Description
When deserializing OSCAL YAML/JSON content, metaschema-java incorrectly requires properties from both alternatives of a choice element, rather than accepting one or the other.
Example
In OSCAL's control-selection assembly, there is a choice between:
include-all (empty element)include-controls (array of control references)
Similarly, control-objective-selection has a choice between:
include-allinclude-objectives
When providing valid YAML with include-controls:
reviewed-controls:
control-selections:
- include-controls:
- control-id: ac-8metaschema-java throws:
Missing required property 'include-all' in 'control-selection'
The same occurs for control-objective-selection when using include-objectives.
Expected Behavior
A choice element should accept one of its alternatives, not require all of them. The presence of include-controls should satisfy the choice without requiring include-all.
Environment
Workaround
Currently, using include-all: {} instead of include-controls or include-objectives works, but this changes the semantics (selects all vs. specific items).
Description
When deserializing OSCAL YAML/JSON content, metaschema-java incorrectly requires properties from both alternatives of a choice element, rather than accepting one or the other.
Example
In OSCAL's
control-selectionassembly, there is a choice between:include-all(empty element)include-controls(array of control references)Similarly,
control-objective-selectionhas a choice between:include-allinclude-objectivesWhen providing valid YAML with
include-controls:metaschema-java throws:
The same occurs for
control-objective-selectionwhen usinginclude-objectives.Expected Behavior
A choice element should accept one of its alternatives, not require all of them. The presence of
include-controlsshould satisfy the choice without requiringinclude-all.Environment
Workaround
Currently, using
include-all: {}instead ofinclude-controlsorinclude-objectivesworks, but this changes the semantics (selects all vs. specific items).