diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a52d139..290e48e 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -57,10 +57,10 @@ Think of these repositories as a pipeline: Contributors make changes in cve-data 4. Install required Python packages: ```bash # If using uv - uv pip install requests check-jsonschema + uv pip install requests check-jsonschema cpe # If using pip - pip install requests check-jsonschema + pip install requests check-jsonschema cpe ``` 5. Fork and clone the cve-data-enrichment repository: @@ -451,6 +451,57 @@ When creating CPEs: - Use asterisks (*) for fields that apply to all values - Ensure vendor and product names follow standardized formats +### Scenario 6: Removing a match + +Sometimes a match needs to be removed from appearing in the results. There +are many reasons this could happen: missing details for a very old +vulnerability, the vulnerability might be marked as wontfix by the upstream +project, or the original CPE is just incorrect. + +Using the example from Scenario 1 + +```json +{ + "additionalMetadata": { + "cna": "github_m", + "cveId": "CVE-2025-23214", + "description": "Cosmos provides users the ability self-host a home server...", + "reason": "Added CPE configurations because not yet analyzed by NVD." + }, + "adp": { + "affected": [ + { + "collectionURL": "https://pkg.go.dev", + "cpes": [ + "cpe:2.3:a:cosmos-cloud:cosmos_server:*:*:*:*:*:go:*:*" + ], + "packageName": "github.com/azukaar/cosmos-server", + "packageType": "go-module", + "product": "Cosmos-Server", + "repo": "https://github.com/azukaar/cosmos-server", + "vendor": "azukaar", + "versions": [ + { + "lessThan": "0.17.7", + "status": "affected", + "version": "0", + "versionType": "custom" + } + ] + } + ] + } +} +``` + +We will change the line +`"status": "affected",` +to be unaffected +`"status": "unaffected",` + +We modify the status rather than removing the data so future script run +won't mistakenly re-add the incorrect data. + ## Best Practices 1. **Documentation**: Always include clear commit messages explaining your changes. Examples: