Textfilecontent54 test without parentheses for subexpression

7 Messages Forum Options Options
Permalink
Martin Thomas
Textfilecontent54 test without parentheses for subexpression
Reply Threaded More
Print post
Permalink
If a regular expression is written without parentheses to capture
information for return in the subexpression element, then only file,
path, pattern and instance will be present in system characteristics.
For some cases, it may be useful enough to know that there were N
matches of a regular expression without knowing the context of the
match.

I think it may be a useful default to return the full text of the match
as the subexpression in this case. Or perhaps there should be a new
element called match?

Anyone have ideas on this?

Thanks // Martin

To unsubscribe, send an email message to LISTSERV@... with
SIGNOFF OVAL-DEVELOPER-LIST
in the BODY of the message.  If you have difficulties, write to OVAL-DEVELOPER-LIST-request@....
Andrew Buttner
Re: Textfilecontent54 test without parentheses for subexpression
Reply Threaded More
Print post
Permalink
This was the intention of the 'text' entity, which does exist in the SC
item.  It represents the block of text that matched the specified
pattern.

Thanks
Drew

>-----Original Message-----
>From: Martin_Thomas@... [mailto:Martin_Thomas@...]
>Sent: Wednesday, July 02, 2008 6:46 PM
>To: oval-developer-list OVAL Developer List/Closed Public Discussion
>Subject: [OVAL-DEVELOPER-LIST] Textfilecontent54 test without
>parentheses for subexpression
>
>If a regular expression is written without parentheses to capture
>information for return in the subexpression element, then only file,
>path, pattern and instance will be present in system characteristics.
>For some cases, it may be useful enough to know that there were N
>matches of a regular expression without knowing the context of the
>match.
>
>I think it may be a useful default to return the full text of the
match

>as the subexpression in this case. Or perhaps there should be a new
>element called match?
>
>Anyone have ideas on this?
>
>Thanks // Martin
>
>To unsubscribe, send an email message to LISTSERV@... with
>SIGNOFF OVAL-DEVELOPER-LIST
>in the BODY of the message.  If you have difficulties, write to OVAL-
>DEVELOPER-LIST-request@....

To unsubscribe, send an email message to LISTSERV@... with
SIGNOFF OVAL-DEVELOPER-LIST
in the BODY of the message.  If you have difficulties, write to OVAL-DEVELOPER-LIST-request@....
Martin Thomas
Re: Textfilecontent54 test without parentheses for subexpression
Reply Threaded More
Print post
Permalink
The problem with the text entity only being in the SC item is that it is
not testable.  Taking it as the equivalent of line from textfilecontent
in 5.3, it should also be in state and should have operations available.

Additionally, the test is called textfilecontent54_test but the item in
SC is called textfilecontent_item - lacking the 54 designation and
providing opportunities for confusion.
I think the different entities of textfilecontent54 should not be added
to the original item and instead there should be a new
textfilecontent54_.

Just my thoughts //M

>-----Original Message-----
>From: Buttner, Drew [mailto:abuttner@...]
>Sent: Thursday, July 03, 2008 12:30 PM
>To: OVAL-DEVELOPER-LIST@...
>Subject: Re: [OVAL-DEVELOPER-LIST] Textfilecontent54 test without
>parentheses for subexpression
>
>This was the intention of the 'text' entity, which does exist in the SC
>item.  It represents the block of text that matched the specified
>pattern.
>
>Thanks
>Drew
>
>>-----Original Message-----
>>From: Martin_Thomas@... [mailto:Martin_Thomas@...]
>>Sent: Wednesday, July 02, 2008 6:46 PM
>>To: oval-developer-list OVAL Developer List/Closed Public Discussion
>>Subject: [OVAL-DEVELOPER-LIST] Textfilecontent54 test without
>>parentheses for subexpression
>>
>>If a regular expression is written without parentheses to capture
>>information for return in the subexpression element, then only file,
>>path, pattern and instance will be present in system characteristics.
>>For some cases, it may be useful enough to know that there were N
>>matches of a regular expression without knowing the context of the
>>match.
>>
>>I think it may be a useful default to return the full text of the
>match
>>as the subexpression in this case. Or perhaps there should be a new
>>element called match?
>>
>>Anyone have ideas on this?
>>
>>Thanks // Martin
>>
>>To unsubscribe, send an email message to LISTSERV@... with
>>SIGNOFF OVAL-DEVELOPER-LIST
>>in the BODY of the message.  If you have difficulties, write to OVAL-
>>DEVELOPER-LIST-request@....
>
>To unsubscribe, send an email message to LISTSERV@... with
>SIGNOFF OVAL-DEVELOPER-LIST
>in the BODY of the message.  If you have difficulties, write to OVAL-
>DEVELOPER-LIST-request@....

To unsubscribe, send an email message to LISTSERV@... with
SIGNOFF OVAL-DEVELOPER-LIST
in the BODY of the message.  If you have difficulties, write to OVAL-DEVELOPER-LIST-request@....
Andrew Buttner
Re: Textfilecontent54 test without parentheses for subexpression
Reply Threaded More
Print post
Permalink
>Additionally, the test is called textfilecontent54_test but the item
in
>SC is called textfilecontent_item - lacking the 54 designation and
>providing opportunities for confusion.
>I think the different entities of textfilecontent54 should not be
added
>to the original item and instead there should be a new
>textfilecontent54_.

It would be great to hear other opinions on this.  We did not create a
new item in the SC schema on purpose here.  The thinking is that since
SC entities are optional, we don't need to create an entirely new item.
This keeps the SC schema from being cluttered by deprecated items.  All
the textfilecontent tests would use the same item.

Does this make sense?  Would the community rather an strict 1:1 mapping
here?

Thanks
Drew

To unsubscribe, send an email message to LISTSERV@... with
SIGNOFF OVAL-DEVELOPER-LIST
in the BODY of the message.  If you have difficulties, write to OVAL-DEVELOPER-LIST-request@....
bakerj
Re: Textfilecontent54 test without parentheses for subexpression
Reply Threaded More
Print post
Permalink
I would prefer consistency in how objects, states, and items relate to
each other. For the most part we are very consistent and we should
strive to be. This consistency makes it easier for us all to understand
the language, and for developers to build simplifying abstractions into
their tools. Having element names that do not align in the sc schema
and the definitions schema certainly forces more work into developing
the OVAL Interpreter.


Jon

============================================
Jonathan O. Baker
The MITRE Corporation
Email: bakerj@...



>-----Original Message-----
>From: Buttner, Drew [mailto:abuttner@...]
>Sent: Monday, July 07, 2008 7:50 AM
>To: oval-developer-list OVAL Developer List/Closed Public Discussion
>Subject: Re: [OVAL-DEVELOPER-LIST] Textfilecontent54 test without
>parentheses for subexpression
>
>>Additionally, the test is called textfilecontent54_test but the item
>in
>>SC is called textfilecontent_item - lacking the 54 designation and
>>providing opportunities for confusion.
>>I think the different entities of textfilecontent54 should not be
>added
>>to the original item and instead there should be a new
>>textfilecontent54_.
>
>It would be great to hear other opinions on this.  We did not create a
>new item in the SC schema on purpose here.  The thinking is that since
>SC entities are optional, we don't need to create an entirely new
item.
>This keeps the SC schema from being cluttered by deprecated items.
All
>the textfilecontent tests would use the same item.
>
>Does this make sense?  Would the community rather an strict 1:1
mapping
>here?
>
>Thanks
>Drew
>
>To unsubscribe, send an email message to LISTSERV@... with
>SIGNOFF OVAL-DEVELOPER-LIST
>in the BODY of the message.  If you have difficulties, write to OVAL-
>DEVELOPER-LIST-request@....

To unsubscribe, send an email message to LISTSERV@... with
SIGNOFF OVAL-DEVELOPER-LIST
in the BODY of the message.  If you have difficulties, write to OVAL-DEVELOPER-LIST-request@....
Martin Thomas
Re: Textfilecontent54 test without parentheses for subexpression
Reply Threaded More
Print post
Permalink
I wrote a script to cross-check syschar schema against definitions
schema and found that there is good consistency.  Whenever an object has
been deprecated and replaced with an enhanced version, the new elements
have been added to the original item.. eg fileeffectiverights53_object
superseded fileeffectiverights_object and trustee_sid was added to
fileeffectiverights_item without removing the original trustee_name.  

This is the same way that texfilecontent and texfilecontent54 have been
handled and, given the bigger picture, this makes more sense and removes
my concern that there should be a texfilecontent54_item.

The only concern I have is that it is possible to write an item into
syschar that is schema valid but incorrect. Taking the example of the
fileeffectiverights, it is valid to include both a trustee_name and a
trustee_sid in the item but only one should be there depending on the
probe used. Perhaps the use of xsd:choice could limit the potential for
confusion?

One small inconsistency I noticed is that there an object and state
called inetlisteningservers but the item is called inetlisteningserver.

Regards // Martin


>-----Original Message-----
>From: Baker, Jon [mailto:bakerj@...]
>Sent: Monday, July 07, 2008 7:24 PM
>To: OVAL-DEVELOPER-LIST@...
>Subject: Re: [OVAL-DEVELOPER-LIST] Textfilecontent54 test without
>parentheses for subexpression
>
>I would prefer consistency in how objects, states, and items relate to
>each other. For the most part we are very consistent and we should
>strive to be. This consistency makes it easier for us all to understand
>the language, and for developers to build simplifying abstractions into
>their tools. Having element names that do not align in the sc schema
>and the definitions schema certainly forces more work into developing
>the OVAL Interpreter.
>
>
>Jon
>
>============================================
>Jonathan O. Baker
>The MITRE Corporation
>Email: bakerj@...
>
>
>
>>-----Original Message-----
>>From: Buttner, Drew [mailto:abuttner@...]
>>Sent: Monday, July 07, 2008 7:50 AM
>>To: oval-developer-list OVAL Developer List/Closed Public Discussion
>>Subject: Re: [OVAL-DEVELOPER-LIST] Textfilecontent54 test without
>>parentheses for subexpression
>>
>>>Additionally, the test is called textfilecontent54_test but the item
>>in
>>>SC is called textfilecontent_item - lacking the 54 designation and
>>>providing opportunities for confusion.
>>>I think the different entities of textfilecontent54 should not be
>>added
>>>to the original item and instead there should be a new
>>>textfilecontent54_.
>>
>>It would be great to hear other opinions on this.  We did not create a
>>new item in the SC schema on purpose here.  The thinking is that since
>>SC entities are optional, we don't need to create an entirely new
>item.
>>This keeps the SC schema from being cluttered by deprecated items.
>All
>>the textfilecontent tests would use the same item.
>>
>>Does this make sense?  Would the community rather an strict 1:1
>mapping
>>here?
>>
>>Thanks
>>Drew
>>
>>To unsubscribe, send an email message to LISTSERV@... with
>>SIGNOFF OVAL-DEVELOPER-LIST
>>in the BODY of the message.  If you have difficulties, write to OVAL-
>>DEVELOPER-LIST-request@....
>
>To unsubscribe, send an email message to LISTSERV@... with
>SIGNOFF OVAL-DEVELOPER-LIST
>in the BODY of the message.  If you have difficulties, write to OVAL-
>DEVELOPER-LIST-request@....

To unsubscribe, send an email message to LISTSERV@... with
SIGNOFF OVAL-DEVELOPER-LIST
in the BODY of the message.  If you have difficulties, write to OVAL-DEVELOPER-LIST-request@....
bakerj
Re: Textfilecontent54 test without parentheses for subexpression
Reply Threaded More
Print post
Permalink
>-----Original Message-----
>From: Martin_Thomas@... [mailto:Martin_Thomas@...]
>Sent: Tuesday, July 08, 2008 11:53 AM
>To: oval-developer-list OVAL Developer List/Closed Public Discussion
>Subject: Re: [OVAL-DEVELOPER-LIST] Textfilecontent54 test without
>parentheses for subexpression
>
>I wrote a script to cross-check syschar schema against definitions
>schema and found that there is good consistency.  Whenever an object
has
>been deprecated and replaced with an enhanced version, the new
elements
>have been added to the original item.. eg fileeffectiverights53_object
>superseded fileeffectiverights_object and trustee_sid was added to
>fileeffectiverights_item without removing the original trustee_name.
>
>This is the same way that texfilecontent and texfilecontent54 have
been
>handled and, given the bigger picture, this makes more sense and
removes
>my concern that there should be a texfilecontent54_item.
>
>The only concern I have is that it is possible to write an item into
>syschar that is schema valid but incorrect. Taking the example of the
>fileeffectiverights, it is valid to include both a trustee_name and a
>trustee_sid in the item but only one should be there depending on the
>probe used. Perhaps the use of xsd:choice could limit the potential
for
>confusion?
>

Since the data in sc items is all optional it don't see any harm in
allowing it all to be included. Some of the data may just not be used
by a given revision of a test.

>One small inconsistency I noticed is that there an object and state
>called inetlisteningservers but the item is called
inetlisteningserver.
>

This is an issue that we will add to our tracker. I don't think it
warrants a new test, but should be fixed in the next major version.

Thanks,

jon

To unsubscribe, send an email message to LISTSERV@... with
SIGNOFF OVAL-DEVELOPER-LIST
in the BODY of the message.  If you have difficulties, write to OVAL-DEVELOPER-LIST-request@....