feat: add test 6.1.26 #214
Conversation
| } | ||
|
|
||
| pub fn from_string(category: &str) -> Self { | ||
| match category { |
There was a problem hiding this comment.
Should we do a to_lower here? I would expect it to match if the casing is different.
There was a problem hiding this comment.
I would argue that that is explicitly not the case. Test 6.1.26 and the profile tests (6.1.27.x) that make heavy use of this mention an explicit list of document category strings to be checked against. Example from 6.1.26 from CSAF 2.0:
For CSAF 2.0, the test must be skipped for the following values in /document/category:
csaf_base
csaf_security_incident_response
csaf_informational_advisory
csaf_security_advisory
csaf_vex
In the context of 6.1.26, csaf_vEx should hit the "leading csaf_ substring without being known document category" error and Csaf_vex and Csaf_Vex should hit the "document category too similar to 'csaf_vex'" error.
There was a problem hiding this comment.
@tschmidtb51 will discussing this with @tziemek, we came up on two cases that we are unsure how to handle:
First, if the category string is csafvex, there isn't a reserved prefix csaf_, so we would lowercase it for the case-insensitive comparison, remove all whitespace, hyphen and underscore, of which there are none, so the value for the comparison is csafvex.
This would be compared to csaf_vex, which when applied the same steps, gives the value for the comparison vex.
The comparison would be csafvex vs vex, which would not match, and so csafvex would be a valid value.
We could circumvent this by removing all remove all whitespace, hyphen and underscores first, then checking for the csaf (without the appended _) prefix, then lowercasing.
But for this, we would need to look a csaf prefix instead of a csaf_ prefix.
Second, we are unsure if how casing should be handled when the case-insensitive characters are all correct, i.e. Csaf_vex, Csaf_Vex, csaf_Vex. In chapter 4.1, the following is given:
The value of /document/category SHALL NOT be equal to any value that is intended to only be used by another profile nor to the (case insensitive) name of any other profile from the standard.
Does the "(case insensitive)" apply to the "any value that is intended to only be used by another profile" here too?
Resolves #99