search

OVAL-Community / OVAL

Official repository for the Open Vulnerability and Assessment Language
33 stars 25 forks source link

Discrepancy in specification of system_data element #116

Closed vojtapolasek closed 3 years ago

vojtapolasek commented 3 years ago

Describe the bug The issue lies in the schema for system characteristics. The schema mandates that system_data element must not be empty. This causes problems when the collected_objects element contains only object with status does not exist.

It causes problems during Scapval validation. The full context is in this mail: https://lists.cisecurity.org/empathy/thread/JARIE5LJASO7WFLT7TPJO7FGBRDOCTEI

Replication Steps (if applicable) empty_system_data.xml.zip no_system_data.xml.zip

  1. validate the no_system_data.xml with schematron, e.g. 
    oscap oval validate --schematron no_system_data.xml

it passes

  1. do the same for empty_system_data.xml - it fails

Expected behavior I believe that validation of no_system_data.xml should fail. It would be great if validation of empty_system_data. would pass.

Content

OVAL details (complete all those relevant)

Additional context

vojtapolasek commented 3 years ago

Proposed fix is in PR #117

wmunyan commented 3 years ago

PR has been merged. Resolving issue.