Skip to content

Commit 1d9ac7e

Browse files
jan-cernyjan-cerny
committed
Fix error when processing OVAL filters
This commit fixes this problem: We have an OVAL `<object>`, this object contains a `<filter>` that is specified by a `<state>`. This `<state>` in one of its child elements references a `<local_variable>`. This `<local_variable>` references a second `<object>`. If the second `<object>` describes an entity that doesn't exist on the system, an error message "Failed to convert OVAL state to SEXP" occurs. If an `<object>` referenced from a `<state>` used in `<filter>` doesn't exist, the filter shouldn't apply, which is already happening in the current code. This fix doesn't change the results of the OVAL evaluation, it only prevents triggering the aforementioned error message. The fix makes the processing of variable references in `oval_state_to_sexp` consistent with the processing of variable references in `oval_object_to_sexp`. Resolves: rhbz#2126882 Resolves: rhbz#2126883
1 parent 1f30221 commit 1d9ac7e

File tree

4 files changed

+81
-5
lines changed

4 files changed

+81
-5
lines changed

‎src/OVAL/oval_sexp.c

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -770,11 +770,10 @@ int oval_state_to_sexp(void *sess, struct oval_state *state, SEXP_t **out_sexp)
770770
var = oval_entity_get_variable(ent);
771771
dt = oval_entity_get_datatype(ent);
772772

773-
if (oval_varref_elm_to_sexp(sess, var, dt, &val_lst, NULL) != 0)
774-
goto fail;
775-
776-
SEXP_list_add(ste_ent, val_lst);
777-
SEXP_free(val_lst);
773+
if (oval_varref_elm_to_sexp(sess, var, dt, &val_lst, NULL) == 0) {
774+
SEXP_list_add(ste_ent, val_lst);
775+
SEXP_free(val_lst);
776+
}
778777
}
779778

780779
SEXP_list_add(ste, ste_ent);

‎tests/API/OVAL/unittests/CMakeLists.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ add_oscap_test("test_skip_valid.sh")
3030
add_oscap_test("test_state_check_existence.sh")
3131
add_oscap_test("test_statetype_operator.sh")
3232
add_oscap_test("test_variable_conversion.sh")
33+
add_oscap_test("test_variable_in_filter.sh")
3334
add_oscap_test("test_without_syschars.sh")
3435
add_oscap_test("test_xmlns_missing.sh")
3536
add_oscap_test("test_xsinil_envv58_pid.sh")

‎tests/API/OVAL/unittests/test_variable_in_filter.sh

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/usr/bin/env bash
2+
. $builddir/tests/test_common.sh
3+
4+
set -e
5+
set -o pipefail
6+
7+
result=`mktemp`
8+
stdout=`mktemp`
9+
stderr=`mktemp`
10+
echo "secret_key" > /tmp/key_file
11+
12+
$OSCAP oval eval --results "$result" "$srcdir/test_variable_in_filter.xml" > "$stdout" 2> "$stderr"
13+
grep "Failed to convert OVAL state to SEXP" "$stderr" && exit 1
14+
assert_exists 1 '//oval_results/results/system/definitions/definition[@result="true"]'
15+
assert_exists 0 '//oval_results/results/system/definitions/definition[@result!="true"]'
16+
17+
rm -f "$result" "$stdout" "$stderr" /tmp/key_file

‎tests/API/OVAL/unittests/test_variable_in_filter.xml

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
<?xml version="1.0"?>
2+
<oval:oval_definitions xmlns:ns2="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:ns3="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:ns4="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
3+
<oval:generator>
4+
<ns2:product_name>jcerny</ns2:product_name>
5+
<ns2:product_version>2.0</ns2:product_version>
6+
<ns2:schema_version>5.11</ns2:schema_version>
7+
<ns2:timestamp>2023-01-10T14:25:10</ns2:timestamp>
8+
</oval:generator>
9+
<oval:definitions>
10+
<oval:definition class="compliance" id="oval:x:def:1" version="1">
11+
<oval:metadata>
12+
<oval:title>Test rhbz#2126882</oval:title>
13+
<oval:description>This definition contains a filter that references a variable that depends on an entity that does not exist on the system.</oval:description>
14+
</oval:metadata>
15+
<oval:criteria operator="AND">
16+
<oval:criterion comment="file_test" test_ref="oval:x:tst:1"/>
17+
</oval:criteria>
18+
</oval:definition>
19+
</oval:definitions>
20+
<oval:tests>
21+
<ns3:file_test check="all" comment="file_test" id="oval:x:tst:1" version="1">
22+
<ns3:object object_ref="oval:x:obj:1"/>
23+
</ns3:file_test>
24+
</oval:tests>
25+
<oval:objects>
26+
<ns3:file_object comment="object with a filter" id="oval:x:obj:1" version="1">
27+
<ns3:path>/tmp</ns3:path>
28+
<ns3:filename operation="pattern match">^key_file$</ns3:filename>
29+
<oval:filter action="exclude">oval:x:ste:1</oval:filter>
30+
</ns3:file_object>
31+
<ns4:textfilecontent54_object comment="object that doesn't exist, used in variable that is used in filter" id="oval:x:obj:2" version="1" >
32+
<ns4:filepath>/nonexistent</ns4:filepath>
33+
<ns4:pattern operation="pattern match">^ssh_keys:\w+:(\w+):.*</ns4:pattern>
34+
<ns4:instance datatype="int" operation="equals">1</ns4:instance>
35+
</ns4:textfilecontent54_object>
36+
</oval:objects>
37+
<oval:states>
38+
<ns3:file_state comment="state used in filter, references a variable" id="oval:x:ste:1" version="1">
39+
<ns3:path>/tmp</ns3:path>
40+
<ns3:filename operation="pattern match">^key_file$</ns3:filename>
41+
<ns3:group_id datatype="int" var_ref="oval:x:var:1"/>
42+
<ns3:user_id datatype="int">0</ns3:user_id>
43+
<ns3:suid datatype="boolean">false</ns3:suid>
44+
<ns3:sgid datatype="boolean">false</ns3:sgid>
45+
<ns3:sticky datatype="boolean">false</ns3:sticky>
46+
<ns3:uexec datatype="boolean">false</ns3:uexec>
47+
<ns3:gwrite datatype="boolean">false</ns3:gwrite>
48+
<ns3:gexec datatype="boolean">false</ns3:gexec>
49+
<ns3:oread datatype="boolean">false</ns3:oread>
50+
<ns3:owrite datatype="boolean">false</ns3:owrite>
51+
<ns3:oexec datatype="boolean">false</ns3:oexec>
52+
</ns3:file_state>
53+
</oval:states>
54+
<oval:variables>
55+
<oval:local_variable id="oval:x:var:1" datatype="int" version="1" comment="variable used in state, referencing object that doesn't exist">
56+
<oval:object_component item_field="subexpression" object_ref="oval:x:obj:2"/>
57+
</oval:local_variable>
58+
</oval:variables>
59+
</oval:oval_definitions>

0 commit comments

Comments
 (0)