[2.0]: dont use character classes in patterns #988

per https://json-schema.org/understanding-json-schema/reference/regular_expressions

Use only standard escapes like \n, \r, \t and keep in mind that you also need to do JSON escaping.

we already do this here

• specification/schema/2.0/model/cyclonedx-common-2.0.schema.json

  Line 23 in 2a86067

  "pattern": "^urn:cdx:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/[1-9][0-9]*$",

• specification/schema/2.0/model/cyclonedx-common-2.0.schema.json

  Line 31 in 2a86067

  "pattern": "^urn:cdx:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/[1-9][0-9]*#.+$",

• specification/schema/2.0/model/cyclonedx-common-2.0.schema.json

  Line 94 in 2a86067

  "pattern": "^([a-fA-F0-9]{32}|[a-fA-F0-9]{40}|[a-fA-F0-9]{64}|[a-fA-F0-9]{96}|[a-fA-F0-9]{128})$"

• specification/schema/2.0/model/cyclonedx-common-2.0.schema.json

  Line 770 in 2a86067

  "pattern": "^([a-z]{2})(-[A-Z]{2})?$",

so character classes are not universal - some regex engines just dont support them.
we should take care of this , and use the custom character classes in these cases.
like [0-9] for \d

things to fix:

• [2.0] Threatmodeling and Blueprints #678 (comment)

• specification/schema/2.0/model/cyclonedx-common-2.0.schema.json

  Line 495 in 2a86067

  "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?Z$",

• to be contiinued

tooling

have a QA tool that asserts that only those common/standard regex patterns are used