[Phase 1] XCCDF Data-Stream Generator from MongoDB

[remyluslosius]

Summary

Implements Phase 1, Issue #3 of the 7-phase hybrid scanning architecture plan. Generates XCCDF 1.2 compliant benchmarks and tailoring files from MongoDB compliance rules for scan-time variable customization.

Related Issues

• Closes: XCCDF Data-Stream Generator from MongoDB #98
• Requires: Enhanced SCAP Converter with Variable Extraction #96 (SCAP converter) - PR [Phase 1] Enhanced SCAP Converter with Variable and Remediation Extraction #97 pending merge
• Part of: Phase 1 - DISA STIGs & CIS Benchmarks with OSCAP

Changes

1. XCCDF Generator Service (`xccdf_generator_service.py` - 550 lines)

Core Methods:

• `generate_benchmark()`: Creates complete XCCDF 1.2 Benchmark XML
• `generate_tailoring()`: Creates XCCDF Tailoring files for variable overrides

XCCDF Elements Generated:

• `xccdf:Value`: Variables with type constraints (number ranges, string patterns, boolean)
• `xccdf:Rule`: Compliance checks with severity, references, identifiers
• `xccdf:Group`: Rule categorization (authentication, network, etc.)
• `xccdf:Profile`: Framework-specific rule selections (NIST, CIS, STIG)
• `xccdf:Benchmark`: Root element with metadata, status, version

XCCDF 1.2 Compliance:
All IDs follow required pattern `xccdf_`:

• Benchmark: `xccdf_com.hanalyx.openwatch_benchmark_{name}`
• Rule: `xccdf_com.hanalyx.openwatch_rule_{name}`
• Value: `xccdf_com.hanalyx.openwatch_value_{var_id}`
• Group: `xccdf_com.hanalyx.openwatch_group_{category}`
• Profile: `xccdf_com.hanalyx.openwatch_profile_{framework}_{version}`

2. XCCDF API Endpoints (`xccdf_api.py` - 220 lines)

Endpoints:

• `POST /api/v1/xccdf/generate-benchmark`: Generate XCCDF Benchmark
• `POST /api/v1/xccdf/generate-tailoring`: Generate tailoring file
• `GET /api/v1/xccdf/frameworks`: List available frameworks/versions
• `GET /api/v1/xccdf/variables`: List customizable variables

Security: All endpoints require authentication via `get_current_user`

3. Pydantic Schemas (`xccdf_schemas.py` - 150 lines)

• `XCCDFBenchmarkRequest`/`Response`
• `XCCDFTailoringRequest`/`Response`
• `XCCDFValidationRequest`/`Response`

XCCDF Structure

Benchmark Example

```xml
<xccdf:Benchmark id="xccdf_com.hanalyx.openwatch_benchmark_nist_800_53r5"
resolved="true">
<xccdf:status date="2025-10-14">draft</xccdf:status>
xccdf:titleNIST SP 800-53 Revision 5</xccdf:title>
<xccdf:version time="2025-10-14T22:00:00Z">1.0.0</xccdf:version>

xccdf:metadata
dc:creatorOpenWatch SCAP Generator</dc:creator>
dc:publisherHanalyx OpenWatch</dc:publisher>
</xccdf:metadata>

<xccdf:Value id="xccdf_com.hanalyx.openwatch_value_var_accounts_tmout"
type="number" interactive="true">
xccdf:titleSession Timeout</xccdf:title>
xccdf:descriptionTimeout for inactive sessions in seconds</xccdf:description>
xccdf:value600</xccdf:value>
xccdf:lower-bound60</xccdf:lower-bound>
xccdf:upper-bound3600</xccdf:upper-bound>
</xccdf:Value>

<xccdf:Group id="xccdf_com.hanalyx.openwatch_group_authentication">
xccdf:titleAuthentication</xccdf:title>

<!-- Rules -->
<xccdf:Rule id="xccdf_com.hanalyx.openwatch_rule_accounts_tmout" 
             severity="medium" selected="true">
  <xccdf:title>Set Interactive Session Timeout</xccdf:title>
  <xccdf:description>Configure TMOUT for session expiration</xccdf:description>
  <xccdf:rationale>Reduces unauthorized access window</xccdf:rationale>
  <xccdf:ident system="http://cce.mitre.org">CCE-27557-8</xccdf:ident>
  
  <xccdf:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <xccdf:check-content-ref href="oscap-definitions.xml" 
                              name="xccdf_org.ssgproject.content_rule_accounts_tmout"/>
  </xccdf:check>
</xccdf:Rule>

</xccdf:Group>

<xccdf:Profile id="xccdf_com.hanalyx.openwatch_profile_nist_800_53r5">
xccdf:titleNIST 800-53r5</xccdf:title>
xccdf:descriptionProfile for NIST 800-53r5 compliance</xccdf:description>
<xccdf:select idref="xccdf_com.hanalyx.openwatch_rule_accounts_tmout"
selected="true"/>
</xccdf:Profile>
</xccdf:Benchmark>
```

Tailoring Example

```xml
<xccdf:Tailoring id="production_tailoring">
<xccdf:version time="2025-10-14T22:00:00Z">1.0</xccdf:version>
<xccdf:benchmark href="nist-800-53r5.xml"
id="xccdf_com.hanalyx.openwatch_benchmark_nist_800_53r5"/>

<xccdf:Profile id="nist_800_53r5_production" extends="nist_800_53r5">
xccdf:titleProduction Environment Settings</xccdf:title>
xccdf:descriptionTightened timeout for production systems</xccdf:description>

<xccdf:set-value idref="xccdf_com.hanalyx.openwatch_value_var_accounts_tmout">
  300
</xccdf:set-value>

</xccdf:Profile>
</xccdf:Tailoring>
```

Usage

Generate Benchmark via API

```bash
curl -X POST http://localhost:8000/api/v1/xccdf/generate-benchmark \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $TOKEN" \
-d '{
"benchmark_id": "nist-800-53r5",
"title": "NIST SP 800-53 Revision 5 Security Controls",
"description": "Security controls for federal information systems",
"version": "1.0.0",
"framework": "nist",
"framework_version": "800-53r5"
}' | jq -r '.benchmark_xml' > nist-800-53r5.xml
```

Generate Tailoring via API

```bash
curl -X POST http://localhost:8000/api/v1/xccdf/generate-tailoring \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $TOKEN" \
-d '{
"tailoring_id": "prod_tailoring",
"benchmark_href": "nist-800-53r5.xml",
"benchmark_version": "1.0.0",
"profile_id": "xccdf_com.hanalyx.openwatch_profile_nist_800_53r5",
"variable_overrides": {
"xccdf_com.hanalyx.openwatch_value_var_accounts_tmout": "300"
},
"title": "Production Environment",
"description": "Tightened security for production"
}' | jq -r '.tailoring_xml' > production.xml
```

Scan with OpenSCAP

```bash

Validate generated files

oscap xccdf validate nist-800-53r5.xml
oscap xccdf validate production.xml

Run compliance scan

oscap xccdf eval \
--profile xccdf_com.hanalyx.openwatch_profile_nist_800_53r5 \
--tailoring-file production.xml \
--results scan-results.xml \
--report scan-report.html \
nist-800-53r5.xml
```

Implementation Details

Variable Constraint Mapping

Variable Type	XCCDF Constraints
number	`xccdf:lower-bound`, `xccdf:upper-bound`
string (enum)	Multiple `xccdf:choice` elements
string (pattern)	`xccdf:match` with regex
boolean	No additional constraints

Profile Generation Strategy

1. Query MongoDB for rules with `is_latest: true`
2. Filter by framework/version if specified
3. Group rules by framework versions found
4. Create one Profile per framework version
5. Add `xccdf:select` for each matching rule

Tailoring File Use Cases

• Environment-specific: Different timeouts for dev/staging/prod
• Organization policies: Custom banner text, password policies
• Temporary exceptions: Temporarily relax constraints during migration
• Multi-tenant: Different variable values per customer

Testing

Manual Validation

Created sample XCCDF files following spec requirements:

• ✅ Benchmark ID format: `xccdf_com.hanalyx.openwatch_benchmark_*`
• ✅ Value ID format: `xccdf_com.hanalyx.openwatch_value_*`
• ✅ Rule ID format: `xccdf_com.hanalyx.openwatch_rule_*`
• ✅ Group ID format: `xccdf_com.hanalyx.openwatch_group_*`
• ✅ Profile ID format: `xccdf_com.hanalyx.openwatch_profile_*`

Integration Testing (Post-Merge)

After PR #97 merges, will test:

1. Generate benchmark from real MongoDB rules
2. Validate with `oscap xccdf validate`
3. Generate HTML guide with `oscap xccdf generate guide`
4. Run actual scan with variable customization

Next Steps

After this PR merges:

1. Issue chore(deps): bump actions/download-artifact from 3 to 5 #4: MongoDB-Based Scan Service (5-7 days)

   • Route scans to appropriate scanners (oscap, kubernetes, cloud)
   • Apply tailoring files for variable customization
   • Store scan results in MongoDB

2. Issue chore(deps): bump node from 18-alpine to 24-alpine in /docker #5: ORSA Plugin Architecture (5-7 days)

   • Execute remediation content (Ansible, Bash)
   • Track remediation status
   • Rollback support

3. Issue chore(deps): bump actions/upload-artifact from 3 to 4 #6: Scan Configuration API (3-4 days)

   • UI for benchmark selection
   • Variable customization interface
   • Tailoring file management

4. Issue chore(deps): bump peter-evans/create-pull-request from 5 to 7 #7: Frontend Variable Customization UI (5-7 days)

   • Framework selection dropdowns
   • Variable override forms with constraint validation
   • Real-time XCCDF preview

Documentation

See:

• `/docs/IMPLEMENTATION_PLAN_7_PHASES.md` (Phase 1, Task 1.3)
• XCCDF 1.2 Spec: https://csrc.nist.gov/publications/detail/nistir/7275/rev-4/final

Checklist

• XCCDF Generator Service implemented (550 lines)
• XCCDF 1.2 ID naming requirements enforced
• Benchmark generation with Values, Rules, Groups, Profiles
• Tailoring file generation with variable overrides
• API endpoints with authentication
• Pydantic schemas for requests/responses
• Helper endpoints (list frameworks, list variables)
• Manual XCCDF validation completed
• Integration tests with real MongoDB data (pending PR [Phase 1] Enhanced SCAP Converter with Variable and Remediation Extraction #97)
• `oscap xccdf validate` passing (pending integration test)

🤖 Generated with Claude Code

Co-Authored-By: Claude noreply@anthropic.com

[sonarqubecloud]

Quality Gate failed

Failed conditions
15 Security Hotspots

See analysis details on SonarQube Cloud

To fix the log injection flaw, sanitize all user-controllable data before including it in the log message. Specifically, for every value logged from request and current_user, strip out any newline (\n, \r\n) and carriage return characters, which can break log integrity.

• In generate_benchmark, sanitize both current_user.get('username') and request.benchmark_id before including them in logs.
• Modify line 48 (logging statement) so those values are passed through a replace chain (e.g. .replace('\n', '').replace('\r', '')).
• No imports are needed—just use Python’s str.replace() method as shown.

---

To generally fix log injection issues, all user-provided input (which will end up in log messages) should be sanitized before being passed to any logger (or to any sink vulnerable to this kind of injection). For plain text log files (as in most default loggers), the basic step is to remove CR (\r), LF (\n), and similar line-breaking or control characters from the logged value. This can be accomplished using Python's str.replace() or a regular expression for robustness.

In the code snippet, request.tailoring_id is logged directly. We should sanitize this value before logging, by stripping or replacing any line breaks. Optionally, though not strictly necessary for log injection, we could also sanitize current_user.get('username') if it can be controlled by a user, but the core issue flagged by CodeQL is with request.tailoring_id.

Specifically, in the function at line 106 (generate_tailoring), prior to logging in line 124, add a line that sanitizes (e.g., using .replace('\n', '').replace('\r', '')) the request.tailoring_id value (done within a local variable or directly inline in the log string). Then, the logging call uses this sanitized ID in its message.

No extra imports are required. This is a single code edit in the file: in the body of generate_tailoring.

---

To fix this issue, remove the unused List import from the typing import statement at line 14 in backend/app/services/scap_yaml_parser_service.py. This will clear unnecessary dependency clutter from the file and make the imports concise and maintainable. The recommended change is to edit line 14 so that only the actually used items from typing are imported: Dict, Any, Optional, and Set.

To fix the log injection, any value derived from user input and written to the log should be sanitized to remove carriage return (\r) and line feed (\n) characters, which could be used to inject new log entries or falsify existing ones. The most targeted and low-disruption fix is to sanitize tailoring_id (and any similar user parameters if present) just before logging it.

Specifically:

• Before writing tailoring_id into the log, replace all instances of \r and \n in the value with the empty string (''). This can be done inline via .replace('\r', '').replace('\n', '').
• No additional imports are needed.
• The change should only affect the log message; there is no need to sanitize the in-memory value unless it is used elsewhere in a vulnerable fashion.
• Only edit logger.info(f"Generating XCCDF Tailoring: {tailoring_id}") at line 147 of backend/app/services/xccdf_generator_service.py to interpolate a sanitized version of tailoring_id.

---

To fix the problem, the assignment to the unused local variable benchmark_elem should be removed, leaving only the function call. Since the right-hand side (ET.SubElement(...)) has the side effect of adding the benchmark element to the parent XML element (tailoring), it needs to be retained as a statement for the side effect. Specifically, in backend/app/services/xccdf_generator_service.py, within the generate_tailoring method, on line 169, remove the assignment to benchmark_elem and simply call ET.SubElement(...) as a statement. No other changes are necessary, as no logic depends on the variable.

To fix the unused local variable issue, we should remove the assignment of ET.SubElement to the unused variable check_ref on line 401 and simply call ET.SubElement(...) as a standalone statement. This preserves the side effect of adding the subelement to the XML tree and makes it clear that there is no intention to use the resulting element. The change affects only a single line within the XCCDFGeneratorService class method (most likely in the _generate_rule_element method), in the file backend/app/services/xccdf_generator_service.py. No new imports, method definitions, or other changes are required.

---

The best way to fix this problem is to remove the assignment to the unused variable export and keep only the call to ET.SubElement(...) for its side effect (adding a new child XML element to the parent). This edit is within the _create_xccdf_rule method of the XCCDFGeneratorService class, specifically the block between lines 413 and 420. The rest of the logic remains unchanged, the element is created and attached to its parent, but no reference needs to be stored. No new dependencies or imports are required; removing export = is sufficient.

The best way to fix the problem is to remove the assignment to the unused variable select on line 526. The call to ET.SubElement(...) has the required side effect of adding the subelement to the profile element, so the assignment is unnecessary. This edit is contained within the body of the _create_profile_element method and affects only line 526. No changes to imports, method signatures, or supporting code are needed.

---