If CNA chooses to use CWE for `problemTypes`, require `cweId`

CVEProject / quality-workgroup

8 stars 16 forks source link

Open zmanion opened 3 months ago

zmanion commented 3 months ago

problemTypes and CWE are recommended, but not required.

If type is 'CWE' then require cweId and test the value with a reasonable regex (something like ^CWE-[0-9]{2,5}).