diff --git a/features/steps/fedramp_extensions_steps.ts b/features/steps/fedramp_extensions_steps.ts
index 44b2435df..601f7b8af 100644
--- a/features/steps/fedramp_extensions_steps.ts
+++ b/features/steps/fedramp_extensions_steps.ts
@@ -1,23 +1,22 @@
-import { BeforeAll, BeforeStep, Given, Then, When, setDefaultTimeout, world } from "@cucumber/cucumber";
+import { BeforeAll, Given, Then, When, setDefaultTimeout } from "@cucumber/cucumber";
import { expect } from "chai";
import {
+ existsSync,
+ mkdirSync,
readFileSync,
readdirSync,
unlinkSync,
writeFileSync,
- mkdirSync,
- existsSync,
} from "fs";
import { load } from "js-yaml";
-import { executeOscalCliCommand, resolveProfile, resolveProfileDocument, validateDocument} from "oscal";
-import {checkServerStatus} from 'oscal/dist/server.js'
-import { dirname, join,parse, resolve } from "path";
-import { Exception, Log, Result } from "sarif";
+import { JSDOM } from 'jsdom';
+import { executeOscalCliCommand, formatSarifOutput, resolveProfileDocument, validateDocument } from "oscal";
+import { checkServerStatus } from 'oscal/dist/server.js';
+import { dirname, join, parse, resolve } from "path";
+import { Log } from "sarif";
import { fileURLToPath } from "url";
-import { parseString } from "xml2js";
-import {JSDOM} from 'jsdom'
import { promisify } from "util";
-import {formatSarifOutput} from 'oscal'
+import { parseString } from "xml2js";
let executor: 'oscal-cli'|'oscal-server' = process.env.OSCAL_EXECUTOR as 'oscal-cli'|'oscal-server' || 'oscal-cli'
const quiet = process.env.OSCAL_TEST_QUIET === 'true'
@@ -686,6 +685,7 @@ Then('I should have valid results {string}', async function (fileToValidate) {
Then('I should verify that all constraints follow the style guide constraint', async function () {
const baseDir = join(__dirname, '..', '..');
+ const styleGuidePath = join(baseDir, 'src', 'validations', 'styleguides', 'fedramp-constraint-style.xml');
const constraintDir = join(baseDir, 'src', 'validations', 'constraints');
const constraintFiles = readdirSync(constraintDir).filter(file =>
file.startsWith('fedramp') && file.endsWith('.xml')
@@ -701,7 +701,15 @@ Then('I should verify that all constraints follow the style guide constraint', a
const fileContent = readFileSync(filePath, 'utf8');
const dom = new JSDOM(fileContent, { contentType: 'text/xml' });
const document = dom.window.document;
-
+ const {isValid,log} = await validateDocument(filePath,{flags:['disable-schema'],quiet,extensions:[styleGuidePath],module:"http://csrc.nist.gov/ns/oscal/metaschema/1.0"},executor)
+ writeFileSync(
+ join(
+ __dirname,
+ "../../sarif/",
+ fileName.split(".xml").join("").toString()+".sarif"
+ ),JSON.stringify(log, null,"\t"))
+ const formattedErrors = (formatSarifOutput(log));
+ formattedErrors&&errors.push(formattedErrors)
// Process each 'constraints' block separately
document.querySelectorAll('constraints').forEach(constraintsNode => {
// Get direct child elements with IDs within this constraints block
diff --git a/src/validations/constraints/fedramp-external-constraints.xml b/src/validations/constraints/fedramp-external-constraints.xml
index abc781156..75fbdafcb 100644
--- a/src/validations/constraints/fedramp-external-constraints.xml
+++ b/src/validations/constraints/fedramp-external-constraints.xml
@@ -592,7 +592,7 @@
Container Image Has Checksum Property
-
+
In a FedRAMP SSP, a component that describes a container or operating system image MUST define a checksum property.
@@ -605,6 +605,11 @@
In a FedRAMP SSP, each inventory item and internal service component MUST state if they are public-facing.
+
+ Inventory Item or Component Has Asset ID
+
+ In a FedRAMP SSP, each inventory item and software image component MUST include the asset ID.
+
Leveraged Authorization Has Authorization Type
@@ -648,16 +653,6 @@
-
-
-
-
- Inventory Item or Component Has Asset ID
-
- In a FedRAMP SSP, each inventory item and software image component MUST include the asset ID.
-
-
-
@@ -756,6 +751,7 @@
'sc-1_smt.a' : 'at least one procedure that addresses System and Communications Protection MUST be associated with SC-1 part a.',
'si-1_smt.a' : 'at least one procedure that addresses System and Information Integrity MUST be associated with SI-1 part a.',
'sr-1_smt.a' : 'at least one procedure that addresses Supply Chain Risk Management MUST be associated with SR-1 part a.'}"/>
+
Has Policy
@@ -766,6 +762,11 @@
In a FedRAMP SSP, {$procedure-messages(./@statement-id)}
+
+ Statement Has This System Component
+
+ In a FedRAMP SSP, each control implementation statement MUST have one "this-system" by-component.
+
@@ -785,17 +786,6 @@
-
-
-
-
-
- Statement Has This System Component
-
- In a FedRAMP SSP, each control implementation statement MUST have one "this-system" by-component.
-
-
-