feat: Revamp vulnerability page #153
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add a new `yaml_front_matter` extension to Pelican that enables parsing YAML front matter from Markdown content. This mirrors the behavior of static site generators like Jekyll and Hugo, allowing users to define arbitrary metadata (e.g., title, tags, date) at the top of Markdown files using a YAML block. While Pelican's default Markdown metadata support only handles flat key-value pairs, this extension allows for nested and structured data—enabling use cases such as VEX documents and other complex front matter schemas. Improves compatibility with common Markdown authoring workflows. References: - https://jekyllrb.com/docs/front-matter/ - https://gohugo.io/content-management/front-matter/
Introduce a JSON Schema (`plugins/vex/schema/vex_article.schema.yaml`) for validating vulnerability-related articles. The schema captures all metadata needed to describe a vulnerability in Apache Solr or in a bundled dependency. Also add a parser that converts article front matter into objects optimized for use in Jinja2 templates.
Introduce a Jinja2 template that generates data views for vulnerability articles, with three example articles included. The template supports both vulnerabilities in Apache Solr itself and in bundled dependencies.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request proposes a new design for the Apache Solr security page, as discussed on
dev@solr, and introduces support for richer metadata in vulnerability-related articles.Key Changes
Full YAML front matter support in Markdown articles
MetaExtensiononly parses flat YAML front matter.YamlFrontMatterExtension, which supports complex YAML documents inside front matter.Defined YAML structure for vulnerability articles
Enhanced security page
in_triage,not_exploitable,affected).Work in progress
I am still working on generating CycloneDX documents (VDR and VEX) from the Markdown articles.
However, early feedback from the maintainers and the community would be valuable to ensure I am heading in the right direction before completing the implementation.
Preview
1. YAML front matter
The YAML front matter of the articles looks like this:
2. Vulnerabilities Table
Lists vulnerabilities by Solr minor version with their current status.
Show screenshot
3. Vulnerability Articles
a. Vulnerability in Solr itself
Show screenshot
b. VEX entry in triage
Show screenshot
c. VEX entry assessed
Show screenshot