diff --git a/.github/issue_template.md b/.github/issue_template.md new file mode 100644 index 0000000..c616e0a --- /dev/null +++ b/.github/issue_template.md @@ -0,0 +1 @@ +{Please describe the nature of your issue} diff --git a/.github/workflows/config/.env b/.github/workflows/config/.env new file mode 100644 index 0000000..e9eb6d2 --- /dev/null +++ b/.github/workflows/config/.env @@ -0,0 +1 @@ +HUGO_VERSION=0.118.2 diff --git a/.github/workflows/config/.lycheeignore b/.github/workflows/config/.lycheeignore new file mode 100644 index 0000000..3f35287 --- /dev/null +++ b/.github/workflows/config/.lycheeignore @@ -0,0 +1,2 @@ +https://search.usa.gov/search +https://github.com/usnistgov/vulntology/tree/master/website/content/* \ No newline at end of file diff --git a/.github/workflows/config/.markdown-link-check/config.json b/.github/workflows/config/.markdown-link-check/config.json new file mode 100644 index 0000000..15376ad --- /dev/null +++ b/.github/workflows/config/.markdown-link-check/config.json @@ -0,0 +1,34 @@ +{ + "ignorePatterns": [ + { + "pattern": "https://docs.github.com" + }, + { + "pattern": "https://guides.github.com" + }, + { + "pattern": "https://help.github.com" + }, + { + "pattern": "https://www.bottlecaps.de/rex/" + } + ], + "replacementPatterns": [ + { + "pattern": "^../../issues", + "replacement": "https://github.com/usnistgov/metaschema/issues" + }, + { + "pattern": "^../../projects", + "replacement": "https://github.com/usnistgov/metaschema/projects" + }, + { + "pattern": "^../../releases", + "replacement": "https://github.com/usnistgov/metaschema/releases" + }, + { + "pattern": "^../../tree", + "replacement": "https://github.com/usnistgov/metaschema/tree" + } + ] +} diff --git a/.github/workflows/config/.nvmrc b/.github/workflows/config/.nvmrc new file mode 100644 index 0000000..6f7f377 --- /dev/null +++ b/.github/workflows/config/.nvmrc @@ -0,0 +1 @@ +v16 diff --git a/.github/workflows/link-check.yml b/.github/workflows/link-check.yml index bd3634b..34a1476 100644 --- a/.github/workflows/link-check.yml +++ b/.github/workflows/link-check.yml @@ -26,7 +26,7 @@ on: required: true default: 'published' type: string - create_issue: + linkcheck_create_issue: description: 'create new GitHub issue if broken links found' required: false default: true @@ -38,25 +38,25 @@ jobs: with: ignorePattern: '^website/' markdownLinkCheckConfig: 'build/config/.markdown-link-check/config.json' - create_issue: true + linkcheck_create_issue: true schedule-validate-repo-markdown-links-debug: uses: ./.github/workflows/workflow-validate-repo-markdown.yml if: github.event_name == 'workflow_dispatch' with: ignorePattern: ${{ github.event.inputs.ignorePattern }} markdownLinkCheckConfig: ${{ github.event.inputs.markdownLinkCheckConfig }} - create_issue: ${{ contains('true', github.event.inputs.create_issue) }} + linkcheck_create_issue: ${{ contains('true', github.event.inputs.linkcheck_create_issue) }} schedule-validate-website-links: uses: ./.github/workflows/workflow-validate-website-content.yml if: github.event_name != 'workflow_dispatch' with: site_git_ref: 'nist-pages' site_git_ref_path: 'published' - create_issue: true + linkcheck_create_issue: true schedule-validate-website-links-debug: uses: ./.github/workflows/workflow-validate-website-content.yml if: github.event_name == 'workflow_dispatch' with: site_git_ref: ${{ github.event.inputs.site_git_ref }} site_git_ref_path: ${{ github.event.inputs.site_git_ref_path }} - create_issue: ${{ contains('true', github.event.inputs.create_issue) }} + linkcheck_create_issue: ${{ contains('true', github.event.inputs.linkcheck_create_issue) }} diff --git a/.github/workflows/status-ci-cd.yml b/.github/workflows/status-ci-cd.yml index feea052..d5e9410 100644 --- a/.github/workflows/status-ci-cd.yml +++ b/.github/workflows/status-ci-cd.yml @@ -26,5 +26,3 @@ jobs: uses: ./.github/workflows/workflow-generate-website.yml with: commit_resources: true - secrets: - access_token: ${{ secrets.COMMIT_TOKEN }} diff --git a/.github/workflows/workflow-generate-website.yml b/.github/workflows/workflow-generate-website.yml index efdbe84..1523265 100644 --- a/.github/workflows/workflow-generate-website.yml +++ b/.github/workflows/workflow-generate-website.yml @@ -7,15 +7,11 @@ on: required: false default: false type: boolean - bad_links_fail_build: + linkcheck_fail_on_error: description: 'a boolean flag that determines if bad links found by the link checker fail fast and stop a complete build' required: false default: true type: boolean - secrets: - access_token: - description: 'the access token to use for commits' - required: false workflow_dispatch: branches: - main @@ -27,12 +23,12 @@ on: required: true default: false type: boolean - bad_links_fail_build: + linkcheck_fail_on_error: description: 'a boolean flag that determines if bad links found by the link checker fail fast and stop a complete build' required: false default: true type: boolean - create_issue: + linkcheck_create_issue: description: 'create new GitHub issue if broken links found' required: false default: false @@ -43,26 +39,20 @@ jobs: runs-on: ubuntu-20.04 env: BUILD_PATH: ./build + permissions: + contents: write steps: - # use this for builds triggered from the UI on protected branches - - name: Checkout Latest (using COMMIT_TOKEN) - if: github.event_name == 'workflow_dispatch' && github.event.inputs.commit_resources == 'true' - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 - with: - token: ${{ secrets.COMMIT_TOKEN }} - submodules: recursive - id: checkout_latest_workflow - # use this for builds triggered from other workflows on protected branches - - name: Checkout Latest (using access_token) - if: github.event_name == 'push' && inputs.commit_resources == true + # use this for builds triggered from the UI and from workflows on protected branches + - id: checkout_latest_workflow + name: Checkout Latest + if: (github.event_name == 'workflow_dispatch' && github.event.inputs.commit_resources == 'true') || (github.event_name == 'push' && inputs.commit_resources == true) uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 with: - token: ${{ secrets.access_token }} + token: ${{ secrets.GITHUB_TOKEN }} submodules: recursive - id: checkout_latest_push # use this for overything else (i.e., pull requests) where publication is not needed - name: Checkout Latest - if: steps.checkout_latest_workflow.conclusion == 'skipped' && steps.checkout_latest_push.conclusion == 'skipped' + if: steps.checkout_latest_workflow.conclusion == 'skipped' uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 with: submodules: recursive @@ -75,7 +65,7 @@ jobs: - name: Read .env id: hugo-version run: | - . ./.env + . .github/workflows/config/.env echo "HUGO_VERSION=${HUGO_VERSION}" >> "${GITHUB_OUTPUT}" - name: Setup Hugo uses: peaceiris/actions-hugo@v2 @@ -85,7 +75,7 @@ jobs: - name: Set up NodeJS uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d with: - node-version-file: 'build/.nvmrc' + node-version-file: '.github/workflows/config/.nvmrc' cache: 'npm' cache-dependency-path: package-lock.json - name: Setup Dependencies @@ -118,50 +108,51 @@ jobs: run: | zip ${{ runner.temp }}/metaschema-website.zip -r public/ working-directory: ${{ github.workspace }}/website - - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce + - name: Upload generated site + uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce with: name: website path: | ${{ runner.temp }}/metaschema-website.zip retention-days: 5 - - name: Link Checker - id: linkchecker + - id: linkchecker + name: Link Checker uses: lycheeverse/lychee-action@ec3ed119d4f44ad2673a7232460dc7dff59d2421 with: - args: --exclude-file ./build/config/.lycheeignore --verbose --no-progress --accept 200,206,429 './website/public/**/*.html' --remap "https://pages.nist.gov/metaschema/ file://${GITHUB_WORKSPACE}/website/public/" --exclude-mail + args: --exclude-file .github/workflows/config/.lycheeignore --verbose --no-progress --accept 200,206,429 './website/public/**/*.html' --remap "https://pages.nist.gov/vulntology/ file://${GITHUB_WORKSPACE}/website/public/" --exclude-mail format: markdown output: html-link-report.md + debug: true + fail: true env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce + continue-on-error: true + - name: Upload link check report + uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce with: name: html-link-report path: html-link-report.md retention-days: 5 - - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 - if: steps.linkchecker.outputs.exit_code != 0 + - name: Create issue if bad links detected + if: ${{ !cancelled() && env.lychee_exit_code != 0 && inputs.linkcheck_create_issue }} + uses: peter-evans/create-issue-from-file@433e51abf769039ee20ba1293a088ca19d573b7f with: - script: | - core.setFailed('Link checker detected broken or invalid links, read attached report.') - - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 - if: steps.linkchecker.outputs.exit_code != 0 && (github.event.inputs.bad_links_fail_build == 'true' || inputs.bad_links_fail_build == true) + title: Scheduled Check of Website Content Found Bad Hyperlinks + content-filepath: ./lychee/out.md + labels: | + bug + documentation + - name: Fail on link check error + if: ${{ !cancelled() && env.lychee_exit_code != 0 && (github.event.inputs.linkcheck_fail_on_error == 'true' || inputs.linkcheck_fail_on_error == true) }} + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 with: script: | core.setFailed('Link checker detected broken or invalid links, read attached report.') - - name: Deploy Website (using access_token) - uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 - if: github.event_name == 'push' && inputs.commit_resources == true && github.ref_name == 'main' - with: - github_token: ${{ secrets.access_token }} - enable_jekyll: false - publish_dir: ./website/public - publish_branch: nist-pages - commit_message: Deploying website [ci deploy skip] - - name: Deploy Website (using COMMIT_TOKEN) + - name: Deploy Website uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 - if: github.event_name == 'workflow_dispatch' && github.event.inputs.commit_resources == 'true' && github.ref_name == 'main' + if: github.ref_name == 'main' && ((github.event_name == 'push' && inputs.commit_resources == true) || (github.event_name == 'workflow_dispatch' && github.event.inputs.commit_resources == 'true')) with: - github_token: ${{ secrets.COMMIT_TOKEN }} + github_token: ${{ secrets.GITHUB_TOKEN }} enable_jekyll: false publish_dir: ./website/public publish_branch: nist-pages diff --git a/.github/workflows/workflow-validate-repo-markdown.yml b/.github/workflows/workflow-validate-repo-markdown.yml index 7e60647..8318970 100644 --- a/.github/workflows/workflow-validate-repo-markdown.yml +++ b/.github/workflows/workflow-validate-repo-markdown.yml @@ -10,9 +10,9 @@ on: markdownLinkCheckConfig: description: 'the path to the markdown link check config file' required: false - default: 'build/config/.markdown-link-check/config.json' + default: '.github/workflows/config/.markdown-link-check/config.json' type: string - create_issue: + linkcheck_create_issue: description: 'create new GitHub issue if broken links found' required: false default: false @@ -21,6 +21,9 @@ jobs: validate-repo-markdown: name: Validate Repo Markdown runs-on: ubuntu-20.04 + permissions: + contents: read + issues: write steps: # use this for pulls where checkout is anonymous - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 @@ -31,7 +34,7 @@ jobs: - name: Set up NodeJS uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d with: - node-version-file: 'build/.nvmrc' + node-version-file: '.github/workflows/config/.nvmrc' cache: 'npm' cache-dependency-path: 'package-lock.json' - name: Setup Dependencies @@ -59,11 +62,11 @@ jobs: exit ${PIPESTATUS[2]} id: linkchecker - name: Create issue if bad links detected in repo - if: failure() && inputs.create_issue == true + if: failure() && inputs.linkcheck_create_issue == true uses: peter-evans/create-issue-from-file@433e51abf769039ee20ba1293a088ca19d573b7f # v3.0.0 with: title: Scheduled Check of Markdown Documents Found Bad Hyperlinks content-filepath: mlc_report.log labels: | bug - Scope: Documentation + documentation diff --git a/.github/workflows/workflow-validate-website-content.yml b/.github/workflows/workflow-validate-website-content.yml index 21017f2..026d4d7 100644 --- a/.github/workflows/workflow-validate-website-content.yml +++ b/.github/workflows/workflow-validate-website-content.yml @@ -1,5 +1,4 @@ name: Validate Website Content - on: workflow_call: inputs: @@ -13,7 +12,12 @@ on: required: true default: 'published' type: string - create_issue: + linkcheck_create_issue: + description: 'create new GitHub issue if broken links found' + required: false + default: false + type: boolean + linkcheck_fail_on_error: description: 'create new GitHub issue if broken links found' required: false default: false @@ -21,6 +25,9 @@ on: jobs: schedule-validate-website-links: runs-on: ubuntu-20.04 + permissions: + contents: read + issues: write steps: - name: Checkout Latest uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 @@ -35,16 +42,23 @@ jobs: id: linkchecker uses: lycheeverse/lychee-action@ec3ed119d4f44ad2673a7232460dc7dff59d2421 with: - args: --exclude-file ./build/config/.lycheeignore --verbose --no-progress --accept 200,206,429 './${{ inputs.site_git_ref_path }}/**/*.html' --exclude-mail + args: --exclude-file .github/workflows/config/.lycheeignore --verbose --no-progress --accept 200,206,429 './${{ inputs.site_git_ref_path }}/**/*.html' --exclude-mail + fail: true env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + continue-on-error: true - name: Create issue if bad links detected - if: steps.linkchecker.outputs.exit_code != 0 && inputs.create_issue + if: ${{ !cancelled() && env.lychee_exit_code != 0 && inputs.linkcheck_create_issue }} uses: peter-evans/create-issue-from-file@433e51abf769039ee20ba1293a088ca19d573b7f with: title: Scheduled Check of Website Content Found Bad Hyperlinks content-filepath: ./lychee/out.md labels: | bug - Scope: Documentation - Scope: Website + documentation + - name: Check coverage tolerance + if: ${{ env.lychee_exit_code != 0 && inputs.linkcheck_fail_on_error }} + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 + with: + script: | + core.setFailed('Link checker detected broken or invalid links, read attached report.') diff --git a/.gitignore b/.gitignore index 14c2247..5d7ccf0 100644 --- a/.gitignore +++ b/.gitignore @@ -4,4 +4,3 @@ /website/public /website/resources /website/_vendor - diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 2636435..9380bbb 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -23,9 +23,9 @@ For more information on the project's current needs and priorities, see the proj ## Issue reporting and handling All requests for changes and enhancements to the repository are initiated through the project's [GitHub issue tracker](https://github.com/usnistgov/vulntology/issues). To initiate a request, please [create a new issue](https://help.github.com/articles/creating-an-issue/). The following issue templates exist for creating a new issue: -* [User Story](https://github.com/usnistgov/vulntology/issues/new?template=feature_request.md&labels=enhancement%2C+User+Story): Use to describe a new feature or capability to be added to the project. -* [Defect Report](https://github.com/usnistgov/vulntology/issues/new?template=bug_report.md&labels=bug): Use to report a problem with an existing feature or capability. -* [Question](https://github.com/usnistgov/vulntology/issues/new?labels=question&template=question.md): Use to ask a question about the project or the contents of the repository. +* [User Story](https://github.com/usnistgov/vulntology/issues/new?template=feature_request.yaml&labels=enhancement%2C+user+story): Use to describe a new feature or capability to be added to the project. +* [Defect Report](https://github.com/usnistgov/vulntology/issues/new?template=bug_report.yaml&labels=bug): Use to report a problem with an existing feature or capability. +* [Question](https://github.com/usnistgov/vulntology/issues/new?labels=question&template=question.yaml): Use to ask a question about the project or the contents of the repository. The project team regularly reviews the open issues, prioritizes their handling, and updates the issue statuses, proving comments on the current status as needed. @@ -45,7 +45,8 @@ This project uses a typical GitHub fork and pull request [workflow](https://guid This repository consists of the following directories and files pertaining to the Vulntology project: - [.github](.github): Contains GitHub issue and pull request templates for the project. -- [specification](specification): The current Vulntology specification, described in a collection of Markdown pages.- [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md): This file contains a code of conduct for the Vulntology project contributors. +- [website](website): The current Vulntology specification website, described as a collection of Markdown pages to be generated as HTML. +- [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md): This file contains a code of conduct for the Vulntology project contributors. - [CONTRIBUTING.md](CONTRIBUTING.md): This file is for potential contributors to the project. It provides basic information on the project, describes the main ways people can make contributions, explains how to report issues, and lists pointers to additional sources of information. It also has instructions on establishing a development environment for contributing to the project and using GitHub project cards to track development sprints. - [LICENSE.md](LICENSE.md): This file contains license information for the files in this GitHub repository. - [USERS.md](USERS.md): This file explains which types of users are most likely to benefit from use of this project and its artifacts. diff --git a/LICENSE.md b/LICENSE.md index 109af23..befce11 100644 --- a/LICENSE.md +++ b/LICENSE.md @@ -2,9 +2,9 @@ As a work of the United States government, this project is in the public domain within the United States. -Additionally, we waive copyright and related rights in the work worldwide through the [CC0 1.0 Universal public domain dedication](https://creativecommons.org/publicdomain/zero/1.0/). +Copyright and related rights in the work worldwide are waived through the [CC0 1.0 Universal public domain dedication](https://creativecommons.org/publicdomain/zero/1.0/). -As a work of the United States government, this project is in the public domain within the United States under the [National Institute of Standards and Technology License](#national-institute-of-standards-and-technology-license). Additionally, we waive copyright and related rights in the work worldwide through the [CC0 1.0 Universal public domain dedication](https://creativecommons.org/publicdomain/zero/1.0/). +As a work of the United States government, this project is in the public domain within the United States under the [National Institute of Standards and Technology License](https://www.nist.gov/open/license)). ### CC0 1.0 Universal Summary diff --git a/README.md b/README.md index 1d0e863..bc66326 100644 --- a/README.md +++ b/README.md @@ -5,14 +5,13 @@ The Vulntology is a project created to characterize vulnerabilities and provide a granular and intuitive structure for that information. This repository is a location to support community development of the NIST Vulnerability Data Ontology, or Vulntology. -#### Project Scope +## Project Scope The Vulntology is intended to provide characterization details about how a vulnerability can be exploited, what the impact of that exploit will be, and what mitigating factors can make exploitation difficult. These details are provided in the context of a given attack scenario, which may differ in characteristics from other scenarios for the same vulnerability. -The vulntology is not intended to be a general purpose format for describing vulnerability information. Instead, the Vulntology is intended to be a drop-in replacement for a vulnerability description. The Vulntology project will avoid duplicating work in other formats to the greatest extent possible. Due to the relational approach used, the Vulntology may provide some overlapping details as a means to define a given scenario, such as affected product information. +The Vulntology is not intended to be a general purpose format for describing vulnerability information. Instead, the Vulntology is intended to be a drop-in replacement for a vulnerability description. The Vulntology project will avoid duplicating work in other formats to the greatest extent possible. Due to the relational approach used, the Vulntology may provide some overlapping details as a means to define a given scenario, such as affected product information. - -#### Goals +## Goals - To standardize the description of vulnerabilities through structured characterization formatting. - To enable automated scoring agnostic of any particular system. @@ -20,8 +19,6 @@ The vulntology is not intended to be a general purpose format for describing vul - To allow for easier vulnerability information sharing across language barriers -#### Resources Inside -There are [Introduction](specification/introduction/) materials available for a general overview of the Vulntology. For those already familiar you can look into the [Figures](specification/figures/), [Objects](specification/objects/) and/or [Values](specification/values/) sections. +## How to Help -#### How to Help We are currently looking for assistance from organizations and people within the vulnerability management community. For those interested please refer to the [Contributing](CONTRIBUTING.md) page. diff --git a/website/content/contribute/_index.md b/website/content/contribute/_index.md index 1e58d36..c4578b2 100644 --- a/website/content/contribute/_index.md +++ b/website/content/contribute/_index.md @@ -14,7 +14,7 @@ We are excited that you want to contribute to the Metaschema project. We are str We use GitHub as a collaboration platform for the development of the Metaschema framework. Within the project's GitHub repository you will find: -- A [set of issues](https://github.com/usnistgov/vulntology/issues?q=is%3Aopen+is%3Aissue) for which we need your help. Feel free to pick from this list, or [reach out to us](contact/) about any other ideas you might have. +- A [set of issues](https://github.com/usnistgov/vulntology/issues?q=is%3Aopen+is%3Aissue) for which we need your help. Feel free to pick from this list, or [reach out to us](#contact-us) about any other ideas you might have. - [Guidelines](https://github.com/usnistgov/vulntology/blob/master/CONTRIBUTING.md) on contributing to this project. - A [project board](https://github.com/usnistgov/vulntology/projects) that shows the issues the team is currently working on. diff --git a/website/content/specification/_index.md b/website/content/specification/_index.md index 5c56bf1..ccb676d 100644 --- a/website/content/specification/_index.md +++ b/website/content/specification/_index.md @@ -20,13 +20,13 @@ The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "S The Vulntology framework is composed of simple components described below: -- **Objects**: A Conceptual entity; Objects can be related to other objects, have types, relationships, and properties. A list of Objects defined by the Vulntology framework is located under the [objects](objects) directory. Each object, such as [Vulnerability](objects/vulnerability), can have multiple properties and/or relationships with other components. +- **Objects**: A Conceptual entity; Objects can be related to other objects, have types, relationships, and properties. Each object, such as [Vulnerability](objects/vulnerability), can have multiple properties and/or relationships with other components. - **Relationships**: A connection relating one object to another. Relationships retain an expected cardinality, i.e. or `one to many` or `zero to many`. - **Properties**: A connection between an object and a value. Some properties and associated values relate to or drive the use of other properties. - The top level object to begin with when reviewing the components is the [Vulnerability](objects/vulnerability) object. + The top level object to begin with when reviewing the components is the [Vulnerability](vulnerability) object. - **Values**: An explicit characteristic used to describe a detail of a Type or SubType. A list of value sets defined by the Vulntology framework is located under the [values](values) directory. Values are contained within Type and SubType groups such as [Theatre](values/theater). diff --git a/website/content/specification/objects/_index.md b/website/content/specification/objects/_index.md index 820ae1f..27163f5 100644 --- a/website/content/specification/objects/_index.md +++ b/website/content/specification/objects/_index.md @@ -7,7 +7,7 @@ sidenav: A Conceptual entity in the vulntology. -Objects can be related to other objects, have types, and properties. Each object, such as [vulnerability](objects/vulnerability), can have multiple properties and/or relationships with other components. +Objects can be related to other objects, have types, and properties. Each object, such as [vulnerability](vulnerability), can have multiple properties and/or relationships with other components. ## Object Types diff --git a/website/content/specification/objects/barrier.md b/website/content/specification/objects/barrier.md index 701af19..84551e6 100644 --- a/website/content/specification/objects/barrier.md +++ b/website/content/specification/objects/barrier.md @@ -9,7 +9,7 @@ This could be any characteristic inherent in the vulnerability that could impede ## Properties - **id** (one): A globally unique identifier for the impact that distinguishes it from other impacts related to the same vulnerability. -- **hasBarrierType** (one): Identifies the kind of barrier. Based on the barrier's type, [additional properties](#additional-properties) may be required. (See [Barrier Types](../values/barrier-type.md)) +- **hasBarrierType** (one): Identifies the kind of barrier. Based on the barrier's type, [additional properties](#additional-properties) may be required. (See [Barrier Types](../../values/barrier-type)) ## Additional Properties diff --git a/website/content/specification/objects/scenario.md b/website/content/specification/objects/scenario.md index 8c67e46..ba5a091 100644 --- a/website/content/specification/objects/scenario.md +++ b/website/content/specification/objects/scenario.md @@ -9,18 +9,18 @@ A scenario describes the conditions surrounding the possible use of a vulnerabil ## Properties - **id** (one): A globally unique identifier for the scenario that distinguishes it from other scenarios related to the same vulnerability. - **hasName** (zero or one): A name or label to assist in identifying a given scenario in the context of the containing Vulnerability. This name should be unique across all sibling scenarios. -- **requiresAttackTheater** (one): Attack Theater is the area or place from which an attack must occur. Each separate theater represents varying levels of implied trust and attack surface. (See [Theater](../values/theater.md)) -- **evidencedBySource** (one or many): [Resource Reference](../values/resource-reference.md) will assist in proving a Vulnerability Scenario is legitimate. -- **hasExploitedWeakness** (one): The weakness causing the Vulnerability. When choosing a value, the most applicable weakness should be selected. (See [Exploited Weakness](../values/exploited-weakness.md)) +- **requiresAttackTheater** (one): Attack Theater is the area or place from which an attack must occur. Each separate theater represents varying levels of implied trust and attack surface. (See [Theater](../../values/theater)) +- **evidencedBySource** (one or many): [Resource Reference](../../values/resource-reference) will assist in proving a Vulnerability Scenario is legitimate. +- **hasExploitedWeakness** (one): The weakness causing the Vulnerability. When choosing a value, the most applicable weakness should be selected. (See [Exploited Weakness](../../values/exploited-weakness)) ## Relationships -- **affectsProduct** (one): [Products](product.md) identify the set of products affected within a Scenario. +- **affectsProduct** (one): [Products](../product) identify the set of products affected within a Scenario. -- **blockedByBarrier** (zero or many): [Barriers](barrier.md) may increase the difficulty of a Scenario. +- **blockedByBarrier** (zero or many): [Barriers](../barrier) may increase the difficulty of a Scenario. -- **hasAction** (one or many): [Actions](action.md) will occur within a Scenario +- **hasAction** (one or many): [Actions](../action) will occur within a Scenario ## Graph View ![Scenario Graph](/figures/graphsnippets/ScenarioSnippet.png "Scenario Graph") \ No newline at end of file diff --git a/website/content/specification/objects/vulnerability.md b/website/content/specification/objects/vulnerability.md index ace392e..923f49b 100644 --- a/website/content/specification/objects/vulnerability.md +++ b/website/content/specification/objects/vulnerability.md @@ -8,15 +8,15 @@ A Vulnerability is any weakness in the computational logic found in products or ## Properties -- **hasSectorOfInterest** (zero or many): Supplemental information identifying potential sectors or use cases where the Vulnerability could have an impact. (See [Sector of Interest](../values/sector-of-interest.md)) +- **hasSectorOfInterest** (zero or many): Supplemental information identifying potential sectors or use cases where the Vulnerability could have an impact. (See [Sector of Interest](../../values/sector-of-interest)) ## Relationships -- **hasKnownChain** (zero or many): [Vulnerability Identifiers](vulnerability-identifier.md) for other known Vulnerabilities that can be used in conjunction with the Vulnerability in question to achieve a different and likely greater impact -- **hasIdentity** (one or many): [Vulnerability Identifiers](vulnerability-identifier.md) may be associated with Vulnerability -- **hasScenario** (one or many): [Scenarios](scenario.md) shall be associated with Vulnerability. -- **hasOriginatingProduct** (one or many): [Product](product.md) shall be associated with Vulnerability +- **hasKnownChain** (zero or many): [Vulnerability Identifiers](../vulnerability-identifier) for other known Vulnerabilities that can be used in conjunction with the Vulnerability in question to achieve a different and likely greater impact +- **hasIdentity** (one or many): [Vulnerability Identifiers](../vulnerability-identifier) may be associated with Vulnerability +- **hasScenario** (one or many): [Scenarios](../scenario) shall be associated with Vulnerability. +- **hasOriginatingProduct** (one or many): [Product](../product) shall be associated with Vulnerability ## Graph View ![Vulnerability Graph](/figures/graphsnippets/VulnerabilitySnippet.png "Vulnerability Graph") \ No newline at end of file diff --git a/website/content/specification/values/scope.md b/website/content/specification/values/scope.md index 4086232..ddd591a 100644 --- a/website/content/specification/values/scope.md +++ b/website/content/specification/values/scope.md @@ -8,7 +8,7 @@ A coarse measure of the level of impact an exploit could have on a target. In so ## Values -- **Limited**: There are restrictions to the associated [impact](../../impact). +- **Limited**: There are restrictions to the associated [impact](../../objects/impact). - **Unlimited**: There are no restrictions to the associated impact. ## Graph View diff --git a/website/go.mod b/website/go.mod index 13494cb..fd8f828 100644 --- a/website/go.mod +++ b/website/go.mod @@ -1,7 +1,7 @@ module github.com/usnistgov/vulntology -replace github.com/usnistgov/hugo-uswds => ../../hugo-uswds +// replace github.com/usnistgov/hugo-uswds => ../../hugo-uswds -go 1.21.0 +go 1.21 -require github.com/usnistgov/hugo-uswds v1.0.1-0.20230907132321-3e1389f75de0 // indirect +require github.com/usnistgov/hugo-uswds v1.0.1-0.20230911165631-874ffd724f52 // indirect diff --git a/website/go.sum b/website/go.sum index 9db7d83..e3a748b 100644 --- a/website/go.sum +++ b/website/go.sum @@ -2,3 +2,5 @@ github.com/usnistgov/hugo-uswds v1.0.0 h1:6Nwrs4XWOkxOheWWM8VTEl6aMM7cLQUNv0chuU github.com/usnistgov/hugo-uswds v1.0.0/go.mod h1:MkgH5fvt5GIZo70VkBav+wP6br+MzrD/+OMZ9EqDkHM= github.com/usnistgov/hugo-uswds v1.0.1-0.20230907132321-3e1389f75de0 h1:+PvpssggA3G9SNXFhIVjMi+UWNOaJlXOubfW23asz9Y= github.com/usnistgov/hugo-uswds v1.0.1-0.20230907132321-3e1389f75de0/go.mod h1:MkgH5fvt5GIZo70VkBav+wP6br+MzrD/+OMZ9EqDkHM= +github.com/usnistgov/hugo-uswds v1.0.1-0.20230911165631-874ffd724f52 h1:7obFQhMxDzuwLYEOTTxK3f7j0IOTBlkfKQj7AmKQSSo= +github.com/usnistgov/hugo-uswds v1.0.1-0.20230911165631-874ffd724f52/go.mod h1:MkgH5fvt5GIZo70VkBav+wP6br+MzrD/+OMZ9EqDkHM=