KyungjinJPark commented 2 weeks ago

Describe the bug

In the Revision 5 source XML, the si-3.9 control does not have the non-zero padded (classless) label. it also seems to be missing the class="zero-padded" one that the other controls seem to have, instead having two class="sp800-53a" labels.

src/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml lines 77352-77359:

      <control class="SP800-53-enhancement" id="si-3.9">
        <title>Authenticate Remote Commands</title>
+       <prop name="label" class="zero-padded" value="SI-03(09)"/>
+       <prop name="label" value="SI-3(9)"/>
-       <prop name="label" class="sp800-53a" value="SI-03(09)"/>
        <prop name="label" class="sp800-53a" value="SI-03(09)"/>
        <prop name="sort-id" value="si-03.09"/>
        <prop name="status" value="withdrawn"/>
        <link rel="moved-to" href="#ac-17.10"/>
      </control>

Who is the bug affecting?

Consumers reading from all formats (JSON, XML, and YAML) of the Revision 5 catalog at nist.gov/SP800-53/rev5 that use the non-padded control labels.

What is affected by this bug?

the si-3.9 control's labels

When does this occur?

always

How do we replicate the issue?

inspect src/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml at lines 77352-77359
inspect the resulting JSON, XML, and YAML catalogs

Expected behavior (i.e. solution)

class="zero-padded" and classless labels exist

Other Comments

Please let me know if this is a misunderstanding. I'm also willing to make the PR if we agree this is an issue.

iMichaela commented 2 weeks ago

@KyungjinJPark - Thank you for identifying the bugs. We will address the typos and release the catalog and profiles with the fixes.