how to convert this array in one? - json

Question

I am playing around with jq at https://jqplay.org/
The JSON I currently have is :
{
"license": {
"type": "permissive",
"url": "http://en.wikipedia.org/wiki/MIT_License",
"name": "MIT"
},
"lib": "libxml2",
"vuln-count": {
"exact": 2,
"total": 3,
"historical": 1
},
"vulns": [
{
"exact": false,
"timestamp-objects": [],
"vuln": {
"published-epoch": "1072839600",
"cvss": 9.3,
"summary": "libxml2, possibly before 2.5.0.\"",
"published": "2003-12-31T03:00:00",
"cve": "CVE-2003-1564",
"modified": "2008-10-24T01:30:02",
"modified-epoch": "1224811802"
}
},
{
"exact": true,
"timestamp-objects": [
"libxml2-2.8.0-1.x86_64.cpio:/usr/lib64/libxml2.so.2.8.0"
],
"vuln": {
"published-epoch": "1356061574",
"cvss": 5,
"summary": "libxml2 before 2.8.0 computes hash values.",
"published": "2012-12-21T03:46:14",
"cve": "CVE-2012-0841",
"modified": "2014-01-28T02:42:55",
"modified-epoch": "1390876975"
}
},
{
"exact": true,
"timestamp-objects": [
"libxml2-2.8.0-1.x86_64.cpio:/usr/lib64/libxml2.so.2.8.0"
],
"vuln": {
"published-epoch": "1346432101",
"cvss": 6.8,
"summary": "libxml2 2.9.0-rc1 and earlier.",
"published": "2012-08-31T16:55:01",
"cve": "CVE-2012-2871",
"modified": "2014-01-28T02:45:36",
"modified-epoch": "1390877136"
}
}
]
}
my current filter is
if .["vuln-count"].exact >0
then {num_of_vulns: .["vuln-count"].exact, lib: .lib, license: .license.type, vuln: .vulns[]|select (.exact==true)|.vuln.cve}
else empty end
And the result is
{
"num_of_vulns": 2,
"lib": "libxml2",
"license": "permissive",
"vuln": "CVE-2012-0841"
}
{
"num_of_vulns": 2,
"lib": "libxml2",
"license": "permissive",
"vuln": "CVE-2012-2871"
}
What is the filter to use in order to get the following output?
{
"num_of_vulns": 2,
"lib": "libxml2",
"license": "permissive",
"vulns": ["CVE-2012-0841", "CVE-2012-2871"]
}
Thanks to Santiago, here is the working filter:
if .["vuln-count"].exact >0 then {
num_of_vulns: ."vuln-count".exact,
lib: .lib,
license: .license.type,
vulns: .vulns | map(select(.exact).vuln.cve)
} else empty end

Answer 1

Your expected result is not meaningful as a JSON! On a JSON object, the property keys must be unique. When property keys are repeated, JSON parsers will usually only keep the last one's value, disregarding the rest.
You can, however, obtain something like this:
{
"num_of_vulns": 2,
"lib": "libxml2",
"license": "permissive",
"vulns": ["CVE-2012-0841", "CVE-2012-2871"]
}
Here's a sample script that does so (I omitted your wrapping if for empty vulns, but it could be added around it):
{
num_of_vulns: ."vuln-count".exact,
lib: .lib,
license: .license.type,
vulns: .vulns | map(select(.exact).vuln.cve)
}