Repository navigation
Evaluate OVAL state with no entities as true (Fixes #2396) - #2452
Open
Mohit20057 wants to merge 1 commit into
Open
Mohit20057 wants to merge 1 commit into
Mohit20057 wants to merge 1 commit into
Conversation
Mohit20057
requested review from
Mab879,
jan-cerny and
matusmarhefka
as code owners
October 20, 2026 13:12
According to the OVAL specification, child entities in state elements have minOccurs=0. A state without any entities imposes no conditions; therefore, any collected system item vacuously satisfies it. Previously, eval_item() in oval_resultTest.c would iterate over an empty list of state contents, leaving the results structure empty. It then passed this empty set to ores_get_result_byopr(), which mapped it to OVAL_RESULT_UNKNOWN. This caused a critical false negative with Canonical's Ubuntu OVAL feeds, which define singleton family_states with no child entities. Because the inventory check evaluated to unknown, every Ubuntu Security Notice (USN) extending that inventory definition failed to evaluate to true, reporting zero vulnerabilities and exiting cleanly with code 0. This patch detects when an OVAL state contains no entities and immediately returns OVAL_RESULT_TRUE. Also adds a regression test suite covering entity-less states and Ubuntu applicability check patterns. Fixes OpenSCAP#2396
Mohit20057
force-pushed
the
fix-empty-state-eval
branch
from
October 20, 2026 14:13
81ad692 to
5836ee5
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #2396
According to the OVAL specification, child entities in state elements have
minOccurs="0". A state without any entities imposes zero conditions; therefore, any collected system item vacuously satisfies it.Previously,
eval_item()inoval_resultTest.cwould iterate over an empty list of state contents, leaving the results structure empty. It then passed this empty set toores_get_result_byopr(), which mapped it toOVAL_RESULT_UNKNOWN.This caused a critical false negative with Canonical's Ubuntu OVAL feeds, which define singleton
family_stateelements with no child entities. Because the inventory check evaluated tounknown, every Ubuntu Security Notice (USN) extending that inventory definition failed to evaluate totrue, reporting zero vulnerabilities and exiting cleanly with code 0.Proposed Changes
src/OVAL/results/oval_resultTest.c, check whetherstate_contents_itris empty before loop execution; if empty, immediately free the iterator and returnOVAL_RESULT_TRUE.tests/API/OVAL/unittests/empty_state.xmlandtests/API/OVAL/unittests/test_empty_state.shcovering:family_statewith defaultANDoperator (evaluates totrue).ORoperator (evaluates totrue).test_empty_state.shintests/API/OVAL/unittests/CMakeLists.txt.