diff --git a/features/steps/fedramp_extensions_steps.ts b/features/steps/fedramp_extensions_steps.ts index 44b2435df..601f7b8af 100644 --- a/features/steps/fedramp_extensions_steps.ts +++ b/features/steps/fedramp_extensions_steps.ts @@ -1,23 +1,22 @@ -import { BeforeAll, BeforeStep, Given, Then, When, setDefaultTimeout, world } from "@cucumber/cucumber"; +import { BeforeAll, Given, Then, When, setDefaultTimeout } from "@cucumber/cucumber"; import { expect } from "chai"; import { + existsSync, + mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync, - mkdirSync, - existsSync, } from "fs"; import { load } from "js-yaml"; -import { executeOscalCliCommand, resolveProfile, resolveProfileDocument, validateDocument} from "oscal"; -import {checkServerStatus} from 'oscal/dist/server.js' -import { dirname, join,parse, resolve } from "path"; -import { Exception, Log, Result } from "sarif"; +import { JSDOM } from 'jsdom'; +import { executeOscalCliCommand, formatSarifOutput, resolveProfileDocument, validateDocument } from "oscal"; +import { checkServerStatus } from 'oscal/dist/server.js'; +import { dirname, join, parse, resolve } from "path"; +import { Log } from "sarif"; import { fileURLToPath } from "url"; -import { parseString } from "xml2js"; -import {JSDOM} from 'jsdom' import { promisify } from "util"; -import {formatSarifOutput} from 'oscal' +import { parseString } from "xml2js"; let executor: 'oscal-cli'|'oscal-server' = process.env.OSCAL_EXECUTOR as 'oscal-cli'|'oscal-server' || 'oscal-cli' const quiet = process.env.OSCAL_TEST_QUIET === 'true' @@ -686,6 +685,7 @@ Then('I should have valid results {string}', async function (fileToValidate) { Then('I should verify that all constraints follow the style guide constraint', async function () { const baseDir = join(__dirname, '..', '..'); + const styleGuidePath = join(baseDir, 'src', 'validations', 'styleguides', 'fedramp-constraint-style.xml'); const constraintDir = join(baseDir, 'src', 'validations', 'constraints'); const constraintFiles = readdirSync(constraintDir).filter(file => file.startsWith('fedramp') && file.endsWith('.xml') @@ -701,7 +701,15 @@ Then('I should verify that all constraints follow the style guide constraint', a const fileContent = readFileSync(filePath, 'utf8'); const dom = new JSDOM(fileContent, { contentType: 'text/xml' }); const document = dom.window.document; - + const {isValid,log} = await validateDocument(filePath,{flags:['disable-schema'],quiet,extensions:[styleGuidePath],module:"http://csrc.nist.gov/ns/oscal/metaschema/1.0"},executor) + writeFileSync( + join( + __dirname, + "../../sarif/", + fileName.split(".xml").join("").toString()+".sarif" + ),JSON.stringify(log, null,"\t")) + const formattedErrors = (formatSarifOutput(log)); + formattedErrors&&errors.push(formattedErrors) // Process each 'constraints' block separately document.querySelectorAll('constraints').forEach(constraintsNode => { // Get direct child elements with IDs within this constraints block diff --git a/src/validations/constraints/fedramp-external-constraints.xml b/src/validations/constraints/fedramp-external-constraints.xml index abc781156..75fbdafcb 100644 --- a/src/validations/constraints/fedramp-external-constraints.xml +++ b/src/validations/constraints/fedramp-external-constraints.xml @@ -592,7 +592,7 @@ Container Image Has Checksum Property - + In a FedRAMP SSP, a component that describes a container or operating system image MUST define a checksum property. @@ -605,6 +605,11 @@ In a FedRAMP SSP, each inventory item and internal service component MUST state if they are public-facing. + + Inventory Item or Component Has Asset ID + + In a FedRAMP SSP, each inventory item and software image component MUST include the asset ID. + Leveraged Authorization Has Authorization Type @@ -648,16 +653,6 @@ - - - - - Inventory Item or Component Has Asset ID - - In a FedRAMP SSP, each inventory item and software image component MUST include the asset ID. - - - @@ -756,6 +751,7 @@ 'sc-1_smt.a' : 'at least one procedure that addresses System and Communications Protection MUST be associated with SC-1 part a.', 'si-1_smt.a' : 'at least one procedure that addresses System and Information Integrity MUST be associated with SI-1 part a.', 'sr-1_smt.a' : 'at least one procedure that addresses Supply Chain Risk Management MUST be associated with SR-1 part a.'}"/> + Has Policy @@ -766,6 +762,11 @@ In a FedRAMP SSP, {$procedure-messages(./@statement-id)} + + Statement Has This System Component + + In a FedRAMP SSP, each control implementation statement MUST have one "this-system" by-component. + @@ -785,17 +786,6 @@ - - - - - - Statement Has This System Component - - In a FedRAMP SSP, each control implementation statement MUST have one "this-system" by-component. - - -