OVAL - Validating an OVAL Document

Validating an OVAL Document

Introduction | W3C Schema Validation | Schematron Validation | References

Introduction

The structure of an XML document written in OVAL is guided by an XML schema. This schema determines things such as what entities are available to specific tests and the order of objects and states within the language. The goal of validation is enforce a common and expected structure amongst the OVAL documents being passed between different users. This allows tools to be written against this expectation.

In a way, validation makes sure that an OVAL document is in fact an OVAL document.

Note that an OVAL document could be an OVAL Definition file, an OVAL System Characteristics file, or an OVAL Results file.

W3C Schema Validation

W3C Schema, also known as XSD, is an XML format used to describe things like elements and types that are found within a specific XML instance document. A XML document is an OVAL document when it validates against the OVAL W3C Schema.

Performing this validation step is provided in most XML tools. You will usually need to place the OVAL documents in the same directory as the OVAL Schema files. This requirement can be worked around but will not be discussed here.

Once all the files are in the same directory, use your XML tool to open up the OVAL document you wish to validate. Then find the menu item that says Validate XML. You should be presented with a success or failure result and any problems should be pointed reported. Of course, each tool is different so consult your specific tool's documentation for more details.

For those working on developing OVAL-Compatible tools, W3C Schema validation can be performed behind the scenes and hidden from the user. Libraries are in many of the most popular languages and can be added to your code to perform the necessary validation. Validation of incoming documents is generally a good idea as it makes certain that it is an OVAL document that is being worked on. Some popular code libraries are included in the References below.

Schematron Validation

Unfortunately, there are many things that cannot be validated with W3C Schema. Maybe the most pertinent example is trying to validate that a particular element exists based on the value of an attribute. To validate these types of conditions, ISO Schematron rules have been included with the OVAL Schema.

The process of Schematron Validation is a bit more complex than W3C Schema Validation. The Schematron rules found imbedded within the OVAL Schema must be collected into their own file. This can be done one of two ways. The first (and by far the simplest) is to download the Schematron file from the OVAL Web site. The other is to use an XSL Stylesheet to pull the Schematron rules out from the OVAL Schema.

Once a copy of the OVAL Schematron file has been found/generated, a Schematron implementation can be used to perform the validation. There are many different types of Schematron implementations available. Some convert the Schematron file into a XSL stylesheet and use standard XSL tools to perform the validation. Others read in the Schematron file directly and perform Schematron validation in a similar way to W3C Schema validation.

As with W3C Schema validation, Schematron can be imbedded inside the code of an OVAL-Compatible tool. Schematron libraries have been for most major programming languages. See the References section below for some popular code libraries.