8000 Improve yamlfile_value template by ggbecker · Pull Request #6584 · ComplianceAsCode/content · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Improve yamlfile_value template #6584

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Feb 3, 2021
Merged

Improve yamlfile_value template #6584

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 4 additions & 6 deletions shared/templates/yamlfile_value/oval.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
<ind:state state_ref="state_{{{ rule_id }}}"/>
</ind:yamlfilecontent_test>
{{% else %}}
<ind:variable_test id="test_{{{ rule_id }}}" check="all" check_existence="all_exist" comment="comment1" version="1">
<ind:variable_test id="test_{{{ rule_id }}}" check="all" check_existence="all_exist" comment="Variable test to check XCCDF variable" version="1">
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lol, thanks, that comment1 would have probably confused folks

<ind:object object_ref="variable_object_{{{ rule_id }}}" />
<ind:state state_ref="variable_state_{{{ rule_id }}}" />
</ind:variable_test>
Expand All @@ -45,13 +45,11 @@
<ind:value datatype="string" operation="equals" var_ref="{{{ XCCDF_VARIABLE }}}"/>
</ind:variable_state>

{{% for val in VALUES %}}
<local_variable id="local_variable_{{{ rule_id }}}" datatype="string" comment="comment1" version="1">
<regex_capture pattern='{{{ val.value }}}'>
<object_component item_field="value" record_field="#" object_ref="object_{{{ rule_id }}}" />
<local_variable id="local_variable_{{{ rule_id }}}" datatype="string" comment="Captured value to be compared with XCCDF value" version="1">
<regex_capture pattern='{{{ (VALUES|first).value }}}'>
<object_component item_field="value" record_field="{{{ (VALUES|first).key|default('#') }}}" object_ref="object_{{{ rule_id }}}" />
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

uhm... wait, so this removes support for using multiple values?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Only when the template data is using XCCDF variables. The previous use case of multiple values is preserved.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a use case where you'd like to compare an XCCDF Variable against multiple values?
Even in the non-embedded case?

I think it would be possible to do so, but id would add more complexity to this template 😬

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't see a use-case now. Let's expand once it's needed.

</regex_capture>
</local_variable>
{{% endfor %}}

{{% endif %}}

Expand Down
15 changes: 14 additions & 1 deletion shared/templates/yamlfile_value/template.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,25 @@
def preprocess(data, lang):

if data.get("xccdf_variable") and data.get("embedded_data") == "true":
if not data.get("values"):
values = data.get("values", [{}])
if len(values) > 1:
raise ValueError(
"Only a single value can be checked when querying "
"for a 'xccdf_value' that returns an embedded value. "
"Rule ID: {}".format(data["_rule_id"]))
elif not values[0].get("value"):
raise ValueError(
"You should specify a capture regex in the 'value' field "
"when querying for a 'xccdf_value' that returns an embedded value. "
"Rule ID: {}".format(data["_rule_id"]))

if data.get("xccdf_variable") and data.get("embedded_data") != "true":
if data.get("values"):
raise ValueError(
"You cannot specify the 'value' field when querying "
"for a 'xccdf_value' that doesn't return an embedded value. "
"Rule ID: {}".format(data["_rule_id"]))

data["embedded_data"] = data.get("embedded_data", "false") == "true"
data["ocp_data"] = data.get("ocp_data", "false") == "true"
return data
0