From 9744dc866c719d844b6476f384f3c16034885d4d Mon Sep 17 00:00:00 2001
From: galtm <40716346+galtm@users.noreply.github.com>
Date: Fri, 22 Sep 2023 07:56:23 -0400
Subject: [PATCH 1/2] XSpec tests and minor XSLT improvements
XSpec tests:
- XSpec tests for produce-xml-converter.xsl in isolation
- Stub of tests for produce-xml-converter.xsl from the
context of produce-json-converter.xsl
- Helper XSLT for use in XSpec tests
- Sample definition maps to provide testing contexts
XSLT improvements:
- Declare data types where known
- Declare context item for named templates
- Start XPath path from context instead of root, for testability
---
.../assessment-plan-reduce-map-output.xml | 16671 ++++++++++++++++
.../profile-reduce-map-output.xml | 7009 +++++++
.../computer-build-xml-converter.xsl | 12 +
.../produce-xml-converter-json-usage.xspec | 84 +
.../xml-to-json/produce-xml-converter.xspec | 1566 ++
.../xml-to-json/test-helper-xml-to-json.xsl | 37 +
.../xml-to-json/produce-xml-converter.xsl | 219 +-
7 files changed, 25503 insertions(+), 95 deletions(-)
create mode 100644 src/converter-gen/testing/definition-maps/assessment-plan-reduce-map-output.xml
create mode 100644 src/converter-gen/testing/definition-maps/profile-reduce-map-output.xml
create mode 100644 src/converter-gen/testing/xml-converters/computer-build-xml-converter.xsl
create mode 100644 src/converter-gen/testing/xml-to-json/produce-xml-converter-json-usage.xspec
create mode 100644 src/converter-gen/testing/xml-to-json/test-helper-xml-to-json.xsl
diff --git a/src/converter-gen/testing/definition-maps/assessment-plan-reduce-map-output.xml b/src/converter-gen/testing/definition-maps/assessment-plan-reduce-map-output.xml
new file mode 100644
index 00000000..2d9925bb
--- /dev/null
+++ b/src/converter-gen/testing/definition-maps/assessment-plan-reduce-map-output.xml
@@ -0,0 +1,16671 @@
+
+
+
+ OSCAL Assessment Plan Model
+ 1.0.4
+ oscal-ap
+ http://csrc.nist.gov/ns/oscal/1.0
+ http://csrc.nist.gov/ns/oscal
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ The link identifies the authoritative location for this file. Defined by RFC 6596.
+ The link identifies an alternative location or format for this file. Defined by the HTML Living Standard
+
+ This link identifies a resource containing the predecessor version in the version history. Defined by RFC 5829.
+ This link identifies a resource containing the predecessor version in the version history. Defined by RFC 5829.
+
+
+
+
+
+
+
+
+
+ A Digital Object Identifier (DOI); use is preferred, since this allows for retrieval of a full bibliographic record.
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A home address.
+ A work address.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A home phone number.
+ An office phone number.
+ A mobile phone number.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Characterizes the kind of location.
+
+
+ A location that contains computing assets. A class can be used to indicate the sub-type of data-center as primary or alternate.
+
+
+ The location is a data-center used for normal operations.
+ The location is a data-center used for fail-over or backup operations.
+
+
+
+
+
+
+
+
+
+
+ An individual.
+ A group of individuals formed for a specific purpose.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ The identifier is Open Researcher and Contributor ID (ORCID).
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A home phone number.
+ An office phone number.
+ A mobile phone number.
+
+
+
+
+
+
+
+
+
+
+
+
+ A home address.
+ A work address.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A mail stop associated with the party.
+ The name or number of the party's office.
+ The formal job title of a person.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Indicates the organization that created this content.
+ Indicates the organization that prepared this content.
+ Indicates the organization for which this content was created.
+ Indicates the organization responsible for all content represented in the "document".
+ Indicates the organization to contact for questions or support related to this content.
+
+
+ The value identifies a comma-seperated listing of keywords associated with this content. These keywords may be used as search terms for indexing and other applications.
+
+
+ The link identifies the authoritative location for this file. Defined by RFC 6596.
+ The link identifies an alternative location or format for this file. Defined by the HTML Living Standard
+
+ This link identifies a resource containing the latest version in the version history. Defined by RFC 5829.
+ This link identifies a resource containing the predecessor version in the version history. Defined by RFC 5829.
+ This link identifies a resource containing the predecessor version in the version history. Defined by RFC 5829.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ The system as a whole.
+ An external system, which may be a leveraged system or the other side of an interconnection.
+ A connection to something outside this system.
+ Any software, operating system, or firmware.
+ A physical device.
+ A service that may provide APIs.
+ An enforceable policy.
+ A tangible asset used to provide physical protections or countermeasures.
+ A list of steps or actions to take to achieve some end result.
+ An applicable plan.
+ Any guideline or recommendation.
+ Any organizational or industry standard.
+ An external assessment performed on some other component, that has been validated by a third-party.
+ A physical or virtual network.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ The component is being designed, developed, or implemented.
+ The component is currently operational and is available for use in the system.
+ The component is no longer operational.
+ Some other state.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Transmission Control Protocol
+ User Datagram Protocol
+
+
+
+
+
+
+
+ It is a best practice to provide a UUID.
+
+
+
+
+
+
+
+
+
+ Relative placement of component ('internal' or 'external') to the system.
+ UUID of the related leveraged-authorization assembly in this SSP.
+ UUID of the component as it was assigned in the leveraged system's SSP.
+ Simple indication of the asset's function, such as Router, Storage Array, DNS Server.
+ An organizationally specific identifier that is used to uniquely identify a logical or tangible item by the organization that owns the item.
+ An asset tag assigned by the organization responsible for maintaining the logical or tangible item.
+ Identifies whether the asset is publicly accessible (yes/no)
+ Identifies whether the asset is virtualized (yes/no)
+ Virtual LAN identifier of the asset.
+ The network identifier of the asset.
+ A human-readable label for the parent context.
+ An alternative identifier, whose value is easily sortable among other such values in the document.
+ The name of the baseline configuration for the asset.
+ Can the asset be check with an authenticated scan? (yes/no)
+ The function provided by the asset for the system.
+ The version of the component.
+ The specific patch level of the component.
+ The model of the component.
+ The date the component was released, such as a software release date or policy publication date.
+ Used with component-type='validation' to provide a well-known name for a kind of validation.
+ Used with component-type='validation' to indicate the validating body's assigned identifier for their validation of this component.
+
+
+ A reference to another component that this component has a dependency on.
+ A reference to another component of component-type=validation, that is a validation (e.g., FIPS 140-2) for this component
+ A pointer to a validation record (e.g., FIPS 140-2) or other compliance information.
+ A reference to the baseline template used to configure the asset.
+ This service is used by the referenced component identifier.
+ A link to the system security plan of the external system.
+ This component uses the network provided by the identified network component.
+
+
+ Accountable for ensuring the asset is managed in accordance with organizational policies and procedures.
+ Responsible for administering a set of assets.
+ Members of the security operations center (SOC).
+ Members of the network operations center (NOC).
+ Responsible for responding to an event that could lead to loss of, or disruption to, an organization's operations, services or functions.
+ Responsible for providing information and support to users.
+ Responsible for the configuration management processes governing changes to the asset.
+ Responsible for the creation and maintenance of a component.
+ Organization responsible for providing the component, if this is different from the "maintainer" (e.g., a reseller).
+
+
+ System software that manages computer hardware, software resources, and provides common services for computer programs.
+ An electronic collection of data, or information, that is specially organized for rapid search and retrieval.
+ A system that delivers content or services to end users over the Internet or an intranet.
+ A system that resolves domain names to internet protocol (IP) addresses.
+ A computer system that sends and receives electronic mail messages.
+ A system that stores, organizes and provides access to directory information in order to unify network resources.
+ A private branch exchange (PBX) provides a a private telephone switchboard.
+ A network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules.
+ A physical or virtual networking device that forwards data packets between computer networks.
+ A physical or virtual networking device that connects devices within a computer network by using packet switching to receive and forward data to the destination device.
+ A consolidated, block-level data storage capability.
+ A physical or virtual machine that centralizes hardware, software, or services for a specific purpose.
+
+
+ The component allows an authenticated scan.
+ The component does not allow an authenticated scan.
+
+
+ The component is publicly accessible.
+ The component is not publicly accessible.
+
+
+ The component is virtualized.
+ The component is not virtualized.
+
+
+ The component is implemented within the system boundary.
+ The component is implemented outside the system boundary.
+
+
+
+
+
+
+
+ The name of the company or organization
+
+
+ A link to an online information provided by the authorizing body.
+
+
+ If a "software" component-type, the identifier, such as a SWID tag, for the software component.
+
+
+ This service is provided by the referenced component identifier.
+ This service is used by the referenced component identifier.
+
+
+
+ Title of the Interconnection Security Agreement (ISA).
+ Date of the Interconnection Security Agreement (ISA).
+ The name of the remote interconnected system.
+ An Internet Protocol Version 4 interconnection address
+ An Internet Protocol Version 6 interconnection address
+ An Internet Protocol Version 6 interconnection address
+
+
+ The identified IP address is for this system.
+ The identified IP address is for the remote system to which this system is connected.
+
+
+ A link to the system interconnection agreement.
+
+
+ Interconnection Security Agreement (ISA) point of contact (POC) for this system.
+ Interconnection Security Agreement (ISA) point of contact (POC) for the remote interconnected system.
+ Interconnection Security Agreement (ISA) authorizing official for this system.
+ Interconnection Security Agreement (ISA) authorizing official for the remote interconnected system.
+
+
+
+
+
+ Data from the remote system flows into this system.
+ Data from this system flows to the remote system.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ The version of the component.
+ The specific patch level of the component.
+ The model of the component.
+ The date the component was released, such as a software release date or policy publication date.
+ Used with component-type='validation' to provide a well-known name for a kind of validation.
+ Used with component-type='validation' to indicate the validating body's assigned identifier for their validation of this component.
+ Simple indication of the asset's function, such as Router, Storage Array, DNS Server.
+ An organizationally specific identifier that is used to uniquely identify a logical or tangible item by the organization that owns the item.
+ An asset tag assigned by the organization responsible for maintaining the logical or tangible item.
+ Identifies whether the asset is publicly accessible (yes/no)
+ Identifies whether the asset is virtualized (yes/no)
+ Virtual LAN identifier of the asset.
+ The network identifier of the asset.
+ A human-readable label for the parent context.
+ An alternative identifier, whose value is easily sortable among other such values in the document.
+ The name of the baseline configuration for the asset.
+ Can the asset be check with an authenticated scan? (yes/no)
+ The function provided by the asset for the system.
+
+
+
+ Accountable for ensuring the asset is managed in accordance with organizational policies and procedures.
+ Responsible for administering a set of assets.
+ Members of the security operations center (SOC).
+ Members of the network operations center (NOC).
+ Responsible for responding to an event that could lead to loss of, or disruption to, an organization's operations, services or functions.
+ Responsible for providing information and support to users.
+ Responsible for the configuration management processes governing changes to the asset.
+
+
+
+
+
+
+
+
+
+
+
+
+ The Internet Protocol v4 Address of the asset.
+ The Internet Protocol v6 Address of the asset.
+ The full-qualified domain name (FQDN) of the asset.
+ A Uniform Resource Identifier (URI) for the asset.
+ A serial number for the asset.
+ The NetBIOS name for the asset.
+ The media access control (MAC) address for the asset.
+ The physical location of the asset's hardware (e.g., Data Center ID, Cage#, Rack#, or other meaningful location identifiers).
+ is the asset subjected to network scans? (yes/no)
+ The model number of the hardware used by the asset.
+ The name of the operating system used by the asset.
+ The version of the operating system used by the asset.
+ The software product name used by the asset.
+ The software product version used by the asset.
+ The software product patch level used by the asset.
+ Simple indication of the asset's function, such as Router, Storage Array, DNS Server.
+ An organizationally specific identifier that is used to uniquely identify a logical or tangible item by the organization that owns the item.
+ An asset tag assigned by the organization responsible for maintaining the logical or tangible item.
+ Identifies whether the asset is publicly accessible (yes/no)
+ Identifies whether the asset is virtualized (yes/no)
+ Virtual LAN identifier of the asset.
+ The network identifier of the asset.
+ A human-readable label for the parent context.
+ An alternative identifier, whose value is easily sortable among other such values in the document.
+ The name of the baseline configuration for the asset.
+ Can the asset be check with an authenticated scan? (yes/no)
+ The function provided by the asset for the system.
+
+
+ System software that manages computer hardware, software resources, and provides common services for computer programs.
+ An electronic collection of data, or information, that is specially organized for rapid search and retrieval.
+ A system that delivers content or services to end users over the Internet or an intranet.
+ A system that resolves domain names to internet protocol (IP) addresses.
+ A computer system that sends and receives electronic mail messages.
+ A system that stores, organizes and provides access to directory information in order to unify network resources.
+ A private branch exchange (PBX) provides a a private telephone switchboard.
+ A network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules.
+ A physical or virtual networking device that forwards data packets between computer networks.
+ A physical or virtual networking device that connects devices within a computer network by using packet switching to receive and forward data to the destination device.
+ A consolidated, block-level data storage capability.
+ A physical or virtual machine that centralizes hardware, software, or services for a specific purpose.
+
+
+ The name of the company or organization
+
+
+ The asset is included in periodic vulnerability scanning.
+ The asset is not included in periodic vulnerability scanning.
+
+
+ A reference to the baseline template used to configure the asset.
+
+
+ Accountable for ensuring the asset is managed in accordance with organizational policies and procedures.
+ Responsible for administering a set of assets.
+ Members of the security operations center (SOC).
+ Members of the network operations center (NOC).
+ Responsible for responding to an event that could lead to loss of, or disruption to, an organization's operations, services or functions.
+ Responsible for providing information and support to users.
+ Responsible for the configuration management processes governing changes to the asset.
+ Responsible for the creation and maintenance of a component.
+ Organization responsible for providing the component, if this is different from the "maintainer" (e.g., a reseller).
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ The type of user, such as internal, external, or general-public.
+ The user's privilege level within the system, such as privileged, non-privileged, no-logical-access.
+
+
+ A user account for a person or entity that is part of the organization who owns or operates the system.
+ A user account for a person or entity that is not part of the organization who owns or operates the system.
+ A user of the system considered to be outside
+
+
+ This role has elevated access to the system, such as a group or system administrator.
+ This role has typical user-level access to the system without elevated access.
+ This role has no access to the system, such as a manager who approves access as part of a process.
+
+
+ Accountable for ensuring the asset is managed in accordance with organizational policies and procedures.
+ Responsible for administering a set of assets.
+ Members of the security operations center (SOC).
+ Members of the network operations center (NOC).
+ Responsible for responding to an event that could lead to loss of, or disruption to, an organization's operations, services or functions.
+ Responsible for providing information and support to users.
+ Responsible for the configuration management processes governing changes to the asset.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A human-readable label for the parent context, which may be rendered in place of the actual identifier for some use cases.
+ An alternative identifier, whose value is easily sortable among other such values in the document.
+ An alternate or aliased identifier for the parent context.
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A human-readable label for the parent context, which may be rendered in place of the actual identifier for some use cases.
+ An alternative identifier, whose value is easily sortable among other such values in the document.
+ An alternate or aliased identifier for the parent context.
+
+
+
+
+
+
+
+
+
+ **(deprecated)** Use 'assessment-objective' instead.
+ **(deprecated)** Use 'assessment-method' instead.
+ The part defines an assessment objective.
+ The part defines an assessment method.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ The assessment method to use. This typically appears on parts with the name "assessment".
+
+
+
+ The process of holding discussions with individuals or groups of individuals within an organization to once again, facilitate assessor understanding, achieve clarification, or obtain evidence.
+ The process of reviewing, inspecting, observing, studying, or analyzing one or more assessment objects (i.e., specifications, mechanisms, or activities).
+ The process of exercising one or more assessment objects (i.e., activities or mechanisms) under specified conditions to compare actual with expected behavior.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ An assessment asset.
+ An assessment method.
+ Describes a set of control objectives.
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ The assessment method to use. This typically appears on parts with the name "objective".
+
+
+
+ The process of holding discussions with individuals or groups of individuals within an organization to once again, facilitate assessor understanding, achieve clarification, or obtain evidence.
+ The process of reviewing, inspecting, observing, studying, or analyzing one or more assessment objects (i.e., specifications, mechanisms, or activities).
+ The process of exercising one or more assessment objects (i.e., activities or mechanisms) under specified conditions to compare actual with expected behavior.
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ The assessment method to use. This typically appears on parts with the name "objective".
+
+
+
+ The process of holding discussions with individuals or groups of individuals within an organization to once again, facilitate assessor understanding, achieve clarification, or obtain evidence.
+ The process of reviewing, inspecting, observing, studying, or analyzing one or more assessment objects (i.e., specifications, mechanisms, or activities).
+ The process of exercising one or more assessment objects (i.e., activities or mechanisms) under specified conditions to compare actual with expected behavior.
+
+
+
+
+
+
+ Defines the circumstances, conditions, degree, and manner in which the use of cyber-attack techniques or actions may be applied to the assessment.
+ Any information the assessor should make known to the system owner or authorizing official. Has child 'item' parts for each individual disclosure.
+ Defines any assessment activities which the system owner or authorizing official wishes to ensure are performed as part of the assessment.
+ Defines any assessment activities which the system owner or authorizing official explicitly prohibits from being performed as part of the assessment.
+ Defines conditions related to the delivery of the assessment results, such as when to deliver, how, and to whom.
+ Defines any supposition made by the assessor. Has child 'item' parts for each assumption.
+ An explanation of practices, procedures, and rules used in the course of the assessment.
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ The referenced assessment subject is a component defined in the SSP, or in the local-definitions of an Assessment Plan or Assessment Results.
+ The referenced assessment subject is a inventory item defined in the SSP, or in the local-definitions of an Assessment Plan or Assessment Results.
+ The referenced assessment subject is a location defined in the metadata of the SSP, Assessment Plan, or Assessment Results.
+ The referenced assessment subject is a person or team to interview, who is defined as a party in the metadata of the SSP, Assessment Plan, or Assessment Results.
+ The referenced assessment subject is a user defined in the SSP, or in the local-definitions of an Assessment Plan or Assessment Results.
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Component
+ Inventory Item
+ Location
+ Interview Party
+ User
+ Resource or Artifact
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Component
+ Inventory Item
+ Location
+ Interview Party
+ User
+ Resource or Artifact
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ The system as a whole.
+ An external system, which may be a leveraged system or the other side of an interconnection.
+ A connection to something outside this system.
+ Any software, operating system, or firmware.
+ A physical device.
+ A service that may provide APIs.
+ An enforceable policy.
+ A tangible asset used to provide physical protections or countermeasures.
+ A list of steps or actions to take to achieve some end result.
+ An applicable plan.
+ Any guideline or recommendation.
+ Any organizational or industry standard.
+ An external assessment performed on some other component, that has been validated by a third-party.
+ A physical or virtual network.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ The component is being designed, developed, or implemented.
+ The component is currently operational and is available for use in the system.
+ The component is no longer operational.
+ Some other state.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Transmission Control Protocol
+ User Datagram Protocol
+
+
+
+
+
+
+
+ It is a best practice to provide a UUID.
+
+
+
+
+
+
+
+
+
+ Relative placement of component ('internal' or 'external') to the system.
+ UUID of the related leveraged-authorization assembly in this SSP.
+ UUID of the component as it was assigned in the leveraged system's SSP.
+ Simple indication of the asset's function, such as Router, Storage Array, DNS Server.
+ An organizationally specific identifier that is used to uniquely identify a logical or tangible item by the organization that owns the item.
+ An asset tag assigned by the organization responsible for maintaining the logical or tangible item.
+ Identifies whether the asset is publicly accessible (yes/no)
+ Identifies whether the asset is virtualized (yes/no)
+ Virtual LAN identifier of the asset.
+ The network identifier of the asset.
+ A human-readable label for the parent context.
+ An alternative identifier, whose value is easily sortable among other such values in the document.
+ The name of the baseline configuration for the asset.
+ Can the asset be check with an authenticated scan? (yes/no)
+ The function provided by the asset for the system.
+ The version of the component.
+ The specific patch level of the component.
+ The model of the component.
+ The date the component was released, such as a software release date or policy publication date.
+ Used with component-type='validation' to provide a well-known name for a kind of validation.
+ Used with component-type='validation' to indicate the validating body's assigned identifier for their validation of this component.
+
+
+ A reference to another component that this component has a dependency on.
+ A reference to another component of component-type=validation, that is a validation (e.g., FIPS 140-2) for this component
+ A pointer to a validation record (e.g., FIPS 140-2) or other compliance information.
+ A reference to the baseline template used to configure the asset.
+ This service is used by the referenced component identifier.
+ A link to the system security plan of the external system.
+ This component uses the network provided by the identified network component.
+
+
+ Accountable for ensuring the asset is managed in accordance with organizational policies and procedures.
+ Responsible for administering a set of assets.
+ Members of the security operations center (SOC).
+ Members of the network operations center (NOC).
+ Responsible for responding to an event that could lead to loss of, or disruption to, an organization's operations, services or functions.
+ Responsible for providing information and support to users.
+ Responsible for the configuration management processes governing changes to the asset.
+ Responsible for the creation and maintenance of a component.
+ Organization responsible for providing the component, if this is different from the "maintainer" (e.g., a reseller).
+
+
+ System software that manages computer hardware, software resources, and provides common services for computer programs.
+ An electronic collection of data, or information, that is specially organized for rapid search and retrieval.
+ A system that delivers content or services to end users over the Internet or an intranet.
+ A system that resolves domain names to internet protocol (IP) addresses.
+ A computer system that sends and receives electronic mail messages.
+ A system that stores, organizes and provides access to directory information in order to unify network resources.
+ A private branch exchange (PBX) provides a a private telephone switchboard.
+ A network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules.
+ A physical or virtual networking device that forwards data packets between computer networks.
+ A physical or virtual networking device that connects devices within a computer network by using packet switching to receive and forward data to the destination device.
+ A consolidated, block-level data storage capability.
+ A physical or virtual machine that centralizes hardware, software, or services for a specific purpose.
+
+
+ The component allows an authenticated scan.
+ The component does not allow an authenticated scan.
+
+
+ The component is publicly accessible.
+ The component is not publicly accessible.
+
+
+ The component is virtualized.
+ The component is not virtualized.
+
+
+ The component is implemented within the system boundary.
+ The component is implemented outside the system boundary.
+
+
+
+
+
+
+
+ The name of the company or organization
+
+
+ A link to an online information provided by the authorizing body.
+
+
+ If a "software" component-type, the identifier, such as a SWID tag, for the software component.
+
+
+ This service is provided by the referenced component identifier.
+ This service is used by the referenced component identifier.
+
+
+
+ Title of the Interconnection Security Agreement (ISA).
+ Date of the Interconnection Security Agreement (ISA).
+ The name of the remote interconnected system.
+ An Internet Protocol Version 4 interconnection address
+ An Internet Protocol Version 6 interconnection address
+ An Internet Protocol Version 6 interconnection address
+
+
+ The identified IP address is for this system.
+ The identified IP address is for the remote system to which this system is connected.
+
+
+ A link to the system interconnection agreement.
+
+
+ Interconnection Security Agreement (ISA) point of contact (POC) for this system.
+ Interconnection Security Agreement (ISA) point of contact (POC) for the remote interconnected system.
+ Interconnection Security Agreement (ISA) authorizing official for this system.
+ Interconnection Security Agreement (ISA) authorizing official for the remote interconnected system.
+
+
+
+
+
+ Data from the remote system flows into this system.
+ Data from this system flows to the remote system.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ The task represents a planned milestone.
+ The task represents a specific assessment action to be performed.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ The period is specified in seconds.
+ The period is specified in minutes.
+ The period is specified in hours.
+ The period is specified in days.
+ The period is specified in calendar months.
+ The period is specified in calendar years.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ The referenced assessment subject is a component defined in the SSP, or in the local-definitions of an Assessment Plan or Assessment Results.
+ The referenced assessment subject is a inventory item defined in the SSP, or in the local-definitions of an Assessment Plan or Assessment Results.
+ The referenced assessment subject is a location defined in the metadata of the SSP, Assessment Plan, or Assessment Results.
+ The referenced assessment subject is a person or team to interview, who is defined as a party in the metadata of the SSP, Assessment Plan, or Assessment Results.
+ The referenced assessment subject is a user defined in the SSP, or in the local-definitions of an Assessment Plan or Assessment Results.
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Component
+ Inventory Item
+ Location
+ Interview Party
+ User
+ Resource or Artifact
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Component
+ Inventory Item
+ Location
+ Interview Party
+ User
+ Resource or Artifact
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ The referenced assessment subject is a component defined in the SSP, or in the local-definitions of an Assessment Plan or Assessment Results.
+ The referenced assessment subject is a inventory item defined in the SSP, or in the local-definitions of an Assessment Plan or Assessment Results.
+ The referenced assessment subject is a location defined in the metadata of the SSP, Assessment Plan, or Assessment Results.
+ The referenced assessment subject is a person or team to interview, who is defined as a party in the metadata of the SSP, Assessment Plan, or Assessment Results.
+ The referenced assessment subject is a user defined in the SSP, or in the local-definitions of an Assessment Plan or Assessment Results.
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Component
+ Inventory Item
+ Location
+ Interview Party
+ User
+ Resource or Artifact
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Component
+ Inventory Item
+ Location
+ Interview Party
+ User
+ Resource or Artifact
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A Digital Object Identifier (DOI); use is preferred, since this allows for retrieval of a full bibliographic record.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ The SHA-224 algorithm as defined by NIST FIPS 180-4.
+
+ The SHA-256 algorithm as defined by NIST FIPS 180-4.
+
+ The SHA-384 algorithm as defined by NIST FIPS 180-4.
+
+ The SHA-512 algorithm as defined by NIST FIPS 180-4.
+
+ The SHA3-224 algorithm as defined by NIST FIPS 202.
+
+ The SHA3-256 algorithm as defined by NIST FIPS 202.
+
+ The SHA3-384 algorithm as defined by NIST FIPS 202.
+
+ The SHA3-512 algorithm as defined by NIST FIPS 202.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Identifies the type of resource represented.
+ For resources representing a published document, this represents the version number of that document.
+ For resources representing a published document, this represents the publication date of that document.
+
+
+
+ Indicates the resource is an organization's logo.
+ Indicates the resource represents an image.
+ Indicates the resource represents an image of screen content.
+ Indicates the resource represents an applicable law.
+ Indicates the resource represents an applicable regulation.
+ Indicates the resource represents an applicable standard.
+ Indicates the resource represents applicable guidance.
+ Indicates the resource provides a list of relevant acronyms.
+ Indicates the resource cites relevant information.
+ Indicates the resource is a policy.
+ Indicates the resource is a procedure.
+ Indicates the resource is guidance document related to the subject system of an SSP.
+ Indicates the resource is guidance document a user's guide or administrator's guide.
+ Indicates the resource is guidance document a administrator's guide.
+ Indicates the resource represents rules of behavior content.
+ Indicates the resource represents a plan.
+ Indicates the resource represents an artifact, such as may be reviewed by an assessor.
+ Indicates the resource represents evidence, such as to support an assessment findiing.
+ Indicates the resource represents output from a tool.
+ Indicates the resource represents machine data, which may require a tool or analysis for interpretation or presentation.
+ Indicates the resource represents notes from an interview, such as may be collected during an assessment.
+ Indicates the resource is a set of questions, possibly with responses.
+ Indicates the resource is a report.
+ Indicates the resource is a formal agreement between two or more parties.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/src/converter-gen/testing/definition-maps/profile-reduce-map-output.xml b/src/converter-gen/testing/definition-maps/profile-reduce-map-output.xml
new file mode 100644
index 00000000..93e88da9
--- /dev/null
+++ b/src/converter-gen/testing/definition-maps/profile-reduce-map-output.xml
@@ -0,0 +1,7009 @@
+
+
+
+ OSCAL Profile Model
+ 1.0.4
+ oscal-profile
+ http://csrc.nist.gov/ns/oscal/1.0
+ http://csrc.nist.gov/ns/oscal
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ The link identifies the authoritative location for this file. Defined by RFC 6596.
+ The link identifies an alternative location or format for this file. Defined by the HTML Living Standard
+
+ This link identifies a resource containing the predecessor version in the version history. Defined by RFC 5829.
+ This link identifies a resource containing the predecessor version in the version history. Defined by RFC 5829.
+
+
+
+
+
+
+
+
+
+ A Digital Object Identifier (DOI); use is preferred, since this allows for retrieval of a full bibliographic record.
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A home address.
+ A work address.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A home phone number.
+ An office phone number.
+ A mobile phone number.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Characterizes the kind of location.
+
+
+ A location that contains computing assets. A class can be used to indicate the sub-type of data-center as primary or alternate.
+
+
+ The location is a data-center used for normal operations.
+ The location is a data-center used for fail-over or backup operations.
+
+
+
+
+
+
+
+
+
+
+ An individual.
+ A group of individuals formed for a specific purpose.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ The identifier is Open Researcher and Contributor ID (ORCID).
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A home phone number.
+ An office phone number.
+ A mobile phone number.
+
+
+
+
+
+
+
+
+
+
+
+
+ A home address.
+ A work address.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A mail stop associated with the party.
+ The name or number of the party's office.
+ The formal job title of a person.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Indicates the organization that created this content.
+ Indicates the organization that prepared this content.
+ Indicates the organization for which this content was created.
+ Indicates the organization responsible for all content represented in the "document".
+ Indicates the organization to contact for questions or support related to this content.
+
+
+ The value identifies a comma-seperated listing of keywords associated with this content. These keywords may be used as search terms for indexing and other applications.
+
+
+ The link identifies the authoritative location for this file. Defined by RFC 6596.
+ The link identifies an alternative location or format for this file. Defined by the HTML Living Standard
+
+ This link identifies a resource containing the latest version in the version history. Defined by RFC 5829.
+ This link identifies a resource containing the predecessor version in the version history. Defined by RFC 5829.
+ This link identifies a resource containing the predecessor version in the version history. Defined by RFC 5829.
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Include child controls with an included control.
+ When importing a control, only include child controls that are also explicitly called.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Include child controls with an included control.
+ When importing a control, only include child controls that are also explicitly called.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Use the first definition - the first control with a given ID is used; subsequent ones are discarded
+ **(deprecated)** **(unspecified)** Merge - controls with the same ID are combined
+ Keep - controls with the same ID are kept, retaining the clash
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Only one value is permitted.
+ One or more values are permitted.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A human-readable label for the parent context, which may be rendered in place of the actual identifier for some use cases.
+ An alternative identifier, whose value is easily sortable among other such values in the document.
+ An alternate or aliased identifier for the parent context.
+ An alternate to the value provided by the parameter's label. This will typically be qualified by a class.
+
+
+ The parent parameter provides an aggregation of 2 or more other parameters, each described by this property.
+
+
+ depends-on is deprecated
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A human-readable label for the parent context, which may be rendered in place of the actual identifier for some use cases.
+ An alternative identifier, whose value is easily sortable among other such values in the document.
+ An alternate or aliased identifier for the parent context.
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A human-readable label for the parent context, which may be rendered in place of the actual identifier for some use cases.
+ An alternative identifier, whose value is easily sortable among other such values in the document.
+ An alternate or aliased identifier for the parent context.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Include child controls with an included control.
+ When importing a control, only include child controls that are also explicitly called.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Include child controls with an included control.
+ When importing a control, only include child controls that are also explicitly called.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Include child controls with an included control.
+ When importing a control, only include child controls that are also explicitly called.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Include child controls with an included control.
+ When importing a control, only include child controls that are also explicitly called.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Only one value is permitted.
+ One or more values are permitted.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Preceding the id-ref target
+ Following the id-ref target
+ Inside the control or id-ref target, at the start
+ Inside the control or id-ref target, at the end
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Only one value is permitted.
+ One or more values are permitted.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A human-readable label for the parent context, which may be rendered in place of the actual identifier for some use cases.
+ An alternative identifier, whose value is easily sortable among other such values in the document.
+ An alternate or aliased identifier for the parent context.
+ An alternate to the value provided by the parameter's label. This will typically be qualified by a class.
+
+
+ The parent parameter provides an aggregation of 2 or more other parameters, each described by this property.
+
+
+ depends-on is deprecated
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A human-readable label for the parent context, which may be rendered in place of the actual identifier for some use cases.
+ An alternative identifier, whose value is easily sortable among other such values in the document.
+ An alternate or aliased identifier for the parent context.
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A human-readable label for the parent context, which may be rendered in place of the actual identifier for some use cases.
+ An alternative identifier, whose value is easily sortable among other such values in the document.
+ An alternate or aliased identifier for the parent context.
+
+
+
+
+
+
+ A human-readable label for the parent context, which may be rendered in place of the actual identifier for some use cases.
+ An alternative identifier, whose value is easily sortable among other such values in the document.
+ An alternate or aliased identifier for the parent context.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A Digital Object Identifier (DOI); use is preferred, since this allows for retrieval of a full bibliographic record.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Reference
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ The SHA-224 algorithm as defined by NIST FIPS 180-4.
+
+ The SHA-256 algorithm as defined by NIST FIPS 180-4.
+
+ The SHA-384 algorithm as defined by NIST FIPS 180-4.
+
+ The SHA-512 algorithm as defined by NIST FIPS 180-4.
+
+ The SHA3-224 algorithm as defined by NIST FIPS 202.
+
+ The SHA3-256 algorithm as defined by NIST FIPS 202.
+
+ The SHA3-384 algorithm as defined by NIST FIPS 202.
+
+ The SHA3-512 algorithm as defined by NIST FIPS 202.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Identifies the type of resource represented.
+ For resources representing a published document, this represents the version number of that document.
+ For resources representing a published document, this represents the publication date of that document.
+
+
+
+ Indicates the resource is an organization's logo.
+ Indicates the resource represents an image.
+ Indicates the resource represents an image of screen content.
+ Indicates the resource represents an applicable law.
+ Indicates the resource represents an applicable regulation.
+ Indicates the resource represents an applicable standard.
+ Indicates the resource represents applicable guidance.
+ Indicates the resource provides a list of relevant acronyms.
+ Indicates the resource cites relevant information.
+ Indicates the resource is a policy.
+ Indicates the resource is a procedure.
+ Indicates the resource is guidance document related to the subject system of an SSP.
+ Indicates the resource is guidance document a user's guide or administrator's guide.
+ Indicates the resource is guidance document a administrator's guide.
+ Indicates the resource represents rules of behavior content.
+ Indicates the resource represents a plan.
+ Indicates the resource represents an artifact, such as may be reviewed by an assessor.
+ Indicates the resource represents evidence, such as to support an assessment findiing.
+ Indicates the resource represents output from a tool.
+ Indicates the resource represents machine data, which may require a tool or analysis for interpretation or presentation.
+ Indicates the resource represents notes from an interview, such as may be collected during an assessment.
+ Indicates the resource is a set of questions, possibly with responses.
+ Indicates the resource is a report.
+ Indicates the resource is a formal agreement between two or more parties.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/src/converter-gen/testing/xml-converters/computer-build-xml-converter.xsl b/src/converter-gen/testing/xml-converters/computer-build-xml-converter.xsl
new file mode 100644
index 00000000..db3565a3
--- /dev/null
+++ b/src/converter-gen/testing/xml-converters/computer-build-xml-converter.xsl
@@ -0,0 +1,12 @@
+
+
+
+
+http://csrc.nist.gov/ns/oscal/1.0
+
diff --git a/src/converter-gen/testing/xml-to-json/produce-xml-converter-json-usage.xspec b/src/converter-gen/testing/xml-to-json/produce-xml-converter-json-usage.xspec
new file mode 100644
index 00000000..28db3324
--- /dev/null
+++ b/src/converter-gen/testing/xml-to-json/produce-xml-converter-json-usage.xspec
@@ -0,0 +1,84 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ stub
+
+
+
+
+
+
+
+
+
+
+
+ stub
+
+
+
+
+
+
+
+
+
+
+
diff --git a/src/converter-gen/testing/xml-to-json/produce-xml-converter.xspec b/src/converter-gen/testing/xml-to-json/produce-xml-converter.xspec
index d679de27..94a1a975 100644
--- a/src/converter-gen/testing/xml-to-json/produce-xml-converter.xspec
+++ b/src/converter-gen/testing/xml-to-json/produce-xml-converter.xspec
@@ -1,14 +1,61 @@
+
+
+
+
+
+
+
+
+ stub
+
+
+
+
+
+
+
+
+
+ stub
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+ ...
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+ ...
+ ...
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+ ...
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+ ...
+ ...
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+ ...
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+ ...
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+ ...
+ ...
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+ ...
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+ ...
+ ...
+ ...
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ http://csrc.nist.gov/ns/oscal/1.0
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ stub
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ remarks
+
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ k
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+
+
+
+
+
+
+
+ ...
+
+
+
+
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+ ...
+ ...
+ ...
+ ...
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+ ...
+ ...
+ ...
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ prop/@uuid
+
+
+
+ profile/@uuid
+
+
+
+
+
+
+
+
+
+
+
+ group/part/@id | group/part//part/@id | add/part/@id | add/part//part/@id
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ link1/@href | link2/@href
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ link/@href
+
+
+
+
+
+
+
+
+ @uuid
+
+
+
+
+
+
+
+
+ prop
+
+
+
+
+
+
+
+ prop
+
+
+
+
+
+
+
+
+
+
+
+
+ group/part | group/part//part | add/part | add/part//part
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ {
+ concat(
+ 'alias/assembly-1only | alias/assembly-1only//assembly-1only | ',
+ 'alias/assembly-1only | alias/assembly-1only//assembly-1only | ',
+ 'EVERYTHING/assembly-1only | EVERYTHING/assembly-1only//assembly-1only | ',
+ '/ASSEMBLY-1ONLY | ASSEMBLY-1ONLY//assembly-1only'
+ )}
+
+
+
+
+
+
+
+
+ metadata/location
+
+
+
+
+
+
+
+
+
+
+ param/value | set-parameter/value | param/value
+
+
+
+
+
+
+
+
+
+
+ profile
+
+
+
+
+
+
+
+ part
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ profile/merge/custom
+
+
+
+
+
+
+
+
+
+
+
+
+ profile//merge/custom
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+
+
+
+
+
+
+
+
+
+ A label or descriptor that...
+
+
+
+
+
+
+
+
+
+
+ ...
+
+
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+
+
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ...
+
+
+ ...
+
+
+ ...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/src/converter-gen/testing/xml-to-json/test-helper-xml-to-json.xsl b/src/converter-gen/testing/xml-to-json/test-helper-xml-to-json.xsl
new file mode 100644
index 00000000..5f91850b
--- /dev/null
+++ b/src/converter-gen/testing/xml-to-json/test-helper-xml-to-json.xsl
@@ -0,0 +1,37 @@
+
+
+
+
+
+ Reached make-xml-pull mode
+
+
+
+
+ Reached make-xml-match mode
+ for any-element
+
+
+
+ Reached make-json-pull mode
+
+
+
+ Reached make-template mode
+
+
+
\ No newline at end of file
diff --git a/src/converter-gen/xml-to-json/produce-xml-converter.xsl b/src/converter-gen/xml-to-json/produce-xml-converter.xsl
index 8ba92f14..18863038 100644
--- a/src/converter-gen/xml-to-json/produce-xml-converter.xsl
+++ b/src/converter-gen/xml-to-json/produce-xml-converter.xsl
@@ -6,7 +6,8 @@
xpath-default-namespace="http://csrc.nist.gov/ns/oscal/metaschema/1.0"
version="3.0"
- xmlns="http://csrc.nist.gov/ns/oscal/metaschema/1.0/supermodel">
+ xmlns="http://csrc.nist.gov/ns/oscal/metaschema/1.0/supermodel"
+ xmlns:sm="http://csrc.nist.gov/ns/oscal/metaschema/1.0/supermodel">
@@ -16,8 +17,8 @@
-
-
+
+
@@ -26,17 +27,12 @@
-
-
-
-
-
-
+
@@ -61,7 +57,8 @@
-
+
@@ -73,7 +70,8 @@
-
+
@@ -84,7 +82,7 @@
-
+
@@ -100,24 +98,25 @@
-
+
{ $source-namespace }
-
+
-
-
+
+
+
-
+
METASCHEMA conversion stylesheet supports XML -> METASCHEMA/SUPERMODEL conversion
-
+
@@ -128,9 +127,10 @@
-
+
+
-
+
@@ -141,28 +141,37 @@
-
+
-
+
-
+
-
+
-
-
-
-
+
+
+
+
+
+
+
-
+
@@ -190,9 +199,9 @@
-
-
+
+
@@ -200,8 +209,9 @@
-
-
+
+
@@ -222,18 +232,23 @@
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
-
-
+
+
@@ -247,8 +262,8 @@
-
-
+
+
@@ -262,39 +277,43 @@
b3/a (when a does not recurse inside b3)-->
-
+
-
-
-
-
-
-
-
-
-
- |
-
-
+
+
+
+
+
+
+
+
+
+
+ |
+
+
+ /
+
+
/
-
-
- /
- /
-
-
-
-
-
-
-
-
-
+ /
+
+
+
+
+
+
+
+
+
+
-
+
-
+
+
@@ -374,6 +394,7 @@
+
@@ -381,17 +402,20 @@
-
+
- p | ul | ol | pre | h1 | h2 | h3 | h4 | h5 | h6 | table
+ p | ul | ol | pre | h1 | h2 | h3 | h4 | h5 | h6 | table
-
+
+
@@ -403,8 +427,9 @@
-
-
+
+
@@ -414,22 +439,23 @@
-->
-
-
-
+
+
+
-
+
-
+
@@ -438,11 +464,11 @@
-
+
string
-
+
boolean
@@ -460,26 +486,29 @@
decimal
-
+
number
-
+
-
+
-
+
-
+
\ No newline at end of file
From 04f5159af8fc9a63f5e7d23f6e21ef13852279d5 Mon Sep 17 00:00:00 2001
From: galtm <40716346+galtm@users.noreply.github.com>
Date: Wed, 5 Jun 2024 08:07:58 -0400
Subject: [PATCH 2/2] Update a comment
---
src/converter-gen/xml-to-json/produce-xml-converter.xsl | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/src/converter-gen/xml-to-json/produce-xml-converter.xsl b/src/converter-gen/xml-to-json/produce-xml-converter.xsl
index f7a75792..84c8d2df 100644
--- a/src/converter-gen/xml-to-json/produce-xml-converter.xsl
+++ b/src/converter-gen/xml-to-json/produce-xml-converter.xsl
@@ -414,8 +414,7 @@
p | ul | ol | pre | h1 | h2 | h3 | h4 | h5 | h6 | table
-
+