Merge pull request #1662 from CVEProject/dev

Update Staging from Dev

Author: jdaigneau5

package-lock.json

@@ -178,6 +178,32 @@ function datePublicHelper (datePublic) {
   return currentDate > datePublicWithGracePeriod
 }
 
+/**
+ * Checks that timeline.time fields are valid datetime objects.
+ * This accounts for invalid timezone offsets that aren't handled by the schema.
+ *
+ * @param {String} dateIndex
+ * @returns true
+ * @throws Error
+ */
+function validateTimelineDates (dateIndex) {
+  // Check if datePublic is a future date
+  return body(dateIndex).isArray().withMessage('Time must be a date string').optional({ nullable: true }).bail().custom((timelineArray) => {
+    for (const timelineObj of timelineArray) {
+      const value = new Date(timelineObj.time)
+      if (!validateTimelineHelper(value)) {
+        throw new Error(`Invalid date string: ${timelineObj.time} `)
+      }
+    }
+
+    return true
+  })
+}
+
+function validateTimelineHelper (value) {
+  return value instanceof Date && !isNaN(value)
+}
+
 // Organizations in the ADP pilot are generating JSON programatically, and thus
 // informing them about the result of the final validation (against the full
 // CVE Record schema) is currently sufficient.
@@ -290,6 +316,7 @@ module.exports = {
   validateDescription,
   validateRejectBody,
   validateDatePublic,
+  validateTimelineDates,
   datePublicHelper,
   validatePURL,
   purlValidateHelper

src/controller/cve.controller/cve.middleware.js

@@ -4,7 +4,7 @@ const mw = require('../../middleware/middleware')
 const errorMsgs = require('../../middleware/errorMessages')
 const controller = require('./cve.controller')
 const { body, param, query } = require('express-validator')
-const { parseGetParams, parsePostParams, parseError, validateCveCnaContainerJsonSchema, validateCveAdpContainerJsonSchema, validateRejectBody, validateUniqueEnglishEntry, validateDescription, validateDatePublic, validatePURL } = require('./cve.middleware')
+const { parseGetParams, parsePostParams, parseError, validateCveCnaContainerJsonSchema, validateCveAdpContainerJsonSchema, validateRejectBody, validateUniqueEnglishEntry, validateDescription, validateDatePublic, validateTimelineDates, validatePURL } = require('./cve.middleware')
 const getConstants = require('../../constants').getConstants
 const CONSTANTS = getConstants()
 const CHOICES = [CONSTANTS.CVE_STATES.REJECTED, CONSTANTS.CVE_STATES.PUBLISHED]
@@ -499,6 +499,7 @@ router.post('/cve/:id',
   validateUniqueEnglishEntry(['containers.cna.descriptions', 'containers.cna.rejectedReasons']),
   validateDescription(['containers.cna.rejectedReasons', 'containers.cna.descriptions', 'containers.cna.problemTypes[0].descriptions']),
   validateDatePublic(['containers.cna.datePublic']),
+  validateTimelineDates(['containers.cna.timeline']),
   validatePURL(['containers.cna.affected']),
   param(['id']).isString().matches(CONSTANTS.CVE_ID_REGEX),
   parseError,
@@ -586,6 +587,7 @@ router.put('/cve/:id',
   validateUniqueEnglishEntry(['containers.cna.descriptions', 'containers.cna.rejectedReasons']),
   validateDescription(['containers.cna.rejectedReasons', 'containers.cna.descriptions', 'containers.cna.problemTypes[0].descriptions']),
   validateDatePublic(['containers.cna.datePublic']),
+  validateTimelineDates(['containers.cna.timeline']),
   validatePURL(['containers.cna.affected']),
   param(['id']).isString().matches(CONSTANTS.CVE_ID_REGEX),
   parseError,
@@ -685,6 +687,7 @@ router.post('/cve/:id/cna',
   validateUniqueEnglishEntry('cnaContainer.descriptions'),
   validateDescription(['cnaContainer.descriptions', 'cnaContainer.problemTypes[0].descriptions']),
   validateDatePublic(['cnaContainer.datePublic']),
+  validateTimelineDates(['cnaContainer.timeline']),
   validatePURL(['cnaContainer.affected']),
   param(['id']).isString().matches(CONSTANTS.CVE_ID_REGEX),
   parseError,
@@ -786,6 +789,7 @@ router.put('/cve/:id/cna',
   validateUniqueEnglishEntry('cnaContainer.descriptions'),
   validateDescription(['cnaContainer.descriptions', 'cnaContainer.problemTypes[0].descriptions']),
   validateDatePublic(['cnaContainer.datePublic']),
+  validateTimelineDates(['cnaContainer.timeline']),
   validatePURL(['cnaContainer.affected']),
   param(['id']).isString().matches(CONSTANTS.CVE_ID_REGEX),
   parseError,
@@ -1058,6 +1062,7 @@ router.put('/cve/:id/adp',
   mw.trimJSONWhitespace,
   validateCveAdpContainerJsonSchema,
   validatePURL(['adpContainer.affected']),
+  validateTimelineDates(['adpContainer.timeline']),
   param(['id']).isString().matches(CONSTANTS.CVE_ID_REGEX),
   parseError,
   parsePostParams,