Skip to content

Commit d92a3b0

Browse files
David Waltermireaj-stein-nist
David Waltermire
authored and
aj-stein-nist
committed
Fixed improper use of allowed-values/allow-other. Ensured that all props in the OSCAL namespace are properly closed and all link rels are open for extension. (#1579)
1 parent 49ba917 commit d92a3b0

9 files changed

+75
-76
lines changed

‎src/metaschema/oscal_assessment-common_metaschema.xml‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -183,11 +183,11 @@
183183
</model>
184184
<constraint>
185185
<!-- TODO: Dave to double-check constraints here -->
186-
<allowed-values target="prop/@name" allow-other="yes">
186+
<allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name">
187187
<enum value="method">The assessment method to use. This typically appears on parts with the name "assessment".</enum>
188188
</allowed-values>
189-
<has-cardinality target="prop[@name='method']" min-occurs="1"/>
190-
<allowed-values target="prop[@name='method']/@value">
189+
<has-cardinality target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='method']" min-occurs="1"/>
190+
<allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='method']/@value">
191191
<enum value="INTERVIEW">The process of holding discussions with individuals or groups of individuals within an organization to once again, facilitate assessor understanding, achieve clarification, or obtain evidence.</enum>
192192
<enum value="EXAMINE">The process of reviewing, inspecting, observing, studying, or analyzing one or more assessment objects (i.e., specifications, mechanisms, or activities).</enum>
193193
<enum value="TEST">The process of exercising one or more assessment objects (i.e., activities or mechanisms) under specified conditions to compare actual with expected behavior.</enum>
@@ -1272,10 +1272,10 @@
12721272
<field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
12731273
</model>
12741274
<constraint>
1275-
<allowed-values target="prop/@name" allow-other="yes">
1275+
<allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name">
12761276
<enum value="type">The type of remediation tracking entry. Can be multi-valued.</enum>
12771277
</allowed-values>
1278-
<allowed-values target="prop[@name='type']/@value" allow-other="yes">
1278+
<allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='type']/@value" allow-other="yes">
12791279
<enum value="vendor-check-in">Contacted vendor to determine the status of a pending fix to a known vulnerability.</enum>
12801280
<enum value="status-update">Information related to the current state of response to this risk.</enum>
12811281
<enum value="milestone-complete">A significant step in the response plan has been achieved.</enum>
@@ -1305,13 +1305,13 @@
13051305
</define-assembly>
13061306
</model>
13071307
<constraint>
1308-
<allowed-values target="prop/@name">
1308+
<allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name">
13091309
<enum value="false-positive">The risk has been confirmed to be a false positive.</enum>
13101310
<enum value="accepted">The risk has been accepted. No further action will be taken.</enum>
13111311
<enum value="risk-adjusted">The risk has been adjusted.</enum>
13121312
<enum value="priority">A numeric value indicating the sequence in which risks should be addressed. (Lower numbers are higher priority)</enum>
13131313
</allowed-values>
1314-
<matches target="prop[@name='priority']/@value" datatype="integer" />
1314+
<matches target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='priority']/@value" datatype="integer" />
13151315
</constraint>
13161316
</define-assembly>
13171317

@@ -1401,21 +1401,21 @@
14011401
<field ref="remarks" in-xml="WITH_WRAPPER"/>
14021402
</model>
14031403
<constraint>
1404-
<allowed-values target="prop/@name">
1404+
<allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name">
14051405
<enum value="state">Indicates if the facet is 'initial' as first identified, or 'adjusted' indicating that the value has be changed after some adjustments have been made (e.g., to identify residual risk).</enum>
14061406
</allowed-values>
1407-
<allowed-values target="prop[@name='risk-state']/@value" allow-other="yes"><!-- For values related to initial and residual (mitigated) risk -->
1407+
<allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='state']/@value"><!-- For values related to initial and residual (mitigated) risk -->
14081408
<enum value="initial">As first identified.</enum>
14091409
<enum value="adjusted">Indicates that residual risk remains after some adjustments have been made.</enum>
14101410
</allowed-values>
14111411
<!-- TODO: What about "vulnerability-id", "plugin-id"? Should this be added to FedRAMP? -->
1412-
<allowed-values target="(.)[@system='http://csrc.nist.gov/ns/oscal']/@name" allow-other="yes">
1412+
<allowed-values target="(.)[@system='http://csrc.nist.gov/ns/oscal']/@name">
14131413
<enum value="likelihood">General likelihood rating.</enum>
14141414
<enum value="impact">General impact rating.</enum>
14151415
<enum value="risk">General risk rating.</enum>
14161416
<enum value="severity">General severity rating.</enum>
14171417
</allowed-values>
1418-
<allowed-values target="(.)[@system=('http://fedramp.gov','http://fedramp.gov/ns/oscal')]/@name" allow-other="yes">
1418+
<allowed-values target="(.)[@system=('http://fedramp.gov','http://fedramp.gov/ns/oscal')]/@name">
14191419
<enum value="likelihood">Likelihood as defined by FedRAMP. The <code>class</code> can be used to specify 'initial' and 'adjusted' risk states.</enum>
14201420
<enum value="impact">Impact as defined by FedRAMP. The <code>class</code> can be used to specify 'initial' and 'adjusted' risk states.</enum>
14211421
<enum value="risk">Risk as calculated according to FedRAMP. The <code>class</code> can be used to specify 'initial' and 'adjusted' risk states.</enum>
@@ -1683,10 +1683,10 @@
16831683
<field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
16841684
</model>
16851685
<constraint>
1686-
<allowed-values target="prop/@name" allow-other="yes">
1686+
<allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name">
16871687
<enum value="type"></enum>
16881688
</allowed-values>
1689-
<allowed-values target="prop[@name='type']/@value" allow-other="yes">
1689+
<allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='type']/@value">
16901690
<enum value="avoid">The risk will be eliminated.</enum>
16911691
<enum value="mitigate">The risk will be reduced.</enum>
16921692
<enum value="transfer">The risk will be transferred to another organization or entity.</enum>
@@ -1766,11 +1766,11 @@
17661766
<!-- <any/> -->
17671767
</model>
17681768
<constraint>
1769-
<allowed-values target=".[@name='objective']/prop/@name" allow-other="yes">
1769+
<allowed-values target=".[@name='objective']/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name">
17701770
<enum value="method">The assessment method to use. This typically appears on parts with the name "objective".</enum>
17711771
</allowed-values>
1772-
<has-cardinality target=".[@name='objective']/prop[@name='method']" min-occurs="1"/>
1773-
<allowed-values target=".[@name='objective']/prop[@name='method']/@value">
1772+
<has-cardinality target=".[@name='objective']/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='method']" min-occurs="1"/>
1773+
<allowed-values target=".[@name='objective']/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='method']/@value">
17741774
<enum value="INTERVIEW">The process of holding discussions with individuals or groups of individuals within an organization to once again, facilitate assessor understanding, achieve clarification, or obtain evidence.</enum>
17751775
<enum value="EXAMINE">The process of reviewing, inspecting, observing, studying, or analyzing one or more assessment objects (i.e., specifications, mechanisms, or activities).</enum>
17761776
<enum value="TEST">The process of exercising one or more assessment objects (i.e., activities or mechanisms) under specified conditions to compare actual with expected behavior.</enum>

‎src/metaschema/oscal_assessment-plan_metaschema.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@
9191
</assembly>
9292
</model>
9393
<constraint>
94-
<allowed-values target="part/@name">
94+
<allowed-values target="part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name">
9595
<enum value="rules-of-engagement">Defines the circumstances, conditions, degree, and manner in which the use of cyber-attack techniques or actions may be applied to the assessment.</enum>
9696
<enum value="disclosures">Any information the assessor should make known to the system owner or authorizing official. Has child 'item' parts for each individual disclosure.</enum>
9797
<enum value="assessment-inclusions">Defines any assessment activities which the system owner or authorizing official wishes to ensure are performed as part of the assessment.</enum>

‎src/metaschema/oscal_catalog_metaschema.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@
5454
<enum value="resolution-tool">The tool used to produce a resolved profile.</enum>
5555
<enum value="source-profile-uuid">The document-level <code>uuid</code> of the source profile from which the catalog was produced by <a href="https://pages.nist.gov/OSCAL/concepts/processing/profile-resolution/">profile resolution</a>.</enum>
5656
</allowed-values>
57-
<allowed-values target="metadata/link/@rel">
57+
<allowed-values target="metadata/link/@rel" allow-other="yes">
5858
<enum value="source-profile">The profile from which the catalog was produced by <a href="https://pages.nist.gov/OSCAL/concepts/processing/profile-resolution/">profile resolution</a>.</enum>
5959
<enum value="source-profile-uuid">The document-level <code>uuid</code> of the profile from which the catalog was produced by <a href="https://pages.nist.gov/OSCAL/concepts/processing/profile-resolution/">profile resolution</a>.</enum>
6060
</allowed-values>

‎src/metaschema/oscal_component_metaschema.xml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@
148148
<field ref="remarks" in-xml="WITH_WRAPPER"/>
149149
</model>
150150
<constraint>
151-
<allowed-values target="prop/@name" allow-other="yes">
151+
<allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name">
152152
<!-- ========================================================================================================== -->
153153
<!-- = Changes to the following values need to be synced with component in the SSP and component metaschemas. = -->
154154
<!-- CHANGED (BJR): Done -->
@@ -177,30 +177,30 @@
177177
&allowed-values-responsible-roles-component-production;
178178
</allowed-values>
179179

180-
<allowed-values target="prop[@name='asset-type']/@value">
180+
<allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='asset-type']/@value">
181181
&allowed-values-property-name-asset-type-values;
182182
</allowed-values>
183183

184184
<!-- ========================================================================================================== -->
185185
<!-- = TODO: The following was copied from implementation-common as-is and should probably be setup with = -->
186186
<!-- = shared constraints; however, the values are highly static (yes/no, internal/external). -->
187187
<!-- = Can be changed later with no breaking impact. -->
188-
<allowed-values target="prop[@name='allows-authenticated-scan']/@value">
188+
<allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='allows-authenticated-scan']/@value">
189189
<enum value="yes">The component allows an authenticated scan.</enum>
190190
<enum value="no">The component does not allow an authenticated scan.</enum>
191191
</allowed-values>
192192

193-
<allowed-values target="prop[@name='virtual']/@value">
193+
<allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='virtual']/@value">
194194
<enum value="yes">The component is virtualized.</enum>
195195
<enum value="no">The component is not virtualized.</enum>
196196
</allowed-values>
197197

198-
<allowed-values target="prop[@name='public']/@value">
198+
<allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='public']/@value">
199199
<enum value="yes">The component is publicly accessible.</enum>
200200
<enum value="no">The component is not publicly accessible.</enum>
201201
</allowed-values>
202202

203-
<allowed-values target="prop[@name='implementation-point']/@value">
203+
<allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='implementation-point']/@value">
204204
<enum value="internal">The component is implemented within the system boundary.</enum>
205205
<enum value="external">The component is implemented outside the system boundary.</enum>
206206
</allowed-values>
@@ -210,8 +210,8 @@
210210
<key-field target="@value"/>
211211
</index-has-key>
212212

213-
<matches target="prop[@name='inherited-uuid']/@value" datatype="uuid" />
214-
<matches target="prop[@name='release-date']/@value" datatype="date"/>
213+
<matches target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='inherited-uuid']/@value" datatype="uuid" />
214+
<matches target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='release-date']/@value" datatype="date"/>
215215

216216
<!-- ========================================================================================================== -->
217217
<!-- = Changes to the following values need to be synced with component in the SSP and component metaschemas. = -->
@@ -221,7 +221,7 @@
221221
<!-- ========================================================================================================== -->
222222
<!-- = SOFTWARE: type='software' constraints = -->
223223
<!-- ========================================================================================================== -->
224-
<allowed-values target="(.)[@type='software']/prop/@name" allow-other="yes">
224+
<allowed-values target="(.)[@type='software']/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name">
225225
&allowed-values-component_component_software;
226226
</allowed-values>
227227

‎src/metaschema/oscal_control-common_metaschema.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -244,7 +244,7 @@
244244
<formal-name>Parameter Cardinality</formal-name>
245245
<description>Describes the number of selections that must occur. Without this setting, only one value should be assumed to be permitted.</description>
246246
<constraint>
247-
<allowed-values allow-other="no">
247+
<allowed-values>
248248
<enum value="one">Only one value is permitted.</enum>
249249
<enum value="one-or-more">One or more values are permitted.</enum>
250250
</allowed-values>

0 commit comments

Comments
 (0)