usnistgov / scapval

Other
4 stars 2 forks source link

SCAPVal fails to detect incorrect //platform-specification/platform/logical-test/check-fact-ref/@href value #12

Closed dragosprisaca closed 6 years ago

dragosprisaca commented 6 years ago

The attached source content passes SCAPVal validation even though it includes an incorrect value for the @href attribute: “//platform-specification/platform/logical-test/check-fact-ref/@href”

<platform id="Windows_Server_2016_DC">
          <title xml:lang="en-US">Windows Server 2016 Domain Controller</title>
          <logical-test negate="false" operator="AND">
            <check-fact-ref 
              id-ref="oval:mil.disa.stig.windows:def:1010" 
              system="http://oval.mitre.org/XMLSchema/oval-definitions-5" 
              href="scap_mil.disa.stig_comp_U_Windows_Server_2016_V1R3_STIG_SCAP_1-2_Benchmark-oval.xml"/>
          </logical-test>
        </platform>

The value of @href shall be equal to data-stream//component-ref/cat:uri@name and not the component_id as The current schematron rules check for @href attribute for check-content-ref elements, but not check-fact-ref elements. SCAP Content Source: https://iasecontent.disa.mil/stigs/zip/U_Windows_Server_2016_V1R3_STIG_SCAP_1-2_Benchmark.zip

U_Windows_Server_2016_V1R3_STIG_SCAP_1-2_Benchmark.zip