Inconsistent handling of URLs in hrefs and rlinks

[david-waltermire]

Describe the bug

The ProfileResolver treats an absolute URL at /profile/import/@href differently to a /profile/import/@href that links to a /profile/back-matter/resource with an absolute URL at /profile/back-matter/resource/rlink. The former is passed to IDocumentLoader.loadAsNodeItem(@NotNull URL url), but the latter is attempted to be resolved and passed as a stream via URISource.newInputStream(). Therefore, the DocumentLoader can not handle the URL as expected.

Who is the bug affecting?

liboscal-java users using a custom DocumentLoader during profile resolution.

What is affected by this bug?

Breaks profile resolution.

When does this occur?

On profile resolution when:

• Using a custom DocumentLoader that is expecting to handle the external URI.
• The Profile contains a /profile/import/@href with a /back-matter/resource link and the /back-matter/resource contains an absolute URL at /profile/back-matter/resource/rlink/@href

How do we replicate the issue?

1. Attempt to resolve the example Profile below and attempt to rewrite the URL before resolution via a custom DocumentLoader to the abc-simple_catalog.xml file.

<?xml version="1.0" encoding="UTF-8"?>
<profile xmlns="http://csrc.nist.gov/ns/oscal/1.0"
         uuid="036213db-02d3-4234-8963-b83f79634e36">
   <metadata>
      <title>Example</title>
      <last-modified>2022-05-30T14:39:50.536-04:00</last-modified>
      <version>1.3</version>
      <oscal-version>1.0.0</oscal-version>
   </metadata>
   <import href="#4d263315-ebac-45cc-801e-f5a986cd59a9">
      <include-controls>
         <with-id>a1</with-id>
         <with-id>a3</with-id>
      </include-controls>
   </import>
   <merge>
      <combine method="keep"/>
      <as-is>true</as-is>
   </merge>
   <modify>
      <set-parameter param-id="a1_prm1">
         <constraint>
            <description>
               <p>at least every 3 years</p>
            </description>
         </constraint>
      </set-parameter>
      <set-parameter param-id="a3_prm1">
         <constraint>
            <description>
               <p>at least annually</p>
            </description>
         </constraint>
      </set-parameter>
      <alter control-id="a1">
         <add position="starting" by-id="a1">
            <prop name="CORE" ns="https://fedramp.gov/ns/oscal" value="core"/>
         </add>
         <add position="starting" by-id="a1-stmt">
            <prop name="conformity"
                  ns="https://fedramp.gov/ns/oscal"
                  value="assessment-objective"/>
            <prop name="method" class="fedramp" value="EXAMINE"/>
         </add>
      </alter>
   </modify>
   <back-matter>
      <resource uuid="4d263315-ebac-45cc-801e-f5a986cd59a9">
         <rlink media-type="application/xml" href="https://example.com/catalogs/abc-simple_catalog.xml"/>
      </resource>
   </back-matter>
</profile>

Expected behavior (i.e. solution)

The ProfileResolver should pass all external href to IDocumentLoader.loadAsNodeItem(@NotNull URL url) for processing. It would also be acceptable for a new IDocumentLoader.loadAsNodeItem(@NotNull URI uri) interface to be developed and used, aligning closely with the uri-reference within the data model.

Other Comments

None