Draft
Conversation
Contributor
|
Ping @floydtree @mikeradka @pagbabian-splunk Now that 1.8.0 is released, it's a good time to think about these fixes. Beyond actual bugs, these fixes should only affect attribute caption and description properties in the actual compiled schema. |
Signed-off-by: Rajas Panat <rajaspa@amazon.com>
Temporary changes to help diffs against new compiler: - Fix processing to base_event is fully processed. - Sort attribute profiles. - Remove reverse merging from extension classes and object to dictionary. - Clarify json_reader variable names a bit.
…extension_id to dictionary types from extensions.
…Elixir/Erlang processes while itereating
…no longer needed TODO fixed comments.
ad9e320 to
fedf6c6
Compare
…ofiles": null properties are incorrectly filtered out with an empty profiles set / empty query paramter. Sort attributes and requirements in JSON Schema output to make diffs easier.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
These bugs were found while rewriting the schema compilation in Python. These bugs are fixed in the new compiler, as well as in the upcoming v4 server PR (#168). Given that we want to continue using the existing v3 server to host schema version 1.7.0 and earlier, we need a branch to use for this case.
The
v3branch will be used for ongoing third-party dependency updates, and can be used for occasional bug fixes and even feature updates./export/schemaAPI output JSON object's"base_event"value was not fully processed, causing the this copy ofbase_eventto have missing profiles in its"profiles"key./export/schemaAPI is called without aprofilesquery parameter, the output JSON object's "base_event" was stripping attribute's affected by profiles, inconsistent with the classes in the "classes" key, includingbase_event. Normally this behavior only occurs with an empty profiles query parameter like&profilesor&profiles=."profiles"in classes and objects. This makes JSON diffs between schemas more consistent but otherwise has no effect."caption"and"description"properties."_links"property built up during the schema compile, and did not capture everything. These gaps can be seen in the current schema browser. These gaps affect objects but not classes, and so are mostly a schema browsing issue, and does not affect event validation. These are the gaps in the 1.6.0 schema:a.
actorobject is missingdata_classification, used inactor.process.file.b.
affected_packageis missingdata_classification, used inaffected_package.remediation.kb_article_list.product.c.
applicationis missingdata_classification, used inapplication.sbom.product.d.
cis_benchmark_resultis missingdata_classification, used incis_benchmark_result.remediation.kb_article_list.product.e.
complianceis missingdata_classification, used incompliance.compliance_references.productandcompliance.compliance_standards.product.f.
idpis missingcontainer, used inidp.auth_factors.device.g.
metadatais missingcontainer, used inmetadata.loggers.device.h.
remediationis missingdata_classification, used inremediation.kb_article_list.product.i.
startup_itemis missingdata_classification, used instartup_item.process.file.j.
vulnerabilityis missingdata_classification, used invulnerability.kb_article_list.product."extension"and"extension_id"to dictionary data types from extensions. This isn't used but was done for consistency and possibly visualization later."type_name"properly for class and object attribute with refined types."profiles": nullproperties are incorrectly filtered out with an empty profiles set / empty query parameter.3.2.0.