Produce Metaschemas without XXEs (#1665)#1901
Merged
aj-stein-nist merged 6 commits intousnistgov:developfrom Aug 25, 2023
Merged
Produce Metaschemas without XXEs (#1665)#1901aj-stein-nist merged 6 commits intousnistgov:developfrom
aj-stein-nist merged 6 commits intousnistgov:developfrom
Conversation
7 tasks
Contributor
Author
Example outputRunning ➜ tree generated | grep RESOLVED
├── oscal_assessment-common_metaschema_RESOLVED.xml
├── oscal_assessment-plan_metaschema_RESOLVED.xml
├── oscal_assessment-results_metaschema_RESOLVED.xml
├── oscal_catalog_metaschema_RESOLVED.xml
├── oscal_complete_metaschema_RESOLVED.xml
├── oscal_component_metaschema_RESOLVED.xml
├── oscal_control-common_metaschema_RESOLVED.xml
├── oscal_implementation-common_metaschema_RESOLVED.xml
├── oscal_metadata_metaschema_RESOLVED.xml
├── oscal_poam_metaschema_RESOLVED.xml
├── oscal_profile_metaschema_RESOLVED.xml
├── oscal_ssp_metaschema_RESOLVED.xmlThe resolved metaschemas are identical to the source ones but with two crucial differences:
Example: <?xml version="1.0" encoding="UTF-8"?>
<?xml-model href="../../build/metaschema-xslt/src/validate/metaschema-composition-check.sch" type="application/xml" schematypens="http://purl.oclc.org/dsdl/schematron"?>
<!-- OSCAL GRAND UNIFIED MEGALOMETASCHEMA -->
<!-- validate with XSD and Schematron (linked) -->
<METASCHEMA xmlns="http://csrc.nist.gov/ns/oscal/metaschema/1.0">
<schema-name>OSCAL Unified Model of Models</schema-name>
<schema-version>1.1.0</schema-version>
<short-name>oscal-complete</short-name>
<namespace>http://csrc.nist.gov/ns/oscal/1.0</namespace>
<json-base-uri>http://csrc.nist.gov/ns/oscal/1.0</json-base-uri>
<remarks>
<p>This format represents a combination of all of the OSCAL models.</p>
</remarks>
<import href="oscal_catalog_metaschema_RESOLVED.xml"/>
<import href="oscal_profile_metaschema_RESOLVED.xml"/>
<import href="oscal_component_metaschema_RESOLVED.xml"/>
<import href="oscal_ssp_metaschema_RESOLVED.xml"/>
<import href="oscal_assessment-plan_metaschema_RESOLVED.xml"/>
<import href="oscal_assessment-results_metaschema_RESOLVED.xml"/>
<import href="oscal_poam_metaschema_RESOLVED.xml"/>
</METASCHEMA> |
wendellpiez
previously approved these changes
Aug 24, 2023
Contributor
wendellpiez
left a comment
There was a problem hiding this comment.
Nice concept, nice simple implementation--
aj-stein-nist
suggested changes
Aug 25, 2023
Contributor
aj-stein-nist
left a comment
There was a problem hiding this comment.
This is a great addition, thank you very much. All I would ask is that you add an ADR and then I can approve.
aj-stein-nist
previously approved these changes
Aug 25, 2023
Co-authored-by: A.J. Stein <alexander.stein@nist.gov>
aj-stein-nist
approved these changes
Aug 25, 2023
7 tasks
aj-stein-nist
added a commit
that referenced
this pull request
Sep 12, 2023
* Produce Metaschemas without XXEs (#1665) * ADR for XXE resolution * Accepted ADR 5 * Apply suggestions from code review Co-authored-by: A.J. Stein <alexander.stein@nist.gov> * Revert release artifact archive readme extension change --------- Co-authored-by: A.J. Stein <alexander.stein@nist.gov>
Arminta-Jenkins-NIST
pushed a commit
that referenced
this pull request
Sep 12, 2023
* Produce Metaschemas without XXEs (#1665) * ADR for XXE resolution * Accepted ADR 5 * Apply suggestions from code review Co-authored-by: A.J. Stein <alexander.stein@nist.gov> * Revert release artifact archive readme extension change --------- Co-authored-by: A.J. Stein <alexander.stein@nist.gov>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Committer Notes
Fixes #1665
Also in this PR:
list-release-artifactsutility makefile target for use in OSCAL-Reference;src/release/README.txtto a more descriptive name to prevent confusion in the future (see Rename README.txt to README.md #1891);All Submissions:
By submitting a pull request, you are agreeing to provide this contribution under the CC0 1.0 Universal public domain dedication.
(For reviewers: The wiki has guidance on code review and overall issue review for completeness.)
Changes to Core Features:
Have you updated all OSCAL website and readme documentation affected by the changes you made? Changes to the OSCAL website can be made in the docs/content directory of your branch.