apply comments

Author: DimitriZhurkin

src/validations/constraints/content/ssp-inter-boundary-component-information-type-has-class-attribute-INVALID.xml

@@ -3,7 +3,6 @@
 <system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="df903c4c-6bb5-4b78-8a71-c5baa06a9f2e">
    <system-implementation>
 
-      <!-- The information-type prop does not have a @class attribute. -->
       <component uuid="67ecaba6-e5be-4c92-9731-e55825689e8f" type="service">
          <title>Service A</title>
          <description>
@@ -12,10 +11,13 @@
          </description>
          <prop name="implementation-point" value="external"/>
          <prop name="connection-security" value="non-fedramp-value" ns="https://fedramp.gov/ns/oscal"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="provider" value="self"/>
+         <prop name="provider" value="self" ns="http://fedramp.gov/ns/oscal"/>
          <prop ns="http://fedramp.gov/ns/oscal" name="still-supported" value="yes"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="information-type" value="C.3.5.1"/>
-         <prop ns="http://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
+
+         <!-- The information-type prop does not have a @class attribute. -->
+         <prop name="information-type" value="C.3.5.1" ns="http://fedramp.gov/ns/oscal"/>
+
+         <prop name="authentication-method" value="yes" ns="http://fedramp.gov/ns/oscal">
             <remarks>
                <p>If 'yes', describe the authentication method.</p>
                <p>If 'no', explain why no authentication is used.</p>

src/validations/constraints/fedramp-external-constraints.xml

@@ -625,7 +625,7 @@
             <expect id="inter-boundary-component-information-type-has-class-attribute" target="$inter-boundary-component" test="prop[@name='information-type' and @ns='http://fedramp.gov/ns/oscal']/@class => exists()" level="ERROR">
                 <formal-name>Inter-Boundary Component's Information Type Has @class Attribute</formal-name>
                 <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#external-systems-and-services-not-having-fedramp-authorization"/>
-                <message>Inter-boundary communication component {@uuid} ({path(.)}) information-type property MUST have the @class attribute. The @class attribute MUST not be empty, and it MUST contain a valid value (incoming or outgoing).</message>
+                <message>In a FedRAMP SSP, the information-type property of the inter-boundary communication component MUST have the @class attribute. The @class attribute MUST NOT be empty, and it MUST contain a valid value (incoming or outgoing).</message>
             </expect>
             <expect id="inventory-item-and-component-has-public" target="(inventory-item | component[@type='service' and prop[@name='implementation-point' and @value='internal']])" test="count(prop[@name='public']) = 1" level="ERROR">
                 <formal-name>Inventory Item and Component Has Public</formal-name>