[feature] Adds a parser for CycloneDX Vex data

pkg/assembler/graphql/schema/certifyVEXStatement.graphql

@@ -57,6 +57,8 @@ enum VexStatus {
   AFFECTED
   FIXED
   UNDER_INVESTIGATION
+  RESOLVED_WITH_PEDIGREE
+  FALSE_POSITIVE
 }
 
 "Records the justification included in the VEX statement."
@@ -67,6 +69,13 @@ enum VexJustification {
   VULNERABLE_CODE_CANNOT_BE_CONTROLLED_BY_ADVERSARY
   INLINE_MITIGATIONS_ALREADY_EXIST
   NOT_PROVIDED
+  REQUIRES_CONFIGURATION
+  REQUIRES_DEPENDENCY
+  REQUIRES_ENVIRONMENT
+  PROTECTED_BY_COMPILER
+  PROTECTED_AT_RUNTIME
+  PROTECTED_AT_PERIMETER
+  PROTECTED_BY_MITIGATING_CONTROL
 }
 
 """

pkg/assembler/graphql/schema/vulnMetadata.graphql

@@ -23,6 +23,10 @@ enum VulnerabilityScoreType {
   CVSSv3
   EPSSv1
   EPSSv2
+  CVSSv31
+  CVSSv4
+  OWASP
+  SSVC
 }
 
 "The Comparator is used by the vulnerability score filter on ranges"

pkg/handler/processor/cdx_vex/cdx_vex.go

@@ -0,0 +1,53 @@
+//
+// Copyright 2023 The GUAC Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cdx_vex
+
+import (
+	"encoding/json"
+	"fmt"
+
+	cdx "github.com/CycloneDX/cyclonedx-go"
+
+	"github.com/guacsec/guac/pkg/handler/processor"
+)
+
+type CdxVexProcessor struct{}
+
+func (p *CdxVexProcessor) ValidateSchema(d *processor.Document) error {
+	if d.Type != processor.DocumentCdxVex {
+		return fmt.Errorf("expected document type: %v, actual document type: %v", processor.DocumentCdxVex, d.Type)
+	}
+
+	switch d.Format {
+	case processor.FormatJSON:
+		var decoded cdx.BOM
+		err := json.Unmarshal(d.Blob, &decoded)
+		if err == nil && decoded.Vulnerabilities != nil {
+			return nil
+		}
+		return err
+	}
+
+	return fmt.Errorf("unable to support parsing of cdx-vex document format: %v", d.Format)
+}
+
+func (p *CdxVexProcessor) Unpack(d *processor.Document) ([]*processor.Document, error) {
+	if d.Type != processor.DocumentCdxVex {
+		return nil, fmt.Errorf("expected document type: %v, actual document type: %v", processor.DocumentCsaf, d.Type)
+	}
+
+	return []*processor.Document{}, nil
+}

pkg/handler/processor/guesser/type_cdx_vex.go

@@ -0,0 +1,38 @@
+//
+// Copyright 2023 The GUAC Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package guesser
+
+import (
+	"encoding/json"
+
+	cdx "github.com/CycloneDX/cyclonedx-go"
+	"github.com/guacsec/guac/pkg/handler/processor"
+)
+
+type cdxVexTypeGuesser struct{}
+
+func (_ *cdxVexTypeGuesser) GuessDocumentType(blob []byte, format processor.FormatType) processor.DocumentType {
+	switch format {
+	case processor.FormatJSON:
+		// Decode the BOM
+		var decoded cdx.BOM
+		err := json.Unmarshal(blob, &decoded)
+		if err == nil && decoded.Vulnerabilities != nil {
+			return processor.DocumentCdxVex
+		}
+	}
+	return processor.DocumentUnknown
+}

pkg/handler/processor/guesser/type_cyclonedx.go

@@ -37,6 +37,9 @@ func (_ *cycloneDXTypeGuesser) GuessDocumentType(blob []byte, format processor.F
 		bom := new(cdx.BOM)
 		decoder := cdx.NewBOMDecoder(reader, cdx.BOMFileFormatJSON)
 		err := decoder.Decode(bom)
+		if err == nil && bom.Vulnerabilities != nil {
+			return processor.DocumentUnknown
+		}
 		if err == nil && bom.BOMFormat == cycloneDXFormat {
 			return processor.DocumentCycloneDX
 		}

pkg/handler/processor/guesser/type_guesser.go

@@ -29,6 +29,7 @@ func init() {
 	_ = RegisterDocumentTypeGuesser(&cycloneDXTypeGuesser{}, "cyclonedx")
 	_ = RegisterDocumentTypeGuesser(&depsDevTypeGuesser{}, "deps.dev")
 	_ = RegisterDocumentTypeGuesser(&csafTypeGuesser{}, "csaf")
+	_ = RegisterDocumentTypeGuesser(&cdxVexTypeGuesser{}, "cdx-vex")
 }
 
 // DocumentTypeGuesser guesses the document type based on the blob and format given

pkg/handler/processor/process/process.go

@@ -24,6 +24,7 @@ import (
 	uuid "github.com/gofrs/uuid"
 	"github.com/guacsec/guac/pkg/emitter"
 	"github.com/guacsec/guac/pkg/handler/processor"
+	"github.com/guacsec/guac/pkg/handler/processor/cdx_vex"
 	"github.com/guacsec/guac/pkg/handler/processor/csaf"
 	"github.com/guacsec/guac/pkg/handler/processor/cyclonedx"
 	"github.com/guacsec/guac/pkg/handler/processor/deps_dev"
@@ -49,6 +50,7 @@ func init() {
 	_ = RegisterDocumentProcessor(&scorecard.ScorecardProcessor{}, processor.DocumentScorecard)
 	_ = RegisterDocumentProcessor(&cyclonedx.CycloneDXProcessor{}, processor.DocumentCycloneDX)
 	_ = RegisterDocumentProcessor(&deps_dev.DepsDev{}, processor.DocumentDepsDev)
+	_ = RegisterDocumentProcessor(&cdx_vex.CdxVexProcessor{}, processor.DocumentCdxVex)
 }
 
 func RegisterDocumentProcessor(p processor.DocumentProcessor, d processor.DocumentType) error {

pkg/handler/processor/processor.go

@@ -62,6 +62,7 @@ const (
 	DocumentCycloneDX        DocumentType = "CycloneDX"
 	DocumentDepsDev          DocumentType = "DEPS_DEV"
 	DocumentCsaf             DocumentType = "CSAF"
+	DocumentCdxVex           DocumentType = "CDX_VEX"
 	DocumentIngestPredicates DocumentType = "INGEST_PREDICATES"
 	DocumentUnknown          DocumentType = "UNKNOWN"
 )