-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix SCE finding XPath to allow nesting with OCILs #11682
Conversation
When building data streams with complex checks (SCE combined with OVAL) that also have OCIL checks, we build a nested check system like: <complex-check operator="OR"> <complex-check operator="<SCE-CROSS-OVAL>"> <OVAL /> <SCE /> </complex-check> <OCIL /> </complex-check> However, the XPath for finding such checks (to include the SCE in the data stream) required the SCE check to be a direct descendant of the rule. Modify the XPath to allow arbitrary nesting on the inner SCE. Resolves: ComplianceAsCode#11681 Signed-off-by: Alexander Scheel <alexander.m.scheel@gmail.com>
Hi @cipherboy. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
/ok-to-test |
🤖 A k8s content image for this PR is available at: Click here to see how to deploy itIf you alread have Compliance Operator deployed: Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and: |
Code Climate has analyzed commit 66ee333 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 59.8% (0.0% change). View more on Code Climate. |
Thanks for the fix! :) |
Description:
When building data streams with complex checks (SCE combined with OVAL) that also have OCIL checks, we build a nested check system like:
However, the XPath for finding such checks (to include the SCE in the data stream) required the SCE check to be a direct descendant of the rule. Modify the XPath to allow arbitrary nesting on the inner SCE.
Rationale:
Fix is broken :-)
Resolves: #11681
Review Hints:
Pull this commit on top of the branch described in #11681 and run: