This PR fixes the logic for metaschema validation, so that it properly uses the Reader's definition of the loaded JSON (via contents) rather than loading it directly from a file. This allows it to be tested properly with an in-memory version.
Fixes #15
Note
Because the concrete Reader walks schema definitions, the data loaded is different than purely validating the metaschemas against their JSON definitions. This has pros and cons:
On the one hand it means this change will appropriately catch a few scenarios that were previously uncaught.
On the other hand the error messages might be hard to understand.
For example, this now catches:
TESTING: JSON files match their metaschema definitions
FATAL: File at events/network/file_activity.json does not pass metaschema validation. Error: 'optional' is not one of ['recommended', 'required'] at JSON path: '$.attributes.connection_info.requirement'
Which is correct, we recently disallowed primary attributes to be optional, and the server believes that to be the case too:
But at face value, if I were new to OCSF and saw that error, I might be confused, because here's how connection_info in events/network/file_activity.json is defined:
"connection_info": {
"requirement": "optional"
},
It's not obvious that the attribute is primary because the base network event defines:
This PR fixes the logic for metaschema validation, so that it properly uses the
Reader
's definition of the loaded JSON (viacontents
) rather than loading it directly from a file. This allows it to be tested properly with an in-memory version.Fixes #15
Note
Because the concrete
Reader
walks schema definitions, the data loaded is different than purely validating the metaschemas against their JSON definitions. This has pros and cons:For example, this now catches:
Which is correct, we recently disallowed
primary
attributes to beoptional
, and the server believes that to be the case too:But at face value, if I were new to OCSF and saw that error, I might be confused, because here's how
connection_info
inevents/network/file_activity.json
is defined:It's not obvious that the attribute is
primary
because the basenetwork
event defines: