github-mirrors/DependencyCheck
1
0
Fork 0
mirror of https://github.com/ysoftdevs/DependencyCheck.git synced 2026-01-16 16:46:55 +01:00
Code Issues Packages Projects Releases Wiki Activity

Lots of updates, incorporated nvd cve data.

Browse Source 
Former-commit-id: d54b2964cf11776521ee7114f536c8c3d9e14028
This commit is contained in:
jeremylong
2012-10-23 14:57:50 -04:00
parent 65700a5a08
commit 2f9b1f6314
156 changed files with 12925 additions and 194795 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/test/java/org/codesecure/dependencycheck/EngineTest.java
View File

@@ -4,7 +4,6 @@
*/
package org.codesecure.dependencycheck;
import org.codesecure.dependencycheck.data.lucene.BaseIndexTestCase;
import org.codesecure.dependencycheck.reporting.ReportGenerator;
import org.junit.After;
import org.junit.AfterClass;
@@ -17,10 +16,11 @@ import static org.junit.Assert.*;
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class EngineTest extends BaseIndexTestCase {
public class EngineTest {
public EngineTest(String testName) {
super(testName);
public EngineTest() throws Exception {
org.codesecure.dependencycheck.data.nvdcve.BaseIndexTestCase.ensureIndexExists();
org.codesecure.dependencycheck.data.cpe.BaseIndexTestCase.ensureIndexExists();
}
@BeforeClass

8
src/test/java/org/codesecure/dependencycheck/data/lucene/BaseIndexTestCase.java → src/test/java/org/codesecure/dependencycheck/data/cpe/BaseIndexTestCase.java
View File

@@ -2,7 +2,7 @@
* To change this template, choose Tools | Templates
* and open the template in the editor.
*/
package org.codesecure.dependencycheck.data.lucene;
package org.codesecure.dependencycheck.data.cpe;
import java.io.BufferedInputStream;
import java.io.BufferedOutputStream;
@@ -30,15 +30,15 @@ public abstract class BaseIndexTestCase extends TestCase {
ensureIndexExists();
}
protected void ensureIndexExists() throws Exception {
String indexPath = Settings.getString("cpe");
public static void ensureIndexExists() throws Exception {
String indexPath = Settings.getString(Settings.KEYS.CPE_INDEX);
java.io.File f = new File(indexPath);
if (!f.exists()) {
f.mkdirs();
FileInputStream fis = null;
ZipInputStream zin = null;
try {
File path = new File(this.getClass().getClassLoader().getResource("index.cpe.zip").getPath());
File path = new File(BaseIndexTestCase.class.getClassLoader().getResource("index.cpe.zip").getPath());
fis = new FileInputStream(path);
zin = new ZipInputStream(new BufferedInputStream(fis));
ZipEntry entry;

1
src/test/java/org/codesecure/dependencycheck/data/cpe/CPEAnalyzerTest.java
View File

@@ -11,7 +11,6 @@ import java.util.List;
import java.util.Set;
import org.apache.lucene.index.CorruptIndexException;
import org.apache.lucene.queryParser.ParseException;
import org.codesecure.dependencycheck.data.lucene.BaseIndexTestCase;
import org.codesecure.dependencycheck.dependency.Dependency;
import org.codesecure.dependencycheck.analyzer.JarAnalyzer;
import org.codesecure.dependencycheck.dependency.Evidence;

1
src/test/java/org/codesecure/dependencycheck/data/cpe/EntryTest.java
View File

@@ -4,7 +4,6 @@
*/
package org.codesecure.dependencycheck.data.cpe;
import org.codesecure.dependencycheck.data.cpe.Entry;
import junit.framework.TestCase;
/**

16
src/test/java/org/codesecure/dependencycheck/data/cpe/IndexTest.java → src/test/java/org/codesecure/dependencycheck/data/cpe/IndexIntegrationTest.java
View File

@@ -5,12 +5,7 @@
package org.codesecure.dependencycheck.data.cpe;
import java.io.File;
import org.codesecure.dependencycheck.data.lucene.BaseIndexTestCase;
import java.io.IOException;
import java.util.logging.Level;
import java.util.logging.Logger;
import org.apache.lucene.analysis.Analyzer;
import org.apache.lucene.index.CorruptIndexException;
import org.apache.lucene.store.Directory;
import org.junit.After;
import org.junit.AfterClass;
@@ -23,9 +18,9 @@ import static org.junit.Assert.*;
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class IndexTest extends BaseIndexTestCase {
public class IndexIntegrationTest extends BaseIndexTestCase {
public IndexTest(String testCase) {
public IndexIntegrationTest(String testCase) {
super(testCase);
}
@@ -78,8 +73,8 @@ public class IndexTest extends BaseIndexTestCase {
* Test of update method, of class Index.
*/
@Test
public void testUpdateIndexFromWeb() throws Exception {
System.out.println("updateIndexFromWeb");
public void testUpdate() throws Exception {
System.out.println("update");
Index instance = new Index();
instance.update();
}
@@ -91,8 +86,7 @@ public class IndexTest extends BaseIndexTestCase {
public void testUpdateNeeded() throws Exception {
System.out.println("updateNeeded");
Index instance = new Index();
long expResult = 0L;
long result = instance.updateNeeded();
instance.updateNeeded();
//if an exception is thrown this test fails. However, because it depends on the
// order of the tests what this will return I am just testing for the exception.
//assertTrue(expResult < result);

45
src/test/java/org/codesecure/dependencycheck/data/cpe/xml/CPEHandlerTest.java
View File

@@ -1,45 +0,0 @@
/*
* To change this template, choose Tools | Templates
* and open the template in the editor.
*/
package org.codesecure.dependencycheck.data.cpe.xml;
import java.io.File;
import junit.framework.TestCase;
/**
*
* @author jeremy
*/
public class CPEHandlerTest extends TestCase {
public CPEHandlerTest(String testName) {
super(testName);
}
@Override
protected void setUp() throws Exception {
super.setUp();
}
@Override
protected void tearDown() throws Exception {
super.tearDown();
}
/**
* Test of all methods within class CPEHandler.
*/
public void testHandler() throws Exception {
System.out.println("CPEHandler");
File path = new File(this.getClass().getClassLoader().getResource("official-cpe-dictionary_v2.2.xml").getPath());
Importer.importXML(path.getCanonicalPath());
}
}

2
src/test/java/org/codesecure/dependencycheck/data/cpe/xml/ImporterTest.java
View File

@@ -32,7 +32,7 @@ public class ImporterTest extends TestCase {
/**
* Test of all methods within class CPEHandler.
* @throws Exception is thrown when an excpetion occurs.
* @throws Exception is thrown when an excretion occurs.
*/
public void testHandler() throws Exception {
System.out.println("importXML");

98
src/test/java/org/codesecure/dependencycheck/data/nvdcve/BaseIndexTestCase.java Normal file
View File

@@ -0,0 +1,98 @@
/*
* To change this template, choose Tools | Templates
* and open the template in the editor.
*/
package org.codesecure.dependencycheck.data.nvdcve;
import org.codesecure.dependencycheck.data.cpe.*;
import java.io.BufferedInputStream;
import java.io.BufferedOutputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.util.zip.ZipEntry;
import java.util.zip.ZipInputStream;
import junit.framework.TestCase;
import org.codesecure.dependencycheck.utils.Settings;
/**
*
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public abstract class BaseIndexTestCase extends TestCase {
public BaseIndexTestCase(String testName) {
super(testName);
}
@Override
protected void setUp() throws Exception {
super.setUp();
ensureIndexExists();
}
public static void ensureIndexExists() throws Exception {
String indexPath = Settings.getString(Settings.KEYS.CVE_INDEX);
java.io.File f = new File(indexPath);
if (!f.exists()) {
f.mkdirs();
FileInputStream fis = null;
ZipInputStream zin = null;
try {
File path = new File(BaseIndexTestCase.class.getClassLoader().getResource("index.nvdcve.zip").getPath());
fis = new FileInputStream(path);
zin = new ZipInputStream(new BufferedInputStream(fis));
ZipEntry entry;
while ((entry = zin.getNextEntry()) != null) {
if (entry.isDirectory()) {
continue;
}
int BUFFER = 2048;
String outputName = indexPath + File.separatorChar + entry.getName();
FileOutputStream fos = null;
BufferedOutputStream dest = null;
try {
File o = new File(outputName);
// File oPath = new File(o.getParent());
// if (!oPath.exists()) {
// oPath.mkdir();
// }
o.createNewFile();
fos = new FileOutputStream(o,false);
dest = new BufferedOutputStream(fos, BUFFER);
byte data[] = new byte[BUFFER];
int count;
while ((count = zin.read(data, 0, BUFFER)) != -1) {
dest.write(data, 0, count);
}
} catch (Exception ex) {
String ignore = ex.getMessage();
} finally {
try {
dest.flush();
dest.close();
dest = null;
} catch (Throwable ex) { String ignore = ex.getMessage(); }
try {
fos.close();
fos = null;
} catch (Throwable ex) { String ignore = ex.getMessage(); }
}
}
} finally {
try {
if (zin!=null) {
zin.close();
}
zin = null;
} catch (Throwable ex) { String ignore = ex.getMessage(); }
try {
if (fis!=null) {
fis.close();
}
fis = null;
} catch (Throwable ex) { String ignore = ex.getMessage(); }
}
}
}
}

85
src/test/java/org/codesecure/dependencycheck/data/nvdcve/IndexIntegrationTest.java Normal file
View File

@@ -0,0 +1,85 @@
/*
* To change this template, choose Tools | Templates
* and open the template in the editor.
*/
package org.codesecure.dependencycheck.data.nvdcve;
import java.io.File;
import java.util.Map;
import org.apache.lucene.store.Directory;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertTrue;
import org.junit.*;
/**
*
* @author Jeremy
*/
public class IndexIntegrationTest extends BaseIndexTestCase {
public IndexIntegrationTest(String testName) {
super(testName);
}
@BeforeClass
public static void setUpClass() throws Exception {
}
@AfterClass
public static void tearDownClass() throws Exception {
}
@Before
public void setUp() {
}
@After
public void tearDown() {
}
/**
* Test of retrieveCurrentTimestampFromWeb method, of class Index.
*/
@Test
public void testRetrieveCurrentTimestampFromWeb() throws Exception {
System.out.println("retrieveCurrentTimestampFromWeb");
Index instance = new Index();
Map<String, Index.NvdCveUrl> result = instance.retrieveCurrentTimestampsFromWeb();
assertEquals(12, result.size());
}
/**
* Test of getDirectory method, of class Index.
*/
@Test
public void testGetDirectory() throws Exception {
System.out.println("getDirectory");
Index instance = new Index();
String exp = File.separatorChar + "target" + File.separatorChar + "data" + File.separatorChar + "cve";
Directory result = instance.getDirectory();
assertTrue(result.toString().contains(exp));
}
/**
* Test of update method, of class Index.
*/
@Test
public void testUpdate() throws Exception {
System.out.println("update");
Index instance = new Index();
instance.update();
}
/**
* Test of updateNeeded method, of class Index.
*/
@Test
public void testUpdateNeeded() throws Exception {
System.out.println("updateNeeded");
Index instance = new Index();
instance.updateNeeded();
//if an exception is thrown this test fails. However, because it depends on the
// order of the tests what this will return I am just testing for the exception.
}
}

77
src/test/java/org/codesecure/dependencycheck/data/nvdcve/xml/NvdCveXmlFilterTest.java Normal file
View File

@@ -0,0 +1,77 @@
/*
* To change this template, choose Tools | Templates
* and open the template in the editor.
*/
package org.codesecure.dependencycheck.data.nvdcve.xml;
import java.io.BufferedInputStream;
import java.io.DataInputStream;
import java.io.File;
import java.io.FileReader;
import java.io.IOException;
import java.io.InputStream;
import java.io.Reader;
import java.net.MalformedURLException;
import javax.xml.bind.JAXBContext;
import javax.xml.bind.JAXBException;
import javax.xml.parsers.ParserConfigurationException;
import javax.xml.parsers.SAXParserFactory;
import org.codesecure.dependencycheck.data.nvdcve.generated.VulnerabilityType;
import org.junit.After;
import org.junit.AfterClass;
import org.junit.Before;
import org.junit.BeforeClass;
import org.junit.Test;
import static org.junit.Assert.*;
import org.xml.sax.Attributes;
import org.xml.sax.InputSource;
import org.xml.sax.Locator;
import org.xml.sax.SAXException;
import org.xml.sax.XMLReader;
/**
*
* @author Jeremy
*/
public class NvdCveXmlFilterTest {
public NvdCveXmlFilterTest() {
}
@BeforeClass
public static void setUpClass() {
}
@AfterClass
public static void tearDownClass() {
}
@Before
public void setUp() {
}
@After
public void tearDown() {
}
/**
* Test of process method, of class NvdCveXmlFilter.
*/
@Test
public void testFilter() throws JAXBException, SAXException, ParserConfigurationException, MalformedURLException, IOException {
System.out.println("filter");
SAXParserFactory factory = SAXParserFactory.newInstance();
factory.setNamespaceAware(true);
XMLReader reader = factory.newSAXParser().getXMLReader();
JAXBContext context = JAXBContext.newInstance("org.codesecure.dependencycheck.data.nvdcve.generated");
NvdCveXmlFilter filter = new NvdCveXmlFilter(context);
reader.setContentHandler(filter);
File file = new File(this.getClass().getClassLoader().getResource("nvdcve-2.0-2012.xml").getPath());
Reader fileReader = new FileReader(file);
InputSource is = new InputSource(fileReader);
reader.parse(is);
}
}

2
src/test/java/org/codesecure/dependencycheck/reporting/ReportGeneratorTest.java
View File

@@ -10,7 +10,7 @@ import java.util.ArrayList;
import java.io.File;
import org.codesecure.dependencycheck.dependency.Dependency;
import java.util.HashMap;
import org.codesecure.dependencycheck.data.lucene.BaseIndexTestCase;
import org.codesecure.dependencycheck.data.cpe.BaseIndexTestCase;
import java.util.Map;
import org.codesecure.dependencycheck.dependency.Evidence.Confidence;
import org.junit.After;

2
src/test/java/org/codesecure/dependencycheck/utils/ChecksumTest.java
View File

@@ -32,7 +32,7 @@ public class ChecksumTest extends TestCase {
/**
* Test of getChecksum method, of class Checksum.
* @throws Exception thrown when an excpetion occurs.
* @throws Exception thrown when an exception occurs.
*/
@Test
public void testGetChecksum() throws Exception {

6
src/test/java/org/codesecure/dependencycheck/utils/SettingsTest.java
View File

@@ -101,7 +101,7 @@ public class SettingsTest extends TestCase {
* Test of getInt method, of class Settings.
*/
@Test
public void testGetInt() {
public void testGetInt() throws InvalidSettingException {
System.out.println("getInt");
String key = "SomeNumber";
int expResult = 85;
@@ -114,7 +114,7 @@ public class SettingsTest extends TestCase {
* Test of getLong method, of class Settings.
*/
@Test
public void testGetLong() {
public void testGetLong() throws InvalidSettingException {
System.out.println("getLong");
String key = "SomeNumber";
long expResult = 300L;
@@ -127,7 +127,7 @@ public class SettingsTest extends TestCase {
* Test of getBoolean method, of class Settings.
*/
@Test
public void testGetBoolean() {
public void testGetBoolean() throws InvalidSettingException {
System.out.println("getBoolean");
String key = "SomeBoolean";
Settings.setString(key, "false");

1
src/test/resources/nvdcve-2.0-2012.xml.REMOVED.git-id Normal file
View File

@@ -0,0 +1 @@
e87a8b468d0d9a139c46cc0e0b94577f7f6fb06f

1
src/test/resources/nvdcve-2010.xml.REMOVED.git-id
View File

@@ -1 +0,0 @@
826eb31ad4e2367a3382efe05d4524b767d4203d

1
src/test/resources/nvdcve-2011.xml.REMOVED.git-id
View File

@@ -1 +0,0 @@
0ac14732689115248018d582505f6751e62fafe8

192322
src/test/resources/nvdcve-2012.xml
View File

File diff suppressed because it is too large Load Diff

498
src/test/resources/nvdcve.xsd
View File

@@ -1,498 +0,0 @@
<?xml version="1.0"?>
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
targetNamespace="http://nvd.nist.gov/feeds/cve/1.2"
xmlns:cve="http://nvd.nist.gov/feeds/cve/1.2"
elementFormDefault="qualified" attributeFormDefault="unqualified"
version="1.2">
<xs:annotation>
<xs:documentation>This schema defines the structure of the National
Vulnerability Database XML feed files version: 1.2. The elements and
attribute in this document are described by xs:annotation tags. This
file is kept at http://nvd.nist.gov/schema/nvdcve.xsd. The NVD XML
feeds are available at http://nvd.nist.gov/download.cfm.
Release Notes:
Version 1.2:
* CVSS version 2 scores and vectors have been added. Please see
http://nvd.nist.gov/cvss.cfm?vectorinfo and
http://www.first.org/cvss/cvss-guide.html for more information on
how to interpret this data. </xs:documentation>
</xs:annotation>
<xs:element name="nvd">
<xs:annotation>
<xs:documentation>The root element of the NVD CVE feed. Multiple "entry" child elements describe specific NVD CVE entries.</xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element ref="cve:entry" minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="nvd_xml_version" type="xs:NMTOKEN" use="required">
<xs:annotation>
<xs:documentation>The schema version number supported by the feed.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="pub_date" type="cve:dateType" use="required">
<xs:annotation>
<xs:documentation>The date the feed was generated.</xs:documentation>
</xs:annotation>
</xs:attribute>
</xs:complexType>
</xs:element>
<xs:element name="entry" type="cve:entryType">
<xs:annotation>
<xs:documentation>A CVE entry.</xs:documentation>
</xs:annotation>
</xs:element>
<!-- ******************************************************************* -->
<!-- * Complex Types * -->
<!-- ******************************************************************* -->
<xs:complexType name="entryType">
<xs:annotation>
<xs:documentation> Documents one CVE entry. The child elements should always
appear in the sequence defined below. These elements are compatible with
entry elements from the CVE XML feeds.</xs:documentation>
</xs:annotation>
<xs:sequence>
<xs:element name="desc">
<xs:annotation>
<xs:documentation>Description wrapper tag, parent to any
documented descriptions of this CVE entry. While the "desc"
tag will always be present, there may be no "descript" child
tags. Only one "descript" tag will exist for each
description source (i.e. CVE, NVD, ...). </xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element name="descript" type="cve:descriptType" minOccurs="0" maxOccurs="2">
<xs:annotation>
<xs:documentation>A description of a CVE entry
from the source indicated by the "source"
attribute.</xs:documentation>
</xs:annotation>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="impacts" minOccurs="0">
<xs:annotation>
<xs:documentation> Impact wrapper tag (may or may not be
present). Only one "impact" tag will exist for each impact
explanation source. </xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element name="impact" type="cve:impactType">
<xs:annotation>
<xs:documentation> Contains a specific impact
explanation of this CVE entry from source
indicated by the "source" attribute.
</xs:documentation>
</xs:annotation>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="sols" type="cve:solsType" minOccurs="0">
<xs:annotation>
<xs:documentation> Solution wrapper tag (may or may not be
present). Only one "sol" tag will exist for each solution
explanation source. </xs:documentation>
</xs:annotation>
</xs:element>
<xs:element name="loss_types" type="cve:lossTypeType" minOccurs="0">
<xs:annotation>
<xs:documentation> Loss type tag (may or may not be present).
Contains one loss type child for each loss type of this CVE
entry. Potential loss types are: "avail" => availability
"conf" => confidentiality "int" => integrity "sec_prot" =>
security protection </xs:documentation>
</xs:annotation>
</xs:element>
<xs:element name="vuln_types" type="cve:vulnType" minOccurs="0">
<xs:annotation>
<xs:documentation> Vulnerability type tag (may or may not be
present). Contains one vulnerability type child for each
vulnerability type of this CVE entry. Potential
vulnerability types are: "access" => Access validation error
"input" => Input validation error "design" => Design error
"exception" => Exceptional condition error "env" =>
Environmental error "config" => Configuration error "race"
=> Race condition error "other" => other </xs:documentation>
</xs:annotation>
</xs:element>
<xs:element name="range" type="cve:rangeType" minOccurs="0">
<xs:annotation>
<xs:documentation> Vulnerability range tag (may or may not be
present). Contains one vulnerability range child for each
vulnerability range of this CVE entry. Potential
vulnerability ranges are: "local" => Locally exploitable
"local_network" => Local network exploitable "network" =>
Network exploitable "user_init" => User accesses attacker
</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element name="refs">
<xs:annotation>
<xs:documentation> Reference wrapper tag (always present).
External references to this CVE entry are contained within
this tag. </xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element name="ref" type="cve:refType" minOccurs="0" maxOccurs="unbounded">
<xs:annotation>
<xs:documentation> Individual reference to this CVE
entry. Text is the name of this vulnerability at
this particular reference. Attributes: "source"
(required) => Name of reference source "url"
(required) => hyperlink to reference "sig" =>
indicates this reference includes a tool
signature "adv" => indicates this reference is a
Security Advisory "patch" => indicates this
reference includes a patch for this
vulnerability </xs:documentation>
</xs:annotation>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="vuln_soft" type="cve:vulnSoftType" minOccurs="0">
<xs:annotation>
<xs:documentation> Vulnerable software wrapper tag (may or may
not be present). Software affected by this CVE entry are
listed within this tag. </xs:documentation>
</xs:annotation>
</xs:element>
</xs:sequence>
<xs:attribute name="type" use="required">
<xs:annotation>
<xs:documentation>CVE or CAN</xs:documentation>
</xs:annotation>
<xs:simpleType>
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="CAN"/>
<xs:enumeration value="CVE"/>
</xs:restriction>
</xs:simpleType>
</xs:attribute>
<xs:attribute name="name" use="required">
<xs:annotation>
<xs:documentation>the full CVE name</xs:documentation>
</xs:annotation>
<xs:simpleType>
<xs:restriction base="xs:ID">
<xs:pattern value="(CAN|CVE)\-\d\d\d\d\-\d\d\d\d"/>
</xs:restriction>
</xs:simpleType>
</xs:attribute>
<xs:attribute name="seq" use="required">
<xs:annotation>
<xs:documentation>the sequence number from CVE name</xs:documentation>
</xs:annotation>
<xs:simpleType>
<xs:restriction base="xs:NMTOKEN">
<xs:pattern value="\d\d\d\d\-\d\d\d\d"/>
</xs:restriction>
</xs:simpleType>
</xs:attribute>
<xs:attribute name="nvd_name" type="xs:string">
<xs:annotation>
<xs:documentation>the NVD name (if it exists)</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="discovered" type="cve:dateType">
<xs:annotation>
<xs:documentation>the date this entry was discovered</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="published" type="cve:dateType" use="required">
<xs:annotation>
<xs:documentation>the date this entry was published</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="modified" type="cve:dateType">
<xs:annotation>
<xs:documentation>the date this entry was last modified</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="severity">
<xs:annotation>
<xs:documentation>the entry's severity as determined by the NVD analysts: High, Medium, or Low</xs:documentation>
</xs:annotation>
<xs:simpleType>
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="High"/>
<xs:enumeration value="Medium"/>
<xs:enumeration value="Low"/>
</xs:restriction>
</xs:simpleType>
</xs:attribute>
<xs:attribute name="reject" type="cve:trueOnlyAttribute">
<xs:annotation>
<xs:documentation>indicates that this CVE entry has been rejected by CVE or NVD</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="CVSS_version" type="xs:string">
<xs:annotation>
<xs:documentation>the CVSS Version Indicator</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="CVSS_score" type="cve:zeroToTen">
<xs:annotation>
<xs:documentation>Same as the CVSS_base_score to provide backwards compatability with the previous CVE XML feed format. This field is deprecated an may be removed at a future date.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="CVSS_base_score" type="cve:zeroToTen">
<xs:annotation>
<xs:documentation>CVSS version 2 Base Score</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="CVSS_impact_subscore" type="cve:zeroToTen">
<xs:annotation>
<xs:documentation>CVSS version 2 Impact Score</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="CVSS_exploit_subscore" type="cve:zeroToTen">
<xs:annotation>
<xs:documentation>CVSS version 2 Exploit Score</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="CVSS_vector" type="cve:CVSSVector">
<xs:annotation>
<xs:documentation>the CVSS version 2 Vector string</xs:documentation>
</xs:annotation>
</xs:attribute>
</xs:complexType>
<xs:complexType name="descriptType">
<xs:simpleContent>
<xs:extension base="xs:string">
<xs:attribute name="source" type="cve:descriptSourceType" use="required">
<xs:annotation>
<xs:documentation>The source of the CVE description.</xs:documentation>
</xs:annotation>
</xs:attribute>
</xs:extension>
</xs:simpleContent>
</xs:complexType>
<xs:complexType name="impactType">
<xs:simpleContent>
<xs:extension base="xs:string">
<xs:attribute name="source" type="cve:impactSourceType" use="required">
</xs:attribute>
</xs:extension>
</xs:simpleContent>
</xs:complexType>
<xs:complexType name="vulnType">
<xs:sequence>
<xs:element name="access" minOccurs="0"/>
<xs:element name="input" minOccurs="0">
<xs:annotation>
<xs:documentation> Input validation error tag with
one attribute for each input validation error
type. Potential input validation error types
are: "bound" => Boundary condition error
"buffer" => Buffer overflow </xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:attribute name="bound" type="cve:trueOnlyAttribute"/>
<xs:attribute name="buffer" type="cve:trueOnlyAttribute"
/>
</xs:complexType>
</xs:element>
<xs:element name="design" minOccurs="0"/>
<xs:element name="exception" minOccurs="0"/>
<xs:element name="env" minOccurs="0"/>
<xs:element name="config" minOccurs="0"/>
<xs:element name="race" minOccurs="0"/>
<xs:element name="other" minOccurs="0"/>
</xs:sequence>
</xs:complexType>
<xs:complexType name="solsType">
<xs:sequence>
<xs:element name="sol">
<xs:annotation>
<xs:documentation> Contains a specific solution
explanation of this CVE entry from source
indicated by the "source" attribute.
</xs:documentation>
</xs:annotation>
<xs:complexType mixed="true">
<xs:simpleContent>
<xs:extension base="xs:string">
<xs:attribute name="source" type="cve:solsSourceType" use="required">
</xs:attribute>
</xs:extension>
</xs:simpleContent>
</xs:complexType>
</xs:element>
</xs:sequence>
</xs:complexType>
<xs:complexType name="lossTypeType">
<xs:sequence>
<xs:element name="avail" minOccurs="0"/>
<xs:element name="conf" minOccurs="0"/>
<xs:element name="int" minOccurs="0"/>
<xs:element name="sec_prot" minOccurs="0">
<xs:annotation>
<xs:documentation> Security Protection tag with one
attribute for each security protection type.
Potential security protection types are: "admin"
=> gain administrative access "user" => gain
user access "other" => other </xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:attribute name="admin" type="cve:trueOnlyAttribute"/>
<xs:attribute name="user" type="cve:trueOnlyAttribute"/>
<xs:attribute name="other" type="cve:trueOnlyAttribute"
/>
</xs:complexType>
</xs:element>
</xs:sequence>
</xs:complexType>
<xs:complexType name="rangeType">
<xs:sequence>
<xs:element name="local" minOccurs="0"/>
<xs:element name="local_network" minOccurs="0"/>
<xs:element name="network" minOccurs="0"/>
<xs:element name="user_init" minOccurs="0"/>
</xs:sequence>
</xs:complexType>
<xs:complexType name="refType">
<xs:simpleContent>
<xs:extension base="xs:string">
<xs:attribute name="source" type="xs:string" use="required"/>
<xs:attribute name="url" type="cve:urlType" use="required"/>
<xs:attribute name="sig" type="cve:trueOnlyAttribute"/>
<xs:attribute name="adv" type="cve:trueOnlyAttribute"/>
<xs:attribute name="patch" type="cve:trueOnlyAttribute"/>
</xs:extension>
</xs:simpleContent>
</xs:complexType>
<xs:complexType name="vulnSoftType">
<xs:sequence>
<xs:element name="prod" maxOccurs="unbounded">
<xs:annotation>
<xs:documentation> Product wrapper tag. Versions of
this product that are affected by this
vulnerability are listed within this tag.
Attributes: "name" => Product name "vendor" =>
Vendor of this product </xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element name="vers" maxOccurs="unbounded">
<xs:annotation>
<xs:documentation> Represents a version
of this product that is affected by
this vulnerability. Attributes:
"num" => This version number "prev"
=> Indicates that versions previous
to this version number are also
affected by this vulnerability
"edition" => Indicates the edition
associated with the version number
</xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:attribute name="num"
type="xs:string" use="required"/>
<xs:attribute name="prev"
type="cve:trueOnlyAttribute"/>
<xs:attribute name="edition"
type="xs:string"/>
</xs:complexType>
</xs:element>
</xs:sequence>
<xs:attribute name="name" type="xs:string"
use="required"/>
<xs:attribute name="vendor" type="xs:string"
use="required"/>
</xs:complexType>
</xs:element>
</xs:sequence>
</xs:complexType>
<!-- ******************************************************************* -->
<!-- * Simple Types * -->
<!-- ******************************************************************* -->
<xs:simpleType name="descriptSourceType">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="cve"/>
<xs:enumeration value="nvd"/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="impactSourceType">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="nvd"/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="solsSourceType">
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="nvd"/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="dateType">
<xs:annotation>
<xs:documentation> Defines date format for NVD. Dates follow the mask "yyyy-mm-dd"
</xs:documentation>
</xs:annotation>
<xs:restriction base="xs:string">
<xs:pattern
value="(19|20)\d\d-((01|03|05|07|08|10|12)-(0[1-9]|[1-2]\d|3[01])|(04|06|09|11)-(0[1-9]|[1-2]\d|30)|02-(0[1-9]|1\d|2\d))"
/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="urlType">
<xs:annotation>
<xs:documentation> Restricts urls in NVD beyond the xs:anyURI restrictions.
</xs:documentation>
</xs:annotation>
<xs:restriction base="xs:anyURI">
<xs:whiteSpace value="collapse"/>
<xs:pattern value="(news|(ht|f)tp(s)?)://.+"/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="trueOnlyAttribute">
<xs:annotation>
<xs:documentation> simpleType used for attributes that are only present when they are
true. Such attributes appear only in the form attribute_name="1".
</xs:documentation>
</xs:annotation>
<xs:restriction base="xs:NMTOKEN">
<xs:enumeration value="1"/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="zeroToTen">
<xs:annotation>
<xs:documentation> simpleType used when scoring on a scale of 0-10, inclusive
</xs:documentation>
</xs:annotation>
<xs:restriction base="xs:decimal">
<xs:minInclusive value="0" fixed="true"/>
<xs:maxInclusive value="10" fixed="true"/>
</xs:restriction>
</xs:simpleType>
<xs:simpleType name="CVSSVector">
<xs:annotation>
<xs:documentation>simpleType to describe the CVSS Base Vector </xs:documentation>
</xs:annotation>
<xs:restriction base="xs:string">
<xs:pattern
value="\(AV:[LAN]/AC:[HML]/Au:[NSM]/C:[NPC]/I:[NPC]/A:[NPC]\)"/>
</xs:restriction>
</xs:simpleType>
</xs:schema>