Giters

CVEProject / cve-schema

This repository is used for the development of the CVE JSON record format. Releases of the CVE JSON record format will also be published here. This repository is managed by the CVE Quality Working Group.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

confusion about ssZZZZ in date-time format

ElectricNroff opened this issue · comments

commented

cve-schema/schema/v5.0/CVE_JSON_5.0_schema.json

Line 79 in f8f54d5

"description": "Date/time format based on RFC3339 and ISO ISO8601, with an optional timezone in the format 'yyyy-MM-ddTHH:mm:ssZZZZ'. If timezone offset is not given, GMT (0000) is assumed.",

cve-schema/schema/v5.0/CVE_JSON_5.0_schema.json

Line 955 in f8f54d5

"description": "Timestamp representing when the event in the timeline occurred. The timestamp format is based on RFC3339 and ISO ISO8601, with an optional timezone. yyyy-MM-ddTHH:mm:ssZZZZ - if the timezone offset is not given, GMT (0000) is assumed.",

seem to imply that a timezone in the format 0000 can be used immediately after the seconds in a date-time value. Actually, there needs to be a plus or minus first, and also a colon between the hours and the minutes. It perhaps could be better represented as:

with an optional timezone in the format 'yyyy-MM-ddTHH:mm:ss[+-]ZZ:ZZ'. If timezone offset is not given, GMT (+00:00) is assumed. (line 79)

with an optional timezone. yyyy-MM-ddTHH:mm:ss[+-]ZZ:ZZ - if the timezone offset is not given, GMT (+00:00) is assumed. (line 955)

or

with an optional timezone in the format 'yyyy-MM-ddTHH:mm:ss[+-]ZH:ZM'. If timezone offset is not given, GMT (+00:00) is assumed. (line 79)

with an optional timezone. yyyy-MM-ddTHH:mm:ss[+-]ZH:ZM - if the timezone offset is not given, GMT (+00:00) is assumed. (line 955)

I realize that this is inconsequential for most schema users, because they will be using standard library functions to construct date-time values within CVE Records, and all, or nearly all, common languages/frameworks are able to construct date-time values that comply with the schema.

The issue is relevant because the date-time format is also used in some CVE Services API commands such as:

GET /api/cve-id?time_reserved.lt=2023-01-01T12:34:56-05:00

and users realistically type such timestamps manually (without using a library function). I realize that the cve-schema repo maintainers aren't responsible for the API. However, the CVE Services API maintainers told me they want their date-time documentation example to be exactly the same as the cve-schema date-time documentation example. So, I was hoping that the cve-schema repo maintainers could help me out by changing the above two occurrences of ssZZZZ and the above two occurrences of 0000 to something that is more accurate.