Having free-format definitions for vulnerability types will result in people using different naming for the same vulnerability types. This makes it harder to consume for computers. I'd propose to use Common Weakness Enumeration (CWE) for this. This would require the file to define a CWE version number and a list of CWE IDs. It could look something like this:
Out-of-scope-vuln: CAPEC-103 (clickjacking)
Out-of-scope-vuln: CWE-77 (command injection)
Using the parentheses is optional and will be ignored, but adds the ability for humans to interpret the meaning of the CWE without the need to look it up. It could be validated with something like:
([CAPEC|CWE]+-\d+)(\s+?\(.*\))?
Having free-format definitions for vulnerability types will result in people using different naming for the same vulnerability types. This makes it harder to consume for computers. I'd propose to use Common Weakness Enumeration (CWE) for this. This would require the file to define a CWE version number and a list of CWE IDs. It could look something like this:
Using the parentheses is optional and will be ignored, but adds the ability for humans to interpret the meaning of the CWE without the need to look it up. It could be validated with something like: