in Security.OSV

Methods

parseJSON :: Value -> Parser (Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific)

parseJSONList :: Value -> Parser [Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific]

omittedField :: Maybe (Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific)

(ToJSON dbSpecific, ToJSON affectedEcosystemSpecific, ToJSON affectedDbSpecific, ToJSON rangeDbSpecific) => ToJSON (Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific)

Defined in Security.OSV

Methods

toJSON :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> Value

toEncoding :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> Encoding

toJSONList :: [Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific] -> Value

toEncodingList :: [Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific] -> Encoding

omitField :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> Bool

(Show rangeDbSpecific, Show affectedDbSpecific, Show affectedEcosystemSpecific, Show dbSpecific) => Show (Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific)

Defined in Security.OSV

Methods

showsPrec :: Int -> Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> ShowS

show :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> String

showList :: [Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific] -> ShowS

(Eq rangeDbSpecific, Eq affectedDbSpecific, Eq affectedEcosystemSpecific, Eq dbSpecific) => Eq (Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific)

Defined in Security.OSV

Methods

(==) :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> Bool

(/=) :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> Bool

newModel

Arguments

:: Text

schema version

-> Text

id

-> UTCTime

modified

-> Model dbs aes adbs rdbs

Construct a new model with only the required fields

newModel'

Arguments

:: Text

id

-> UTCTime

modified

-> Model dbs aes adbs rdbs

Construct a new model given id and modified values, using defaultSchemaVersion.

defaultSchemaVersion :: Text

Schema version implemented by this library. Currently 1.5.0.

Subsidiary data types

data Affected dbSpecific ecosystemSpecific rangeDbSpecific

Constructors

Affected

Fields

• affectedRanges :: [Range rangeDbSpecific]
• affectedPackage :: Package
• affectedSeverity :: [Severity]
• affectedEcosystemSpecific :: Maybe ecosystemSpecific
• affectedDatabaseSpecific :: Maybe dbSpecific

Instances

(FromJSON ecosystemSpecific, FromJSON dbSpecific, FromJSON rangeDbSpecific) => FromJSON (Affected ecosystemSpecific dbSpecific rangeDbSpecific)

Defined in Security.OSV

Methods

parseJSON :: Value -> Parser (Affected ecosystemSpecific dbSpecific rangeDbSpecific)

parseJSONList :: Value -> Parser [Affected ecosystemSpecific dbSpecific rangeDbSpecific]

omittedField :: Maybe (Affected ecosystemSpecific dbSpecific rangeDbSpecific)

(ToJSON ecosystemSpecific, ToJSON dbSpecific, ToJSON rangeDbSpecific) => ToJSON (Affected ecosystemSpecific dbSpecific rangeDbSpecific)

Defined in Security.OSV

Methods

toJSON :: Affected ecosystemSpecific dbSpecific rangeDbSpecific -> Value

toEncoding :: Affected ecosystemSpecific dbSpecific rangeDbSpecific -> Encoding

toJSONList :: [Affected ecosystemSpecific dbSpecific rangeDbSpecific] -> Value

toEncodingList :: [Affected ecosystemSpecific dbSpecific rangeDbSpecific] -> Encoding

omitField :: Affected ecosystemSpecific dbSpecific rangeDbSpecific -> Bool

(Show rangeDbSpecific, Show ecosystemSpecific, Show dbSpecific) => Show (Affected dbSpecific ecosystemSpecific rangeDbSpecific)

Defined in Security.OSV

Methods

showsPrec :: Int -> Affected dbSpecific ecosystemSpecific rangeDbSpecific -> ShowS

show :: Affected dbSpecific ecosystemSpecific rangeDbSpecific -> String

showList :: [Affected dbSpecific ecosystemSpecific rangeDbSpecific] -> ShowS

(Eq rangeDbSpecific, Eq ecosystemSpecific, Eq dbSpecific) => Eq (Affected dbSpecific ecosystemSpecific rangeDbSpecific)

Defined in Security.OSV

Methods

(==) :: Affected dbSpecific ecosystemSpecific rangeDbSpecific -> Affected dbSpecific ecosystemSpecific rangeDbSpecific -> Bool

(/=) :: Affected dbSpecific ecosystemSpecific rangeDbSpecific -> Affected dbSpecific ecosystemSpecific rangeDbSpecific -> Bool

data Credit

Constructors

Credit

Fields

• creditType :: CreditType
• creditName :: Text

  The name, label, or other identifier of the individual or entity being credited, using whatever notation the creditor prefers.

• creditContacts :: [Text]

  Fully qualified, plain-text URLs at which the credited can be reached.

Instances

FromJSON Credit

Defined in Security.OSV

Methods

parseJSON :: Value -> Parser Credit

parseJSONList :: Value -> Parser [Credit]

omittedField :: Maybe Credit

ToJSON Credit

Defined in Security.OSV

Methods

toJSON :: Credit -> Value

toEncoding :: Credit -> Encoding

toJSONList :: [Credit] -> Value

toEncodingList :: [Credit] -> Encoding

omitField :: Credit -> Bool

Show Credit

Defined in Security.OSV

Methods

showsPrec :: Int -> Credit -> ShowS

show :: Credit -> String

showList :: [Credit] -> ShowS

Eq Credit

Defined in Security.OSV

Methods

(==) :: Credit -> Credit -> Bool

(/=) :: Credit -> Credit -> Bool

data CreditType

Types of individuals or entities to be credited in relation to an advisory.

Constructors

CreditTypeFinder

Identified the vulnerability

CreditTypeReporter

Notified the vendor of the vulnerability to a CNA

CreditTypeAnalyst

Validated the vulnerability to ensure accuracy or severity

CreditTypeCoordinator

Facilitated the coordinated response process

CreditTypeRemediationDeveloper

prepared a code change or other remediation plans

CreditTypeRemediationReviewer

Reviewed vulnerability remediation plans or code changes for effectiveness and completeness

CreditTypeRemediationVerifier

Tested and verified the vulnerability or its remediation

CreditTypeTool

Names of tools used in vulnerability discovery or identification

CreditTypeSponsor

Supported the vulnerability identification or remediation activities

CreditTypeOther

Any other type or role that does not fall under the categories described above

Instances

FromJSON CreditType

Defined in Security.OSV

Methods

parseJSON :: Value -> Parser CreditType

parseJSONList :: Value -> Parser [CreditType]

omittedField :: Maybe CreditType

ToJSON CreditType

Defined in Security.OSV

Methods

toJSON :: CreditType -> Value

toEncoding :: CreditType -> Encoding

toJSONList :: [CreditType] -> Value

toEncodingList :: [CreditType] -> Encoding

omitField :: CreditType -> Bool

Show CreditType

Defined in Security.OSV

Methods

showsPrec :: Int -> CreditType -> ShowS

show :: CreditType -> String

showList :: [CreditType] -> ShowS

Eq CreditType

Defined in Security.OSV

Methods

(==) :: CreditType -> CreditType -> Bool

(/=) :: CreditType -> CreditType -> Bool

creditTypes :: [(CreditType, Text)]

Bijection of credit types and their string representations

data Event a

Constructors

EventIntroduced a

EventFixed a

EventLastAffected a

EventLimit a

Instances

FromJSON a => FromJSON (Event a)

Defined in Security.OSV

Methods

parseJSON :: Value -> Parser (Event a)

parseJSONList :: Value -> Parser [Event a]

omittedField :: Maybe (Event a)

ToJSON a => ToJSON (Event a)

Defined in Security.OSV

Methods

toJSON :: Event a -> Value

toEncoding :: Event a -> Encoding

toJSONList :: [Event a] -> Value

toEncodingList :: [Event a] -> Encoding

omitField :: Event a -> Bool

Show a => Show (Event a)

Defined in Security.OSV

Methods

showsPrec :: Int -> Event a -> ShowS

show :: Event a -> String

showList :: [Event a] -> ShowS

Eq a => Eq (Event a)

Defined in Security.OSV

Methods

(==) :: Event a -> Event a -> Bool

(/=) :: Event a -> Event a -> Bool

Ord a => Ord (Event a)

Defined in Security.OSV

Methods

compare :: Event a -> Event a -> Ordering

(<) :: Event a -> Event a -> Bool

(<=) :: Event a -> Event a -> Bool

(>) :: Event a -> Event a -> Bool

(>=) :: Event a -> Event a -> Bool

max :: Event a -> Event a -> Event a

min :: Event a -> Event a -> Event a

data Package

Constructors

Package

Fields

• packageName :: Text
• packageEcosystem :: Text
• packagePurl :: Maybe Text

Instances

FromJSON Package

Defined in Security.OSV

Methods

parseJSON :: Value -> Parser Package

parseJSONList :: Value -> Parser [Package]

omittedField :: Maybe Package

ToJSON Package

Defined in Security.OSV

Methods

toJSON :: Package -> Value

toEncoding :: Package -> Encoding

toJSONList :: [Package] -> Value

toEncodingList :: [Package] -> Encoding

omitField :: Package -> Bool

Show Package

Defined in Security.OSV

Methods

showsPrec :: Int -> Package -> ShowS

show :: Package -> String

showList :: [Package] -> ShowS

Eq Package

Defined in Security.OSV

Methods

(==) :: Package -> Package -> Bool

(/=) :: Package -> Package -> Bool

Ord Package

Defined in Security.OSV

Methods

compare :: Package -> Package -> Ordering

(<) :: Package -> Package -> Bool

(<=) :: Package -> Package -> Bool

(>) :: Package -> Package -> Bool

(>=) :: Package -> Package -> Bool

max :: Package -> Package -> Package

min :: Package -> Package -> Package

data Range dbSpecific

Constructors

RangeSemVer [Event Text] (Maybe dbSpecific)

RangeEcosystem [Event Text] (Maybe dbSpecific)

RangeGit

Fields

• [Event Text]
• Text

  Git repo URL

• (Maybe dbSpecific)

Instances

FromJSON dbSpecific => FromJSON (Range dbSpecific)

Defined in Security.OSV

Methods

parseJSON :: Value -> Parser (Range dbSpecific)

parseJSONList :: Value -> Parser [Range dbSpecific]

omittedField :: Maybe (Range dbSpecific)

ToJSON dbSpecific => ToJSON (Range dbSpecific)

Defined in Security.OSV

Methods

toJSON :: Range dbSpecific -> Value

toEncoding :: Range dbSpecific -> Encoding

toJSONList :: [Range dbSpecific] -> Value

toEncodingList :: [Range dbSpecific] -> Encoding

omitField :: Range dbSpecific -> Bool

Show dbSpecific => Show (Range dbSpecific)

Defined in Security.OSV

Methods

showsPrec :: Int -> Range dbSpecific -> ShowS

show :: Range dbSpecific -> String

showList :: [Range dbSpecific] -> ShowS

Eq dbSpecific => Eq (Range dbSpecific)

Defined in Security.OSV

Methods

(==) :: Range dbSpecific -> Range dbSpecific -> Bool

(/=) :: Range dbSpecific -> Range dbSpecific -> Bool

data Reference

Constructors

Reference

Fields

• referencesType :: ReferenceType
• referencesUrl :: Text

Instances

FromJSON Reference

Defined in Security.OSV

Methods

parseJSON :: Value -> Parser Reference

parseJSONList :: Value -> Parser [Reference]

omittedField :: Maybe Reference

ToJSON Reference

Defined in Security.OSV

Methods

toJSON :: Reference -> Value

toEncoding :: Reference -> Encoding

toJSONList :: [Reference] -> Value

toEncodingList :: [Reference] -> Encoding

omitField :: Reference -> Bool

Show Reference

Defined in Security.OSV

Methods

showsPrec :: Int -> Reference -> ShowS

show :: Reference -> String

showList :: [Reference] -> ShowS

Eq Reference

Defined in Security.OSV

Methods

(==) :: Reference -> Reference -> Bool

(/=) :: Reference -> Reference -> Bool

data ReferenceType

Constructors

ReferenceTypeAdvisory

A published security advisory for the vulnerability.

ReferenceTypeArticle

An article or blog post describing the vulnerability.

ReferenceTypeDetection

A tool, script, scanner, or other mechanism that allows for detection of the vulnerability in production environments. e.g. YARA rules, hashes, virus signature, or other scanners.

ReferenceTypeDiscussion

A social media discussion regarding the vulnerability, e.g. a Twitter, Mastodon, Hacker News, or Reddit thread.

ReferenceTypeReport

A report, typically on a bug or issue tracker, of the vulnerability.

ReferenceTypeFix

A source code browser link to the fix (e.g., a GitHub commit) Note that the Fix type is meant for viewing by people using web browsers. Programs interested in analyzing the exact commit range would do better to use the GIT-typed affected Range entries.

ReferenceTypeIntroduced

A source code browser link to the introduction of the vulnerability (e.g., a GitHub commit) Note that the introduced type is meant for viewing by people using web browsers. Programs interested in analyzing the exact commit range would do better to use the GIT-typed affected Range entries.

ReferenceTypePackage

A home web page for the package.

ReferenceTypeEvidence

A demonstration of the validity of a vulnerability claim, e.g. app.any.run replaying the exploitation of the vulnerability.

ReferenceTypeWeb

A web page of some unspecified kind.

Instances

FromJSON ReferenceType

Defined in Security.OSV

Methods

parseJSON :: Value -> Parser ReferenceType

parseJSONList :: Value -> Parser [ReferenceType]

omittedField :: Maybe ReferenceType

ToJSON ReferenceType

Defined in Security.OSV

Methods

toJSON :: ReferenceType -> Value

toEncoding :: ReferenceType -> Encoding

toJSONList :: [ReferenceType] -> Value

toEncodingList :: [ReferenceType] -> Encoding

omitField :: ReferenceType -> Bool

Show ReferenceType

Defined in Security.OSV

Methods

showsPrec :: Int -> ReferenceType -> ShowS

show :: ReferenceType -> String

showList :: [ReferenceType] -> ShowS

Eq ReferenceType

Defined in Security.OSV

Methods

(==) :: ReferenceType -> ReferenceType -> Bool

(/=) :: ReferenceType -> ReferenceType -> Bool

referenceTypes :: [(ReferenceType, Text)]

Bijection of reference types and their string representations

newtype Severity

Severity. There is no Ord instance. Severity scores should be calculated and compared in a more nuanced way than Ord can provide for.

Constructors

Severity CVSS

Instances

FromJSON Severity

Defined in Security.OSV

Methods

parseJSON :: Value -> Parser Severity

parseJSONList :: Value -> Parser [Severity]

omittedField :: Maybe Severity

ToJSON Severity

Defined in Security.OSV

Methods

toJSON :: Severity -> Value

toEncoding :: Severity -> Encoding

toJSONList :: [Severity] -> Value

toEncodingList :: [Severity] -> Encoding

omitField :: Severity -> Bool

Show Severity

Defined in Security.OSV

Methods

showsPrec :: Int -> Severity -> ShowS

show :: Severity -> String

showList :: [Severity] -> ShowS

Eq Severity

Defined in Security.OSV

Methods

(==) :: Severity -> Severity -> Bool

(/=) :: Severity -> Severity -> Bool