Add iventory-item-or-component-has-virtual Constraint
#1055
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
14 tasks
Rene2mt
requested changes
Dec 31, 2024
| @@ -651,6 +651,11 @@ | |||
| <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/5-attachments/#system-inventory-approach"/> | |||
| <message>In a FedRAMP SSP, each inventory item MUST include the vendor name in the inventory item itself or within the linked component.</message> | |||
| </expect> | |||
| <expect id="iventory-item-or-component-has-virtual" target="." test="count(prop[@name='virtual']) = 1 or count(../component[@uuid=$component-uuid]/prop[@name='virtual']) = 1" level="ERROR"> | |||
There was a problem hiding this comment.
BLOCKING: The constraint itself is fine / works as intended, but there's a minor typo in the constraint ID. Same goes for the content file, and unit tests.
Suggested change
| <expect id="iventory-item-or-component-has-virtual" target="." test="count(prop[@name='virtual']) = 1 or count(../component[@uuid=$component-uuid]/prop[@name='virtual']) = 1" level="ERROR"> | |
| <expect id="inventory-item-or-component-has-virtual" target="." test="count(prop[@name='virtual']) = 1 or count(../component[@uuid=$component-uuid]/prop[@name='virtual']) = 1" level="ERROR"> |
Comment on lines
+375
to
389
| | iventory-item-or-component-has-virtual-FAIL.yaml | | ||
| | iventory-item-or-component-has-virtual-PASS.yaml | | ||
| | last-accessed-is-datetime-FAIL.yaml | |
There was a problem hiding this comment.
Suggested change
| | iventory-item-or-component-has-virtual-FAIL.yaml | | |
| | iventory-item-or-component-has-virtual-PASS.yaml | | |
| | last-accessed-is-datetime-FAIL.yaml | | |
| | inventory-item-or-component-has-virtual-FAIL.yaml | | |
| | inventory-item-or-component-has-virtual-PASS.yaml | | |
| | last-accessed-is-datetime-FAIL.yaml | |
| @@ -0,0 +1,12 @@ | |||
| <system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="11111111-2222-4000-8000-000000000000"> | |||
There was a problem hiding this comment.
Recommend renaming file to "ssp-inventory-item-or-component-has-virtual-INVALID.xml"
Comment on lines
1
to
9
| test-case: | ||
| name: Negative Test for iventory-item-or-component-has-virtual | ||
| description: >- | ||
| This test case validates the behavior of constraint | ||
| iventory-item-or-component-has-virtual | ||
| content: ../content/ssp-iventory-item-or-component-has-virtual-INVALID.xml | ||
| expectations: | ||
| - constraint-id: iventory-item-or-component-has-virtual | ||
| result: fail |
There was a problem hiding this comment.
recommend renaming file to "inventory-item-or-component-has-virtual-FAIL.yaml", and making the following changes:
Suggested change
| test-case: | |
| name: Negative Test for iventory-item-or-component-has-virtual | |
| description: >- | |
| This test case validates the behavior of constraint | |
| iventory-item-or-component-has-virtual | |
| content: ../content/ssp-iventory-item-or-component-has-virtual-INVALID.xml | |
| expectations: | |
| - constraint-id: iventory-item-or-component-has-virtual | |
| result: fail | |
| name: Negative Test for inventory-item-or-component-has-virtual | |
| description: >- | |
| This test case validates the behavior of constraint | |
| inventory-item-or-component-has-virtual | |
| content: ../content/ssp-inventory-item-or-component-has-virtual-INVALID.xml | |
| expectations: | |
| - constraint-id: inventory-item-or-component-has-virtual | |
| result: fail |
Comment on lines
1
to
9
| test-case: | ||
| name: Positive Test for iventory-item-or-component-has-virtual | ||
| description: >- | ||
| This test case validates the behavior of constraint | ||
| iventory-item-or-component-has-virtual | ||
| content: ../../../content/rev5/examples/ssp/xml/fedramp-ssp-example.oscal.xml | ||
| expectations: | ||
| - constraint-id: iventory-item-or-component-has-virtual | ||
| result: pass |
There was a problem hiding this comment.
Recommend renaming file to "inventory-item-or-component-has-virtual-PASS.yaml" and making the following changes:
Suggested change
| test-case: | |
| name: Positive Test for iventory-item-or-component-has-virtual | |
| description: >- | |
| This test case validates the behavior of constraint | |
| iventory-item-or-component-has-virtual | |
| content: ../../../content/rev5/examples/ssp/xml/fedramp-ssp-example.oscal.xml | |
| expectations: | |
| - constraint-id: iventory-item-or-component-has-virtual | |
| result: pass | |
| test-case: | |
| name: Positive Test for inventory-item-or-component-has-virtual | |
| description: >- | |
| This test case validates the behavior of constraint | |
| inventory-item-or-component-has-virtual | |
| content: ../../../content/rev5/examples/ssp/xml/fedramp-ssp-example.oscal.xml | |
| expectations: | |
| - constraint-id: inventory-item-or-component-has-virtual | |
| result: pass |
Gabeblis
force-pushed
the
constraints/issue-1027
branch
from
4850875 to
be0c369
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Committer Notes
Purpose
This PR aims to add the
iventory-item-or-component-has-virtualconstraint which ensures that every inventory item, or it's linked component, is virtual or not by checking for the existence and value of the "virtual" prop.Changes
Added constraint:
iventory-item-or-component-has-virtualAdded valid/invalid test content:
ssp-iventory-item-or-component-has-virtual-INVALID.xmlfedramp-ssp-example.oscal.xmlto align with constraintAdded yaml files for testing:
All Submissions:
By submitting a pull request, you are agreeing to provide this contribution under the CC0 1.0 Universal public domain dedication.