search

mitre / inspec_tools

A command-line and ruby API of utilities, converters and tools for creating, converting and processing security baseline formats, results and data
https://inspec-tools.mitre.org/
Other
91 stars 30 forks source link

xccdf2inspec string quotes bug #191

Closed rx294 closed 4 years ago

rx294 commented 4 years ago

xccdf2inspec currently replaces " to '. This causes .to_ruby method on place metadata blocks in single quotes. This creates invalid string in the inspec profile scaffolding when a the xccdf metadata blocks has a single quote within it.

Issue can be seems to be fixed by updating the following https://github.com/mitre/inspec_tools/blob/b89eecf887c310a08444561fdc918b02b5f0e623/lib/utilities/inspec_util.rb#L396 https://github.com/mitre/inspec_tools/blob/b89eecf887c310a08444561fdc918b02b5f0e623/lib/utilities/inspec_util.rb#L412

To

myfile.puts wrap(control.to_ruby.gsub('"', "\""), WIDTH) + "\n"

Bialogs commented 4 years ago

The issue is more nuanced than this because we want to create Ruby strings with single quotes according to the Ruby style guide.

rx294 commented 4 years ago

@Bialogs we are relying on inspec's to_ruby method to convert control stubs, and looks like if one of the stubs is a string they all get converted to double quote usage ... so we might have little control there...

I am in favor of pushing a functionality fix and research the styling fix for later.

And possibly add an inspec check line to the functional tests for the generated inspec profile.

Bialogs commented 4 years ago

Can you send me the xccdf to reproduce?

rx294 commented 4 years ago

Sample xccdfs are available here https://public.cyber.mil/stigs/downloads/