^x_[^.]*$ to prevent dots in additional properties?

[ElectricNroff]

The schema has a few instances of:

"patternProperties": {
    "^x_": {}
},
"additionalProperties": false

to allow arbitrary additional properties that begin with an x_ substring. In CVE Services, JSON documents need to be stored in Amazon DocumentDB, which does not allow dot characters:

• https://docs.aws.amazon.com/documentdb/latest/developerguide/functional-differences.html#functional-differences.field-name-restrictions
• Amazon DocumentDB does not support dots "." in a document field name

Suppose I want to provide data in my CNA container about the number of patients who were harmed by exploitation of a vulnerability on the CVE List. I want to indicate that this data is associated with the org.mitre.synthea namespace as shown at:

• https://mvnrepository.com/artifact/org.mitre.synthea
• https://synthea.mitre.org

For example:

"x_org.mitre.synthea": 0,

This is valid according to the schema. However, CVE Services does not accept a CVE Record submission with this. DocumentDB fails with writeError, and the CVE Services API implementation then (more or less) relies on a top-level error handler to return this to the client:

{"error":"SERVICE_NOT_AVAILABLE","message":"This service appears to not be available."}

Because the underlying implementation (the DocumentDB dependency) is unlikely to be changed anytime soon, it may be useful to inform the user community that dots aren't allowed (especially because of the inscrutable "not be available" error message).

One way to do this is by changing the schema, e.g.,

"patternProperties": {
    "^x_[^.]*$": {}
},
"additionalProperties": false

(This only helps with properties at certain places in a document. It doesn't prevent use of a dot in a field name within a custom nested data structure designed by a CNA or ADP.)

Alternatively, there could be some type of guidance document at https://cveproject.github.io/automation-transition to cover known restrictions on JSON 5 documents and API performance.

[arslan-raza-143]

@ElectricNroff