From 5d331f0ee86003fc3b14aeb7af29de73d65e7bfb Mon Sep 17 00:00:00 2001
From: wandmagic <156969148+wandmagic@users.noreply.github.com>
Date: Mon, 16 Sep 2024 10:32:03 -0400
Subject: [PATCH] introduce missing-response-components constraint (#688)

* introduce missing-response-components constraint

* Add review feedback from AJ before merge

---------

Co-authored-by: A.J. Stein <aj@gsa.gov>
---
 .../ssp-missing-by-component-INVALID.xml      | 190 ++++++++++++++++++
 .../fedramp-external-constraints.xml          |   8 +
 2 files changed, 198 insertions(+)
 create mode 100644 src/validations/constraints/content/ssp-missing-by-component-INVALID.xml

diff --git a/src/validations/constraints/content/ssp-missing-by-component-INVALID.xml b/src/validations/constraints/content/ssp-missing-by-component-INVALID.xml
new file mode 100644
index 000000000..ceeee823a
--- /dev/null
+++ b/src/validations/constraints/content/ssp-missing-by-component-INVALID.xml
@@ -0,0 +1,190 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
+                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                      xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd"
+                      uuid="12345678-1234-4321-8765-123456789012">
+  <metadata>
+    <title>Enhanced Example System Security Plan</title>
+    <published>2024-08-01T14:30:00Z</published>
+    <last-modified>2024-08-01T14:30:00Z</last-modified>
+    <version>1.1</version>
+    <oscal-version>1.0.0</oscal-version>
+    <document-id scheme="https://example.com/identifiers">SSP-2024-002</document-id>
+    
+    <role id="creator">
+      <title>Document Creator</title>
+    </role>
+    <role id="content-approver">
+      <title>Content Approver</title>
+    </role>
+    <role id="system-admin">
+      <title>System Administrator</title>
+    </role>
+    <role id="asset-owner">
+      <title>Asset Owner</title>
+    </role>
+    <location uuid="11111112-0000-4000-9001-000000000009">
+      <address >
+        <country>WRONG</country>
+      </address>
+      <prop name='data-center' value='dc-zone-1' class='tertiary' ns="https://fedramp.gov/ns/oscal"/>
+    </location>
+    <party uuid="11111111-0000-4000-9000-000000000001" type="organization">
+      <name>Example Organization</name>
+      <short-name>ExOrg</short-name>
+      <link rel="website" href="https://example.com"/>
+      <address type="unsupported-type"  />
+    </party>
+    <party uuid="22222222-0000-4000-9000-000000000002" type="person">
+      <name>Jane Doe</name>
+      <email-address>jane.doe@example.com</email-address>
+      <address type="unsupported-type"  />
+    </party>
+    
+    <responsible-party role-id="creator">
+      <party-uuid>11111111-0000-4000-9000-000000000001</party-uuid>
+    </responsible-party>
+    <responsible-party role-id="content-approver">
+      <party-uuid>22222222-0000-4000-9000-000000000002</party-uuid>
+    </responsible-party>
+    
+    <remarks>
+      <p>This SSP is an example for demonstration purposes.</p>
+    </remarks>
+  </metadata>
+  
+  <import-profile href="https://raw.githubusercontent.com/GSA/fedramp-automation/master/dist/content/rev5/baselines/xml/FedRAMP_rev5_HIGH-baseline-resolved-profile_catalog.xml"/>
+  
+  <system-characteristics>
+    <system-id identifier-type="https://fedramp.gov">F00000001</system-id>
+    <system-name>Enhanced Example System</system-name>
+    <description>
+      <p>This is an enhanced example system for demonstration purposes, incorporating more FedRAMP-specific elements.</p>
+    </description>
+    <prop name='cloud-service-model' value='unsupported-model' ns="https://fedramp.gov/ns/oscal"/>
+    <prop name='cloud-deployment-model' value='unsupported-value' ns="https://fedramp.gov/ns/oscal"/>
+    <prop name='authorization-type' value='unsupported-value' ns="https://fedramp.gov/ns/oscal"/>
+    <security-sensitivity-level>moderate</security-sensitivity-level>
+    <system-information>
+      <information-type uuid="33333333-0000-4000-9000-000000000003">
+        <title>Financial Information</title>
+        <description>
+          <p>Contains sensitive financial data related to organizational operations.</p>
+        </description>
+        <categorization system="https://unsupported-system.com">
+          <information-type-id>C.2.8.12</information-type-id>
+        </categorization>
+        <confidentiality-impact>
+          <base>high</base>
+        </confidentiality-impact>
+        <integrity-impact>
+          <base>moderate</base>
+        </integrity-impact>
+        <availability-impact>
+          <base>low</base>
+        </availability-impact>
+      </information-type>
+    </system-information>
+    
+    <security-impact-level>
+      <security-objective-confidentiality>moderate</security-objective-confidentiality>
+      <security-objective-integrity>moderate</security-objective-integrity>
+      <security-objective-availability>moderate</security-objective-availability>
+    </security-impact-level>
+    
+    <status state="operational"/>
+    
+    <authorization-boundary>
+      <description>
+        <p>The authorization boundary includes all components within the main data center and the disaster recovery site.</p>
+      </description>
+    </authorization-boundary>
+  </system-characteristics>
+  
+  <system-implementation>
+    <user uuid="44444444-0000-4000-9000-000000000004">
+      <title>System Administrator</title>
+      <prop name="type" value="unsupported-type"/>
+      <prop name="privilege-level" value="unsupported-access-type"/>
+      <role-id>system-admin</role-id>
+    </user>
+    
+    <component uuid="55555555-0000-4000-9000-000000000005" type="unsupported-component-type">
+      <title>Primary Application Server</title>
+      <description>
+        <p>Main application server hosting the core system functionality.</p>
+      </description>
+      <purpose>main line</purpose>
+      <status state="operational"/>
+      <responsible-role role-id="system-admin">
+        <party-uuid>11111111-0000-4000-9000-000000000001</party-uuid>
+      </responsible-role>
+      <remarks>
+        <p>This is the primary application server for the system.</p>
+      </remarks>
+    </component>
+    
+    <component uuid="66666666-0000-4000-9000-000000000006" type="interconnection">
+      <title>External API Connection</title>
+      <description>
+        <p>Secure connection to an external API for data enrichment.</p>
+      </description>
+      <prop name="interconnection-direction" value="unsupported-direction" ns="https://fedramp.gov/ns/oscal"/>
+      <prop name="interconnection-security" value="unsupported-security" ns="https://fedramp.gov/ns/oscal"/>
+      <status state="operational"/>
+      <responsible-role role-id="system-admin">
+        <party-uuid>11111111-0000-4000-9000-000000000001</party-uuid>
+      </responsible-role>
+      <remarks>
+        <p>This connection is used for secure data exchange with external systems.</p>
+      </remarks>
+    </component>
+    
+    <inventory-item uuid="77777777-0000-4000-9000-000000000007">
+      <description>
+        <p>Primary database server</p>
+      </description>
+      <prop name="asset-id" value="DB-001" ns="http://csrc.nist.gov/ns/oscal"/>
+      <prop name="asset-type" value="database"/>
+      <prop name="allows-authenticated-scan" value="unsupported-scan"/>
+      <prop name="public" value="unsupported-public"/>
+      <prop name="virtual" value="unsupported-virtual"/>
+      <prop name="scan-type" value="unsupported-scan-type" ns="https://fedramp.gov/ns/oscal"/>
+      <responsible-party role-id="asset-owner">
+        <party-uuid>11111111-0000-4000-9000-000000000001</party-uuid>
+      </responsible-party>
+      <implemented-component component-uuid="55555555-0000-4000-9000-000000000005">
+        <prop name="asset-id" value="DB-001" ns="http://csrc.nist.gov/ns/oscal"/>
+      </implemented-component>
+    </inventory-item>
+  </system-implementation>
+  
+  <control-implementation>
+    <description>
+      <p>Implementation of controls for the Enhanced Example System</p>
+    </description>
+    <implemented-requirement uuid="88888888-0000-4000-9000-000000000008" control-id="ac-1">
+      <prop name="control-origination" value="unsupported-origination" ns="https://fedramp.gov/ns/oscal"/>
+      <prop name="implementation-status" value="unsupported-status" ns="https://fedramp.gov/ns/oscal"/>
+      <statement statement-id="ac-1_stmt.a" uuid="99999999-0000-4000-9000-000000000009">
+      </statement>
+    </implemented-requirement>
+    
+    <implemented-requirement uuid="bbbbbbbb-0000-4000-9000-00000000000b" control-id="cm-8">
+      <prop name="control-origination" value="unsupported-origination" ns="https://fedramp.gov/ns/oscal"/>
+      <statement statement-id="cm-8_stmt.a" uuid="cccccccc-0000-4000-9000-00000000000c">
+      </statement>
+    </implemented-requirement>
+  </control-implementation>
+  
+  <back-matter>
+    <resource uuid="eeeeeeee-0000-4000-9000-00000000000e">
+      <!-- There is no <title/> to purposefully to trigger an error for negative testing. -->
+      <description>
+        <p>Detailed access control policy document</p>
+      </description>
+      <prop name="type" value="unsupported-type" ns="https://fedramp.gov/ns/oscal"/>
+      <!-- There is no <rlink/> to purposefully to trigger an error for negative testing. -->
+    </resource>
+  </back-matter>
+</system-security-plan>
diff --git a/src/validations/constraints/fedramp-external-constraints.xml b/src/validations/constraints/fedramp-external-constraints.xml
index 881e99a33..d65179d41 100644
--- a/src/validations/constraints/fedramp-external-constraints.xml
+++ b/src/validations/constraints/fedramp-external-constraints.xml
@@ -170,4 +170,12 @@
             </expect>
         </constraints>
     </context>
+    <context>
+        <metapath target="/system-security-plan/control-implementation"/>
+        <constraints>
+        <expect id="missing-response-components" target="implemented-requirement" test="count(./by-component) gt 0">
+            <message>Each implemented requirement must have at least one by-component reference to the source component implementing it.</message>
+        </expect>
+        </constraints>
+    </context>
 </metaschema-meta-constraints>