From d6a2f9fb4d8cbcf3f94e0c795f86785c6a8323a4 Mon Sep 17 00:00:00 2001 From: Jan Pazdziora Date: Tue, 18 Jun 2019 22:31:37 +0200 Subject: [PATCH] Code in MarkDown will not interpret the star as italics. --- docs/independent-definitions-schema.md | 4 ++-- docs/oval-definitions-schema.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/independent-definitions-schema.md b/docs/independent-definitions-schema.md index 10d3edb..8d42e8a 100644 --- a/docs/independent-definitions-schema.md +++ b/docs/independent-definitions-schema.md @@ -550,7 +550,7 @@ It is important to note that the 'max_depth' and 'recurse_direction' attributes | filename | [oval-def:EntityObjectStringType](oval-definitions-schema.md#EntityObjectStringType) (1..1) | ||
The filename entity specifies the name of a file.
| | pattern | [oval-def:EntityObjectStringType](oval-definitions-schema.md#EntityObjectStringType) (1..1) | -||
The pattern entity defines a chunk of text in a file and is represented using a regular expression. A subexpression (using parentheses) can call out a piece of the text block to test. For example, the pattern abc(.*)xyz would look for a block of text in the file that starts with abc and ends with xyz, with the subexpression being all the characters that exist in between. The value of the subexpression can then be tested using the subexpression entity of a textfilecontent54_state. Note that if the pattern, starting at the same point in the file, matches more than one block of text, then it matches the longest. For example, given a file with abcdefxyzxyzabc, then the pattern abc(.*)xyz would match the block abcdefxyzxyz. Subexpressions also match the longest possible substrings, subject to the constraint that the whole match be as long as possible, with subexpressions starting earlier in the pattern taking priority over ones starting later.
Note that when using regular expressions, OVAL supports a common subset of the regular expression character classes, operations, expressions and other lexical tokens defined within Perl 5's regular expression specification. For more information on the supported regular expression syntax in OVAL see: http://oval.mitre.org/language/about/re_support_5.6.html.
| +||
The pattern entity defines a chunk of text in a file and is represented using a regular expression. A subexpression (using parentheses) can call out a piece of the text block to test. For example, the pattern `abc(.*)xyz` would look for a block of text in the file that starts with abc and ends with xyz, with the subexpression being all the characters that exist in between. The value of the subexpression can then be tested using the subexpression entity of a textfilecontent54_state. Note that if the pattern, starting at the same point in the file, matches more than one block of text, then it matches the longest. For example, given a file with abcdefxyzxyzabc, then the pattern `abc(.*)xyz` would match the block abcdefxyzxyz. Subexpressions also match the longest possible substrings, subject to the constraint that the whole match be as long as possible, with subexpressions starting earlier in the pattern taking priority over ones starting later.
Note that when using regular expressions, OVAL supports a common subset of the regular expression character classes, operations, expressions and other lexical tokens defined within Perl 5's regular expression specification. For more information on the supported regular expression syntax in OVAL see: http://oval.mitre.org/language/about/re_support_5.6.html.
| | instance | [oval-def:EntityObjectIntType](oval-definitions-schema.md#EntityObjectIntType) (1..1) | ||
The instance entity calls out a specific match of the pattern. It can have both positive and negative values. If the value is positive, the index of the specific match of the pattern is counted from the beginning of the set of matches of that pattern. The first match is given an instance value of 1, the second match is given an instance value of 2, and so on. For positive values, the 'less than' and 'less than or equals' operations imply the the object is operating only on positive values. Frequently, this entity will be defined as 'greater than or equals' 1, which results in the object representing the set of all matches of the pattern.
Negative values are used to simplify collection of pattern match occurrences counting backwards from the last match. To find the last match, use an instance of -1; the penultimate match is found using an instance value of -2, and so on. For negative values, the 'greater than' and 'greater than or equals' operations imply the object is operating only on negative values. For example, searching for instances greater than or equal to -2 would yield only the last two maches.
Note that the main purpose of the instance item entity is to provide uniqueness for different textfilecontent_items that results from multiple matches of a given pattern against the same file, and they will always have positive values.
| | [oval-def:filter](oval-definitions-schema.md#filter) | n/a (0..unbounded) | @@ -577,7 +577,7 @@ The textfilecontent54_state element contains entities that are used to check the | text | [oval-def:EntityStateAnySimpleType](oval-definitions-schema.md#EntityStateAnySimpleType) (0..1) | ||
The text entity represents the block of text that matched the specified pattern.
| | subexpression | [oval-def:EntityStateAnySimpleType](oval-definitions-schema.md#EntityStateAnySimpleType) (0..1) | -||
The subexpression entity represents a value to test against the subexpression in the specified pattern. If multiple subexpressions are specified in the pattern, this value is tested against all of them. For example, if the pattern abc(.*)mno(.*)xyp was supplied, and the state specifies a subexpression value of enabled, then the test would check that both (or at least one, none, etc. depending on the entity_check attribute) of the subexpressions have a value of enabled.
| +||
The subexpression entity represents a value to test against the subexpression in the specified pattern. If multiple subexpressions are specified in the pattern, this value is tested against all of them. For example, if the pattern `abc(.*)mno(.*)xyp` was supplied, and the state specifies a subexpression value of enabled, then the test would check that both (or at least one, none, etc. depending on the entity_check attribute) of the subexpressions have a value of enabled.
| | windows_view | [ind-def:EntityStateWindowsViewType](#EntityStateWindowsViewType) (0..1) | ||
The windows view value to which this was targeted. This is used to indicate which view (32-bit or 64-bit), the associated State applies to. This entity only applies to 64-bit Microsoft Windows operating systems.
| diff --git a/docs/oval-definitions-schema.md b/docs/oval-definitions-schema.md index 8470123..4eca577 100644 --- a/docs/oval-definitions-schema.md +++ b/docs/oval-definitions-schema.md @@ -624,7 +624,7 @@ The end function takes a single string component and defines a character (or str ## == EscapeRegexFunctionType == -The escape_regex function takes a single string component and escapes all of the regular expression characters. If the string sub-component contains multiple values, then the escape_regex function will be applied to each individual value and return a multiple-valued result. For example, the string '(\.test_string*)?' will evaluate to '\(\\\.test_string\*\)\?'. The purpose for this is that many times, a component used in pattern match needs to be treated as a literal string and not a regular expression. For example, assume a basic component element that identifies a file path that is held in the Windows registry. This path is a string that might contain regular expression characters. These characters are likely not intended to be treated as regular expression characters and need to be escaped. This function allows a definition writer to mark convert the values of components to regular expression format. +The escape_regex function takes a single string component and escapes all of the regular expression characters. If the string sub-component contains multiple values, then the escape_regex function will be applied to each individual value and return a multiple-valued result. For example, the string `'(\.test_string*)?'` will evaluate to `'\(\\\.test_string\*\)\?'`. The purpose for this is that many times, a component used in pattern match needs to be treated as a literal string and not a regular expression. For example, assume a basic component element that identifies a file path that is held in the Windows registry. This path is a string that might contain regular expression characters. These characters are likely not intended to be treated as regular expression characters and need to be escaped. This function allows a definition writer to mark convert the values of components to regular expression format. Note that when using regular expressions, OVAL supports a common subset of the regular expression character classes, operations, expressions and other lexical tokens defined within Perl 5's regular expression specification. The set of Perl metacharacters which must be escaped by this function is as follows, enclosed by single quotes: '^$\.[](){}*+?|'. For more information on the supported regular expression syntax in OVAL see: http://oval.mitre.org/language/about/re_support_5.6.html.