enforce uniqueness of IDs in an xml instance about schemas

[gtback]

We need to figure out if this is possible in native XSD, and if so this can go into 2.1. If it takes more effort (such as schematron), we should push this out.

[bworrell]

We should be able to add something like this to all root-level elements

<xs:unique name="unique-id">
  <xs:selector xpath=".//*"/>
  <xs:field xpath="@id"/>
</xs:unique>

[ikiril01]

Thanks @bworrell! I tested that out and it seems to work well. I have added it to the version 2.1 branch in commit 57e6df9.

[johnwunder]

Is this limited to @id attributes in the CybOX namespace or does it propagate to schemas that import CybOX? If it propagates we might want to limit it to @id attributes in the CybOX namespaces only?

[bworrell]

Good question @johnwunder! I believe it will be applied to all @id attributes under a given root CybOX structure, so even those @id attributes on constructs defined outside the CybOX namespace. Luckily, the only external schema that CybOX imports is CPE, which also has uniqueness constraints on its ids.

[bworrell]

The commit 57e6df9 adds that uniqueness constraint to the root, Observables element, but not the other allowable root elements. I thought that it'd have to be added to Observable, Action, Object, Event, and Property as well.

[ikiril01]

Good point @bworrell. However, it seems to apply to any elements under cybox:Observables that have ids, including the ones you listed.

EDIT - nevermind, I see what you're saying! Since we allow multiple possible root elements (not just Observables), we need the same construct in the rest to ensure that unique IDs are enforced if they are used as the root element of the document. This is completely valid so I'll go ahead and add the constraint to these as well.

[johnwunder]

I did fairly extensive testing on this and couldn't find any problems with it.

The only slight complexity I found is that schemas importing CybOX (e.g. STIX) may need to apply their own uniqueness constraints depending on whether they use an element reference into a global CybOX element or a type reference to the corresponding complexType. Nothing is necessarily broken in CybOX (and since you can only apply uniqueness constraints at the element level there's no way to avoid it), but schemas importing CybOX should be aware of the issue.