24 Schematron assertions validating object_ref and state_ref are missing across 13 tests

[dragosprisaca]

Describe the bug

OVAL relies on Schematron to check that a test's object and state children point at an object or state of the matching type; XSD cannot express this. Thirteen tests across six schemas carry no such assertion, 24 missing in total, so content referencing a wrong-typed or nonexistent object or state validates as clean.

For example, a junos-def:show_test whose object_ref names an xml_show_object, or names an id that no object declares, produces no error today.

Replication Steps

1. Extract and compile the Schematron for one of the schemas below.
2. Validate a document whose test references an object or state id that does not exist, or that resolves to the wrong element type.
3. No failed-assert is produced.

Expected behavior

Every test declaring an object or state child has a rule asserting that the reference resolves to the correctly typed element, matching the pattern already used by the majority of tests:

<sch:rule context="junos-def:show_test/junos-def:object">
  <sch:assert test="@object_ref=ancestor::oval-def:oval_definitions/oval-def:objects/junos-def:show_object/@id">...</sch:assert>
</sch:rule>

Content

Schema	Test	Missing
asa-definitions	tcp_map_test	object_ref, state_ref
aws-definitions	apicontent_test	state_ref
aws-definitions	credentialreportuser_test	object_ref, state_ref
aws-definitions	credentialreportkey_test	object_ref, state_ref
aws-definitions	credentialreportcert_test	object_ref, state_ref
junos-definitions	show_test	object_ref, state_ref
junos-definitions	version_test	object_ref, state_ref
junos-definitions	xml_show_test	object_ref, state_ref
sharepoint-definitions	infopolicycoll_test	object_ref, state_ref
unix-definitions	fileextendedattribute_test	object_ref
windows-definitions	license_test	object_ref, state_ref
windows-definitions	peheader_test	object_ref, state_ref
windows-definitions	systemmetric_test	object_ref, state_ref

Some of these overlap #339: the aws, sharepoint and unix entries had rules whose context named a nonexistent element, so correcting the context there and supplying the assertion here are the same repair.

OVAL details

• Schema: asa-definitions, aws-definitions, junos-definitions, sharepoint-definitions, unix-definitions, windows-definitions