@mitre/inspec-objects 0.0.24 → 0.0.27

package/lib/parsers/oval.d.ts

@@ -1,2 +1,3 @@
-import { OvalDefinitionValue } from '../types/oval';
+import { OvalDefinitionValue, DefinitionCriterion } from '../types/oval';
+export declare function extractAllCriteriaRefs(initialCriteria: DefinitionCriterion[]): string[];
 export declare function processOVAL(oval?: string): Record<string, OvalDefinitionValue> | undefined;

package/lib/parsers/oval.js

@@ -1,8 +1,58 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.processOVAL = void 0;
+exports.processOVAL = exports.extractAllCriteriaRefs = void 0;
 const xccdf_1 = require("../utilities/xccdf");
+// https://stackoverflow.com/questions/9133500/how-to-find-a-node-in-a-tree-with-javascript
+function searchTree(aTree, fCompair, bGreedy) {
+    var aInnerTree = []; // will contain the inner children
+    var oNode; // always the current node
+    var aReturnNodes = []; // the nodes array which will returned
+    // 1. loop through all root nodes so we don't touch the tree structure
+    for (const keysTree in aTree) {
+        aInnerTree.push(aTree[keysTree]);
+    }
+    while (aInnerTree.length > 0) {
+        oNode = aInnerTree.pop();
+        // check current node
+        if (fCompair(oNode)) {
+            aReturnNodes.push(oNode);
+            if (!bGreedy) {
+                return aReturnNodes;
+            }
+        }
+        else { // if (node.children && node.children.length) {
+            // find other objects, 1. check all properties of the node if they are arrays
+            for (const keysNode in oNode) {
+                // true if the property is an array
+                if (oNode[keysNode] instanceof Array) {
+                    // 2. push all array object to aInnerTree to search in those later
+                    for (var i = 0; i < oNode[keysNode].length; i++) {
+                        aInnerTree.push(oNode[keysNode][i]);
+                    }
+                }
+            }
+        }
+    }
+    return aReturnNodes;
+}
+function extractAllCriteriaRefs(initialCriteria) {
+    const criteriaRefs = [];
+    initialCriteria.forEach(criteria => {
+        var _a;
+        (_a = criteria.criterion) === null || _a === void 0 ? void 0 : _a.forEach((criterion) => {
+            if (criterion["@_test_ref"]) {
+                criteriaRefs.push(criterion["@_test_ref"]);
+            }
+        });
+        if (criteria.criteria) {
+            criteriaRefs.push(...extractAllCriteriaRefs(criteria.criteria));
+        }
+    });
+    return criteriaRefs;
+}
+exports.extractAllCriteriaRefs = extractAllCriteriaRefs;
 function processOVAL(oval) {
+    var _a;
     if (!oval) {
         return undefined;
     }
@@ -12,6 +62,50 @@ function processOVAL(oval) {
         for (const definitionList of ovalDefinitions.definitions) {
             for (const definition of definitionList.definition) {
                 extractedDefinitions[definition["@_id"]] = definition;
+                extractedDefinitions[definition["@_id"]].criteriaRefs = extractAllCriteriaRefs(definition.criteria);
+                extractedDefinitions[definition["@_id"]].resolvedValues = (_a = extractedDefinitions[definition["@_id"]].criteriaRefs) === null || _a === void 0 ? void 0 : _a.map((criteriaRef) => {
+                    // Extract the original criteria from the oval file
+                    const foundCriteriaRefererence = searchTree(parsed.oval_definitions[0].tests, (oNode) => oNode["@_id"] === criteriaRef, false)[0];
+                    let foundObjects = [];
+                    let foundStates = [];
+                    if (foundCriteriaRefererence) {
+                        if (foundCriteriaRefererence.object) {
+                            foundCriteriaRefererence.object.forEach((object) => {
+                                if (!object["@_object_ref"]) {
+                                    console.warn(`Found object without object_ref in test ${criteriaRef}`);
+                                }
+                                else {
+                                    const objectRef = object["@_object_ref"];
+                                    const foundObjectReference = searchTree(parsed.oval_definitions[0].objects, (oNode) => oNode["@_id"] === objectRef, false)[0];
+                                    if (foundObjectReference) {
+                                        foundObjects.push(foundObjectReference);
+                                    }
+                                    else {
+                                        console.warn(`Could not find object ${objectRef} for test ${criteriaRef}`);
+                                    }
+                                }
+                            });
+                        }
+                        if (foundCriteriaRefererence.state) {
+                            foundCriteriaRefererence.state.forEach((state) => {
+                                if (!state["@_state_ref"]) {
+                                    console.warn(`Found state without state_ref in test ${criteriaRef}`);
+                                }
+                                else {
+                                    const stateRef = state["@_state_ref"];
+                                    const foundStateReference = searchTree(parsed.oval_definitions[0].states, (oNode) => oNode["@_id"] === stateRef, false)[0];
+                                    if (foundStateReference) {
+                                        foundStates.push(foundStateReference);
+                                    }
+                                    else {
+                                        console.warn(`Could not find state ${stateRef} for test ${criteriaRef}`);
+                                    }
+                                }
+                            });
+                        }
+                    }
+                    return { ...foundCriteriaRefererence, resolvedObjects: foundObjects, resolvedStates: foundStates };
+                }).filter((value) => value);
             }
         }
     }

package/lib/parsers/xccdf.d.ts

@@ -1,8 +1,12 @@
 import Profile from '../objects/profile';
-import { BenchmarkGroup, BenchmarkRule } from '../types/xccdf';
+import { BenchmarkGroup, BenchmarkRule, RuleComplexCheck } from '../types/xccdf';
 import { OvalDefinitionValue } from '../types/oval';
 export declare type GroupContextualizedRule = BenchmarkRule & {
     group: Omit<BenchmarkGroup, 'Rule' | 'Group'>;
 };
 export declare function extractAllRules(groups: BenchmarkGroup[]): GroupContextualizedRule[];
-export declare function processXCCDF(xml: string, removeNewlines: boolean | undefined, useRuleId: 'group' | 'rule' | 'version' | 'cis', ovalDefinitions?: Record<string, OvalDefinitionValue>): Profile;
+export declare function extractAllComplexChecks(complexCheck: RuleComplexCheck): Omit<RuleComplexCheck, 'complex-check'>[];
+export declare function processXCCDF(xml: string, removeNewlines: boolean | undefined, useRuleId: 'group' | 'rule' | 'version' | 'cis', ovalDefinitions?: Record<string, OvalDefinitionValue & {
+    criteriaRefs?: string[];
+    resolvedValues?: any;
+}>): Profile;

package/lib/parsers/xccdf.js

@@ -1,12 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.processXCCDF = exports.extractAllRules = void 0;
+exports.processXCCDF = exports.extractAllComplexChecks = exports.extractAllRules = void 0;
 const tslib_1 = require("tslib");
 const profile_1 = tslib_1.__importDefault(require("../objects/profile"));
 const xccdf_1 = require("../utilities/xccdf");
 const control_1 = tslib_1.__importDefault(require("../objects/control"));
 const lodash_1 = tslib_1.__importDefault(require("lodash"));
 const CciNistMappingData_1 = require("../mappings/CciNistMappingData");
+const pretty_1 = tslib_1.__importDefault(require("pretty"));
 function extractAllRules(groups) {
     const rules = [];
     groups.forEach((group) => {
@@ -25,6 +26,17 @@ function extractAllRules(groups) {
     return rules;
 }
 exports.extractAllRules = extractAllRules;
+function extractAllComplexChecks(complexCheck) {
+    const complexChecks = [lodash_1.default.omit(complexCheck, 'complex-check')];
+    if (complexCheck['complex-check']) {
+        complexChecks.push(...complexCheck['complex-check'].map((subComplexCheck) => lodash_1.default.omit(subComplexCheck, 'complex-check')));
+        complexCheck['complex-check'].forEach((subComplexCheck) => {
+            complexChecks.push(...extractAllComplexChecks(subComplexCheck));
+        });
+    }
+    return complexChecks;
+}
+exports.extractAllComplexChecks = extractAllComplexChecks;
 function ensureDecodedXMLStringValue(input) {
     return lodash_1.default.get(input, '[0].#text') ? lodash_1.default.get(input, '[0].#text') : input;
 }
@@ -39,8 +51,18 @@ function processXCCDF(xml, removeNewlines = false, useRuleId, ovalDefinitions) {
     rules.forEach(rule => {
         var _a, _b, _c;
         let extractedDescription;
-        if (Array.isArray(rule.description)) {
-            extractedDescription = rule.description[0]['#text'];
+        if (typeof rule.description === 'object') {
+            if (Array.isArray(rule.description) && lodash_1.default.get(rule, "description[0]['#text']")) {
+                extractedDescription = rule.description[0]['#text'];
+            }
+            else {
+                if (typeof lodash_1.default.get(rule.description, '[0].p') === 'string') {
+                    extractedDescription = (0, pretty_1.default)(lodash_1.default.get(rule.description, '[0].p'));
+                }
+                else {
+                    extractedDescription = JSON.stringify(rule.description);
+                }
+            }
         }
         else {
             extractedDescription = (0, xccdf_1.convertEncodedHTMLIntoJson)(rule.description);
@@ -74,9 +96,19 @@ function processXCCDF(xml, removeNewlines = false, useRuleId, ovalDefinitions) {
             default:
                 throw new Error('useRuleId must be one of "group", "rule", or "version"');
         }
-        control.title = (0, xccdf_1.removeXMLSpecialCharacters)(rule['@_severity'] ? ensureDecodedXMLStringValue(rule.title) : `[[[MISSING SEVERITY FROM STIG]]] ${ensureDecodedXMLStringValue(rule.title)}`);
-        const descriptionText = (typeof extractedDescription === 'object' && !Array.isArray(extractedDescription)) ? ((_a = extractedDescription.VulnDiscussion) === null || _a === void 0 ? void 0 : _a.split('Satisfies: ')[0]) || 'Missing Description' : '';
-        control.desc = (0, xccdf_1.removeXMLSpecialCharacters)(descriptionText);
+        control.title = (0, xccdf_1.removeXMLSpecialCharacters)(rule['@_severity'] ? ensureDecodedXMLStringValue(rule.title) : `[[[MISSING SEVERITY FROM BENCHMARK]]] ${ensureDecodedXMLStringValue(rule.title)}`);
+        if (typeof extractedDescription === 'object' && !Array.isArray(extractedDescription)) {
+            control.desc = ((_a = extractedDescription.VulnDiscussion) === null || _a === void 0 ? void 0 : _a.split('Satisfies: ')[0]) || '';
+        }
+        else if (typeof extractedDescription === 'object') {
+            control.desc = JSON.stringify(extractedDescription);
+        }
+        else if (typeof extractedDescription === 'string') {
+            control.desc = extractedDescription || '';
+        }
+        else {
+            console.warn(`Invalid value for extracted description: ${extractedDescription}`);
+        }
         control.impact = (0, xccdf_1.severityStringToImpact)(rule['@_severity'] || 'medium', rule.group['@_id']);
         if (!control.descs || Array.isArray(control.descs)) {
             control.descs = {};
@@ -90,6 +122,7 @@ function processXCCDF(xml, removeNewlines = false, useRuleId, ovalDefinitions) {
                 let referenceID = null;
                 for (const checkContent of rule.check) {
                     if ('check-content-ref' in checkContent && checkContent['@_system'].includes('oval')) {
+                        console.log(`Found OVAL reference: ${checkContent['@_system']}`);
                         for (const checkContentRef of checkContent['check-content-ref']) {
                             if (checkContentRef['@_name']) {
                                 referenceID = checkContentRef['@_name'];
@@ -105,6 +138,54 @@ function processXCCDF(xml, removeNewlines = false, useRuleId, ovalDefinitions) {
                 }
             }
         }
+        // Very CIS specific
+        else if (rule['complex-check']) {
+            let checkTexts = [];
+            for (const complexChecks of rule['complex-check']) {
+                const allComplexChecks = extractAllComplexChecks(complexChecks);
+                if (control.id === '1.1.1.5') {
+                    console.log(allComplexChecks);
+                }
+                allComplexChecks.forEach((complexCheck) => {
+                    if (complexCheck.check) {
+                        complexCheck.check.forEach((check) => {
+                            var _a;
+                            if ((_a = check['@_system']) === null || _a === void 0 ? void 0 : _a.toLowerCase().includes('oval')) {
+                                const ovalReference = check['check-content-ref'][0]['@_name'];
+                                if (!ovalDefinitions) {
+                                    console.warn(`Missing OVAL definitions! Unable to process OVAL reference: ${ovalReference}`);
+                                }
+                                else if (ovalReference && ovalReference in ovalDefinitions) {
+                                    ovalDefinitions[ovalReference].resolvedValues.forEach((resolvedValue) => {
+                                        const comment = resolvedValue['@_comment'];
+                                        if (comment) {
+                                            checkTexts.push(comment + '\n');
+                                        }
+                                        resolvedValue.resolvedObjects.forEach((resolvedObject) => {
+                                            // Try to find the associated state for a resolved object
+                                            const resolvedId = resolvedObject['@_id'].split(':')[resolvedValue['@_id'].split(':').length - 1];
+                                            if (resolvedId) {
+                                                const relatedResolvedState = resolvedValue.resolvedStates.find((resolvedState) => resolvedState['@_id'].toLowerCase().includes(resolvedId.toLowerCase()));
+                                                if (relatedResolvedState) {
+                                                    lodash_1.default.set(resolvedObject, 'expectedState', lodash_1.default.pickBy(relatedResolvedState, (value, key) => !key.startsWith('@_')));
+                                                }
+                                            }
+                                            checkTexts.push(JSON.stringify(lodash_1.default.pickBy(resolvedObject, (value, key) => !key.startsWith('@_')), null, 2));
+                                        });
+                                    });
+                                }
+                            }
+                            else {
+                                console.warn(`Found external reference to unknown system: ${check['@_system']}, only OVAL is supported`);
+                            }
+                        });
+                    }
+                });
+            }
+            if (checkTexts.length >= 1) {
+                control.descs.check = checkTexts.join('\n');
+            }
+        }
         if (lodash_1.default.get(rule.fixtext, '[0]["#text"]')) {
             control.descs.fix = (0, xccdf_1.removeXMLSpecialCharacters)(rule.fixtext[0]['#text']);
         }
@@ -113,7 +194,17 @@ function processXCCDF(xml, removeNewlines = false, useRuleId, ovalDefinitions) {
         }
         else if (typeof rule.fixtext === 'object') {
             if (Array.isArray(rule.fixtext)) {
-                control.descs.fix = (0, xccdf_1.removeXMLSpecialCharacters)(JSON.stringify(rule.fixtext));
+                control.descs.fix = (0, xccdf_1.removeXMLSpecialCharacters)((0, pretty_1.default)((0, xccdf_1.convertJsonIntoXML)(rule.fixtext.map((fixtext) => {
+                    if (fixtext.div) {
+                        return fixtext.div;
+                    }
+                    else {
+                        return fixtext;
+                    }
+                }))));
+            }
+            else {
+                control.descs.fix = (0, xccdf_1.removeXMLSpecialCharacters)((0, pretty_1.default)((0, xccdf_1.convertJsonIntoXML)(rule.fixtext)));
             }
         }
         else if (typeof rule.fixtext === 'undefined') {
@@ -124,7 +215,7 @@ function processXCCDF(xml, removeNewlines = false, useRuleId, ovalDefinitions) {
         else {
             control.descs.fix = 'Missing fix text';
         }
-        control.tags.severity = (0, xccdf_1.impactNumberToSeverityString)((0, xccdf_1.severityStringToImpact)(rule['@_severity'] || 'critical', control.id || 'Unknown'));
+        control.tags.severity = (0, xccdf_1.impactNumberToSeverityString)((0, xccdf_1.severityStringToImpact)(rule['@_severity'] || 'medium', control.id || 'Unknown'));
         control.tags.gid = rule.group['@_id'],
             control.tags.rid = rule['@_id'];
         control.tags.stig_id = rule['version'];