Skip to content

[backport] Evaluate OVAL state with no entities as true #2463

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
matusmarhefka merged 1 commit into from
Oct 22, 2026
Merged

[backport] Evaluate OVAL state with no entities as true #2463

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions src/OVAL/results/oval_resultTest.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -564,6 +564,17 @@ static oval_result_t eval_item(struct oval_syschar_model *syschar_model, struct
ores_clear(&ste_ores);

state_contents_itr = oval_state_get_contents(state);
if (!oval_state_content_iterator_has_more(state_contents_itr)) {
/* An OVAL state with no entities imposes no constraints;
* any item satisfies it (evaluates to true). */
oval_state_content_iterator_free(state_contents_itr);
result = OVAL_RESULT_TRUE;
dI("State '%s' has no entities. Item '%s' satisfies state with result %s.",
oval_state_get_id(state), oval_sysitem_get_id(cur_sysitem),
oval_result_get_text(result));
return result;
}

while (oval_state_content_iterator_has_more(state_contents_itr)) {
struct oval_state_content *content;
struct oval_entity *state_entity;
Expand Down
1 change: 1 addition & 0 deletions tests/API/OVAL/unittests/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ add_oscap_test("test_debian_evr_string_missing_epoch.sh")
add_oscap_test("test_deprecated_def.sh")
add_oscap_test("test_directives.sh")
add_oscap_test("test_empty_filename.sh")
add_oscap_test("test_empty_state.sh")
add_oscap_test("test_envvar_insensitive_equals.sh")
add_oscap_test("test_evr_string_comparison.sh")
add_oscap_test("test_evr_string_missing_epoch.sh")
Expand Down
101 changes: 101 additions & 0 deletions tests/API/OVAL/unittests/empty_state.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,101 @@
<?xml version="1.0"?>
<oval_definitions xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
<generator>
<oval:schema_version>5.11.1</oval:schema_version>
<oval:timestamp>2026-10-20T00:00:00+00:00</oval:timestamp>
</generator>

<definitions>
<!-- Definition 1: Tests empty family_state with default AND operator -->
<definition class="compliance" version="1" id="oval:x:def:1">
<metadata>
<title>Empty state evaluation test</title>
<description>Verify that a state with no entities evaluates to true</description>
<affected family="unix">
<platform>all</platform>
</affected>
</metadata>
<criteria>
<criterion test_ref="oval:x:tst:1" comment="family_test with empty state evaluates to true"/>
</criteria>
</definition>

<!-- Definition 2: Tests empty family_state with explicit OR operator -->
<definition class="compliance" version="1" id="oval:x:def:2">
<metadata>
<title>Empty state with OR operator test</title>
<description>Verify that an empty state with operator OR evaluates to true</description>
<affected family="unix">
<platform>all</platform>
</affected>
</metadata>
<criteria>
<criterion test_ref="oval:x:tst:2" comment="family_test with empty OR state evaluates to true"/>
</criteria>
</definition>

<!-- Definition 3: Extended definition (applicability check) pattern used by Ubuntu USN -->
<definition class="compliance" version="1" id="oval:x:def:3">
<metadata>
<title>Applicability check with empty state</title>
<description>Verify extend_definition using inventory definition with empty state</description>
<affected family="unix">
<platform>all</platform>
</affected>
</metadata>
<criteria operator="AND">
<extend_definition definition_ref="oval:x:def:1" comment="platform inventory is true"/>
<criterion test_ref="oval:x:tst:1" comment="additional check is true"/>
</criteria>
</definition>

<!-- Definition 4: Non-existent item must still evaluate to false even with empty state -->
<definition class="compliance" version="1" id="oval:x:def:4">
<metadata>
<title>Empty state with non-existent object</title>
<description>Verify that non-existent object still fails check_existence</description>
<affected family="unix">
<platform>all</platform>
</affected>
</metadata>
<criteria>
<criterion test_ref="oval:x:tst:3" comment="non-existent file test evaluates to false"/>
</criteria>
</definition>
</definitions>

<tests>
<ind-def:family_test id="oval:x:tst:1" version="1" check="all" check_existence="at_least_one_exists" comment="family test with empty state">
<ind-def:object object_ref="oval:x:obj:1"/>
<ind-def:state state_ref="oval:x:ste:1"/>
</ind-def:family_test>

<ind-def:family_test id="oval:x:tst:2" version="1" check="all" check_existence="at_least_one_exists" comment="family test with empty OR state">
<ind-def:object object_ref="oval:x:obj:1"/>
<ind-def:state state_ref="oval:x:ste:2"/>
</ind-def:family_test>

<unix-def:file_test id="oval:x:tst:3" version="1" check="all" check_existence="at_least_one_exists" comment="non-existent file test with empty state">
<unix-def:object object_ref="oval:x:obj:2"/>
<unix-def:state state_ref="oval:x:ste:3"/>
</unix-def:file_test>
</tests>

<objects>
<ind-def:family_object id="oval:x:obj:1" version="1" comment="family object"/>
<unix-def:file_object id="oval:x:obj:2" version="1" comment="non-existent file">
<unix-def:filepath>/openscap_nonexistent_test_file_path_xyz</unix-def:filepath>
</unix-def:file_object>
</objects>

<states>
<!-- State 1: empty state with default AND operator -->
<ind-def:family_state id="oval:x:ste:1" version="1"/>

<!-- State 2: empty state with explicit OR operator -->
<ind-def:family_state id="oval:x:ste:2" version="1" operator="OR"/>

<!-- State 3: empty file_state -->
<unix-def:file_state id="oval:x:ste:3" version="1"/>
</states>
</oval_definitions>
28 changes: 28 additions & 0 deletions tests/API/OVAL/unittests/test_empty_state.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
#!/usr/bin/env bash
. $builddir/tests/test_common.sh

result=`mktemp`

set -e
set -o pipefail

$OSCAP oval eval --results $result $srcdir/empty_state.xml

# Definition 1: State with no entities (default AND operator) must evaluate to true
assert_exists 1 '/oval_results/results/system/definitions/definition[@definition_id="oval:x:def:1" and @result="true"]'
assert_exists 1 '/oval_results/results/system/tests/test[@test_id="oval:x:tst:1" and @result="true"]'
assert_exists 1 '/oval_results/results/system/tests/test[@test_id="oval:x:tst:1"]/tested_item[@result="true"]'

# Definition 2: State with no entities and OR operator must evaluate to true
assert_exists 1 '/oval_results/results/system/definitions/definition[@definition_id="oval:x:def:2" and @result="true"]'
assert_exists 1 '/oval_results/results/system/tests/test[@test_id="oval:x:tst:2" and @result="true"]'
assert_exists 1 '/oval_results/results/system/tests/test[@test_id="oval:x:tst:2"]/tested_item[@result="true"]'

# Definition 3: Extended definition applicability check (Ubuntu USN pattern) must evaluate to true
assert_exists 1 '/oval_results/results/system/definitions/definition[@definition_id="oval:x:def:3" and @result="true"]'

# Definition 4: Non-existent item must still evaluate to false even when state has no entities
assert_exists 1 '/oval_results/results/system/definitions/definition[@definition_id="oval:x:def:4" and @result="false"]'
assert_exists 1 '/oval_results/results/system/tests/test[@test_id="oval:x:tst:3" and @result="false"]'

rm $result
Loading