Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Missing metaschema constraints from jsonschema #1145

Closed
guyzyl opened this issue Feb 20, 2022 · 5 comments
Closed

Missing metaschema constraints from jsonschema #1145

guyzyl opened this issue Feb 20, 2022 · 5 comments
Assignees
Labels

Comments

@guyzyl
Copy link
Contributor

guyzyl commented Feb 20, 2022

After looking over a bit over the jsonschema definitions and the origin metaschema counterpart, I noticed that there constraints that are defined in the metaschemas but are missing from the jsonschemas.

Just as an example, many fields contain a <choice> tag in the src metaschema which requires having one of x choices, but this isn't reflected in the jsonschema at all.
A concrete example to one - <define-assembly name="timing"> here which defines a choice between 3 different fields in the metaschema vs the jsonschema "timing" here which doesn't reflect this constraint.

This is probably not an OSCAL specific issue, and might be a bigger metaschema issue.
Having said that, this either needs to be solved in the schema generation or addressed in the documentation (and forgive me if it's already there).
It seems that this specific example is solvable in jsonschemas (see discussion).

FYI - this discrepancy doesn't exist in the XML schemas.

@david-waltermire
Copy link
Contributor

david-waltermire commented Feb 25, 2022

@guyzyl Expressing the choice semantic in JSON Schema is very challenging. You can use oneOf or anyOf to express the combination of properties that are allowed, but the combinations are an n^2 problem that is compounded by the number of choice nodes in a given assembly.

This class of problem would be better expressed as a Metaschema constraint, which can be enforced separately from JSON schema validation.

This means that all uses of <choice> need to audited and corresponding constraints need to be created.

@guyzyl
Copy link
Contributor Author

guyzyl commented Mar 1, 2022

@david-waltermire-nist enforcing the constraints via the Metaschemas makes sense, the drawback here is that there isn't that much tooling around Metaschema, especially when compared to jsonschema / XML.

@david-waltermire
Copy link
Contributor

@guyzyl True. But the tooling around JSON and XML Schema is insufficient as well for our needs. Tooling will catch up.

@aj-stein-nist
Copy link
Contributor

I need to review this it appears this is a close as WONTFIX but need to double check.

@aj-stein-nist aj-stein-nist moved this from Todo to Further Analysis Needed in NIST OSCAL Work Board Sep 20, 2023
@Arminta-Jenkins-NIST
Copy link
Contributor

At 10/12 Triage Meeting: this issue is being closed because jsonschema does not support.

@Arminta-Jenkins-NIST Arminta-Jenkins-NIST closed this as not planned Won't fix, can't repro, duplicate, stale Oct 12, 2023
@github-project-automation github-project-automation bot moved this from Further Analysis Needed to Done in NIST OSCAL Work Board Oct 12, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
Status: Done
Development

No branches or pull requests

5 participants