feat(CSAF2.1): #287 add mandatory test 6.1.26

README.md

@@ -311,7 +311,6 @@ The following tests are not yet implemented and therefore missing:
 
 **Mandatory Tests**
 
-- Mandatory Test 6.1.26
 - Mandatory Test 6.1.27.13
 - Mandatory Test 6.1.46
 - Mandatory Test 6.1.47
@@ -425,6 +424,7 @@ export const mandatoryTest_6_1_22: DocumentTest
 export const mandatoryTest_6_1_23: DocumentTest
 export const mandatoryTest_6_1_24: DocumentTest
 export const mandatoryTest_6_1_25: DocumentTest
+export const mandatoryTest_6_1_26: DocumentTest
 export const mandatoryTest_6_1_27_1: DocumentTest
 export const mandatoryTest_6_1_27_2: DocumentTest
 export const mandatoryTest_6_1_27_3: DocumentTest

csaf_2_1/mandatoryTests.js

@@ -16,7 +16,6 @@ export {
   mandatoryTest_6_1_23,
   mandatoryTest_6_1_24,
   mandatoryTest_6_1_25,
-  mandatoryTest_6_1_26,
   mandatoryTest_6_1_27_1,
   mandatoryTest_6_1_27_2,
   mandatoryTest_6_1_27_3,
@@ -42,6 +41,7 @@ export { mandatoryTest_6_1_9 } from './mandatoryTests/mandatoryTest_6_1_9.js'
 export { mandatoryTest_6_1_10 } from './mandatoryTests/mandatoryTest_6_1_10.js'
 export { mandatoryTest_6_1_11 } from './mandatoryTests/mandatoryTest_6_1_11.js'
 export { mandatoryTest_6_1_13 } from './mandatoryTests/mandatoryTest_6_1_13.js'
+export { mandatoryTest_6_1_26 } from './mandatoryTests/mandatoryTest_6_1_26.js'
 export { mandatoryTest_6_1_27_5 } from './mandatoryTests/mandatoryTest_6_1_27_5.js'
 export { mandatoryTest_6_1_27_12 } from './mandatoryTests/mandatoryTest_6_1_27_12.js'
 export { mandatoryTest_6_1_27_14 } from './mandatoryTests/mandatoryTest_6_1_27_14.js'

csaf_2_1/mandatoryTests/mandatoryTest_6_1_26.js

@@ -0,0 +1,100 @@
+import Ajv from 'ajv/dist/jtd.js'
+
+const jtdAjv = new Ajv()
+
+/*
+  This is the jtd schema that needs to match the input document so that the
+  test is activated. If this schema doesn't match it normally means that the input
+  document does not validate against the csaf json schema or optional fields that
+  the test checks are not present.
+ */
+const inputSchema = /** @type {const} */ ({
+  additionalProperties: true,
+  properties: {
+    document: {
+      additionalProperties: true,
+      properties: {
+        category: {
+          type: 'string',
+        },
+      },
+    },
+  },
+})
+
+const validateInput = jtdAjv.compile(inputSchema)
+
+const allowedCategoryNames = [
+  'csaf_base',
+  'csaf_security_incident_response',
+  'csaf_informational_advisory',
+  'csaf_security_advisory',
+  'csaf_vex',
+  'csaf_deprecated_security_advisory',
+  'csaf_withdrawn',
+  'csaf_superseded',
+]
+
+// lowercase category names with without the prefix csaf_ and removed dash, whitespace, and underscore characters
+// without csaf_base
+const prohibitedCategoriesWithoutPrefix = [
+  'securityincidentresponse',
+  'informationaladvisory',
+  'securityadvisory',
+  'vex',
+  'deprecatedsecurityadvisory',
+  'withdrawn',
+  'superseded',
+]
+
+/**
+ * It MUST be tested that the document category is not equal to the (case-insensitive) name (without the prefix csaf_)
+ * or value of any other profile than "CSAF Base". Any occurrences of dash, whitespace, and underscore characters are
+ * removed from the values on both sides before the match.
+ * Also, the value MUST NOT start with the reserved prefix csaf_ except if the value is csaf_base.
+ * @param {unknown} doc
+ */
+export function mandatoryTest_6_1_26(doc) {
+  const ctx = {
+    errors:
+      /** @type {Array<{ instancePath: string; message: string }>} */ ([]),
+    isValid: true,
+  }
+  if (!validateInput(doc)) {
+    return ctx
+  }
+
+  /** @type {string} */
+  const category = doc.document.category
+
+  // Skip test for the allowedCategoryNames in /document/category:
+  if (allowedCategoryNames.includes(category)) {
+    return ctx
+  }
+
+  // Fail on reserved prefix
+  if (category.toLowerCase().startsWith('csaf_')) {
+    ctx.isValid = false
+    ctx.errors.push({
+      instancePath: '/document/category',
+      message: 'reserved prefix "csaf_" used',
+    })
+
+    return ctx
+  }
+
+  // Fail on name case-insensitive similarity
+  if (
+    prohibitedCategoriesWithoutPrefix.includes(
+      //remove occurrences of dash, whitespace, and underscore characters
+      category.replace(/[_-\s]+/g, '').toLowerCase()
+    )
+  ) {
+    ctx.isValid = false
+    ctx.errors.push({
+      instancePath: '/document/category',
+      message: 'value prohibited',
+    })
+  }
+  return ctx
+}

tests/csaf_2_1/mandatoryTest_6_1_26.js

@@ -0,0 +1,18 @@
+import assert from 'node:assert/strict'
+import { mandatoryTest_6_1_26 } from '../../csaf_2_1/mandatoryTests/mandatoryTest_6_1_26.js'
+
+describe('mandatoryTest_6_1_26', function () {
+  it('only runs on relevant documents', function () {
+    assert.equal(mandatoryTest_6_1_26({ document: 'mydoc' }).isValid, true)
+  })
+  it('check use of reserved prefix csaf_ except if the value is csaf_base', function () {
+    assert.equal(
+      mandatoryTest_6_1_26({
+        document: {
+          category: 'csaf_invalid',
+        },
+      }).isValid,
+      false
+    )
+  })
+})

tests/csaf_2_1/oasis.js

@@ -12,7 +12,6 @@ import * as mandatory from '../../csaf_2_1/mandatoryTests.js'
 const excluded = [
   '6.1.8',
   '6.1.9',
-  '6.1.26',
   '6.1.27.3',
   '6.1.27.4',
   '6.1.27.6',