Add initial constraint and tests for GSA#833

kyhu65867 · Nov 19, 2024 · acbed86 · acbed86
1 parent 2c0974d
commit acbed86
Show file tree

Hide file tree

Showing 5 changed files with 50 additions and 1 deletion.
diff --git a/features/fedramp_extensions.feature b/features/fedramp_extensions.feature
@@ -177,6 +177,8 @@ Examples:
   | missing-response-components-PASS.yaml |
   | party-has-name-FAIL.yaml |
   | party-has-name-PASS.yaml |
+  | oscal-version-matches-fedramp-version-FAIL.yaml |
+  | oscal-version-matches-fedramp-version-PASS.yaml |
   | privilege-level-FAIL.yaml |
   | privilege-level-PASS.yaml |
   | resource-has-base64-or-rlink-FAIL.yaml |
@@ -323,6 +325,7 @@ Examples:
   | marking |
   | missing-response-components |
   | party-has-name |
+  | oscal-version-matches-fedramp-version |
   | privilege-level |
   | prop-response-point-has-cardinality-one |
   | resource-has-base64-or-rlink |

diff --git a/src/validations/constraints/content/ssp-oscal-version-matches-fedramp-version-INVALID.xml b/src/validations/constraints/content/ssp-oscal-version-matches-fedramp-version-INVALID.xml
@@ -0,0 +1,6 @@
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" uuid="12345678-1234-4321-8765-123456789012">
+  <metadata>
+    <oscal-version>2.0.0</oscal-version>
+    <prop name="fedramp-version" ns="https://fedramp.gov/ns/oscal" value="fedramp-3.0.0rc1-oscal-2.0.0"/>
+  </metadata>
+</system-security-plan>
diff --git a/src/validations/constraints/fedramp-external-constraints.xml b/src/validations/constraints/fedramp-external-constraints.xml
@@ -23,9 +23,31 @@
             </expect>
         </constraints>
     </context>
-
+    <context>
+        <metapath target="/system-security-plan/metadata"/>
+        <constraints>
+            <let var="preferred-version" expression="'3.0.0-rc1'"/>
+            <let var="fedramp-minimal-oscal-versions" expression="map{'3.0.0-rc1': '1.1.2'}"/>
+            <let var="doc-fedramp-version" expression="prop[@name='fedramp-version'][@ns='https://fedramp.gov/ns/oscal']/@value"/>
+            <let var="fedramp-required-minimal-version" expression="if map:contains($fedramp-minimal-oscal-versions, $doc-fedramp-version) then map:get($fedramp-minimal-oscal-versions, $doc-fedramp-version) else map:get($fedramp-minimal-oscal-versions, $preferred-version)"/>
+            <let var="required-doc-oscal-version-parts" expression="tokenize($fedramp-required-minimal-version, '\.')"/>
+            <let var="doc-oscal-version-parts" expression="tokenize(oscal-version, '\.')"/>
+            <let var="major-version-valid" expression="$doc-oscal-version-parts[1]  = $required-doc-oscal-version-parts[1]">
+                <remarks>
+                    <p>FedRAMP considers every major version as a possible source of backwards-compatible changes. FedRAMP only accepts versions with the same major version, but not newer.</p>
+                </remarks>
+            </let>
+            <let var="minor-version-valid" expression="$doc-oscal-version-parts[2] >= $required-doc-oscal-version-parts[2]"/>
+            <let var="patch-version-valid" expression="$doc-oscal-version-parts[3] >= $required-doc-oscal-version-parts[3]"/>
+            <expect id="oscal-version-matches-fedramp-version" target="prop[@name='fedramp-version'][@ns='https://fedramp.gov/ns/oscal']" test="$major-version-valid and $minor-version-valid and $patch-version-valid" level="WARNING">
+                <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://docs.oasis-open.org/sarif/sarif/v2.1.0"/>                
+                <message>A FedRAMP document SHOULD have an OSCAL version that matches the minimally required version for FedRAMP packages, {$fedramp-version-oscal-part}, not {../oscal-version}. DEBUG: {$major-version-valid} {$minor-version-valid} {$patch-version-valid}</message>
+            </expect>           
+        </constraints>
+    </context>
     <context>
         <metapath target="//user"/>
+
         <constraints>
             <expect id="user-has-authorized-privilege" target="." test="count(authorized-privilege) gt 0">
                 <formal-name>User Has Authorized Privilege</formal-name>

diff --git a/src/validations/constraints/unit-tests/oscal-version-matches-fedramp-version-FAIL.yaml b/src/validations/constraints/unit-tests/oscal-version-matches-fedramp-version-FAIL.yaml
@@ -0,0 +1,9 @@
+test-case:
+  name: Negative Test for oscal-version-matches-fedramp-version
+  description: >-
+    This test case validates the behavior of constraint
+    oscal-version-matches-fedramp-version
+  content: ../content/ssp-oscal-version-matches-fedramp-version-INVALID.xml
+  expectations:
+    - constraint-id: oscal-version-matches-fedramp-version
+      result: fail
diff --git a/src/validations/constraints/unit-tests/oscal-version-matches-fedramp-version-PASS.yaml b/src/validations/constraints/unit-tests/oscal-version-matches-fedramp-version-PASS.yaml
@@ -0,0 +1,9 @@
+test-case:
+  name: Positive Test for oscal-version-matches-fedramp-version
+  description: >-
+    This test case validates the behavior of constraint
+    oscal-version-matches-fedramp-version
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: oscal-version-matches-fedramp-version
+      result: pass