Schematron rules that can never fire: 18 rule contexts reference elements that do not exist

[dragosprisaca]

Describe the bug

Eighteen sch:rule contexts across ten schemas name elements that are not declared in the namespace they resolve to. XPath silently matches nothing, so these rules compile cleanly, read correctly, and never fire. Content that violates them validates as clean.

Causes are a mix of typos, stale names left behind when an element was renamed, and one wrong namespace URI in a sch:ns declaration.

Replication Steps

1. Extract the Schematron from any schema below with tools/ExtractSchFromXSD.xsl and compile it.
2. Validate an instance document that violates the rule.
3. No failed-assert is produced.

For example, unix-def:filextendedattribute_test is missing an e; the declared element is fileextendedattribute_test, so the object_ref rule for that test has never been enforced.

Expected behavior

Every sch:rule/@context resolves to a declared element, so the rule matches real content.

Content

Schema	Broken context	Should be
apache-system-characteristics	sch:ns maps apache-sc to …-5#windows	…-5#apache
aws-definitions	aws-def:test/aws-def:object and /aws-def:state (3 pairs)	credentialreportuser_test, credentialreportkey_test, credentialreportcert_test
independent-definitions	ind-def:yamlfile_state/ind-def:value	ind-def:yamlfilecontent_state
independent-system-characteristics	ind-sc:yamlfile_item/ind-sc:value	ind-sc:yamlfilecontent_item
macos-definitions	macos-def:macos_object//oval-def:filter (×3)	disabledservice_object, launchd_object, nvram512_object
netconf-definitions	netconf-def:netconf_object//oval-def:filter	netconf-def:config_object
panos-definitions	panos-def:paloalto_object//oval-def:filter	panos-def:config_object
sharepoint-definitions	sp-def:policycoll_test/sp-def:object and /sp-def:state	sp-def:infopolicycoll_test
unix-definitions	unix-def:filextendedattribute_test/unix-def:object	unix-def:fileextendedattribute_test
windows-system-characteristics	…/win-sc:file_item/win-sc:filetype	win-sc:type

The apache case is the widest: because the prefix resolved to the windows namespace, no apache-sc rule in that schema could match anything.

OVAL details

• Schema: apache-system-characteristics, aws-definitions, independent-definitions, independent-system-characteristics, macos-definitions, netconf-definitions, panos-definitions, sharepoint-definitions, unix-definitions, windows-system-characteristics