Closed DaleBinghamSoteriaSoft closed 2 years ago
In the upload controller we need this. We may need to adjust the web UI to check against the proper stigRelease as well for upgrades possibly if the CKL is missing the top metadata. https://github.com/Cingulara/openrmf-api-upload/blob/master/src/Controllers/UploadController.cs
Need to get the VULN tags into a listing and then parse where applicable.
// if the release info or version are odd, we need to parse the first VULN area
if ( (newArtifact.stigVersion == "version" || string.IsNullOrEmpty(newArtifact.stigVersion) || newArtifact.stigRelease == "releaseinfo" || string.IsNullOrEmpty(newArtifact.stigRelease) )
&& vulnList.Count > 0) {
// go get it in the first VULN
newArtifact.stigVersion = "1";
string stigReference = "";
foreach (XmlElement child in vulnList.Item(0).ChildNodes) {
if (child.Name == "STIG_DATA") {
foreach (XmlElement stigdata in child.ChildNodes) {
if (child.ChildNodes.Item(0).Name == "VULN_ATTRIBUTE" && child.ChildNodes.Item(0).InnerText == "STIGRef")
stigReference = child.ChildNodes.Item(1).InnerText;
break;
}
}
}
if (!string.IsNullOrEmpty(stigReference)) { // parse it
// remove the title and :: area
stigReference = stigReference.Replace(newArtifact.stigType + " :: ","").Trim().Replace("Version ","");
// Version 1,
newArtifact.stigVersion = stigReference.Substring(0, stigReference.IndexOf(","));
// Release: 4 Benchmark Date: 27 Oct 2021
newArtifact.stigRelease = stigReference.Replace(newArtifact.stigVersion + ",", "").Trim();
}
}
Only for custom CKL generators leaving off the top information for the checklist that we use for type, release and version in essence. This is not from normal CKL creation, SCAP or anything else.
This was only on a specific customer generating CKLs themselves in improper format.
Describe the bug When importing a Radix REL 8 checklist, the checklist does not load properly even though it says it parses correctly.
To Reproduce Steps to reproduce the behavior:
Expected behavior The CKL loads, score is generated, and it loads properly. Worst case, it does not choke and at least shows the data, even if no release or version information is present.
Additional context Missing the top level STIG_INFO fields, so need to use this VULN section below so need to parse from the first VULN area for STIGRef, remove the title from that, remove the :: and then parse the rest.