schema.yml

extensions:
  - ".github/schema/checks.py"
type: map
func: check_root
mapping:
  Name:
    type: str
    pattern: '^[a-z0-9_\-\.]+\.dll$'
    required: true

  Author:
    type: str
    pattern: '^\w[\w\s\-'']+\w$'
    required: true

  Created:
    type: date
    format: "%Y-%m-%d"
    required: true

  Vendor:
    type: str
    pattern: '^\w[\w|\s|\-]+\w$'
    required: true

  CVE:
    type: str
    pattern: '^CVE-\d{4}-\d{3,}$'
    required: false

  ExpectedLocations:
    type: seq
    required: false
    sequence:
      - type: str
        pattern: '^[%cC][ a-zA-Z0-9_\-\\%\.\(\):]+(?<!\\)(?<!\.\w{3})$'
        desc: Only backslashes, no trailing slashes, folder paths only (so no filenames)
        unique: true
        required: true

  VulnerableExecutables:
    type: seq
    required: true
    sequence:
      - type: map
        func: check_executables
        mapping:
          Path:
            type: str
            required: true
            unique: true
            pattern: '^[ a-zA-Z0-9_\-\\%\.\(\)]+$'

          Type:
            type: str
            enum: ["Sideloading", "Phantom", "Search Order", "Environment Variable"]
            required: true

          AutoElevate:
            type: bool
            required: false

          PrivilegeEscalation:
            type: bool
            required: false

          Condition:
            type: str
            required: false

          SHA256:
            type: seq
            required: false
            sequence:
              - type: str
                pattern: "^[a-zA-Z0-9]{64}$"
                required: true

          Variable:
            type: str
            required: false

  Resources:
    type: seq
    required: false
    sequence:
      - type: str
        required: true
        unique: true
        pattern: '^([^:\/?#]+:)(?:\/\/([^\/?#]*))?([^?#]+)?(\?[^#]*)?(#.*)?'

  Acknowledgements:
    type: seq
    required: false
    sequence:
      - type: map
        func: not_empty
        required: true
        mapping:
          Name:
            type: str
            pattern: '^\w[\w\s\-'']+\w$'
            required: true
          Twitter:
            type: str
            pattern: '^@(\w){1,15}$'
            required: false