apple-ios filter assertion checks the wrong namespace, so every filter on profile_object is rejected

[dragosprisaca]

Describe the bug
The Schematron rule apple-ios-def_profile_object_verify_filter_state in oval-schemas/apple-ios-definitions-schema.xsd compares the referenced state's namespace against http://oval.mitre.org/XMLSchema/oval-definitions-5#apple-ios (hyphen). The schema's targetNamespace is http://oval.mitre.org/XMLSchema/oval-definitions-5#apple_ios (underscore). The comparison can never be true, so any oval-def:filter inside a profile_object fails with "is of the wrong type" even when it points at a correctly typed profile_state.

Replication Steps

1. Extract the Schematron from apple-ios-definitions-schema.xsd with tools/ExtractSchFromXSD.xsl and compile it.
2. Validate a document containing an apple-ios-def:profile_object whose oval-def:filter references an apple-ios-def:profile_state with a matching id.
3. Observe a failed-assert: "State referenced in filter for profile_object ... is of the wrong type."

Expected behavior
A filter that references a profile_state in the #apple_ios namespace passes. Only a state of a different type or namespace is rejected.

Content
Before (line 461):

<sch:assert test="(($state_namespace='http://oval.mitre.org/XMLSchema/oval-definitions-5#apple-ios') and ($state_name='profile_state'))">

After:

<sch:assert test="(($state_namespace='http://oval.mitre.org/XMLSchema/oval-definitions-5#apple_ios') and ($state_name='profile_state'))">

OVAL details

• Schema: apple-ios-definitions-schema.xsd
• Object: profile_object
• State: profile_state