usnistgov / OSCAL

Open Security Controls Assessment Language (OSCAL)
https://pages.nist.gov/OSCAL/
Other
670 stars 181 forks source link

Parameter insertion is not handled properly in Markdown #451

Closed david-waltermire closed 5 years ago

david-waltermire commented 5 years ago

Describe the bug

We designed an approach for parameter insertion in #194, but it looks like the XML-to-JSON content conversion process is not quite up to spec.

Parameter insertions are being generated as:

Reviews and updates the risk management strategy { pm-9_prm_1 } or as required, to address organizational changes.

Instead of:

Reviews and updates the risk management strategy {{ pm-9_prm_1 }} or as required, to address organizational changes.

We need to fix this.

Who is the bug affecting?

All users of converted XML OSCAL content containing parameter insertions.

What is affected by this bug?

Parameter insertions cannot be properly identified in Markdown content.

When does this occur?

When XML is converted to JSON using the OSCAL content converters.

How do we replicate the issue?

Run the XML-to-JSON conversion process on the OSCAL SP 800-53 catalog XML file.

Expected behavior (i.e. solution)

See above.

wendellpiez commented 5 years ago

This issue has been addressed but testing suggests more repair may be necessary around Markdown and escaping Markdown (when it is not intended as Markdown). Since this is complex, unit testing is called for to guard against regressions.

david-waltermire commented 5 years ago

This will be closed once PR #464 is pulled.

david-waltermire commented 5 years ago

@wendellpiez This should be unit tested before being closed.

wendellpiez commented 5 years ago

In place of more comprehensive unit testing, we could provide an XSpec for data conversions. Perhaps starting with the catalog model since it is the most stable. A small mockup with markup-multiline could include <insert> as well as other markdown targets for conversion.