Skip to content

Resolves issue #2029, preserve extension fields when creating rejected CVE records. - #2078

Merged
david-rocca merged 3 commits into
devfrom
dr_2029
Nov 3, 2026
Merged

Resolves issue #2029, preserve extension fields when creating rejected CVE records.#2078
david-rocca merged 3 commits into
devfrom
dr_2029

Conversation

@david-rocca

@david-rocca david-rocca commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Closes Issue #2029

Summary

POST /cve/:id/reject previously returned 200 while silently discarding submitted x_ fields. It now preserves the submitted CNA container while retaining server-managed provider metadata.

Important Changes

src/model/cve.js

  • Copy the submitted rejected CNA container and overwrite providerMetadata with server-generated values.
  • Remove the helper that discarded extension fields.
  • Allow full-record validation to reject unknown non-extension fields instead of silently dropping them.

test/integration-tests/cve/cveRecordRejectionTest.js

  • Add six tests covering POST/GET/PUT persistence, nested and falsy extension values, optional replacedBy, metadata overrides, and invalid input.

test/integration-tests/cve/crossContainerValidationTest.js

  • Verify existing invalid CNA or ADP containers block updates without modifying the stored record.
  • Confirm updates succeed after the invalid container is repaired.

Testing

  • Full integration suite: bash -i -c "npm run test:integration:replicas" — 1,007 passing.
  • ESLint passed for the model and rejection tests.
  • Whitespace checks passed.

Manual verification:

  • Reserve a CVE ID and POST a rejected container containing "x_myProperty": true.
  • GET the record before issuing PUT and verify the extension is present.
  • PUT the same container, then GET again and verify the extension remains.

David T Rocca
fix: preserve x_ fields when creating rejected CVE records
9216896 
Copy the submitted CNA container while keeping provider metadata
server-controlled. Remove the helper that silently discarded extensions.

Add regression coverage for POST/GET/PUT persistence, validation,
metadata overrides, and updates blocked by existing invalid containers.
@david-rocca david-rocca linked an issue Oct 29, 2026 that may be closed by this pull request
POST /cve/:id/reject deletes some properties #2029
Closed
jdalphond-mitre
jdalphond-mitre approved these changes Nov 2, 2026
View reviewed changes

@jdalphond-mitre jdalphond-mitre left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Works

I found a validation library issue while testing this. But that will be a separate issue.

@david-rocca
david-rocca merged commit b8b2656 into dev Nov 3, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jdalphond-mitre jdalphond-mitre jdalphond-mitre approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

POST /cve/:id/reject deletes some properties

2 participants

@david-rocca @jdalphond-mitre