usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 14:03:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

$ODV value not replaced correctly in nested dict #82

New Issue
Closed
opened 2026-01-19 18:29:10 +00:00 by michael · 1 comment
michael commented 2026-01-19 18:29:10 +00:00
Owner
Copy Link

Originally created by @adrian-ib on GitHub.

Originally assigned to: @brodjieski on GitHub.

Summary

$ODV value not replaced correctly in nested dict

Steps to reproduce

  1. git checkout sonoma
  2. run: ./scripts/generate_guidance.py -p baselines/DISA-STIG.yaml
  3. check generated profile: com.apple.mobiledevice.passwordpolicy.plist
  4. The key customRegex is incorrect

What is the current bug behavior?

The profile com.apple.mobiledevice.passwordpolicy.plist is not generated correctly:

<dict>
	<key>customRegex</key>
	<string>^(?=.*[A-Z])(?=.*[a-z]).*$</string>
	<key>maxFailedAttempts</key>
	<integer>3</integer>
	<key>maxPINAgeInDays</key>
	<integer>60</integer>
	<key>minComplexChars</key>
	<integer>1</integer>
	<key>minLength</key>
	<integer>14</integer>
	<key>minutesUntilFailedLoginReset</key>
	<integer>15</integer>
	<key>pinHistory</key>
	<integer>5</integer>
	<key>requireAlphanumeric</key>
	<true/>
</dict>

What is the expected correct behavior?

If the same profile is generated in the main branch instead of the sonoma branch it works properly:

<dict>
	<key>customRegex</key>
	<dict>
		<key>passwordContentDescription</key>
		<dict>
			<key>default</key>
			<string>Password must match custom regex.</string>
		</dict>
		<key>passwordContentRegex</key>
		<string>^(?=.*[A-Z])(?=.*[a-z]).*$</string>
	</dict>
	<key>maxFailedAttempts</key>
	<integer>3</integer>
	<key>maxPINAgeInDays</key>
	<integer>60</integer>
	<key>minComplexChars</key>
	<integer>1</integer>
	<key>minLength</key>
	<integer>14</integer>
	<key>minutesUntilFailedLoginReset</key>
	<integer>15</integer>
	<key>pinHistory</key>
	<integer>5</integer>
	<key>requireAlphanumeric</key>
	<true/>
</dict>

Possible fixes

Take into account nested dicts when replacing the $ODV value

Originally created by @adrian-ib on GitHub. Originally assigned to: @brodjieski on GitHub. ### Summary $ODV value not replaced correctly in nested dict ### Steps to reproduce 1. git checkout sonoma 2. run: `./scripts/generate_guidance.py -p baselines/DISA-STIG.yaml` 3. check generated profile: `com.apple.mobiledevice.passwordpolicy.plist` 4. The key customRegex is incorrect ### What is the current *bug* behavior? The profile `com.apple.mobiledevice.passwordpolicy.plist` is not generated correctly: ``` <dict> <key>customRegex</key> <string>^(?=.*[A-Z])(?=.*[a-z]).*$</string> <key>maxFailedAttempts</key> <integer>3</integer> <key>maxPINAgeInDays</key> <integer>60</integer> <key>minComplexChars</key> <integer>1</integer> <key>minLength</key> <integer>14</integer> <key>minutesUntilFailedLoginReset</key> <integer>15</integer> <key>pinHistory</key> <integer>5</integer> <key>requireAlphanumeric</key> <true/> </dict> ``` ### What is the expected *correct* behavior? If the same profile is generated in the main branch instead of the sonoma branch it works properly: ``` <dict> <key>customRegex</key> <dict> <key>passwordContentDescription</key> <dict> <key>default</key> <string>Password must match custom regex.</string> </dict> <key>passwordContentRegex</key> <string>^(?=.*[A-Z])(?=.*[a-z]).*$</string> </dict> <key>maxFailedAttempts</key> <integer>3</integer> <key>maxPINAgeInDays</key> <integer>60</integer> <key>minComplexChars</key> <integer>1</integer> <key>minLength</key> <integer>14</integer> <key>minutesUntilFailedLoginReset</key> <integer>15</integer> <key>pinHistory</key> <integer>5</integer> <key>requireAlphanumeric</key> <true/> </dict> ``` ### Possible fixes Take into account nested dicts when replacing the $ODV value
michael commented 2026-01-19 18:29:11 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

Regression from syncing branches and our silly system. Fixed now.

@robertgendler commented on GitHub: Regression from syncing branches and our silly system. Fixed now.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#82
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?