vulnerability.proto

/*
 * Copyright 2020 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

// Data models for describing a vulnerability.
syntax = "proto3";

package tsunami.proto;

option java_multiple_files = true;
option java_outer_classname = "VulnerabilityProtos";
option java_package = "com.google.tsunami.proto";
option go_package = "github.com/google/tsunami-security-scanner/proto";

// Severity of a vulnerability.
enum Severity {
  // Unspecified severity.
  SEVERITY_UNSPECIFIED = 0;
  // Minimal severity.
  MINIMAL = 1;
  // Low severity.
  LOW = 2;
  // Medium severity.
  MEDIUM = 3;
  // High severity.
  HIGH = 4;
  // Critical severity.
  CRITICAL = 5;
}

// The identifier that uniquely identifies this vulnerability.
message VulnerabilityId {
  // Entity that published this identifier.
  string publisher = 1;

  // Publisher assigned unique identifier.
  string value = 2;

  // Optional. URL for details about this vulnerability.
  string link = 3;
}

// Message that represents one single vulnerability detected by Tsunami.
message Vulnerability {
  // The main identifier for this vulnerability, usually a publicly known
  // identifier like CVEs and such. If not publicly known, users are expected to
  // assign an id on their own.
  VulnerabilityId main_id = 1;

  // Any related identifiers about this vulnerability, e.g. a CWE weakness.
  repeated VulnerabilityId related_id = 2;

  // Severity of this vulnerability.
  Severity severity = 3;

  // Terse but descriptive sentence about this vulnerability.
  // For example: "Default Password (0p3nm35h) for 'root' Account.".
  string title = 4;

  // Verbose description of this vulnerability.
  string description = 5;

  // Optional. Verbose recommended solution(s).
  string recommendation = 6;

  // Optional. The CVSS v2 score of this vulnerability.
  string cvss_v2 = 7;

  // Optional. The CVSS v3 score of this vulnerability.
  string cvss_v3 = 8;

  // Any additional technical details about this vulnerability.
  repeated AdditionalDetail additional_details = 9;
}

// Additional details regarding a vulnerability can be stored here. Prefers to
// use the existing structured data when possible, otherwise store the raw data
// as a blob.
message AdditionalDetail {
  string description = 1;

  oneof detail {
    BlobData blob_data = 2;
    TextData text_data = 3;
    Credential credential = 4;
  }
}

// A piece of arbitrary binary data.
message BlobData {
  bytes data = 1;
}

// A piece of arbitrary UTF-8 encoded text data.
message TextData {
  string text = 1;
}

// Credential for a vulnerable network service.
message Credential {
  string username = 1;
  string password = 2;
}