@mitre/inspec-objects 0.0.34 → 1.0.1

package/.github/release-drafter.yml

@@ -0,0 +1,21 @@
+name-template: "$NEXT_PATCH_VERSION"
+tag-template: "$NEXT_PATCH_VERSION"
+categories:
+  - title: "New Features"
+    labels:
+      - "feature"
+      - "enhancement"
+  - title: "Bug Fixes"
+    labels:
+      - "fix"
+      - "bugfix"
+      - "bug"
+  - title: "Security Enhancements"
+    labels:
+      - "security"
+  - title: "Dependency Updates"
+    labels:
+      - "dependencies"
+change-template: "- $TITLE @$AUTHOR (#$NUMBER)"
+template: |
+  $CHANGES

package/.github/workflows/draft-release.yml

@@ -0,0 +1,16 @@
+name: Draft Release
+
+on:
+  push:
+    # branches to consider in the event; optional, defaults to all
+    branches:
+      - main
+
+jobs:
+  update_draft_release:
+    runs-on: ubuntu-latest
+    steps:
+      # Drafts your next Release notes as Pull Requests are merged into "master"
+      - uses: toolmantim/release-drafter@v5.2.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

package/lib/objects/control.d.ts

@@ -49,5 +49,6 @@ export default class Control {
     };
     constructor(data?: Partial<Control>);
     toUnformattedObject(): Control;
-    toRuby(): string;
+    toString(): string;
+    toRuby(verbose?: boolean): string;
 }

package/lib/objects/control.js

@@ -5,6 +5,7 @@ const tslib_1 = require("tslib");
 const lodash_1 = tslib_1.__importDefault(require("lodash"));
 const flat_1 = require("flat");
 const global_1 = require("../utilities/global");
+const logging_1 = require("../utilities/logging");
 function objectifyDescriptions(descs) {
     if (Array.isArray(descs)) {
         const descriptions = {};
@@ -36,21 +37,86 @@ class Control {
         });
         return new Control((0, flat_1.unflatten)(flattened));
     }
-    toRuby() {
+    // WIP - provides the ability to get the control in its raw form
+    toString() {
+        let result = '';
+        result += `control '${this.id}' do\n`;
+        if (this.title) {
+            result += `  title "${this.title}"\n`;
+        }
+        // This is the known 'default' description - on previous version this content was repeated on descriptions processed by "descs"
+        if (this.desc) {
+            result += `  desc "${this.desc}"\n`;
+        }
+        if (this.descs) {
+            Object.entries(this.descs).forEach(([key, subDesc]) => {
+                if (subDesc) {
+                    result += `  desc '${key}', "${subDesc}"\n`;
+                }
+            });
+        }
+        if (this.impact) {
+            result += `  impact ${this.impact}\n`;
+        }
+        if (this.refs) {
+            this.refs.forEach((ref) => {
+                var _a;
+                if (typeof ref === 'string') {
+                    result += `  ref "${ref}"\n`;
+                }
+                else {
+                    result += `  ref ${((_a = ref.ref) === null || _a === void 0 ? void 0 : _a.toString()) || ''}, url: ${ref.url || ''}`;
+                }
+            });
+        }
+        Object.entries(this.tags).forEach(([tag, value]) => {
+            if (typeof value === 'object') {
+                if (Array.isArray(value) && typeof value[0] === 'string') {
+                    result += `  tag ${tag}: ${JSON.stringify(value)}\n`;
+                }
+                else {
+                    result += `  tag '${tag}': ${(value == null ? 'nil' : value)}\n`;
+                }
+            }
+            else if (typeof value === 'string') {
+                if (value.includes('"')) {
+                    result += `  tag "${tag}": "${value}"\n`;
+                }
+                else {
+                    result += `  tag '${tag}': '${value}'\n`;
+                }
+            }
+        });
+        if (this.describe) {
+            result += '\n';
+            result += this.describe;
+        }
+        if (!result.slice(-1).match('\n')) {
+            result += '\n';
+        }
+        result += 'end\n';
+        return result;
+    }
+    toRuby(verbose = true) {
+        const logger = (0, logging_1.createWinstonLogger)();
         let result = '';
         result += `control '${this.id}' do\n`;
         if (this.title) {
             result += `  title ${(0, global_1.escapeQuotes)(this.title)}\n`;
         }
         else {
-            console.error(`${this.id} does not have a title`);
+            if (verbose) {
+                logger.error(`${this.id} does not have a title`);
+            }
         }
         // This is the known 'default' description - on previous version this content was repeated on descriptions processed by "descs"
         if (this.desc) {
             result += `  desc ${(0, global_1.escapeQuotes)(this.desc)}\n`;
         }
         else {
-            console.error(`${this.id} does not have a desc`);
+            if (verbose) {
+                logger.error(`${this.id} does not have a desc`);
+            }
         }
         if (this.descs) {
             Object.entries(this.descs).forEach(([key, subDesc]) => {
@@ -60,7 +126,9 @@ class Control {
                             // The "default" keyword may have the same content as the desc content for backward compatibility with different historical InSpec versions.
                             // In that case, we can ignore writing the "default" subdescription field.
                             // If they are different, however, someone may be trying to use the keyword "default" for a unique subdescription, which should not be done.
-                            console.error(`${this.id} has a subdescription called "default" with contents that do not match the main description. "Default" should not be used as a keyword for unique sub-descriptions.`);
+                            if (verbose) {
+                                logger.error(`${this.id} has a subdescription called "default" with contents that do not match the main description. "Default" should not be used as a keyword for unique sub-descriptions.`);
+                            }
                         }
                     }
                     else {
@@ -68,15 +136,19 @@ class Control {
                     }
                 }
                 else {
-                    console.error(`${this.id} does not have a desc for the value ${key}`);
+                    if (verbose) {
+                        logger.error(`${this.id} does not have a desc for the value ${key}`);
+                    }
                 }
             });
         }
-        if (this.impact) {
-            result += `  impact ${this.impact}\n`;
+        if (this.impact !== undefined) {
+            result += `  impact ${(this.impact <= 0 ? this.impact.toFixed(1) : this.impact)}\n`;
         }
         else {
-            console.error(`${this.id} does not have an impact`);
+            if (verbose) {
+                logger.error(`${this.id} does not have an impact`);
+            }
         }
         if (this.refs) {
             this.refs.forEach((ref) => {
@@ -115,6 +187,18 @@ class Control {
                     result += `  tag ${tag}: ${(0, global_1.escapeQuotes)(value)}\n`;
                 }
             }
+            else {
+                const nilTagList = ['severity', 'satisfies'];
+                if (nilTagList.includes(tag)) {
+                    result += `  tag ${tag}: nil\n`;
+                }
+                else {
+                    result += `  tag '${tag}'\n`;
+                }
+                if (verbose) {
+                    logger.info(`${this.id} does not have a value for tag: ${tag}`);
+                }
+            }
         });
         if (this.describe) {
             result += '\n';

package/lib/parsers/oval.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.processOVAL = exports.extractAllCriteriaRefs = void 0;
 const xccdf_1 = require("../utilities/xccdf");
+const logging_1 = require("../utilities/logging");
 // https://stackoverflow.com/questions/9133500/how-to-find-a-node-in-a-tree-with-javascript
 function searchTree(aTree, fCompair, bGreedy) {
     let oNode; // always the current node  
@@ -53,6 +54,7 @@ function extractAllCriteriaRefs(initialCriteria) {
 exports.extractAllCriteriaRefs = extractAllCriteriaRefs;
 function processOVAL(oval) {
     var _a;
+    const logger = (0, logging_1.createWinstonLogger)();
     if (!oval) {
         return undefined;
     }
@@ -73,7 +75,7 @@ function processOVAL(oval) {
                         if (foundCriteriaRefererence.object) {
                             foundCriteriaRefererence.object.forEach((object) => {
                                 if (!object['@_object_ref']) {
-                                    console.warn(`Found object without object_ref in test ${criteriaRef}`);
+                                    logger.warn(`Found object without object_ref in test ${criteriaRef}`);
                                 }
                                 else {
                                     const objectRef = object['@_object_ref'];
@@ -82,7 +84,7 @@ function processOVAL(oval) {
                                         foundObjects.push(foundObjectReference);
                                     }
                                     else {
-                                        console.warn(`Could not find object ${objectRef} for test ${criteriaRef}`);
+                                        logger.warn(`Could not find object ${objectRef} for test ${criteriaRef}`);
                                     }
                                 }
                             });
@@ -90,7 +92,7 @@ function processOVAL(oval) {
                         if (foundCriteriaRefererence.state) {
                             foundCriteriaRefererence.state.forEach((state) => {
                                 if (!state['@_state_ref']) {
-                                    console.warn(`Found state without state_ref in test ${criteriaRef}`);
+                                    logger.warn(`Found state without state_ref in test ${criteriaRef}`);
                                 }
                                 else {
                                     const stateRef = state['@_state_ref'];
@@ -99,7 +101,7 @@ function processOVAL(oval) {
                                         foundStates.push(foundStateReference);
                                     }
                                     else {
-                                        console.warn(`Could not find state ${stateRef} for test ${criteriaRef}`);
+                                        logger.warn(`Could not find state ${stateRef} for test ${criteriaRef}`);
                                     }
                                 }
                             });

package/lib/parsers/xccdf.js

@@ -8,6 +8,7 @@ const control_1 = tslib_1.__importDefault(require("../objects/control"));
 const lodash_1 = tslib_1.__importDefault(require("lodash"));
 const CciNistMappingData_1 = require("../mappings/CciNistMappingData");
 const pretty_1 = tslib_1.__importDefault(require("pretty"));
+const logging_1 = require("../utilities/logging");
 function extractAllRules(groups) {
     const rules = [];
     groups.forEach((group) => {
@@ -42,7 +43,11 @@ function ensureDecodedXMLStringValue(input) {
 }
 // Moving the newline removal to diff library rather than processXCCDF level
 function processXCCDF(xml, removeNewlines, useRuleId, ovalDefinitions) {
+    const logger = (0, logging_1.createWinstonLogger)();
     const parsedXML = (0, xccdf_1.convertEncodedXmlIntoJson)(xml);
+    if (parsedXML.Benchmark === undefined) {
+        throw new Error('Could not process the XCCDF file, check the input to make sure this is a properly formatted XCCDF file.');
+    }
     const rules = extractAllRules(parsedXML.Benchmark[0].Group);
     const profile = new profile_1.default({
         name: parsedXML.Benchmark[0]['@_id'],
@@ -116,7 +121,7 @@ function processXCCDF(xml, removeNewlines, useRuleId, ovalDefinitions) {
             control.desc = extractedDescription || '';
         }
         else {
-            console.warn(`Invalid value for extracted description: ${extractedDescription}`);
+            logger.warn(`Invalid value for extracted description: ${extractedDescription}`);
         }
         control.impact = (0, xccdf_1.severityStringToImpact)(rule['@_severity'] || 'medium', rule.group['@_id']);
         if (!control.descs || Array.isArray(control.descs)) {
@@ -131,7 +136,7 @@ function processXCCDF(xml, removeNewlines, useRuleId, ovalDefinitions) {
                 let referenceID = null;
                 for (const checkContent of rule.check) {
                     if ('check-content-ref' in checkContent && checkContent['@_system'].includes('oval')) {
-                        console.log(`Found OVAL reference: ${checkContent['@_system']}`);
+                        logger.info(`Found OVAL reference: ${checkContent['@_system']}`);
                         for (const checkContentRef of checkContent['check-content-ref']) {
                             if (checkContentRef['@_name']) {
                                 referenceID = checkContentRef['@_name'];
@@ -143,7 +148,7 @@ function processXCCDF(xml, removeNewlines, useRuleId, ovalDefinitions) {
                     control.descs.check = (0, xccdf_1.removeXMLSpecialCharacters)(ovalDefinitions[referenceID].metadata[0].title);
                 }
                 else if (referenceID) {
-                    console.warn(`Could not find OVAL definition for ${referenceID}`);
+                    logger.warn(`Could not find OVAL definition for ${referenceID}`);
                 }
             }
         }
@@ -153,7 +158,7 @@ function processXCCDF(xml, removeNewlines, useRuleId, ovalDefinitions) {
             for (const complexChecks of rule['complex-check']) {
                 const allComplexChecks = extractAllComplexChecks(complexChecks);
                 if (control.id === '1.1.1.5') {
-                    console.log(allComplexChecks);
+                    logger.info(allComplexChecks);
                 }
                 allComplexChecks.forEach((complexCheck) => {
                     if (complexCheck.check) {
@@ -162,7 +167,7 @@ function processXCCDF(xml, removeNewlines, useRuleId, ovalDefinitions) {
                             if ((_a = check['@_system']) === null || _a === void 0 ? void 0 : _a.toLowerCase().includes('oval')) {
                                 const ovalReference = check['check-content-ref'][0]['@_name'];
                                 if (!ovalDefinitions) {
-                                    console.warn(`Missing OVAL definitions! Unable to process OVAL reference: ${ovalReference}`);
+                                    logger.warn(`Missing OVAL definitions! Unable to process OVAL reference: ${ovalReference}`);
                                 }
                                 else if (ovalReference && ovalReference in ovalDefinitions) {
                                     ovalDefinitions[ovalReference].resolvedValues.forEach((resolvedValue) => {
@@ -185,7 +190,7 @@ function processXCCDF(xml, removeNewlines, useRuleId, ovalDefinitions) {
                                 }
                             }
                             else {
-                                console.warn(`Found external reference to unknown system: ${check['@_system']}, only OVAL is supported`);
+                                logger.warn(`Found external reference to unknown system: ${check['@_system']}, only OVAL is supported`);
                             }
                         });
                     }
@@ -332,19 +337,19 @@ function processXCCDF(xml, removeNewlines, useRuleId, ovalDefinitions) {
                                 control.tags[identifierType] = lodash_1.default.union(control.tags[identifierType], [identifier]);
                             }
                             else {
-                                console.warn(`Attempted to push identifier to control tags when identifier already exists: ${identifierType}: ${identifier}`);
+                                logger.warn(`Attempted to push identifier to control tags when identifier already exists: ${identifierType}: ${identifier}`);
                             }
                         }
                         else {
-                            console.warn('Reference parts of invalid length:');
-                            console.log(referenceParts);
+                            logger.warn('Reference parts of invalid length:');
+                            logger.info(referenceParts);
                         }
                     }
                 }
                 catch (e) {
-                    console.warn(`Error parsing ref for control ${control.id}: `);
-                    console.warn(JSON.stringify(reference, null, 2));
-                    console.warn(e);
+                    logger.warn(`Error parsing ref for control ${control.id}: `);
+                    logger.warn(JSON.stringify(reference, null, 2));
+                    logger.warn(e);
                 }
             }
         });

package/lib/utilities/global.js

@@ -44,6 +44,9 @@ function removeWhitespace(input) {
     return input.replace(/\s/gi, '');
 }
 exports.removeWhitespace = removeWhitespace;
+const escapeSpecialCaseBackslashes = (s) => {
+    return s.replace(/\\\)/g, '\\\\)'); // Escape backslashes if preceding close parentheses
+};
 const escapeSingleQuotes = (s) => {
     return s.replace(/\\/g, '\\\\').replace(/'/g, "\\'"); // Escape backslashes and quotes
 };
@@ -52,7 +55,7 @@ const escapeDoubleQuotes = (s) => {
 };
 function escapeQuotes(s) {
     if (s.includes("'") && s.includes('"')) {
-        return `%q(${removeNewlinePlaceholders(s)})`;
+        return `%q(${escapeSpecialCaseBackslashes(removeNewlinePlaceholders(s))})`;
     }
     else if (s.includes("'")) {
         return `"${escapeDoubleQuotes(removeNewlinePlaceholders(s))}"`;

package/lib/utilities/update.js

@@ -5,9 +5,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.updateProfileUsingXCCDF = exports.updateProfile = exports.updateControl = exports.findUpdatedControlByAllIdentifiers = exports.getExistingDescribeFromControl = void 0;
 const tslib_1 = require("tslib");
 const lodash_1 = tslib_1.__importDefault(require("lodash"));
+const diff_1 = require("./diff");
 const profile_1 = tslib_1.__importDefault(require("../objects/profile"));
 const xccdf_1 = require("../parsers/xccdf");
-const diff_1 = require("./diff");
 const diffMarkdown_1 = require("./diffMarkdown");
 function projectValuesOntoExistingObj(dst, src, currentPath = '') {
     for (const updatedValue in src) {
@@ -51,7 +51,7 @@ function getRangesForLines(text) {
       - Percent literals (%; delimiters: (), {}, [], <>, most non-
         alphanumeric characters); (e.g., "%()")
       - Multi-line comments (e.g., =begin\nSome comment\n=end)
-      - Variable delimiters (i.e., paranthesis: (); array: []; hash: {})
+      - Variable delimiters (i.e., parenthesis: (); array: []; hash: {})
     */
     const stringDelimiters = { '(': ')', '{': '}', '[': ']', '<': '>' };
     const variableDelimiters = { '(': ')', '{': '}', '[': ']' };
@@ -62,6 +62,7 @@ function getRangesForLines(text) {
         skipCharLength[skipCharLength["string"] = '('.length] = "string";
         skipCharLength[skipCharLength["percentString"] = 'q('.length] = "percentString";
         skipCharLength[skipCharLength["commentBegin"] = '=begin'.length] = "commentBegin";
+        skipCharLength[skipCharLength["inlineInterpolationBegin"] = '{'.length] = "inlineInterpolationBegin";
     })(skipCharLength || (skipCharLength = {}));
     const stack = [];
     const rangeStack = [];
@@ -80,6 +81,8 @@ function getRangesForLines(text) {
             const isVariableDelimiterChar = Object.keys(variableDelimiters).includes(char);
             const isStringDelimiterChar = ((j < line.length - 1) && (/^[^A-Za-z0-9]$/.test(line[j + 1])));
             const isCommentBeginChar = ((j == 0) && (line.length >= 6) && (line.slice(0, 6) == '=begin'));
+            const isCommentChar = /^\s*#/.test(line);
+            const isInlineInterpolation = (char == '#' && ((j < line.length - 1) && line[j + 1] == '{'));
             const isPercentStringKeyChar = ((j < line.length - 1) && (strings.includes(line[j + 1])));
             const isPercentStringDelimiterChar = ((j < line.length - 2) && (/^[^A-Za-z0-9]$/.test(line[j + 2])));
             const isPercentString = (isPercentStringKeyChar && isPercentStringDelimiterChar);
@@ -89,6 +92,11 @@ function getRangesForLines(text) {
             const stringPushCondition = (baseCondition && isPercentChar && isStringDelimiterChar);
             const percentStringPushCondition = (baseCondition && isPercentChar && isPercentString);
             const commentBeginCondition = (baseCondition && isCommentBeginChar);
+            const commentCondition = (baseCondition && isCommentChar);
+            const inlineInterpolationCondition = (isNotEmptyStack && isInlineInterpolation);
+            if (commentCondition) {
+                break;
+            }
             if (stringPushCondition) {
                 j += skipCharLength.string; // j += 1
             }
@@ -98,6 +106,9 @@ function getRangesForLines(text) {
             else if (commentBeginCondition) {
                 j += skipCharLength.commentBegin; // j += 6
             }
+            else if (inlineInterpolationCondition) {
+                j += skipCharLength.inlineInterpolationBegin; // j += 1
+            }
             char = line[j];
             baseCondition = (isNotEmptyStack && isNotEscapeChar);
             const delimiterCondition = (baseCondition && Object.keys(stringDelimiters).includes(stack[stack.length - 1]));
@@ -108,7 +119,7 @@ function getRangesForLines(text) {
             const commentEndCondition = (baseCondition && isCommentEndChar && (stack[stack.length - 1] == '=begin'));
             const popCondition = (basePopCondition || delimiterPopCondition || commentEndCondition);
             const pushCondition = (quotePushCondition || variablePushCondition || stringPushCondition ||
-                percentStringPushCondition || delimiterPushCondition || commentBeginCondition);
+                percentStringPushCondition || delimiterPushCondition || commentBeginCondition || inlineInterpolationCondition);
             if (popCondition) {
                 stack.pop();
                 rangeStack[rangeStack.length - 1].push(i);
@@ -121,6 +132,9 @@ function getRangesForLines(text) {
                 if (commentBeginCondition) {
                     stack.push('=begin');
                 }
+                else if (inlineInterpolationCondition) {
+                    stack.push('{');
+                }
                 else {
                     stack.push(char);
                 }
@@ -177,9 +191,11 @@ function getExistingDescribeFromControl(control) {
     if (control.code) {
         // Join multi-line strings in InSpec control.
         const ranges = getRangesForLines(control.code);
+        // Get the entries that have delimiters that span multi-lines
         const multiLineRanges = getMultiLineRanges(ranges);
-        const lines = joinMultiLineStringsFromRanges(control.code, multiLineRanges); // Array of lines representing the full InSpec control, with multi-line strings collapsed
-        // Define RegExp for lines to skip when searching for describe block.
+        // Array of lines representing the full InSpec control, with multi-line strings collapsed
+        const lines = joinMultiLineStringsFromRanges(control.code, multiLineRanges);
+        // Define RegExp for lines to skip.
         const skip = ['control\\W', '  title\\W', '  desc\\W', '  impact\\W', '  tag\\W', '  ref\\W'];
         const skipRegExp = RegExp(skip.map(x => `(^${x})`).join('|'));
         // Extract describe block from InSpec control with collapsed multiline strings.
@@ -197,7 +213,8 @@ function getExistingDescribeFromControl(control) {
                 ignoreNewLine = true;
             }
         }
-        return describeBlock.slice(0, describeBlock.length - 2).join('\n'); // Drop trailing ['end', '\n'] from Control block.
+        // Return synthesized logic as describe block
+        return describeBlock.slice(0, describeBlock.lastIndexOf('end')).join('\n'); // Drop trailing ['end', '\n'] from Control block.
     }
     else {
         return '';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mitre/inspec-objects",
-  "version": "0.0.34",
+  "version": "1.0.1",
   "description": "Typescript objects for normalizing between InSpec profiles and XCCDF benchmarks",
   "main": "lib/index.js",
   "publishConfig": {