Skip to content

fix(examples): make example documents schema-valid and resolvable #163

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
gronke wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

fix(examples): make example documents schema-valid and resolvable #163

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9243f75
fix(dtd): correct schema gaps so valid documents validate
gronke Jun 10, 2026
159ec77
fix(examples): make example documents schema-valid and resolvable
gronke Jun 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions doc/examples/client_info.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../source/client_info.xml
16 changes: 9 additions & 7 deletions doc/examples/examplefinding.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,20 @@
<?xml version="1.0" encoding="UTF-8"?>
<finding threatLevel="Moderate" type="Escalation">
<?xml version="1.0" encoding="utf-8"?>
<finding threatLevel="Moderate"
type="Escalation"
>
<title>Example Title</title>
<description>
<description>
A specialized piece of malware can be crafted to bypass local anti-virus software and to cheat during tests.
</description>
<technicaldescription>
<technicaldescription>
The student desks run antivirus software that will prevent many common remote access and malware tools that students may use to try and cheat. It is however still possible to use common tools to evade detection by the anti-virus software. Note that to run the custom malware, a student needs to have found an arbitrary file execution bug first.

To exploit this vulnerability, we used 'veil-evasion' to build an undetected Meterpreter reverse TCP executable that connects back to an external computer and allows for remote access. See https://www.veil-framework.com/veil-tutorial/ for details.
</technicaldescription>
<impact>
<impact>
A student may use this malware to have an accomplice at a remote location assist in the test by viewing screenshots of the student desk and reading/modifying files on the student desk. The setup for this can be done very quickly - before the test even starts - and will leave no obvious visible clues that something fishy has happened.
</impact>
<recommendation>
<recommendation>
Allow only a set of whitelisted programs to be executed. Base restrictions on file contents, e.g. by comparing agains one or more strong file hashes.
</recommendation>
</finding>
214 changes: 118 additions & 96 deletions doc/examples/examplegenericdocument.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,101 +1,123 @@
<?xml version="1.0" encoding="UTF-8"?>
<generic_document xmlns:xi="http://www.w3.org/2001/XInclude" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="../dtd/genericdocument.xsd">
<meta>
<title>Generic Document</title>
<subtitle>It can be about ANYTHING you want!</subtitle>
<collaborators>
<reviewers>
<reviewer>Melanie Rieback</reviewer>
</reviewers>
<approver>
<name>Melanie Rieback</name>
<bio>Melanie Rieback is a former Asst. Prof. of Computer Science from the VU,
<?xml version="1.0" encoding="utf-8"?>
<generic_document xmlns:xi="http://www.w3.org/2001/XInclude"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:noNamespaceSchemaLocation="../dtd/genericdocument.xsd"
>
<meta>
<title>Generic Document</title>
<subtitle>It can be about ANYTHING you want!</subtitle>
<collaborators>
<reviewers>
<reviewer>Melanie Rieback</reviewer>
</reviewers>
<approver>
<name>Melanie Rieback</name>
<bio>Melanie Rieback is a former Asst. Prof. of Computer Science from the VU,
who is also the co-founder/CEO of Radically Open Security.</bio>
</approver>
</collaborators>
<classification>Confidential</classification>
<version_history>
<version date="2015-01-19T01:00:00" number="auto">
<v_author>Patricia Piolon</v_author>
<v_description>Initial draft</v_description>
</version>
<version date="2015-01-20T01:00:00" number="auto">
<v_author>Ernest Hemingway</v_author>
<v_description>Structure &amp; contents revision</v_description>
</version>
<version date="2015-01-21T01:00:00" number="auto">
<v_author>Patricia Piolon</v_author>
<v_description>Added some stuff</v_description>
</version>
<version date="2015-01-22T01:00:00" number="auto">
<v_author>Patricia Piolon</v_author>
<v_author>JRR Tolkien</v_author>
<v_description>Revision</v_description>
</version>
<version date="2015-01-23T01:00:00" number="auto">
<v_author>Patricia Piolon</v_author>
<v_description>Revision</v_description>
</version>
<version date="2015-01-26T01:00:00" number="1.0">
<v_author>Arthur Conan Doyle</v_author>
<v_description>Finalizing</v_description>
</version>
</version_history>
<xi:include href="snippets/company_info.xml"/>
</meta>

<generate_index/>

<section id="info">
<title>This is a generic document</title>
<section id="introduction">
<title>This is a subsection</title>
<p>In this document we describe anything that is not an offer, invoice or pentest.</p>
<p>It is as generic as generic can be.</p>
</section>
<section id="other">
<title>Some more info</title>
<p>You can only use the most general of elements in this document (all the elements borrowed from html + monospace, code, section, appendix and title, basically).</p>
<p>Only the company-related placeholders work!</p>
</section>
</section>


<section id="somethingelse">
<title>Anything else?</title>
<p>Mmmm no, that's it.</p>

<table border="1"><tr><th>This is a table</th></tr>
<tr><td>It contains bogus information.</td></tr></table>

<section id="list">
<title>List example</title>
<p>This is a list:</p>
<ul>
<li>item 1 - see <a href="https://www.radicallyopensecurity.com">https://www.radicallyopensecurity.com</a>.</li>
<li>item 2</li>
</ul>
<p>You get the idea</p>
</section>
<section id="bla">
<title>other elements</title>
<p>Command:</p>
<pre>$ this is a pre (for command line entries)</pre>

<p>Outcome:</p>
<pre>This is where
</approver>
</collaborators>
<classification>Confidential</classification>
<version_history>
<version date="2015-01-19T01:00:00"
number="auto"
>
<v_author>Patricia Piolon</v_author>
<v_description>Initial draft</v_description>
</version>
<version date="2015-01-20T01:00:00"
number="auto"
>
<v_author>Ernest Hemingway</v_author>
<v_description>Structure &amp; contents revision</v_description>
</version>
<version date="2015-01-21T01:00:00"
number="auto"
>
<v_author>Patricia Piolon</v_author>
<v_description>Added some stuff</v_description>
</version>
<version date="2015-01-22T01:00:00"
number="auto"
>
<v_author>Patricia Piolon</v_author>
<v_author>JRR Tolkien</v_author>
<v_description>Revision</v_description>
</version>
<version date="2015-01-23T01:00:00"
number="auto"
>
<v_author>Patricia Piolon</v_author>
<v_description>Revision</v_description>
</version>
<version date="2015-01-26T01:00:00"
number="1.0"
>
<v_author>Arthur Conan Doyle</v_author>
<v_description>Finalizing</v_description>
</version>
</version_history>
<xi:include href="snippets/company_info.xml" />
</meta>

<generate_index />

<section id="info">
<title>This is a generic document</title>
<section id="introduction">
<title>This is a subsection</title>
<p>In this document we describe anything that is not an offer, invoice or pentest.</p>
<p>It is as generic as generic can be.</p>
</section>
<section id="other">
<title>Some more info</title>
<p>You can only use the most general of elements in this document (all the elements borrowed from html + monospace, code, section, appendix and title, basically).</p>
<p>Only the company-related placeholders work!</p>
</section>
</section>


<section id="somethingelse">
<title>Anything else?</title>
<p>Mmmm no, that's it.</p>

<table border="1"><tr><th>This is a table</th></tr>
<tr><td>It contains bogus information.</td></tr></table>

<section id="list">
<title>List example</title>
<p>This is a list:</p>
<ul>
<li>
item 1 - see
<a href="https://www.radicallyopensecurity.com">https://www.radicallyopensecurity.com</a>.
</li>
<li>item 2</li>
</ul>
<p>You get the idea</p>
</section>
<section id="bla">
<title>other elements</title>
<p>Command:</p>
<pre>$ this is a pre (for command line entries)</pre>

<p>Outcome:</p>
<pre>This is where
you would write the
output
I
guess.</pre>

<p>Let's have a link pointing to <a href="#list"/> at this point.</p>

</section>

</section>
<appendix id="testteam">
<title>Did we forget anything</title>
<p>Nope.</p>
</appendix>
</generic_document>

<p>
Let's have a link pointing to
<a href="#list" />
at this point.
</p>

</section>

</section>
<appendix id="testteam">
<title>Did we forget anything</title>
<p>Nope.</p>
</appendix>
</generic_document>
62 changes: 33 additions & 29 deletions doc/examples/exampleinvoice.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,30 +1,34 @@
<?xml version="1.0" encoding="UTF-8"?>
<invoice xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xi="http://www.w3.org/2001/XInclude" xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:fo="http://www.w3.org/1999/XSL/Format" xsi:noNamespaceSchemaLocation="../dtd/invoice.xsd"
invoice_no="00/000" denomination="dollar">
<meta>
<xi:include href="snippets/company_info.xml"/>
<xi:include href="client_info.xml"/>
</meta>
<servicesdelivered>
<service>
<description>10-day penetration test Sitting Duck</description>
<fee vat="yes">7000</fee>
</service>
<service>
<description>Something else</description>
<fee vat="yes">2000</fee>
</service>
</servicesdelivered>
<additionalcosts>
<cost>
<description>An additional cost without vat</description>
<fee vat="no">1000</fee>
</cost>
<cost>
<description>An additional cost with vat</description>
<fee vat="yes">1000</fee>
</cost>
</additionalcosts>
<?xml version="1.0" encoding="utf-8"?>
<invoice xmlns:fo="http://www.w3.org/1999/XSL/Format"
xmlns:xi="http://www.w3.org/2001/XInclude"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
denomination="usd"
invoice_no="00/000"
xsi:noNamespaceSchemaLocation="../dtd/invoice.xsd"
>
<meta>
<xi:include href="snippets/company_info.xml" />
<xi:include href="client_info.xml" />
</meta>
<servicesdelivered>
<service>
<description>10-day penetration test Sitting Duck</description>
<fee vat="yes">7000</fee>
</service>
<service>
<description>Something else</description>
<fee vat="yes">2000</fee>
</service>
</servicesdelivered>
<additionalcosts>
<cost>
<description>An additional cost without vat</description>
<fee vat="no">1000</fee>
</cost>
<cost>
<description>An additional cost with vat</description>
<fee vat="yes">1000</fee>
</cost>
</additionalcosts>
</invoice>
Loading
Loading