@mitre/inspec-objects 0.0.25 → 0.0.28

package/lib/parsers/oval.d.ts

@@ -1,2 +1,3 @@
-import { OvalDefinitionValue } from '../types/oval';
+import { OvalDefinitionValue, DefinitionCriterion } from '../types/oval';
+export declare function extractAllCriteriaRefs(initialCriteria: DefinitionCriterion[]): string[];
 export declare function processOVAL(oval?: string): Record<string, OvalDefinitionValue> | undefined;

package/lib/parsers/oval.js

@@ -1,8 +1,58 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.processOVAL = void 0;
+exports.processOVAL = exports.extractAllCriteriaRefs = void 0;
 const xccdf_1 = require("../utilities/xccdf");
+// https://stackoverflow.com/questions/9133500/how-to-find-a-node-in-a-tree-with-javascript
+function searchTree(aTree, fCompair, bGreedy) {
+    var aInnerTree = []; // will contain the inner children
+    var oNode; // always the current node
+    var aReturnNodes = []; // the nodes array which will returned
+    // 1. loop through all root nodes so we don't touch the tree structure
+    for (const keysTree in aTree) {
+        aInnerTree.push(aTree[keysTree]);
+    }
+    while (aInnerTree.length > 0) {
+        oNode = aInnerTree.pop();
+        // check current node
+        if (fCompair(oNode)) {
+            aReturnNodes.push(oNode);
+            if (!bGreedy) {
+                return aReturnNodes;
+            }
+        }
+        else { // if (node.children && node.children.length) {
+            // find other objects, 1. check all properties of the node if they are arrays
+            for (const keysNode in oNode) {
+                // true if the property is an array
+                if (oNode[keysNode] instanceof Array) {
+                    // 2. push all array object to aInnerTree to search in those later
+                    for (var i = 0; i < oNode[keysNode].length; i++) {
+                        aInnerTree.push(oNode[keysNode][i]);
+                    }
+                }
+            }
+        }
+    }
+    return aReturnNodes;
+}
+function extractAllCriteriaRefs(initialCriteria) {
+    const criteriaRefs = [];
+    initialCriteria.forEach(criteria => {
+        var _a;
+        (_a = criteria.criterion) === null || _a === void 0 ? void 0 : _a.forEach((criterion) => {
+            if (criterion["@_test_ref"]) {
+                criteriaRefs.push(criterion["@_test_ref"]);
+            }
+        });
+        if (criteria.criteria) {
+            criteriaRefs.push(...extractAllCriteriaRefs(criteria.criteria));
+        }
+    });
+    return criteriaRefs;
+}
+exports.extractAllCriteriaRefs = extractAllCriteriaRefs;
 function processOVAL(oval) {
+    var _a;
     if (!oval) {
         return undefined;
     }
@@ -12,6 +62,50 @@ function processOVAL(oval) {
         for (const definitionList of ovalDefinitions.definitions) {
             for (const definition of definitionList.definition) {
                 extractedDefinitions[definition["@_id"]] = definition;
+                extractedDefinitions[definition["@_id"]].criteriaRefs = extractAllCriteriaRefs(definition.criteria);
+                extractedDefinitions[definition["@_id"]].resolvedValues = (_a = extractedDefinitions[definition["@_id"]].criteriaRefs) === null || _a === void 0 ? void 0 : _a.map((criteriaRef) => {
+                    // Extract the original criteria from the oval file
+                    const foundCriteriaRefererence = searchTree(parsed.oval_definitions[0].tests, (oNode) => oNode["@_id"] === criteriaRef, false)[0];
+                    let foundObjects = [];
+                    let foundStates = [];
+                    if (foundCriteriaRefererence) {
+                        if (foundCriteriaRefererence.object) {
+                            foundCriteriaRefererence.object.forEach((object) => {
+                                if (!object["@_object_ref"]) {
+                                    console.warn(`Found object without object_ref in test ${criteriaRef}`);
+                                }
+                                else {
+                                    const objectRef = object["@_object_ref"];
+                                    const foundObjectReference = searchTree(parsed.oval_definitions[0].objects, (oNode) => oNode["@_id"] === objectRef, false)[0];
+                                    if (foundObjectReference) {
+                                        foundObjects.push(foundObjectReference);
+                                    }
+                                    else {
+                                        console.warn(`Could not find object ${objectRef} for test ${criteriaRef}`);
+                                    }
+                                }
+                            });
+                        }
+                        if (foundCriteriaRefererence.state) {
+                            foundCriteriaRefererence.state.forEach((state) => {
+                                if (!state["@_state_ref"]) {
+                                    console.warn(`Found state without state_ref in test ${criteriaRef}`);
+                                }
+                                else {
+                                    const stateRef = state["@_state_ref"];
+                                    const foundStateReference = searchTree(parsed.oval_definitions[0].states, (oNode) => oNode["@_id"] === stateRef, false)[0];
+                                    if (foundStateReference) {
+                                        foundStates.push(foundStateReference);
+                                    }
+                                    else {
+                                        console.warn(`Could not find state ${stateRef} for test ${criteriaRef}`);
+                                    }
+                                }
+                            });
+                        }
+                    }
+                    return { ...foundCriteriaRefererence, resolvedObjects: foundObjects, resolvedStates: foundStates };
+                }).filter((value) => value);
             }
         }
     }

package/lib/parsers/xccdf.d.ts

@@ -1,8 +1,12 @@
 import Profile from '../objects/profile';
-import { BenchmarkGroup, BenchmarkRule } from '../types/xccdf';
+import { BenchmarkGroup, BenchmarkRule, RuleComplexCheck } from '../types/xccdf';
 import { OvalDefinitionValue } from '../types/oval';
 export declare type GroupContextualizedRule = BenchmarkRule & {
     group: Omit<BenchmarkGroup, 'Rule' | 'Group'>;
 };
 export declare function extractAllRules(groups: BenchmarkGroup[]): GroupContextualizedRule[];
-export declare function processXCCDF(xml: string, removeNewlines: boolean | undefined, useRuleId: 'group' | 'rule' | 'version' | 'cis', ovalDefinitions?: Record<string, OvalDefinitionValue>): Profile;
+export declare function extractAllComplexChecks(complexCheck: RuleComplexCheck): Omit<RuleComplexCheck, 'complex-check'>[];
+export declare function processXCCDF(xml: string, removeNewlines: boolean | undefined, useRuleId: 'group' | 'rule' | 'version' | 'cis', ovalDefinitions?: Record<string, OvalDefinitionValue & {
+    criteriaRefs?: string[];
+    resolvedValues?: any;
+}>): Profile;

package/lib/parsers/xccdf.js

@@ -1,12 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.processXCCDF = exports.extractAllRules = void 0;
+exports.processXCCDF = exports.extractAllComplexChecks = exports.extractAllRules = void 0;
 const tslib_1 = require("tslib");
 const profile_1 = tslib_1.__importDefault(require("../objects/profile"));
 const xccdf_1 = require("../utilities/xccdf");
 const control_1 = tslib_1.__importDefault(require("../objects/control"));
 const lodash_1 = tslib_1.__importDefault(require("lodash"));
 const CciNistMappingData_1 = require("../mappings/CciNistMappingData");
+const pretty_1 = tslib_1.__importDefault(require("pretty"));
 function extractAllRules(groups) {
     const rules = [];
     groups.forEach((group) => {
@@ -25,6 +26,17 @@ function extractAllRules(groups) {
     return rules;
 }
 exports.extractAllRules = extractAllRules;
+function extractAllComplexChecks(complexCheck) {
+    const complexChecks = [lodash_1.default.omit(complexCheck, 'complex-check')];
+    if (complexCheck['complex-check']) {
+        complexChecks.push(...complexCheck['complex-check'].map((subComplexCheck) => lodash_1.default.omit(subComplexCheck, 'complex-check')));
+        complexCheck['complex-check'].forEach((subComplexCheck) => {
+            complexChecks.push(...extractAllComplexChecks(subComplexCheck));
+        });
+    }
+    return complexChecks;
+}
+exports.extractAllComplexChecks = extractAllComplexChecks;
 function ensureDecodedXMLStringValue(input) {
     return lodash_1.default.get(input, '[0].#text') ? lodash_1.default.get(input, '[0].#text') : input;
 }
@@ -39,8 +51,18 @@ function processXCCDF(xml, removeNewlines = false, useRuleId, ovalDefinitions) {
     rules.forEach(rule => {
         var _a, _b, _c;
         let extractedDescription;
-        if (Array.isArray(rule.description)) {
-            extractedDescription = rule.description[0]['#text'];
+        if (typeof rule.description === 'object') {
+            if (Array.isArray(rule.description) && lodash_1.default.get(rule, "description[0]['#text']")) {
+                extractedDescription = rule.description[0]['#text'];
+            }
+            else {
+                if (typeof lodash_1.default.get(rule.description, '[0].p') === 'string') {
+                    extractedDescription = (0, pretty_1.default)(lodash_1.default.get(rule.description, '[0].p'));
+                }
+                else {
+                    extractedDescription = JSON.stringify(rule.description);
+                }
+            }
         }
         else {
             extractedDescription = (0, xccdf_1.convertEncodedHTMLIntoJson)(rule.description);
@@ -74,9 +96,19 @@ function processXCCDF(xml, removeNewlines = false, useRuleId, ovalDefinitions) {
             default:
                 throw new Error('useRuleId must be one of "group", "rule", or "version"');
         }
-        control.title = (0, xccdf_1.removeXMLSpecialCharacters)(rule['@_severity'] ? ensureDecodedXMLStringValue(rule.title) : `[[[MISSING SEVERITY FROM STIG]]] ${ensureDecodedXMLStringValue(rule.title)}`);
-        const descriptionText = (typeof extractedDescription === 'object' && !Array.isArray(extractedDescription)) ? ((_a = extractedDescription.VulnDiscussion) === null || _a === void 0 ? void 0 : _a.split('Satisfies: ')[0]) || 'Missing Description' : '';
-        control.desc = (0, xccdf_1.removeXMLSpecialCharacters)(descriptionText);
+        control.title = (0, xccdf_1.removeXMLSpecialCharacters)(rule['@_severity'] ? ensureDecodedXMLStringValue(rule.title) : `[[[MISSING SEVERITY FROM BENCHMARK]]] ${ensureDecodedXMLStringValue(rule.title)}`);
+        if (typeof extractedDescription === 'object' && !Array.isArray(extractedDescription)) {
+            control.desc = ((_a = extractedDescription.VulnDiscussion) === null || _a === void 0 ? void 0 : _a.split('Satisfies: ')[0]) || '';
+        }
+        else if (typeof extractedDescription === 'object') {
+            control.desc = JSON.stringify(extractedDescription);
+        }
+        else if (typeof extractedDescription === 'string') {
+            control.desc = extractedDescription || '';
+        }
+        else {
+            console.warn(`Invalid value for extracted description: ${extractedDescription}`);
+        }
         control.impact = (0, xccdf_1.severityStringToImpact)(rule['@_severity'] || 'medium', rule.group['@_id']);
         if (!control.descs || Array.isArray(control.descs)) {
             control.descs = {};
@@ -90,6 +122,7 @@ function processXCCDF(xml, removeNewlines = false, useRuleId, ovalDefinitions) {
                 let referenceID = null;
                 for (const checkContent of rule.check) {
                     if ('check-content-ref' in checkContent && checkContent['@_system'].includes('oval')) {
+                        console.log(`Found OVAL reference: ${checkContent['@_system']}`);
                         for (const checkContentRef of checkContent['check-content-ref']) {
                             if (checkContentRef['@_name']) {
                                 referenceID = checkContentRef['@_name'];
@@ -105,6 +138,54 @@ function processXCCDF(xml, removeNewlines = false, useRuleId, ovalDefinitions) {
                 }
             }
         }
+        // Very CIS specific
+        else if (rule['complex-check']) {
+            let checkTexts = [];
+            for (const complexChecks of rule['complex-check']) {
+                const allComplexChecks = extractAllComplexChecks(complexChecks);
+                if (control.id === '1.1.1.5') {
+                    console.log(allComplexChecks);
+                }
+                allComplexChecks.forEach((complexCheck) => {
+                    if (complexCheck.check) {
+                        complexCheck.check.forEach((check) => {
+                            var _a;
+                            if ((_a = check['@_system']) === null || _a === void 0 ? void 0 : _a.toLowerCase().includes('oval')) {
+                                const ovalReference = check['check-content-ref'][0]['@_name'];
+                                if (!ovalDefinitions) {
+                                    console.warn(`Missing OVAL definitions! Unable to process OVAL reference: ${ovalReference}`);
+                                }
+                                else if (ovalReference && ovalReference in ovalDefinitions) {
+                                    ovalDefinitions[ovalReference].resolvedValues.forEach((resolvedValue) => {
+                                        const comment = resolvedValue['@_comment'];
+                                        if (comment) {
+                                            checkTexts.push(comment + '\n');
+                                        }
+                                        resolvedValue.resolvedObjects.forEach((resolvedObject) => {
+                                            // Try to find the associated state for a resolved object
+                                            const resolvedId = resolvedObject['@_id'].split(':')[resolvedValue['@_id'].split(':').length - 1];
+                                            if (resolvedId) {
+                                                const relatedResolvedState = resolvedValue.resolvedStates.find((resolvedState) => resolvedState['@_id'].toLowerCase().includes(resolvedId.toLowerCase()));
+                                                if (relatedResolvedState) {
+                                                    lodash_1.default.set(resolvedObject, 'expectedState', lodash_1.default.pickBy(relatedResolvedState, (value, key) => !key.startsWith('@_')));
+                                                }
+                                            }
+                                            checkTexts.push(JSON.stringify(lodash_1.default.pickBy(resolvedObject, (value, key) => !key.startsWith('@_')), null, 2));
+                                        });
+                                    });
+                                }
+                            }
+                            else {
+                                console.warn(`Found external reference to unknown system: ${check['@_system']}, only OVAL is supported`);
+                            }
+                        });
+                    }
+                });
+            }
+            if (checkTexts.length >= 1) {
+                control.descs.check = checkTexts.join('\n');
+            }
+        }
         if (lodash_1.default.get(rule.fixtext, '[0]["#text"]')) {
             control.descs.fix = (0, xccdf_1.removeXMLSpecialCharacters)(rule.fixtext[0]['#text']);
         }
@@ -113,7 +194,17 @@ function processXCCDF(xml, removeNewlines = false, useRuleId, ovalDefinitions) {
         }
         else if (typeof rule.fixtext === 'object') {
             if (Array.isArray(rule.fixtext)) {
-                control.descs.fix = (0, xccdf_1.removeXMLSpecialCharacters)(JSON.stringify(rule.fixtext));
+                control.descs.fix = (0, xccdf_1.removeXMLSpecialCharacters)((0, pretty_1.default)((0, xccdf_1.convertJsonIntoXML)(rule.fixtext.map((fixtext) => {
+                    if (fixtext.div) {
+                        return fixtext.div;
+                    }
+                    else {
+                        return fixtext;
+                    }
+                }))));
+            }
+            else {
+                control.descs.fix = (0, xccdf_1.removeXMLSpecialCharacters)((0, pretty_1.default)((0, xccdf_1.convertJsonIntoXML)(rule.fixtext)));
             }
         }
         else if (typeof rule.fixtext === 'undefined') {
@@ -124,7 +215,7 @@ function processXCCDF(xml, removeNewlines = false, useRuleId, ovalDefinitions) {
         else {
             control.descs.fix = 'Missing fix text';
         }
-        control.tags.severity = (0, xccdf_1.impactNumberToSeverityString)((0, xccdf_1.severityStringToImpact)(rule['@_severity'] || 'critical', control.id || 'Unknown'));
+        control.tags.severity = (0, xccdf_1.impactNumberToSeverityString)((0, xccdf_1.severityStringToImpact)(rule['@_severity'] || 'medium', control.id || 'Unknown'));
         control.tags.gid = rule.group['@_id'],
             control.tags.rid = rule['@_id'];
         control.tags.stig_id = rule['version'];

package/lib/utilities/update.js

@@ -41,6 +41,7 @@ function getExistingDescribeFromControl(control) {
         let inQuoteBlock = false;
         let inMetadataValueOverride = false;
         let indentedMetadataOverride = false;
+        let inDescribeBlock = false;
         let mostSpacesSeen = 0;
         control.code.split('\n').forEach((line) => {
             const wordSplit = line.trim().split(' ');
@@ -52,11 +53,16 @@ function getExistingDescribeFromControl(control) {
                 mostSpacesSeen = spaces;
                 indentedMetadataOverride = false;
             }
-            if (!inQuoteBlock && !inMetadataValueOverride && !indentedMetadataOverride) {
+            if (control.id === 'SV-204392') {
+                console.log(line);
+                console.log(inDescribeBlock);
+            }
+            if ((!inQuoteBlock && !inMetadataValueOverride && !indentedMetadataOverride) || inDescribeBlock) {
                 // Get the number of spaces at the beggining of the current line
                 if (spaces >= 2) {
                     const firstWord = wordSplit[0];
-                    if (knownInSpecKeywords.indexOf(firstWord.toLowerCase()) === -1 || (knownInSpecKeywords.indexOf(firstWord.toLowerCase()) !== -1 && spaces > 2)) {
+                    if (knownInSpecKeywords.indexOf(firstWord.toLowerCase()) === -1 || (knownInSpecKeywords.indexOf(firstWord.toLowerCase()) !== -1 && spaces > 2) || inDescribeBlock) {
+                        inDescribeBlock = true;
                         existingDescribeBlock += line + '\n';
                     }
                 }
@@ -65,7 +71,7 @@ function getExistingDescribeFromControl(control) {
                 const charSplit = word.split('');
                 charSplit.forEach((char, index) => {
                     if (char === '"' && charSplit[index - 1] !== '\\') {
-                        if (!currentQuoteEscape) {
+                        if (!currentQuoteEscape || !inQuoteBlock) {
                             currentQuoteEscape = '"';
                         }
                         if (currentQuoteEscape === '"') {
@@ -73,7 +79,7 @@ function getExistingDescribeFromControl(control) {
                         }
                     }
                     else if (char === "'" && charSplit[index - 1] !== '\\') {
-                        if (!currentQuoteEscape) {
+                        if (!currentQuoteEscape || !inQuoteBlock) {
                             currentQuoteEscape = "'";
                         }
                         if (currentQuoteEscape === "'") {

package/lib/utilities/xccdf.d.ts

@@ -1,5 +1,6 @@
 import { DecodedDescription } from '../types/xccdf';
 export declare function convertEncodedXmlIntoJson(encodedXml: string): any;
+export declare function convertJsonIntoXML(data: any): string;
 export declare function removeXMLSpecialCharacters(str: string): string;
 export declare function severityStringToImpact(string: string, id: string): number;
 export declare function impactNumberToSeverityString(impact: number): string;

package/lib/utilities/xccdf.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.convertEncodedHTMLIntoJson = exports.impactNumberToSeverityString = exports.severityStringToImpact = exports.removeXMLSpecialCharacters = exports.convertEncodedXmlIntoJson = void 0;
+exports.convertEncodedHTMLIntoJson = exports.impactNumberToSeverityString = exports.severityStringToImpact = exports.removeXMLSpecialCharacters = exports.convertJsonIntoXML = exports.convertEncodedXmlIntoJson = void 0;
 const tslib_1 = require("tslib");
 const fast_xml_parser_1 = tslib_1.__importDefault(require("fast-xml-parser"));
+const jstoxml_1 = require("jstoxml");
 const htmlparser = tslib_1.__importStar(require("htmlparser2"));
 const lodash_1 = tslib_1.__importDefault(require("lodash"));
 const he_1 = tslib_1.__importDefault(require("he"));
@@ -11,10 +12,15 @@ function convertEncodedXmlIntoJson(encodedXml) {
         ignoreAttributes: false,
         ignoreNameSpace: true,
         attributeNamePrefix: '@_',
+        stopNodes: ['div', 'p'],
         arrayMode: true
     });
 }
 exports.convertEncodedXmlIntoJson = convertEncodedXmlIntoJson;
+function convertJsonIntoXML(data) {
+    return (0, jstoxml_1.toXML)(data);
+}
+exports.convertJsonIntoXML = convertJsonIntoXML;
 function removeXMLSpecialCharacters(str) {
     return he_1.default.decode(str);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mitre/inspec-objects",
-  "version": "0.0.25",
+  "version": "0.0.28",
   "description": "Typescript objects for normalizing between InSpec profiles and XCCDF benchmarks",
   "main": "lib/index.js",
   "publishConfig": {
@@ -25,8 +25,10 @@
     "@types/flat": "^5.0.2",
     "@types/he": "^1.1.2",
     "@types/json-diff": "^0.7.0",
+    "@types/jstoxml": "^2.0.2",
     "@types/lodash": "^4.14.178",
     "@types/mustache": "^4.2.0",
+    "@types/pretty": "^2.0.1",
     "fast-xml-parser": "^3.1.19",
     "flat": "^5.0.2",
     "he": "^1.2.0",
@@ -34,8 +36,10 @@
     "inspecjs": "^2.6.6",
     "jest": "^28.1.1",
     "json-diff": "^0.9.0",
+    "jstoxml": "^3.2.3",
     "lodash": "^4.17.21",
     "mustache": "^4.2.0",
+    "pretty": "^2.0.0",
     "ts-jest": "^28.0.4",
     "typescript": "^4.5.5",
     "winston": "^3.8.1",