Re: [csaf] [CSAF JSON Schema] limits to field lengths

Hi Allan,

I'd be perfectly comfortable with not imposing limits. I raised the issue because:

it is an option when creating a new schema

we don't actually live with unbounded limits, we just choose not to document them....

it may be useful to convey limitations for certain fields (such as title) so that people actually limit what they say in those fields.

some alternate representations of CVE data (i.e. MITRE) have found it necessary to at least consider limits, because stuff broke when someone exceeded previously undocumented limits.

However, trying to guess at limits is likely a tricky enterprise. I thought it might be worth a discussion - even if we discard it.

Eric.

On Mon, May 7, 2018 at 8:16 PM, Allan Thomson <> wrote:

Eric – 

 

Lower limit -> It depends on the property. 0 (empty string without null) may be a good lower limit. For example, a string property where the value is unassigned may be set to empty string.

 

Upper limit -> In most cases STIX2 avoided setting an upper limit at all. For certain string enumeration properties the upper limit was set to a reasonably high value for what could be expected in that enumeration. (e.g. 256)

 

Allan

From: <> on behalf of Eric Johnson <>

Date: Monday, May 7, 2018 at 5:53 PM

To: "" <>

Subject: [csaf] [CSAF JSON Schema] limits to field lengths

 

The current specification does not limit the amount of data that goes into properties, such as the document title or the description fields.

 

The lower limit I put in the JSON schema (for just about everything), is simply a non-empty string - 1 or more characters.

 

Is that the right lower limit?

 

What's the upper limit?

 

Eric.