Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Spec currently allows both the use of definition_type/definition properties and extensions with marking-definitions #300

Open
rpiazza opened this issue Nov 8, 2022 · 0 comments

Comments

@rpiazza
Copy link
Contributor

rpiazza commented Nov 8, 2022

The following is valid as the spec is currently written:

{
			"type": "marking-definition",
			"spec_version": "2.1",
			"id": "marking-definition--b58d6a2a-f14a-4994-af70-69156cd48190",
			"created": "2022-10-25T13:51:56.797459Z",
			"definition_type": "statement",
			"definition": {
				"statement": "U//FOUO"
			},
			"name": "UNCLASSIFIED//FOR OFFICIAL USE ONLY",
			"extensions": {
				"extension-definition--3a65884d-005a-4290-8335-cb2d778a83ce": {
					"control_set": {
						"classification": "U",
						"formal_determination": [
							"FOUO"
						]
					},
					"create_date_time": "2022-10-25T13:51:56.796458Z",
					"extension_type": "property-extension",
					"identifier": "isa:guide.19001.ACS3-2b51e0d7-e3de-43cf-81ac-09e21ee0ff5d",
					"policy_reference": "urn:isa:policy:acs:ns:v3.0?privdefault=deny&sharedefault=permit",
					"responsible_entity_custodian": "USA.USG"
				}


			}
		}

This marking-definition object contains both statement and ACS marking information, as an extension. The spec says:

If the extensions property is not present, this (definition-type) property MUST be present.

But it doesn’t say the opposite (i.e., if the definition-type is present, then the extension property MUST NOT be present).

One marking-definition object shouldn’t contain information about more than one marking definition type, since they could be contradictory. This should be corrected in the spec

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants