XML output writes a vulnerability's `created` date as `published` and `updated`

未关闭 适合新手
  • 哪里不对？
#1,537 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 7 天内回复

还没有人认领这个 Issue。

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
88/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
node.js, typescript, xml
领域
backend, data

调研方向

从 src/serialize/xml/normalize.ts 中的 VulnerabilityNormalizer 开始，检查日期元素的构造。将 XML 输出与模型日期及现有 JSON 输出进行比较。更新 XML 规范化器，并添加或调整对不同日期和缺失日期的覆盖；XML 应独立保留每个日期，相关快照应保持一致。

由索引模型根据 Issue 内容生成。

描述

Describe the bug

The XML normalizer writes a vulnerability's created date into all three date elements. published and updated are never read, so in XML they are wrong, missing, or made up. The JSON output is correct.

To reproduce

const { Models, Serialize, Spec } = require('@cyclonedx/cyclonedx-library')

const bom = new Models.Bom()
bom.vulnerabilities.add(new Models.Vulnerability.Vulnerability({
  bomRef: 'v1',
  created: new Date('2021-01-01T00:00:00Z'),
  published: new Date('2022-02-02T00:00:00Z'),
  updated: new Date('2023-03-03T00:00:00Z')
}))

const serializer = new Serialize.XmlSerializer(
  new Serialize.XML.Normalize.Factory(Spec.Spec1dot6))
console.log(serializer.serialize(bom, { space: 2 }))

Output:

<created>2021-01-01T00:00:00.000Z</created>
<published>2021-01-01T00:00:00.000Z</published>
<updated>2021-01-01T00:00:00.000Z</updated>

Two more cases:

Dates set on the model XML output
only published and updated no date elements at all
only created created, plus published and updated with the same value

Expected behaviour

Each element carries its own value, as in the JSON output:

<created>2021-01-01T00:00:00.000Z</created>
<published>2022-02-02T00:00:00.000Z</published>
<updated>2023-03-03T00:00:00.000Z</updated>

Cause

src/serialize/xml/normalize.ts, in VulnerabilityNormalizer:

makeOptionalDateTimeElement(data.created, 'created'),
makeOptionalDateTimeElement(data.created, 'published'),
makeOptionalDateTimeElement(data.created, 'updated'),

The stored snapshots show it too: tests/_data/models.js sets published to ...00:00:41 and updated to ...00:00:42, and tests/_data/serializeResults/xml_complex_spec1.6.xml.bin has ...00:00:40 three times.

Environment

  • Library version: 10.5.0 (main at 7456cad)
  • Node.js 24.18.0, Windows 11

I can open a PR with the fix and the regenerated snapshots.

AI disclosure: this was found with the help of Claude Code. The snippet was run against the built library.

主要语言
TypeScript
星标
25
派生
16
平均合并
5 天 17 小时
30 天内合并 PR
9

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

CycloneDX/cyclonedx-javascript-library 的其他 Issue

查看 CycloneDX/cyclonedx-javascript-library 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。