Ordered Description List (#1214)

Enhancements to convert unordered lists to ordered description lists in report tables.

---------

Co-authored-by: Roy Lane <rlane@mitre.org>

.regal/config.yaml

@@ -46,6 +46,7 @@ rules:
         - data.utils.FailTestNonCompliant
         - data.utils.FailTestNoEvent
         - data.utils.FailTestResult
+        - data.utils.NonCompliantMessage
         - data.utils.PassTestResult
         - data.utils.PassTestResultWithMessage
         - data.utils.TestResult

scubagoggles/Testing/Unit/Python/reporter/test_reporter.py

@@ -54,9 +54,9 @@ class TestReporter:
                     "Criticality": "Should",
                     "Details": (
                         "The following OUs are non-compliant:\n"
-                        "<ul>\n"
+                        "<ol>\n"
                         "  <li>Terry Hahn's OU: Mail delegation is enabled</li>\n"
-                        "</ul>"
+                        "</ol>"
                     ),
                 },
                 {
@@ -66,9 +66,9 @@ class TestReporter:
                     "Criticality": "Should",
                     "Details": (
                         "The following OUs are non-compliant:\n"
-                        "<ul>\n"
+                        "<ol>\n"
                         "  <li>Terry Hahn's OU: DKIM is not enabled</li>\n"
-                        "</ul>"
+                        "</ol>"
                     ),
                 },
             ],
@@ -456,9 +456,9 @@ class TestReporter:
                 "Criticality": "Should",
                 "ReportDetails": (
                     "The following OUs are non-compliant:\n"
-                    "<ul>\n"
+                    "<ol>\n"
                     "  <li>Terry Hahn's OU: Mail delegation is enabled</li>\n"
-                    "</ul>"
+                    "</ol>"
                 ),
                 "ActualValue": { "NonCompliantOUs": ["Terry Hahn's OU"] },
                 "RequirementMet": False,
@@ -503,9 +503,9 @@ class TestReporter:
                 "Criticality": "Should",
                 "Details": (
                     "The following OUs are non-compliant:\n"
-                    "<ul>\n"
+                    "<ol>\n"
                     "  <li>Terry Hahn's OU: Mail delegation is enabled</li>\n"
-                    "</ul>"
+                    "</ol>"
                 ),
                 "OmittedEvaluationResult": "N/A",
                 "OmittedEvaluationDetails": "N/A",

scubagoggles/Testing/Unit/Python/test_orchestrator.py

@@ -341,7 +341,7 @@ class TestOrchestrator:
                                 'Criticality': 'Should',
                                 'Details': (
                                     'The following OUs are non-compliant:'
-                                    '<ul><li>Example OU: enabled</li></ul>'
+                                    '<ol><li>Example OU: enabled</li></ol>'
                                 ),
                             },
                             {

scubagoggles/Testing/Unit/Rego/chat/chat05_test.rego

@@ -1,6 +1,17 @@
 package chat
 import future.keywords
 
+import data.utils.FailTestOUNonCompliant
+import data.utils.FailTestResult
+import data.utils.NonCompliantMessage
+
+ChatNonCompliantMessage(GroupsOrOU, Listing) := message if {
+
+    ouMessage := NonCompliantMessage(GroupsOrOU, Listing)
+
+    message := sprintf("%s<br>%s", [ouMessage, Chat5Warning])
+}
+
 #
 # GWS.CHAT.5.1
 #--
@@ -309,16 +320,12 @@ test_Enable_Incorrect_V1 if {
         }
     }
 
-    RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
-    count(RuleOutput) == 1
-    not RuleOutput[0].RequirementMet
-    not RuleOutput[0].NoSuchEvent
-    RuleOutput[0].ReportDetails == concat("", [
-        "The following OUs are non-compliant:<ul>",
-        "<li>Test Top-Level OU: Content reporting for 1:1 direct messages is disabled.</li></ul>",
-        "<br>",
-        Chat5Warning
-    ])
+    failedOU := [{"Name": "Test Top-Level OU",
+                "Value": "Content reporting for 1:1 direct messages is disabled."}]
+
+    expectedMessage := ChatNonCompliantMessage("OUs", failedOU)
+
+    FailTestResult(PolicyId, Output, expectedMessage)
 }
 
 test_Enable_Incorrect_V2 if {
@@ -372,16 +379,12 @@ test_Enable_Incorrect_V2 if {
         }
     }
 
-    RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
-    count(RuleOutput) == 1
-    not RuleOutput[0].RequirementMet
-    not RuleOutput[0].NoSuchEvent
-    RuleOutput[0].ReportDetails == concat("", [
-        "The following OUs are non-compliant:<ul>",
-        "<li>Test Top-Level OU: Content reporting for spaces is restricted to discoverable spaces only.</li></ul>",
-        "<br>",
-        Chat5Warning
-    ])
+    failedOU := [{"Name": "Test Top-Level OU",
+                "Value": "Content reporting for spaces is restricted to discoverable spaces only."}]
+
+    expectedMessage := ChatNonCompliantMessage("OUs", failedOU)
+
+    FailTestResult(PolicyId, Output, expectedMessage)
 }
 
 test_Enable_Incorrect_V3 if {
@@ -475,16 +478,12 @@ test_Enable_Incorrect_V3 if {
         }
     }
 
-    RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
-    count(RuleOutput) == 1
-    not RuleOutput[0].RequirementMet
-    not RuleOutput[0].NoSuchEvent
-    RuleOutput[0].ReportDetails == concat("", [
-        "The following OUs are non-compliant:<ul>",
-        "<li>Other OU: Content reporting for spaces is disabled.</li></ul>",
-        "<br>",
-        Chat5Warning
-    ])
+    failedOU := [{"Name": "Other OU",
+                "Value": "Content reporting for spaces is disabled."}]
+
+    expectedMessage := ChatNonCompliantMessage("OUs", failedOU)
+
+    FailTestResult(PolicyId, Output, expectedMessage)
 }
 
 test_Enable_Incorrect_V4 if {
@@ -708,14 +707,10 @@ test_Categories_Incorrect_V1 if {
         }
     }
 
-    RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
-    count(RuleOutput) == 1
-    not RuleOutput[0].RequirementMet
-    not RuleOutput[0].NoSuchEvent
-    RuleOutput[0].ReportDetails == concat("", [
-        "The following OUs are non-compliant:<ul>",
-        "<li>Test Top-Level OU: The following reporting types are disabled: other</li></ul>"
-    ])
+    failedOU := [{"Name": "Test Top-Level OU",
+                  "Value": "The following reporting types are disabled: other"}]
+
+    FailTestOUNonCompliant(PolicyId, Output, failedOU)
 }
 
 test_Categories_Incorrect_V2 if {
@@ -765,14 +760,10 @@ test_Categories_Incorrect_V2 if {
         }
     }
 
-    RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
-    count(RuleOutput) == 1
-    not RuleOutput[0].RequirementMet
-    not RuleOutput[0].NoSuchEvent
-    RuleOutput[0].ReportDetails == concat("", [
-        "The following OUs are non-compliant:<ul>",
-        "<li>Other OU: The following reporting types are disabled: harassment</li></ul>"
-    ])
+    failedOU := [{"Name": "Other OU",
+                  "Value": "The following reporting types are disabled: harassment"}]
+
+    FailTestOUNonCompliant(PolicyId, Output, failedOU)
 }
 
 test_Categories_Incorrect_V3 if {

scubagoggles/Testing/Unit/Rego/gemini/gemini01_test.rego

@@ -1,6 +1,9 @@
 package gemini
 import future.keywords
 
+import data.utils.FailTestGroupNonCompliant
+import data.utils.FailTestOUNonCompliant
+
 #
 # GWS.GEMINI.1.1
 #--
@@ -167,14 +170,10 @@ test_1_1_Incorrect_V1 if {
         }
     }
 
-    RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
-    count(RuleOutput) == 1
-    not RuleOutput[0].RequirementMet
-    not RuleOutput[0].NoSuchEvent
-    RuleOutput[0].ReportDetails == concat("", [
-        "The following OUs are non-compliant:<ul>",
-        "<li>topOU: Gemini access regardless of license is enabled.</li></ul>"
-    ])
+    failedOU := [{"Name": "topOU",
+                  "Value": "Gemini access regardless of license is enabled."}]
+
+    FailTestOUNonCompliant(PolicyId, Output, failedOU)
 }
 
 test_1_1_Incorrect_V2 if {
@@ -220,13 +219,9 @@ test_1_1_Incorrect_V2 if {
         }
     }
 
-    RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
-    count(RuleOutput) == 1
-    not RuleOutput[0].RequirementMet
-    not RuleOutput[0].NoSuchEvent
-    RuleOutput[0].ReportDetails == concat("", [
-        "The following groups are non-compliant:<ul>",
-        "<li>group1: Gemini access regardless of license is enabled.</li></ul>"
-    ])
+    failedOU := [{"Name": "group1",
+                  "Value": "Gemini access regardless of license is enabled."}]
+
+    FailTestGroupNonCompliant(PolicyId, Output, failedOU)
 }
 #--

scubagoggles/Testing/Unit/Rego/gemini/gemini02_test.rego

@@ -1,6 +1,9 @@
 package gemini
 import future.keywords
 
+import data.utils.FailTestGroupNonCompliant
+import data.utils.FailTestOUNonCompliant
+
 #
 # GWS.GEMINI.2.1
 #--
@@ -131,14 +134,10 @@ test_2_1_Incorrect_V1 if {
         }
     }
 
-    RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
-    count(RuleOutput) == 1
-    not RuleOutput[0].RequirementMet
-    not RuleOutput[0].NoSuchEvent
-    RuleOutput[0].ReportDetails == concat("", [
-        "The following OUs are non-compliant:<ul>",
-        "<li>topOU: Gemini Beta features are enabled.</li></ul>"
-    ])
+    failedOU := [{"Name": "topOU",
+                  "Value": "Gemini Beta features are enabled."}]
+
+    FailTestOUNonCompliant(PolicyId, Output, failedOU)
 }
 
 test_2_1_Incorrect_V2 if {
@@ -184,14 +183,10 @@ test_2_1_Incorrect_V2 if {
         }
     }
 
-    RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
-    count(RuleOutput) == 1
-    not RuleOutput[0].RequirementMet
-    not RuleOutput[0].NoSuchEvent
-    RuleOutput[0].ReportDetails == concat("", [
-        "The following groups are non-compliant:<ul>",
-        "<li>group1: Gemini Beta features are enabled.</li></ul>"
-    ])
+    failedOU := [{"Name": "group1",
+                  "Value": "Gemini Beta features are enabled."}]
+
+    FailTestGroupNonCompliant(PolicyId, Output, failedOU)
 }
 
 test_2_1_Incorrect_V3 if {
@@ -223,14 +218,10 @@ test_2_1_Incorrect_V3 if {
         }
     }
 
-    RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
-    count(RuleOutput) == 1
-    not RuleOutput[0].RequirementMet
-    not RuleOutput[0].NoSuchEvent
-    RuleOutput[0].ReportDetails == concat("", [
-        "The following OUs are non-compliant:<ul>",
-        "<li>topOU: Gemini Beta features are enabled.</li></ul>"
-    ])
+    failedOU := [{"Name": "topOU",
+                  "Value": "Gemini Beta features are enabled."}]
+
+    FailTestOUNonCompliant(PolicyId, Output, failedOU)
 }
 
 test_2_1_Correct_V3 if {
@@ -347,14 +338,10 @@ test_2_1_Incorrect_V4 if {
         }
     }
 
-    RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
-    count(RuleOutput) == 1
-    not RuleOutput[0].RequirementMet
-    not RuleOutput[0].NoSuchEvent
-    RuleOutput[0].ReportDetails == concat("", [
-        "The following OUs are non-compliant:<ul>",
-        "<li>topOU: Gemini Beta features are enabled.</li></ul>"
-    ])
+    failedOU := [{"Name": "topOU",
+                  "Value": "Gemini Beta features are enabled."}]
+
+    FailTestOUNonCompliant(PolicyId, Output, failedOU)
 }
 
 test_2_1_Incorrect_V5 if {
@@ -399,13 +386,9 @@ test_2_1_Incorrect_V5 if {
         }
     }
 
-    RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
-    count(RuleOutput) == 1
-    not RuleOutput[0].RequirementMet
-    not RuleOutput[0].NoSuchEvent
-    RuleOutput[0].ReportDetails == concat("", [
-        "The following OUs are non-compliant:<ul>",
-        "<li>topOU: Gemini Beta features are enabled.</li></ul>"
-    ])
+    failedOU := [{"Name": "topOU",
+                  "Value": "Gemini Beta features are enabled."}]
+
+    FailTestOUNonCompliant(PolicyId, Output, failedOU)
 }
 #--

scubagoggles/Testing/Unit/Rego/gmail/gmail13_test.rego

@@ -1,6 +1,8 @@
 package gmail
 import future.keywords
 
+import data.utils.FailTestOUNonCompliant
+
 #
 # GWS.GMAIL.13.1
 #--
@@ -223,12 +225,10 @@ test_ExternalReplyWarning_Incorrect_V2 if {
         }
     }
 
-    RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
-    count(RuleOutput) == 1
-    not RuleOutput[0].RequirementMet
-    not RuleOutput[0].NoSuchEvent
-    RuleOutput[0].ReportDetails == concat("", ["The following OUs are non-compliant:<ul><li>Test Top-Level OU: ",
-        "Warn for external participants is set to disabled</li></ul>"])
+    failedOU := [{"Name": "Test Top-Level OU",
+                  "Value": "Warn for external participants is set to disabled"}]
+
+    FailTestOUNonCompliant(PolicyId, Output, failedOU)
 }
 
 test_ExternalReplyWarning_Incorrect_V3 if {
@@ -268,12 +268,10 @@ test_ExternalReplyWarning_Incorrect_V3 if {
         },
     }
 
-    RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
-    count(RuleOutput) == 1
-    not RuleOutput[0].RequirementMet
-    not RuleOutput[0].NoSuchEvent
-    RuleOutput[0].ReportDetails == concat("", ["The following OUs are non-compliant:<ul><li>Test Top-Level OU: ",
-        "Warn for external participants is set to disabled</li></ul>"])
+    failedOU := [{"Name": "Test Top-Level OU",
+                  "Value": "Warn for external participants is set to disabled"}]
+
+    FailTestOUNonCompliant(PolicyId, Output, failedOU)
 }
 
 test_ExternalReplyWarning_Incorrect_V4 if {
@@ -300,12 +298,10 @@ test_ExternalReplyWarning_Incorrect_V4 if {
         }
     }
 
-    RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
-    count(RuleOutput) == 1
-    not RuleOutput[0].RequirementMet
-    not RuleOutput[0].NoSuchEvent
-    RuleOutput[0].ReportDetails == concat("", ["The following OUs are non-compliant:<ul><li>Secondary OU: ",
-        "Warn for external participants is set to disabled</li></ul>"])
+    failedOU := [{"Name": "Secondary OU",
+                  "Value": "Warn for external participants is set to disabled"}]
+
+    FailTestOUNonCompliant(PolicyId, Output, failedOU)
 }
 
 test_ExternalReplyWarning_Incorrect_V5 if {
@@ -345,11 +341,9 @@ test_ExternalReplyWarning_Incorrect_V5 if {
         },
     }
 
-    RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
-    count(RuleOutput) == 1
-    not RuleOutput[0].RequirementMet
-    not RuleOutput[0].NoSuchEvent
-    RuleOutput[0].ReportDetails == concat("", ["The following OUs are non-compliant:<ul><li>Secondary OU: ",
-        "Warn for external participants is set to disabled</li></ul>"])
+    failedOU := [{"Name": "Secondary OU",
+                  "Value": "Warn for external participants is set to disabled"}]
+
+    FailTestOUNonCompliant(PolicyId, Output, failedOU)
 }
 #--

scubagoggles/Testing/Unit/Rego/gmail/gmail16_test.rego

@@ -1,6 +1,8 @@
 package gmail
 import future.keywords
 
+import data.utils.FailTestOUNonCompliant
+
 #
 # GWS.GMAIL.16.1
 #--
@@ -199,12 +201,10 @@ test_SecuritySandbox_Incorrect_V2 if {
         }
     }
 
-    RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
-    count(RuleOutput) == 1
-    not RuleOutput[0].RequirementMet
-    not RuleOutput[0].NoSuchEvent
-    RuleOutput[0].ReportDetails == concat("", ["The following OUs are non-compliant:<ul><li>Test Top-Level OU: ",
-        "Security sandbox is disabled</li></ul>"])
+    failedOU := [{"Name": "Test Top-Level OU",
+                  "Value": "Security sandbox is disabled"}]
+
+    FailTestOUNonCompliant(PolicyId, Output, failedOU)
 }
 
 test_SecuritySandbox_Incorrect_V3 if {
@@ -238,12 +238,10 @@ test_SecuritySandbox_Incorrect_V3 if {
         },
     }
 
-    RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
-    count(RuleOutput) == 1
-    not RuleOutput[0].RequirementMet
-    not RuleOutput[0].NoSuchEvent
-    RuleOutput[0].ReportDetails == concat("", ["The following OUs are non-compliant:<ul><li>Test Top-Level OU: ",
-        "Security sandbox is disabled</li></ul>"])
+    failedOU := [{"Name": "Test Top-Level OU",
+                  "Value": "Security sandbox is disabled"}]
+
+    FailTestOUNonCompliant(PolicyId, Output, failedOU)
 }
 
 test_SecuritySandbox_Incorrect_V4 if {
@@ -267,12 +265,10 @@ test_SecuritySandbox_Incorrect_V4 if {
         }
     }
 
-    RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
-    count(RuleOutput) == 1
-    not RuleOutput[0].RequirementMet
-    not RuleOutput[0].NoSuchEvent
-    RuleOutput[0].ReportDetails == concat("", ["The following OUs are non-compliant:<ul><li>Secondary OU: ",
-        "Security sandbox is disabled</li></ul>"])
+    failedOU := [{"Name": "Secondary OU",
+                  "Value": "Security sandbox is disabled"}]
+
+    FailTestOUNonCompliant(PolicyId, Output, failedOU)
 }
 
 test_SecuritySandbox_Incorrect_V5 if {
@@ -306,12 +302,9 @@ test_SecuritySandbox_Incorrect_V5 if {
         },
     }
 
-    RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
-    count(RuleOutput) == 1
-    not RuleOutput[0].RequirementMet
-    not RuleOutput[0].NoSuchEvent
-    RuleOutput[0].ReportDetails == concat("", ["The following OUs are non-compliant:<ul><li>Secondary OU: ",
-        "Security sandbox is disabled</li></ul>"])
+    failedOU := [{"Name": "Secondary OU",
+                  "Value": "Security sandbox is disabled"}]
+
+    FailTestOUNonCompliant(PolicyId, Output, failedOU)
 }
 #--
-

scubagoggles/orchestrator.py

@@ -370,11 +370,11 @@ class Orchestrator:
 
                     if 'Requirement' in control:
                         control["Requirement"] = control["Requirement"].strip()
-                        if "<ul>" in control["Details"]:
-                            control["Details"] = control ["Details"].replace("<ul>", " ")
+                        if "<ol>" in control["Details"]:
+                            control["Details"] = control ["Details"].replace("<ol>", " ")
                             control["Details"] = control ["Details"].replace("<li>", "\n- ")
                             control["Details"] = control ["Details"].replace("</li>", " ")
-                            control["Details"] = control ["Details"].replace("</ul>", "")
+                            control["Details"] = control ["Details"].replace("</ol>", "")
                             control["Details"] = control["Details"].strip()
 
                         # Check if the control result is "Fail"

scubagoggles/rego/Utils.rego

@@ -57,9 +57,10 @@ EnumGroupSettings(NonCompGroups) := NonCompliantMessage("groups", NonCompGroups)
 # Create a html formatted list detailing the settings for each OU/group
 # - Listing: a set of dicts, each with a "Name" and "Value" fields
 NonCompliantMessage(GroupsOrOU, Listing) := message if {
-    items := [concat("", ["<li>", item.Name, ": ", item.Value, "</li>"])
+    items := [sprintf("\n<li><dl><dt>%s</dt><dd>%s</dd></dl></li>",
+                     [item.Name, item.Value])
               | some item in Listing]
-    message := sprintf("The following %s are non-compliant:<ul>%s</ul>",
+    message := sprintf("The following %s are non-compliant:\n<ol>%s\n</ol>\n",
                        [GroupsOrOU, concat("", items)])
 }
 

scubagoggles/reporter/reporter_html.py

@@ -190,8 +190,8 @@ def convert_html_lists_to_plaintext(text: str) -> str:
 
     if not isinstance(text, str):
         return text
-    text = text.replace('<ul>', ' ')
-    text = text.replace('</ul>', '')
+    text = text.replace('<ol>', ' ')
+    text = text.replace('</ol>', '')
     text = text.replace('<li>', '\n- ')
     text = text.replace('</li>', ' ')
     return text.strip()

scubagoggles/reporter/styles/main.css

@@ -55,6 +55,14 @@ body {
     color: var(--text-color)
 }
 
+ol {
+    padding-inline-start: 16px;
+}
+
+dd {
+    margin-left: 1rem;
+}
+
 #baseline-docs {
     width: 6.25rem;
 }