Skip to content

Commit 7b133ff

Browse files
Mab879Mab879
committed
Fix schema ordering when adding tailoring to ARF files
Now the tailoring is added just before the extended-components (i.e. SCE). Created in part by Claude Code. Fixes #2260
1 parent 0cdf676 commit 7b133ff

File tree

3 files changed

+86
-2
lines changed

3 files changed

+86
-2
lines changed

‎src/DS/rds.c‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -737,7 +737,16 @@ static int _ds_rds_create_from_dom(xmlDocPtr *ret, xmlDocPtr sds_doc,
737737
xmlSetProp(tailoring_component, BAD_CAST "id", BAD_CAST tailoring_component_id);
738738
xmlSetProp(tailoring_component, BAD_CAST "timestamp", BAD_CAST tailoring_doc_timestamp);
739739
xmlAddChild(tailoring_component, tailoring_res_node);
740-
xmlAddChild(sds_res_node, tailoring_component);
740+
741+
// Insert tailoring component after regular components but before extended-components
742+
// to maintain proper schema ordering (all components must come before extended-components)
743+
xmlNodePtr first_extended_component = node_get_child_element(sds_res_node, "extended-component");
744+
if (first_extended_component == NULL) {
745+
// no extended component yet, add to the end
746+
xmlAddChild(sds_res_node, tailoring_component);
747+
} else {
748+
xmlAddPrevSibling(first_extended_component, tailoring_component);
749+
}
741750

742751
xmlNodePtr checklists_element = NULL;
743752
xmlNodePtr datastream_element = node_get_child_element(sds_res_node, "data-stream");

‎tests/API/XCCDF/tailoring/all.sh‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,28 @@ function test_api_xccdf_tailoring_profile_generate_guide {
169169
rm -f $guide
170170
}
171171

172+
function test_api_xccdf_tailoring_with_extended_component_ordering {
173+
# Regression test for the fix ensuring tailoring extended-component is inserted
174+
# before existing extended-components (e.g. SCE scripts) to maintain schema ordering
175+
# See https://github.com/OpenSCAP/openscap/issues/2260 for more details
176+
177+
local INPUT=$srcdir/$1
178+
local TAILORING=$srcdir/$2
179+
180+
result=`mktemp`
181+
stderr=`mktemp`
182+
183+
# Generate ARF with tailoring
184+
$OSCAP xccdf eval --tailoring-file $TAILORING --profile "xccdf_org.open-scap.sce-community-content_profile_pci-dss" --results-arf $result $INPUT 2>$stderr || [ "$?" == "2" ]
185+
186+
# Validate the ARF against schema - this would fail if ordering is wrong
187+
$OSCAP ds rds-validate $result 2>$stderr
188+
189+
# Verify that tailoring extended-component exists
190+
assert_exists 1 '/arf:asset-report-collection/arf:report-requests/arf:report-request/arf:content/ds:data-stream-collection/ds:component/xccdf:Tailoring'
191+
rm -f "$result" "$stderr"
192+
}
193+
172194
# Testing.
173195

174196
test_init "test_api_xccdf_tailoring.log"
@@ -191,6 +213,6 @@ test_run "test_api_xccdf_tailoring_simple_include_in_arf_xlink_namespace" test_a
191213
test_run "test_api_xccdf_tailoring_profile_include_in_arf" test_api_xccdf_tailoring_profile_include_in_arf baseline.xccdf.xml baseline.tailoring.xml
192214
test_run "test_api_xccdf_tailoring_profile_generate_fix" test_api_xccdf_tailoring_profile_generate_fix baseline.xccdf.xml baseline.tailoring.xml
193215
test_run "test_api_xccdf_tailoring_profile_generate_guide" test_api_xccdf_tailoring_profile_generate_guide baseline.xccdf.xml baseline.tailoring.xml
194-
216+
test_run "test_api_xccdf_tailoring_with_extended_component_ordering" test_api_xccdf_tailoring_with_extended_component_ordering ds_with_sce.xccdf.xml baseline.tailoring.xml
195217

196218
test_exit

‎tests/API/XCCDF/tailoring/ds_with_sce.xccdf.xml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<ds:data-stream-collection xmlns:ds="http://scap.nist.gov/schema/scap/source/1.2" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:cat="urn:oasis:names:tc:entity:xmlns:xml:catalog" id="scap_org.open-scap_collection_from_xccdf_all-resolved-xccdf-dummyoval.xml" schematron-version="1.2">
3+
<ds:data-stream id="scap_org.open-scap_datastream_from_xccdf_all-resolved-xccdf-dummyoval.xml" scap-version="1.2" use-case="OTHER">
4+
<ds:checklists>
5+
<ds:component-ref id="scap_org.open-scap_cref_all-resolved-xccdf-dummyoval.xml" xlink:href="#scap_org.open-scap_comp_all-resolved-xccdf-dummyoval.xml">
6+
<cat:catalog>
7+
<cat:uri name="services/obsolete/disable_nfs_exports.sh" uri="#scap_org.open-scap_cref_services--obsolete--disable_nfs_exports.sh"/>
8+
</cat:catalog>
9+
</ds:component-ref>
10+
</ds:checklists>
11+
<ds:checks>
12+
<ds:component-ref id="scap_org.open-scap_cref_stub-oval.xml" xlink:href="#scap_org.open-scap_comp_stub-oval.xml"/>
13+
</ds:checks>
14+
<ds:extended-components>
15+
<ds:component-ref id="scap_org.open-scap_cref_services--obsolete--disable_nfs_exports.sh" xlink:href="#scap_org.open-scap_ecomp_services--obsolete--disable_nfs_exports.sh"/>
16+
</ds:extended-components>
17+
</ds:data-stream>
18+
19+
<ds:component id="scap_org.open-scap_comp_all-resolved-xccdf-dummyoval.xml" timestamp="2016-02-23T14:39:05">
20+
<ns0:Benchmark xmlns:html="http://www.w3.org/1999/xhtml" xmlns:ns0="http://checklists.nist.gov/xccdf/1.2" id="xccdf_org.open-scap.sce-community-content_benchmark_all" resolved="1" xml:lang="en">
21+
<ns0:status date="2016-02-23">draft</ns0:status>
22+
<ns0:title xml:lang="en">SCE in DS</ns0:title>
23+
<ns0:description xml:lang="en"/>
24+
<ns0:notice id="disclaimer" xml:lang="en"/>
25+
<ns0:front-matter xml:lang="en"/>
26+
27+
<ns0:version>1.0</ns0:version>
28+
<ns0:model system="urn:xccdf:scoring:default"/>
29+
<ns0:model system="urn:xccdf:scoring:flat"/>
30+
31+
<ns0:Profile id="xccdf_org.open-scap.sce-community-content_profile_pci-dss">
32+
<ns0:title xml:lang="en" />
33+
<ns0:description xml:lang="en"/>
34+
</ns0:Profile>
35+
36+
<ns0:Rule id="xccdf_org.open-scap.sce-community-content_rule_services_obsolete-disable_nfs_exports" selected="true">
37+
<ns0:title xml:lang="en"/>
38+
<ns0:description xml:lang="en"/>
39+
40+
<ns0:check system="http://open-scap.org/page/SCE">
41+
<ns0:check-import import-name="stdout"/>
42+
<ns0:check-content-ref href="services/obsolete/disable_nfs_exports.sh"/>
43+
</ns0:check>
44+
</ns0:Rule>
45+
46+
</ns0:Benchmark>
47+
</ds:component>
48+
<ds:extended-component xmlns:oscap-sce-xccdf-stream="http://open-scap.org/page/SCE_xccdf_stream" id="scap_org.open-scap_ecomp_services--obsolete--disable_nfs_exports.sh" timestamp="2016-02-23T14:36:08">
49+
<oscap-sce-xccdf-stream:script>#!/bin/sh
50+
exit &#36;XCCDF_RESULT_PASS
51+
</oscap-sce-xccdf-stream:script>
52+
</ds:extended-component>
53+
</ds:data-stream-collection>

0 commit comments

Comments
 (0)