<xsd:element name="file_test" substitutionGroup="oval:test">
<xsd:annotation>
<xsd:documentation>This test checks file metadata. The time information can be retrieved by the _stat function.</xsd:documentation>
<xsd:appinfo>
<test_name>File Test</test_name>
<extends>standardTestType</extends>
<valid_sections>notes, object, data</valid_sections>
<example>
<file_test id="wft-0" check="at least one" comment="the version of mshtml.dll is less than 5.1.2600.128" xmlns="http://oval.mitre.org/XMLSchema/oval#windows">
<oval:notes xmlns:oval="http://oval.mitre.org/XMLSchema/oval">
<oval:note>This is an example test written under version 4 of the OVAL schema. It is meant to give a short overview of the test and might not contain every possible child element.</oval:note>
</oval:notes>
<object>
<path datatype="component">
<component type="registry_value">HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot</component>
<component type="literal">\system32\mshtml.dll</component>
</path>
</object>
<data>
<version datatype="version" operator="less than">
<major>5</major>
<minor>1</minor>
<build>2600</build>
<private>128</private>
</version>
</data>
</file_test>
</example>
</xsd:appinfo>
</xsd:annotation>
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval:standardTestType">
<xsd:sequence>
<xsd:element name="object" minOccurs="1" maxOccurs="1">
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval:objectType">
<xsd:sequence>
<xsd:element name="path" type="windows:componentType" minOccurs="1" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Specifies the absolute path to a file on the machine. This path can be created from multiple components that are added together. When a pattern match operator is used, the corresponding regular expression is matched against the set of absolute path strings. These string would not include the '.' and '..' notations. This means that a '.*' component of a regular expression will not only match all files in the specified directories, but all subdirectories, their subdirectories, etc.</xsd:documentation>
<xsd:appinfo>
<parent_test>File Test</parent_test>
<cardinality>1</cardinality>
<content>none</content>
<valid_datatypes>component</valid_datatypes>
<valid_operators>equals, not equal, pattern match</valid_operators>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
<xsd:element name="data" minOccurs="0" maxOccurs="1">
<xsd:complexType>
<xsd:complexContent>
<xsd:extension base="oval:dataType">
<xsd:sequence>
<xsd:element name="owner" type="oval:subtestStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>A string that contains the name of the owner.</xsd:documentation>
<xsd:appinfo>
<parent_test>File Test</parent_test>
<cardinality>0-1</cardinality>
<content>string</content>
<valid_datatypes>string</valid_datatypes>
<valid_operators>equals, not equal, pattern match</valid_operators>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element name="size" type="oval:subtestIntType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Size of the file in bytes.</xsd:documentation>
<xsd:appinfo>
<parent_test>File Test</parent_test>
<cardinality>0-1</cardinality>
<content>integer</content>
<valid_datatypes>integer</valid_datatypes>
<valid_operators>equals, not equal, greater than, less than, greater than or equal, less than or equal</valid_operators>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element name="a_time" type="oval:subtestStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Time of last access of file. Valid on NTFS but not on FAT formatted disk drives. The string should represent the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC).</xsd:documentation>
<xsd:appinfo>
<parent_test>File Test</parent_test>
<cardinality>0-1</cardinality>
<content>string</content>
<valid_datatypes>string</valid_datatypes>
<valid_operators>equals, not equal, greater than, less than, greater than or equal, less than or equal, pattern match</valid_operators>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element name="c_time" type="oval:subtestStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Time of creation of file. Valid on NTFS but not on FAT formatted disk drives. The string should represent the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC).</xsd:documentation>
<xsd:appinfo>
<parent_test>File Test</parent_test>
<cardinality>0-1</cardinality>
<content>string</content>
<valid_datatypes>string</valid_datatypes>
<valid_operators>equals, not equal, greater than, less than, greater than or equal, less than or equal, pattern match</valid_operators>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element name="m_time" type="oval:subtestStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>Time of last modification of file. The string should represent the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC).</xsd:documentation>
<xsd:appinfo>
<parent_test>File Test</parent_test>
<cardinality>0-1</cardinality>
<content>string</content>
<valid_datatypes>string</valid_datatypes>
<valid_operators>equals, not equal, greater than, less than, greater than or equal, less than or equal, pattern match</valid_operators>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element name="ms_checksum" type="oval:subtestStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>the md5 checksum of the file.</xsd:documentation>
<xsd:appinfo>
<parent_test>File Test</parent_test>
<cardinality>0-1</cardinality>
<content>string</content>
<valid_datatypes>string</valid_datatypes>
<valid_operators>equals, not equal, pattern match</valid_operators>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element name="md5" type="oval:subtestStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The md5 hash of the file</xsd:documentation>
<xsd:appinfo>
<parent_test>File Test</parent_test>
<cardinality>0-1</cardinality>
<content>string</content>
<valid_datatypes>string</valid_datatypes>
<valid_operators>equals, not equal, pattern match</valid_operators>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element name="version" type="windows:subtestFileVersionType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The version of the file.</xsd:documentation>
<xsd:appinfo>
<parent_test>File Test</parent_test>
<cardinality>0-1</cardinality>
<content>none</content>
<valid_datatypes>version</valid_datatypes>
<valid_operators>equals, not equal, greater than, less than, greater than or equal, less than or equal</valid_operators>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element name="type" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The type child element marks wether the file test describes a directory, named pipe, standard file, etc. These types are the return values for GetFileType, with the exception of FILE_ATTRIBUTE_DIRECTORY which is obtained by looking at GetFileAttributesEx.</xsd:documentation>
<xsd:appinfo>
<parent_test>File Test</parent_test>
<cardinality>0-1</cardinality>
<content>string</content>
<valid_datatypes>string</valid_datatypes>
<valid_operators>equals, not equal</valid_operators>
</xsd:appinfo>
</xsd:annotation>
<xsd:complexType>
<xsd:simpleContent>
<xsd:restriction base="oval:subtestStringType">
<xsd:enumeration value="FILE_ATTRIBUTE_DIRECTORY" />
<xsd:enumeration value="FILE_TYPE_CHAR" />
<xsd:enumeration value="FILE_TYPE_DISK" />
<xsd:enumeration value="FILE_TYPE_PIPE" />
<xsd:enumeration value="FILE_TYPE_REMOTE" />
<xsd:enumeration value="FILE_TYPE_UNKNOWN" />
</xsd:restriction>
</xsd:simpleContent>
</xsd:complexType>
</xsd:element>
<xsd:element name="development_class" type="oval:subtestStringType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>The development_class element allows the distinction to be made between the GDR development environment and the QFE development environment. This field holds the text found in front of the mmmmmm-nnnn version, for example srv03_gdr.</xsd:documentation>
<xsd:appinfo>
<parent_test>File Test</parent_test>
<cardinality>0-1</cardinality>
<content>string</content>
<valid_datatypes>string</valid_datatypes>
<valid_operators>equals, not equal, pattern match</valid_operators>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
</xsd:sequence>
</xsd:extension>
</xsd:complexContent>
</xsd:complexType>
</xsd:element>
|
XSD Schema Diagram:
