Count HIGH-severity entries in a mock CVE JSON feed

Challenge

Count the HIGH-severity entries in a mock CVE feed — triaging a feed line-by-line with a precise substring match is the fastest path from feed to alert.

Task

Implement int count_high_severity(const char *json) that returns how many records contain the exact field "severity":"HIGH".

Input

• json: a NUL-terminated string of \n-separated mock JSON records, baked into the harness.

Output

Returns int: the count of records matching the field (>= 0), or 0 if json == NULL.

Example

'{"severity":"HIGH"}\n{"severity":"LOW"}\n'   ->   1
'{"severity":"HIGHEST"}\n'                     ->   0   (not closed by ")
'{"name":"HIGH"}\n'                            ->   0   (key is "name")

Edge cases

• NULL or empty input returns 0.
• The value must be closed by " — HIGHEST, HIGHER, etc. must not match.

Rules

• The full needle is "severity":"HIGH" followed by a closing ". Matching just HIGH is fooled by HIGHEST/HIGHWAY.

Why this matters

Triaging a CVE feed line-by-line with a pinned substring sweep is the fastest path from feed → alert. The lesson is in being precise about what you match.

Input format

A NUL-terminated string of \n-separated mock JSON records.

Output format

Count (>= 0). 0 on NULL.

Constraints

The full needle is "severity":"HIGH" followed by ". Match the closing quote.

Starter code

int count_high_severity(const char *json) {
    /* TODO */
    (void)json;
    return 0;
}

Common mistakes

Trusting strstr("HIGH") alone. Forgetting to advance past the match — infinite loop. Counting "name":"HIGH" because the key wasn't pinned.

Edge cases to handle

Trailing record without newline. Mixed-case (we only accept all-caps HIGH).

Complexity

O(n) where n is the input length.

Background lessons

• Count HIGH-severity entries in a mock CVE feed

Up next

• Score a URL for phishing structural smells