-
Notifications
You must be signed in to change notification settings - Fork 183
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
* Produce Metaschemas without XXEs (#1665) * ADR for XXE resolution * Accepted ADR 5 * Apply suggestions from code review Co-authored-by: A.J. Stein <[email protected]> * Revert release artifact archive readme extension change --------- Co-authored-by: A.J. Stein <[email protected]>
- Loading branch information
1 parent
e038f5c
commit 46d6527
Showing
6 changed files
with
148 additions
and
11 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <!-- | ||
| Entity resolver for OSCAL Metaschemas | ||
| This stylesheet: | ||
| 1. Copies an input metaschema module, resolving all external entities | ||
| 2. Replace all import/@href's to match a given $importHrefSuffix parameter | ||
| --> | ||
| <xsl:stylesheet version="1.0" | ||
| xmlns:xsl="http://www.w3.org/1999/XSL/Transform" | ||
| xmlns:metaschema="http://csrc.nist.gov/ns/oscal/metaschema/1.0"> | ||
| <xsl:output omit-xml-declaration="no" indent="yes"/> | ||
|
|
||
| <xsl:param name="importHrefSuffix" select="'RESOLVED'"/> | ||
|
|
||
| <!-- | ||
| XSLT1.0 compatible string replacement | ||
| Via https://gist.github.com/ijy/6572481 | ||
| --> | ||
| <xsl:template name="string-replace"> | ||
| <xsl:param name="string" /> | ||
| <xsl:param name="replace" /> | ||
| <xsl:param name="with" /> | ||
|
|
||
| <xsl:choose> | ||
| <xsl:when test="contains($string, $replace)"> | ||
| <xsl:value-of select="substring-before($string, $replace)" /> | ||
| <xsl:value-of select="$with" /> | ||
| <xsl:call-template name="string-replace"> | ||
| <xsl:with-param name="string" select="substring-after($string,$replace)" /> | ||
| <xsl:with-param name="replace" select="$replace" /> | ||
| <xsl:with-param name="with" select="$with" /> | ||
| </xsl:call-template> | ||
| </xsl:when> | ||
| <xsl:otherwise> | ||
| <xsl:value-of select="$string" /> | ||
| </xsl:otherwise> | ||
| </xsl:choose> | ||
| </xsl:template> | ||
|
|
||
| <!-- Simple identity transform, resolving entities implicitly --> | ||
| <xsl:template match="@*|node()"> | ||
| <xsl:copy> | ||
| <xsl:apply-templates select="@*|node()"/> | ||
| </xsl:copy> | ||
| </xsl:template> | ||
|
|
||
| <!-- Transform import/@href using $importHrefSuffix --> | ||
| <xsl:template match="metaschema:import/@href"> | ||
| <xsl:attribute name="href"> | ||
| <!-- oscal_poam_metaschema.xml => oscal_poam_metaschema_$importHrefSuffix.xml --> | ||
| <xsl:call-template name="string-replace"> | ||
| <xsl:with-param name="string" select="." /> | ||
| <xsl:with-param name="replace" select="'.xml'" /> | ||
| <xsl:with-param name="with" select="concat('_', $importHrefSuffix, '.xml')" /> | ||
| </xsl:call-template> | ||
| </xsl:attribute> | ||
| </xsl:template> | ||
| </xsl:stylesheet> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,7 +5,7 @@ Date: 2023/07/06 | |
|
|
||
| ## Status | ||
|
|
||
| Proposed | ||
| Approved | ||
|
|
||
| ## Context | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| # Production of transformed source Metaschema modules without external entities (XXEs) | ||
|
|
||
| Date: 08/25/2023 | ||
|
|
||
| ## Status | ||
|
|
||
| Approved | ||
|
|
||
| ## Context | ||
|
|
||
| We wish to remove or mitigate points friction encountered by NIST or community OSCAL developers producing tooling that consumes the OSCAL Metaschema module sources. | ||
|
|
||
| The OSCAL Metaschema modules currently use external entities to prevent duplication of constraint data. | ||
| These external entities are important for modeling ergonomics and cannot be removed until a Metaschema-native approach is stabilized, however external entities have a storied history of abuse. | ||
| So called "XML External Entity (XXE) Attacks", along with the additional complexity needed to support external entity resolution, have led to a situation where many XML parsers do not ship with XXE functionality. | ||
| This has put additional burden on OSCAL tool developers seeking to consume the source Metaschemas, who have either had to choose from the small subset of XML parsers that support external entities (if one exists for their target language at all) and inherit all additional risks that come with XXEs, or perform transformation of the source Metaschema modules before consuming them. | ||
|
|
||
| - Related to Issue [#1665](https://github.com/usnistgov/OSCAL/issues/1665) | ||
|
|
||
| ## Decision | ||
|
|
||
| The NIST OSCAL Team should include the "resolved" Metaschema module sources as an artifact generated upon release. | ||
| Additionally, the NIST OSCAL Team should document the process for obtaining a resolved Metaschema module as part of the [streamlined build process](./0005-repository-reorganization.md#streamlined-build-process). | ||
|
|
||
| In the event that Metaschema stabilizes constraint imports, the NIST OSCAL Team will review this ADR and potentially determine a deprecation strategy for these generated artifacts in the relevant releases. | ||
|
|
||
| ## Consequences | ||
|
|
||
| This decision will not have any breaking changes to our process, however: | ||
|
|
||
| 1. The NIST team will be responsible for reviewing the additional artifacts before performing a release. | ||
| 2. In the event that Metaschema stabilizes constraint imports, the NIST OSCAL team will have to maintain deprecated artifacts until the next major version. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -9,8 +9,8 @@ Documentation for the OSCAL models can be found at: https://pages.nist.gov/OSCAL | |
|
|
||
| This release provides 2 types of resources, each located in a different subdirectory: | ||
|
|
||
| - xml: Provides the XML schemas and content converters that are needed to support the OSCAL model XML-based formats. Instructions for using this information can be found at: https://github.com/usnistgov/OSCAL/tree/master/xml. | ||
| - json: Provides the JSON schemas and content converters that are needed to support the OSCAL model JSON-based formats. Instructions for using this information can be found at: https://github.com/usnistgov/OSCAL/tree/master/json. | ||
| - `xml/` and `json/`: Provides the XML and JSON schemas and content converters that are needed to support the OSCAL model. Instructions for using these artifacts can be found at https://github.com/usnistgov/OSCAL/blob/develop/build/README.md#artifact-usage | ||
| - `metaschema/`: Provides the source OSCAL Metaschema modules with all external entities (XXE) resolved for tools that do not support XXEs. | ||
|
|
||
| These directories provide stable, released versions of the resources provided on the OSCAL GitHub repository: https://github.com/usnistgov/OSCAL. | ||
|
|
||
|
|
@@ -32,6 +32,6 @@ OSCAL is being developed in a public GitHub repository, in collaboration with in | |
| - Help with developing OSCAL models and associated content. | ||
| - Assistance with developing documentation, tutorials, and other informational resources. | ||
|
|
||
| If you are interested in helping, please visit or contributing page for more information at: https://github.com/usnistgov/OSCAL/blob/master/CONTRIBUTING.md. | ||
| If you are interested in helping, please visit or contributing page for more information at: https://github.com/usnistgov/OSCAL/blob/main/CONTRIBUTING.md. | ||
|
|
||
| Please direct any questions, comments, concerns, or kudos by email to: [email protected]. | ||