Support multiple URLs in the URL field - Githubissues

rustsec / advisory-db

Security advisory database for Rust crates published through crates.io

https://rustsec.org

Other

919 stars 364 forks source link

Support multiple URLs in the URL field #429

Closed Qwaz closed 2 years ago

Qwaz commented 4 years ago

The current advisory format only allows a single entry in the URL field, but sometimes it is useful to include multiple URLs in advisories.

Examples:

RUSTSEC-2019-0034 was an advisory for two bugs, hyperium/http#354 and hyperium/http#355. I included the links in the description section and left the URL field empty, because it only supports a single entry.
RUSTSEC-2019-0035 used a changelog URL that lists PRs and issue IDs patched in that version, but it would be better to include precise issue numbers that are related to the issue in the advisory itself. For instance, rust-random/rand#781 mentioned in the changelog is not directly related to the bug.
RUSTSEC-2019-0009 put servo/rust-smallvec#148 in the URL section, while servo/rust-smallvec#149 is also relevant.

Is it too late to introduce this kind of breaking changes to the advisory format, or can we still do this as part of V3 migration (#414)?

tarcieri commented 4 years ago

I would suggest a non-breaking approach which adds a brand new references section in addition to the current url field.

The references section can be a list/array of URLs, but url still provides the most definitive information about a vulnerability.

Qwaz commented 4 years ago

I like the name references. One question though, what would be the recommendation if there are multiple equally definitive URLs (as in RUSTSEC-2019-0009)? Put one of them in url and the other in references, leave url empty and put both of them in references, or something else?

tarcieri commented 4 years ago

I think it's up to the advisory author to decide. If there's no definitive one, they could all just be references.

tarcieri commented 4 years ago

It seems references is already used for a list of vulnerability IDs, and there's some usage of it in the current advisory DB, unfortunately.

BlackHoleFox commented 4 years ago

Its not as fun as references, but maybe “sources”, as in “information sources”?

It would be great to have multiple, for example, if you wanted to link the issue that has most of the information but also the PR that fixed it, which I bumped into wanting to do earlier.

tarcieri commented 4 years ago

@BlackHoleFox I had a similar thought, but resources

tarcieri commented 4 years ago

Reflecting on this, I'd really like to use references for this, since that's standard nomeclature in other vulnerability databases, but that'd be a breaking change.

One possible way to do it:

Rename the current references section to related. This is non-breaking.
Update the database to move all the existing references to related
After clients have been updated (this may not even be breaking), start introducing URL references

It'd be interesting to experiment and determine if existing clients could parse URLs in the references field as well

Qwaz commented 4 years ago

RUSTSEC-2016-0002, RUSTSEC-2019-0002, and RUSTSEC-2020-0024 seem to be the only advisories that use references field at this point of time.

tarcieri commented 3 years ago

PR to rename references to related: https://github.com/RustSec/rustsec-crate/pull/261

The former is still preserved in the linter.

After that we'll need to rename it in the advisories, and then add support for a new URL-based references field.

pinkforest commented 2 years ago

This works today as: references = ["https://foo.com", "https://bar.com"]

I've added Doc PR https://github.com/rustsec/advisory-db/pull/1354

Closing as Completed