133 lines
6.4 KiB
Diff
133 lines
6.4 KiB
Diff
From 9c2052febe494ca5fe8e3fef7996fd2c2c736785 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
|
Date: Wed, 2 Nov 2022 09:04:25 +0100
|
|
Subject: [PATCH] Don't emit items if XPath doesn't match
|
|
|
|
This commit fixes the behavior of the xmlfilecontent probe in situation
|
|
when the XPath query in xmlfilecontent_object doesn't match any node in
|
|
the given XML file and the query returns an empty node set. Currently,
|
|
in this situation, we emit an item in which we add an empty value_of
|
|
element. However, this value_of element has its datatype attribute set
|
|
to an empty string, which is invalid according to the OVAL schema. When
|
|
we try to make the OVAL results valid, we face the problem that it isn't
|
|
clear what should be the value of the datatype attribute for empty
|
|
elements. But as we can realize the XPath doesn't match anything means
|
|
that the requested object doesn't exist on the system, so a better
|
|
behavior would be to not produce a xmlfilecontent54_item. That is
|
|
consistent with eg. situation when a regular expression matched nothing
|
|
in textfilecontent54_object. This commit therefore stops the item
|
|
generation in this situation.
|
|
|
|
This commit also extends the existing test to cover the situation
|
|
of XPath queries for nonexistent element and nonexistent attribute.
|
|
|
|
Fixes: #1890, rhbz#2138884, rhbz#2139060
|
|
---
|
|
.../probes/independent/xmlfilecontent_probe.c | 5 +--
|
|
.../test_xmlfilecontent_probe.sh | 6 +++
|
|
.../test_xmlfilecontent_probe.xml | 38 +++++++++++++++++++
|
|
3 files changed, 46 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/src/OVAL/probes/independent/xmlfilecontent_probe.c b/src/OVAL/probes/independent/xmlfilecontent_probe.c
|
|
index 6c70b359ba..5d56afa0d4 100644
|
|
--- a/src/OVAL/probes/independent/xmlfilecontent_probe.c
|
|
+++ b/src/OVAL/probes/independent/xmlfilecontent_probe.c
|
|
@@ -296,10 +296,9 @@ static int process_file(const char *prefix, const char *path, const char *filena
|
|
|
|
node_cnt = nodes->nodeNr;
|
|
dD("node_cnt: %d.", node_cnt);
|
|
- if (node_cnt == 0) {
|
|
- probe_item_setstatus(item, SYSCHAR_STATUS_DOES_NOT_EXIST);
|
|
- probe_item_ent_add(item, "value_of", NULL, NULL);
|
|
- probe_itement_setstatus(item, "value_of", 1, SYSCHAR_STATUS_DOES_NOT_EXIST);
|
|
+ if (node_cnt <= 0) {
|
|
+ ret = -5;
|
|
+ goto cleanup;
|
|
} else {
|
|
node_tab = nodes->nodeTab;
|
|
for (i = 0; i < node_cnt; ++i) {
|
|
diff --git a/tests/probes/xmlfilecontent/test_xmlfilecontent_probe.sh b/tests/probes/xmlfilecontent/test_xmlfilecontent_probe.sh
|
|
index e3c56a8606..68138dad75 100755
|
|
--- a/tests/probes/xmlfilecontent/test_xmlfilecontent_probe.sh
|
|
+++ b/tests/probes/xmlfilecontent/test_xmlfilecontent_probe.sh
|
|
@@ -6,9 +6,15 @@ set -e -o pipefail
|
|
cp $srcdir/example.xml /tmp/
|
|
result=$(mktemp)
|
|
$OSCAP oval eval --results $result $srcdir/test_xmlfilecontent_probe.xml
|
|
+# Even if OSCAP_FULL_VALIDATION is set, an invalid OVAL result doesn't cause
|
|
+# the "oscap oval eval" to return a non-zero value, so let's run validation
|
|
+# as a separate command
|
|
+$OSCAP oval validate "$result"
|
|
assert_exists 1 '/oval_results/results/system/definitions/definition[@definition_id="oval:x:def:1" and @result="true"]'
|
|
assert_exists 1 '/oval_results/results/system/definitions/definition[@definition_id="oval:x:def:2" and @result="true"]'
|
|
assert_exists 1 '/oval_results/results/system/definitions/definition[@definition_id="oval:x:def:3" and @result="true"]'
|
|
assert_exists 1 '/oval_results/results/system/definitions/definition[@definition_id="oval:x:def:4" and @result="true"]'
|
|
assert_exists 1 '/oval_results/results/system/definitions/definition[@definition_id="oval:x:def:5" and @result="true"]'
|
|
+assert_exists 1 '/oval_results/results/system/definitions/definition[@definition_id="oval:x:def:6" and @result="true"]'
|
|
+assert_exists 1 '/oval_results/results/system/definitions/definition[@definition_id="oval:x:def:7" and @result="true"]'
|
|
rm -f $result
|
|
\ No newline at end of file
|
|
diff --git a/tests/probes/xmlfilecontent/test_xmlfilecontent_probe.xml b/tests/probes/xmlfilecontent/test_xmlfilecontent_probe.xml
|
|
index 3350df0c49..0a9708d4b6 100644
|
|
--- a/tests/probes/xmlfilecontent/test_xmlfilecontent_probe.xml
|
|
+++ b/tests/probes/xmlfilecontent/test_xmlfilecontent_probe.xml
|
|
@@ -66,6 +66,30 @@
|
|
<criterion test_ref="oval:x:tst:5" comment="test"/>
|
|
</criteria>
|
|
</definition>
|
|
+ <definition class="compliance" version="1" id="oval:x:def:6">
|
|
+ <metadata>
|
|
+ <title>A simple test OVAL for xmlfilecontent test - check nonexisting attribute</title>
|
|
+ <description>x</description>
|
|
+ <affected family="unix">
|
|
+ <platform>x</platform>
|
|
+ </affected>
|
|
+ </metadata>
|
|
+ <criteria>
|
|
+ <criterion test_ref="oval:x:tst:6" comment="test"/>
|
|
+ </criteria>
|
|
+ </definition>
|
|
+ <definition class="compliance" version="1" id="oval:x:def:7">
|
|
+ <metadata>
|
|
+ <title>A simple test OVAL for xmlfilecontent test - check nonexisting element</title>
|
|
+ <description>x</description>
|
|
+ <affected family="unix">
|
|
+ <platform>x</platform>
|
|
+ </affected>
|
|
+ </metadata>
|
|
+ <criteria>
|
|
+ <criterion test_ref="oval:x:tst:7" comment="test"/>
|
|
+ </criteria>
|
|
+ </definition>
|
|
</definitions>
|
|
|
|
<tests>
|
|
@@ -89,6 +113,12 @@
|
|
<ind:object object_ref="oval:x:obj:5"/>
|
|
<ind:state state_ref="oval:x:ste:5"/>
|
|
</ind:xmlfilecontent_test>
|
|
+ <ind:xmlfilecontent_test id="oval:x:tst:6" version="1" comment="test an xpath expression" check="all" check_existence="none_exist">
|
|
+ <ind:object object_ref="oval:x:obj:6"/>
|
|
+ </ind:xmlfilecontent_test>
|
|
+ <ind:xmlfilecontent_test id="oval:x:tst:7" version="1" comment="test an xpath expression" check="all" check_existence="none_exist">
|
|
+ <ind:object object_ref="oval:x:obj:7"/>
|
|
+ </ind:xmlfilecontent_test>
|
|
</tests>
|
|
|
|
<objects>
|
|
@@ -112,6 +142,14 @@
|
|
<ind:filepath>/tmp/example.xml</ind:filepath>
|
|
<ind:xpath>//*[@regid="mycoyote.com"]/@name</ind:xpath>
|
|
</ind:xmlfilecontent_object>
|
|
+ <ind:xmlfilecontent_object id="oval:x:obj:6" version="1" comment="xpath query">
|
|
+ <ind:filepath>/tmp/example.xml</ind:filepath>
|
|
+ <ind:xpath>/SoftwareIdentity/@thisattributedoesnotexist</ind:xpath>
|
|
+ </ind:xmlfilecontent_object>
|
|
+ <ind:xmlfilecontent_object id="oval:x:obj:7" version="1" comment="xpath query">
|
|
+ <ind:filepath>/tmp/example.xml</ind:filepath>
|
|
+ <ind:xpath>/SoftwareIdentity/thiselementdoesnotexist</ind:xpath>
|
|
+ </ind:xmlfilecontent_object>
|
|
</objects>
|
|
|
|
<states>
|