* `make converters`: Generates the XSLT stylesheets for JSON<->XML conversion off of the source Metaschemas;

* `make resolved-metaschemas`: Resolves external entities (XXE) present in the source OSCAL Metaschema modules for use with tools that do not support XXEs.

<?xml version="1.0" encoding="UTF-8"?>

<xsl:stylesheet version="1.0"

xmlns:xsl="http://www.w3.org/1999/XSL/Transform"

xmlns:metaschema="http://csrc.nist.gov/ns/oscal/metaschema/1.0">

<xsl:output omit-xml-declaration="no" indent="yes"/>

<xsl:param name="importHrefSuffix" select="'RESOLVED'"/>

<!--

<xsl:template name="string-replace">

<xsl:param name="string" />

<xsl:param name="replace" />

<xsl:param name="with" />

<xsl:choose>

<xsl:when test="contains($string, $replace)">

<xsl:value-of select="substring-before($string, $replace)" />

<xsl:value-of select="$with" />

<xsl:call-template name="string-replace">

<xsl:with-param name="string" select="substring-after($string,$replace)" />

<xsl:with-param name="replace" select="$replace" />

<xsl:with-param name="with" select="$with" />

</xsl:call-template>

</xsl:when>

<xsl:otherwise>

<xsl:value-of select="$string" />

</xsl:otherwise>

</xsl:choose>

</xsl:template>

<!-- Simple identity transform, resolving entities implicitly -->

<xsl:template match="@*|node()">

<xsl:copy>

<xsl:apply-templates select="@*|node()"/>

</xsl:copy>

</xsl:template>

<!-- Transform import/@href using $importHrefSuffix -->

<xsl:template match="metaschema:import/@href">

<xsl:attribute name="href">

<!-- oscal_poam_metaschema.xml => oscal_poam_metaschema_$importHrefSuffix.xml -->

<xsl:call-template name="string-replace">

<xsl:with-param name="string" select="." />

<xsl:with-param name="replace" select="'.xml'" />

<xsl:with-param name="with" select="concat('_', $importHrefSuffix, '.xml')" />

</xsl:call-template>

</xsl:attribute>

</xsl:template>

</xsl:stylesheet>

Date: 08/25/2023

Approved

We wish to remove or mitigate points friction encountered by NIST or community OSCAL developers producing tooling that consumes the OSCAL Metaschema module sources.

The OSCAL Metaschema modules currently use external entities to prevent duplication of constraint data.

These external entities are important for modeling ergonomics and cannot be removed until a Metaschema-native approach is stabilized, however external entities have a storied history of abuse.

So called "XML External Entity (XXE) Attacks", along with the additional complexity needed to support external entity resolution, have led to a situation where many XML parsers do not ship with XXE functionality.

This has put additional burden on OSCAL tool developers seeking to consume the source Metaschemas, who have either had to choose from the small subset of XML parsers that support external entities (if one exists for their target language at all) and inherit all additional risks that come with XXEs, or perform transformation of the source Metaschema modules before consuming them.

- Related to Issue [#1665](https://github.com/usnistgov/OSCAL/issues/1665)

The NIST OSCAL Team should include the "resolved" Metaschema module sources as an artifact generated upon release.

Additionally, the NIST OSCAL Team should document the process for obtaining a resolved Metaschema module as part of the [streamlined build process](./0005-repository-reorganization.md#streamlined-build-process).

In the event that Metaschema stabilizes constraint imports, the NIST OSCAL Team will review this ADR and potentially determine a deprecation strategy for these generated artifacts in the relevant releases.

This decision will not have any breaking changes to our process, however:

1. The NIST team will be responsible for reviewing the additional artifacts before performing a release.

2. In the event that Metaschema stabilizes constraint imports, the NIST OSCAL team will have to maintain deprecated artifacts until the next major version.

- `xml/` and `json/`: Provides the XML and JSON schemas and content converters that are needed to support the OSCAL model. Instructions for using these artifacts can be found at https://github.com/usnistgov/OSCAL/blob/develop/build/README.md#artifact-usage

- `metaschema/`: Provides the source OSCAL Metaschema modules with all external entities (XXE) resolved for tools that do not support XXEs.

If you are interested in helping, please visit or contributing page for more information at: https://github.com/usnistgov/OSCAL/blob/main/CONTRIBUTING.md.