Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jinja templating enhancements #1500

Open
AleJo2995 opened this issue Jan 17, 2024 · 0 comments
Open

Jinja templating enhancements #1500

AleJo2995 opened this issue Jan 17, 2024 · 0 comments

Comments

@AleJo2995
Copy link
Collaborator

AleJo2995 commented Jan 17, 2024

Describe the bug

Jinja templating supports generating a table of parameters as follows:

{{ control_writer.write_control_with_sections(
      control, profile, group_title,
      ['statement', 'assessment-objective', 'guidance', 'table_of_parameters'],
      {
         'statement':'Statements',
         'assessment-objective':'Assessment objectives',
         'guidance':'NIST guidance',
         'table_of_parameters':'Parameters'
      },
      label_column=True,
      add_group_to_title=False
      ) | safe
   }}

The table generated looks like this:

| Parameter ID | Values | Label or Choices |
|---|---|---|
| ac-1_prm_1 |  | organization-defined personnel or roles |
| ac-01_odp.01 |  | personnel or roles |
| ac-01_odp.02 |  | personnel or roles |
| ac-01_odp.03 |  | Selection (one or more): organization-level; mission/business process-level; system-level |
| ac-01_odp.04 |  | official |
| ac-01_odp.05 |  | frequency |
| ac-01_odp.06 |  | events |
| ac-01_odp.07 |  | frequency |
| ac-01_odp.08 |  | events |
{: #"Parameters for AC-1" caption-side="top"}

But, it could use some enhancements to handle additional properties that go with parameters. This includes:

  • Information about aggregation

For params like ac-1_prm_1 that aggregate other parameters, it would be useful to indicate that in the parameters table.

            "params": [
              {
                "id": "ac-1_prm_1",
                "props": [
                  {
                    "name": "aggregates",
                    "ns": "http://csrc.nist.gov/ns/rmf",
                    "value": "ac-01_odp.01"
                  },
                  {
                    "name": "aggregates",
                    "ns": "http://csrc.nist.gov/ns/rmf",
                    "value": "ac-01_odp.02"
                  }
                ],
                "label": "organization-defined personnel or roles"
              },
  • A column for guideline prose

It would also be useful to add a column for the prose because it gives a deeper description than the label. For example, see the prose in params like ac-01_odp.01:

              {
                "id": "ac-01_odp.01",
                "props": [
                  {
                    "name": "label",
                    "value": "AC-01_ODP[01]",
                    "class": "sp800-53a"
                  }
                ],
                "label": "personnel or roles",
                "guidelines": [
                  {
                    "prose": "personnel or roles to whom the access control policy is to be disseminated is/are defined;"
                  }
                ]
              },
  • Proper handling of values and profile-values

From recent discussion, I believe values indicates a value that came from the catalog while profile-values indicates a value provided in the profile. It's not clear from the generated table what is shown in the Values column. We either need two columns or some how indicate where the value came from the the Values column.

Steps to reproduce the behavior:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior

A clear and concise description of what you expected to happen.

Screenshots / Logs.

If applicable, add screenshots to help explain your problem.

Environment

  • OS: [e.g. iOS]
  • Python version:
  • Installed packages:
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant