OSCAL
OSCAL copied to clipboard
usnistgov
Missing metaschema constraints from jsonschema
After looking over a bit over the jsonschema definitions and the origin metaschema counterpart, I noticed that there constraints that are defined in the metaschemas but are missing from the jsonschemas.
Just as an example, many fields contain a <choice> tag in the src metaschema which requires having one of x choices, but this isn't reflected in the jsonschema at all.
A concrete example to one - <define-assembly name="timing"> here which defines a choice between 3 different fields in the metaschema vs the jsonschema "timing" here which doesn't reflect this constraint.
This is probably not an OSCAL specific issue, and might be a bigger metaschema issue. Having said that, this either needs to be solved in the schema generation or addressed in the documentation (and forgive me if it's already there). It seems that this specific example is solvable in jsonschemas (see discussion).
FYI - this discrepancy doesn't exist in the XML schemas.
@guyzyl Expressing the choice semantic in JSON Schema is very challenging. You can use oneOf or anyOf to express the combination of properties that are allowed, but the combinations are an n^2 problem that is compounded by the number of choice nodes in a given assembly.
This class of problem would be better expressed as a Metaschema constraint, which can be enforced separately from JSON schema validation.
This means that all uses of <choice> need to audited and corresponding constraints need to be created.
@david-waltermire-nist enforcing the constraints via the Metaschemas makes sense, the drawback here is that there isn't that much tooling around Metaschema, especially when compared to jsonschema / XML.
@guyzyl True. But the tooling around JSON and XML Schema is insufficient as well for our needs. Tooling will catch up.
I need to review this it appears this is a close as WONTFIX but need to double check.
At 10/12 Triage Meeting: this issue is being closed because jsonschema does not support.
