Binding patterns in FedRAMP_extensions.json and fedramp_values.json are inconsistent.

[dskyberg]

• This is a ...

  • concern - I think something needs to be different.
  • question - I didn't understand something.
  • kudos - I found something helpful and want to encourage it in future FedRAMP publications.
  • request - I would like to see something additional provided.

• This relates to ...

  • the FedRAMP OSCAL Registry (Excel File)
  • the Guide to OSCAL-based FedRAMP Content (PDF)
  • the Guide to OSCAL-based FedRAMP System Security Plans (SSP) (PDF)
  • the Guide to OSCAL-based FedRAMP Security Assessment Plans (SAP) (PDF)
  • the Guide to OSCAL-based FedRAMP Security Assessment Results (SAR) (PDF)
  • the Guide to OSCAL-based FedRAMP Plan of Action and Milestones (POA&M) (PDF)
  • the FedRAMP SSP OSCAL Template (JSON or XML Format)
  • the FedRAMP SAP OSCAL Template (JSON or XML Format)
  • the FedRAMP SAR OSCAL Template (JSON or XML Format)
  • the FedRAMP POA&M OSCAL Template (JSON or XML Format)
  • General/Overall
  • Other

NOTE: For feedback related to the OSCAL syntax itself, please create or add to an issue in the NIST OSCAL Repository.

• Where, exactly?
  • For the registry, please indicate the tab and cell, or other clear identifier
  • For the guide, please indicate the section number and printed page number (lower right corner)
  • For the OSCAL XML or JSON files, please indicate XML or JSON; and indicate the line number, field id, or other clear location identifier

FedRAMP_extensions.json
fedramp_values.json

• What is your feedback?

The pattern expressions in extension and constraint bindings are buggy and inconsistent. The inconsistency makes writing constrain validation automation needlessly difficult.

The binding patterns in FedRAMP_extensions.json inconsistently prepend o: to elements in the path. The binding patterns in fedramp_values.json consistently do not prepend o:. For example, these patterns in FedRAMP_extensions.json are incoonsistent:

component/o:prop[@name='public']
o:component/o:prop[@name='allows-authenticated-scan']/@value

The bindings property within the response-point extension contains the following pattern:
{"pattern": "/o:catalog//o:control//o:part/o:prop"}

I believe the double backslash instances are an error. The pattern should be:
{"pattern": "/o:catalog/o:control/o:part/o:prop"}

• Is this report specifically related to the Word or Excel files from fedramp.gov? If so, please do not open an issue here. Follow the guidance in this repository's README and contact info@fedramp..gov.

No. This report is related to the binding constructs in

• What version of OSCAL are you using? (Check our info on supported OSCAL versions)

1.0.4

• What action would you like to see from the FedRAMP PMO?

1. Do not prepend o: in FedRAMP_extensions.json binding patterns. This would be consistent with fedramp_values.json. If prepending o: has value, then do so consistently.
2. Ensure all binding pattern paths are accurate (no // instances).

• Other information (e.g. detailed explanation, related issues, suggestions how to fix, links for us to have context, eg. slack, gitter, etc)

[volpet2014]

Forwarding on to @Rene2mt for review. Result of // being output is due to conversion from xml to json. More research is needed. Workaround: replace all occurences in json FedRAMP_extensions and FedRAMP_values with single slashes where appropriate.