[OVAL DEVELOPER] [Non-DoD Source] Re: Oval feature recommendation string 'replace' function

Vanderpol, Jack R CIV USN SPAWARSYSCEN LANT SC (US) jack.r.vanderpol.civ at mail.mil
Wed Jul 25 08:30:40 EDT 2018

Sure I'll give it a try.

Jack Vander Pol
SPAWAR Systems Center Atlantic

From: David Solin [solin at jovalcm.com]
Sent: Tuesday, July 24, 2018 6:54 PM
Cc: oval_developer at lists.cisecurity.org
Subject: [Non-DoD Source] Re: [OVAL DEVELOPER] Oval feature recommendation string 'replace' function

All active links contained in this email were disabled. Please verify the identity of the sender, and confirm the authenticity of all links contained within the message prior to copying and pasting the address to a Web browser.


Hi Jack,

I was going to suggest: "why not use the ReplaceFunctionType" … but then I discovered there simply is no such thing!  I feel like someone proposed this before, but perhaps I only dreamed it.

I can’t think of any other way to achieve what you want to do.  Do you want to write up a proposal for a new function?

Best regards,
—David Solin

On Jul 24, 2018, at 2:28 PM, Vanderpol, Jack R CIV USN SPAWARSYSCEN LANT SC (US) <jack.r.vanderpol.civ at mail.mil < Caution-mailto:jack.r.vanderpol.civ at mail.mil > > wrote:

I'm writing some content, and obtaining data from textfilecontent54 subexpression, and it has some undesirable data that I'd like to quickly replace with the "correct" data, before using in another object.   I was thinking that I might be able to replicate the functionality of a 'replace' with a combination of a split and concat, but after looking at other samples of concat, I don't think I'm going to end up with a single string.

If anyone has any methods in OVAL to replace a substring and make a new string I'd appreciate it.   I'm hoping to be flamed, that I missed something trivial, so feel free to blast away.

I'm parsing the deployment.config file in Java 8 to see what the path is to the https://protect-us.mimecast.com/s/BJiLCADXBjCLx59sGUekJ?domain=deployment.properties < https://protect-us.mimecast.com/s/OS_GCBBXDlfpxNVU6b0SB?domain=deployment.properties >  file is, but they intentionally use forward slashes instead of backslashes on Windows.  While using forward slashes in Windows filepaths may work, I didn't wasn't to assume it would work as expected in all SCAP tools, as a valid Windows path.



Desired Output:


If I split my original string with /, I suspect I'll get back a variable with

https://protect-us.mimecast.com/s/BJiLCADXBjCLx59sGUekJ?domain=deployment.properties < https://protect-us.mimecast.com/s/OS_GCBBXDlfpxNVU6b0SB?domain=deployment.properties >

If I then concat each with \ I'll end up with
https://protect-us.mimecast.com/s/q0dUCDkZGptN7ZBTA8p-u?domain=deployment.properties < https://protect-us.mimecast.com/s/X09aCERXJriVwjWsPHssV?domain=deployment.properties >  (which I don't want either...)

Then I'm unsure if or how to glue my multiple element variable back to a single string.

So, just checking to see if I'm offtrack or if a regex replace substring function would be useful in OVAL?

Jack Vander Pol

OVAL_Developer mailing list
OVAL_Developer at lists.cisecurity.org < Caution-mailto:OVAL_Developer at lists.cisecurity.org >
https://protect-us.mimecast.com/s/5WtJCG6XLyHKr9JFkjcVh < https://protect-us.mimecast.com/s/5WtJCG6XLyHKr9JFkjcVh >

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cisecurity.org/pipermail/oval_developer_lists.cisecurity.org/attachments/20180725/191dd479/attachment-0001.html>

More information about the OVAL_Developer mailing list