Skip to content

Bug fixes for v3#169

Draft
rmouritzen-splunk wants to merge 19 commits intoocsf:v3from
rmouritzen-splunk:v3
Draft

Bug fixes for v3#169
rmouritzen-splunk wants to merge 19 commits intoocsf:v3from
rmouritzen-splunk:v3

Conversation

@rmouritzen-splunk
Copy link
Copy Markdown
Contributor

@rmouritzen-splunk rmouritzen-splunk commented Nov 10, 2025

These bugs were found while rewriting the schema compilation in Python. These bugs are fixed in the new compiler, as well as in the upcoming v4 server PR (#168). Given that we want to continue using the existing v3 server to host schema version 1.7.0 and earlier, we need a branch to use for this case.

The v3 branch will be used for ongoing third-party dependency updates, and can be used for occasional bug fixes and even feature updates.

  1. The /export/schema API output JSON object's "base_event" value was not fully processed, causing the this copy of base_event to have missing profiles in its "profiles" key.
  2. When the /export/schema API is called without a profiles query parameter, the output JSON object's "base_event" was stripping attribute's affected by profiles, inconsistent with the classes in the "classes" key, including base_event. Normally this behavior only occurs with an empty profiles query parameter like &profiles or &profiles=.
  3. Sort "profiles" in classes and objects. This makes JSON diffs between schemas more consistent but otherwise has no effect.
  4. Remove reverse merging from extension classes and objects to dictionary. It's not clear why this code existed. This only affects some attribute "caption" and "description" properties.
  5. Clarify json_reader variable names a bit.
  6. Fix the consolidation / roll-up of profiles in objects and classes. The new approach is recursive, while the old method leveraged the relationship "_links" property built up during the schema compile, and did not capture everything. These gaps can be seen in the current schema browser. These gaps affect objects but not classes, and so are mostly a schema browsing issue, and does not affect event validation. These are the gaps in the 1.6.0 schema:
    a. actor object is missing data_classification, used in actor.process.file.
    b. affected_package is missing data_classification, used in affected_package.remediation.kb_article_list.product.
    c. application is missing data_classification, used in application.sbom.product.
    d. cis_benchmark_result is missing data_classification, used in cis_benchmark_result.remediation.kb_article_list.product.
    e. compliance is missing data_classification, used in compliance.compliance_references.product and compliance.compliance_standards.product.
    f. idp is missing container, used in idp.auth_factors.device.
    g. metadata is missing container, used in metadata.loggers.device.
    h. remediation is missing data_classification, used in remediation.kb_article_list.product.
    i. startup_item is missing data_classification, used in startup_item.process.file.
    j. vulnerability is missing data_classification, used in vulnerability.kb_article_list.product.
  7. Add "extension" and "extension_id" to dictionary data types from extensions. This isn't used but was done for consistency and possibly visualization later.
  8. Fix attribute source on the class and object pages.
  9. Improve page building performance by avoiding repeated transfers of data between Elixir/Erlang processes while iterating.
  10. Set "type_name" properly for class and object attribute with refined types.
  11. Update dependencies.
  12. Add space between category unique ID and extension on category page.
  13. Consistently capitalize "Object" on object page.
  14. Honor show deprecated items checkbox on category page.
  15. Fix profiles filtering bug where class and object attributes with "profiles": null properties are incorrectly filtered out with an empty profiles set / empty query parameter.
  16. Sort attributes and requirements in JSON Schema output to make diffs easier.
  17. Bump version to 3.2.0.

@rmouritzen-splunk rmouritzen-splunk changed the title V3 Bug fixes Nov 10, 2025
@rmouritzen-splunk rmouritzen-splunk marked this pull request as ready for review November 11, 2025 00:55
@rickmode
Copy link
Copy Markdown
Contributor

Ping @floydtree @mikeradka @pagbabian-splunk

Now that 1.8.0 is released, it's a good time to think about these fixes.

Beyond actual bugs, these fixes should only affect attribute caption and description properties in the actual compiled schema.

…ofiles": null properties are incorrectly filtered out with an empty profiles set / empty query paramter. Sort attributes and requirements in JSON Schema output to make diffs easier.
@rmouritzen-splunk rmouritzen-splunk changed the title Bug fixes Bug fixes for v3 Mar 4, 2026
@rmouritzen-splunk rmouritzen-splunk marked this pull request as draft April 23, 2026 18:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants