# CVE reachability lens (template)
#
# Regenerate or extend this file per advisory. Replace the example rules below
# with FQNs from the CVE/f-SBOM advisory you are investigating.
definition:
  language:
    java:
      - name: "Log4j JNDI lookup (example CVE-2021-44228)"
        prefix: "org.apache.logging.log4j"
        provider: CVE
        rule: "org\\.apache\\.logging\\.log4j\\..*\\.(?<operation>[a-zA-Z0-9_]+)"
      - name: "Log4j core Logger"
        prefix: "org.apache.logging.log4j.core"
        provider: CVE
        rule: "org\\.apache\\.logging\\.log4j\\.core\\..*\\.(?<operation>[a-zA-Z0-9_]+)"
    python:
      - name: "Pillow image open (example pattern)"
        prefix: "PIL.Image"
        provider: CVE
        rule: "PIL\\.Image\\.(?<operation>[a-zA-Z0-9_]+)"
    go:
      - name: "Vulnerable stdlib crypto (example)"
        prefix: "crypto/tls."
        provider: CVE
        rule: "crypto/tls\\.(?<operation>[a-zA-Z0-9_]+)"
    javascript:
      - name: "Lodash deep merge (example pattern)"
        prefix: "lodash."
        provider: CVE
        rule: "lodash\\.(?<operation>merge|mergeWith|defaultsDeep)"

  providers:
    CVE:
      servicenameMapping: {}
