openapi.json is unsuitable for generating bindings

[gwd]

Prerequisites

• Put an X between the brackets on this line if you have done all of the following:
  • Checked the FAQs on the message board for common solutions: (TBD)
  • Checked that your issue isn't already filed.

Description

The openapi.json at https://cveawg.mitre.org/api-docs/openapi.json isn't suitable for use for generating bindings. Specifically, the CVE Record endpoints don't expose the full CVE JSON 5.0 fields that it accepts, but only a tiny subset; this ends up being mirrored in the bindings, making them nearly unusable for submitting CVEs.

Steps to Reproduce

1. Install openapi-generate (e.g., brew install openapi-generator).
2. Generate the bindings (e.g., openapi-generator generate -i https://cveawg.mitre.org/api-docs/openapi.json -g go -o go-cve-api --skip-validate-spec)

Expected behavior:

The bindings generated from openapi.json expose the full functionality of the interface; including the ability to fill out any of the fields defined in CVE JSON 5.0

Actual behavior:

The bindings generated from openapi.json only expose the fields from the "cve record minimum request"; namely, affected, descriptions, problemtypes, and references.

Here is the only struct available to pass into the code to submit updates to records:

type CveRecordMinimumRequestCnaContainer struct {
    Affected         []CreateFullCveRecordRequestContainersCnaAffectedInner `json:"affected"`
    Descriptions     []GetCveRecordResponseContainersCnaDescriptionsInner   `json:"descriptions"`
    ProblemTypes     []GetCveRecordResponseContainersCnaProblemTypesInner   `json:"problemTypes,omitempty"`
    ProviderMetadata *GetCveRecordResponseContainersCnaProviderMetadata     `json:"providerMetadata,omitempty"`
    References       []GetCveRecordResponseContainersCnaReferencesInner     `json:"references"`
}

Reproduces how often:

Always

Versions

2.1.4

Additional Information

The full set of generated code (along with a few example programs I wrote, partly just to test that it worked at a basic level) can be found here: https://gitlab.com/xen-project/misc/go-cveapi

[david-rocca]

Hey @gwd , any chance you could take a look at the PR we made for this ticket here to see if the output works better for you?

We did a test with postman's binding generator and it seemed that things were much more complete.

Thanks!