<?xml version="1.0" encoding="UTF-8"?>
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified">
	<xs:element name="report">
		<xs:annotation>
			<xs:documentation>
				Schema for NIST reporting format, as described at
				http://samate.nist.gov/SATE.html
			</xs:documentation>
		</xs:annotation>

		<xs:complexType>
			<xs:sequence>
				<xs:element minOccurs="0" maxOccurs="unbounded" ref="weakness" />
			</xs:sequence>
			<xs:attribute name="tool_name" use="required" />
			<xs:attribute name="tool_version" use="required" />
		</xs:complexType>
	</xs:element>
	<xs:element name="weakness">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="name" />
				<xs:element maxOccurs="unbounded" ref="location" />
				<xs:element ref="grade" />
				<xs:element ref="output" />
				<xs:element ref="evaluation" minOccurs="0" maxOccurs="1" />
			</xs:sequence>
			<xs:attributeGroup ref="attlist.weakness" />
		</xs:complexType>
	</xs:element>
	<xs:attributeGroup name="attlist.weakness">
		<xs:attribute name="id" use="required" />
		<xs:attribute name="tool_specific_id" />
	</xs:attributeGroup>
	<xs:element name="name">
		<xs:complexType mixed="true">
			<xs:attributeGroup ref="attlist.name" />
		</xs:complexType>
	</xs:element>
	<xs:attributeGroup name="attlist.name">
		<xs:attribute name="cweid" type="xs:positiveInteger" />
	</xs:attributeGroup>
	<xs:element name="location">
		<xs:complexType>
			<xs:sequence>
				<xs:element name="fragment" type="xs:string" minOccurs="0" maxOccurs="1" />
				<xs:element name="explanation" type="xs:string" minOccurs="0" maxOccurs="1" />
			</xs:sequence>
			<xs:attribute name="id" use="optional" type="xs:nonNegativeInteger" />
			<xs:attribute name="line" use="required" type="xs:nonNegativeInteger" />
			<xs:attribute name="path" use="required" type="xs:string" />
		</xs:complexType>
	</xs:element>
	<xs:element name="grade">
		<xs:complexType>
			<xs:attribute name="severity" use="required">
				<xs:annotation>
					<xs:documentation>
						Severity on the scale 1 (high) to 5 (low)
					</xs:documentation>
				</xs:annotation>
				<xs:simpleType>
					<xs:restriction base="xs:integer">
						<xs:minInclusive value="1" />
						<xs:maxInclusive value="5" />
					</xs:restriction>
				</xs:simpleType>
			</xs:attribute>
			<xs:attribute name="probability" use="optional">
				<xs:annotation>
					<xs:documentation>
						Probability that the problem is a true positive,
						from 0 to 1
					</xs:documentation>
				</xs:annotation>
				<xs:simpleType>
					<xs:restriction base="xs:decimal">
						<xs:minInclusive value="0.0" />
						<xs:maxInclusive value="1.0" />
					</xs:restriction>
				</xs:simpleType>
			</xs:attribute>
			<xs:attribute name="tool_specific_rank" use="optional">
				<xs:annotation>
					<xs:documentation>
						Tool specific rank for the problem; the scale
						must be specified separately
					</xs:documentation>
				</xs:annotation>
				<xs:simpleType>
					<xs:restriction base="xs:decimal" />
				</xs:simpleType>
			</xs:attribute>
		</xs:complexType>
	</xs:element>
	<xs:element name="output">
		<xs:complexType>
			<xs:sequence>
				<xs:element ref="textoutput" minOccurs="0" maxOccurs="unbounded" />
				<xs:element ref="htmloutput" minOccurs="0" />
				<xs:element ref="xmloutput" minOccurs="0" />
			</xs:sequence>
		</xs:complexType>
	</xs:element>
	<xs:element name="textoutput" type="xs:string" />
	<xs:element name="htmloutput">
		<xs:complexType>
			<xs:sequence>
				<xs:any processContents="skip" />
			</xs:sequence>
		</xs:complexType>
	</xs:element>
	<xs:element name="xmloutput">
		<xs:complexType>
			<xs:sequence>
				<xs:any processContents="skip" />
			</xs:sequence>
		</xs:complexType>
	</xs:element>
	<xs:element name="evaluation">
		<xs:annotation>
			<xs:documentation>
				Human evaluation of the issue; not considered to
				be part of tool output
			</xs:documentation>
		</xs:annotation>
		<xs:complexType>
			<xs:sequence>
				<xs:element name="comments" type="xs:string" />
			</xs:sequence>
			<xs:attribute name="severity" use="optional">
				<xs:annotation>
					<xs:documentation>
						Severity on the scale 1 (high) to 5 (low)
					</xs:documentation>
				</xs:annotation>
				<xs:simpleType>
					<xs:restriction base='xs:integer'>
						<xs:minInclusive value="1" />
						<xs:maxInclusive value="5" />
					</xs:restriction>
				</xs:simpleType>
			</xs:attribute>
			<xs:attribute name="falsepositive" use="optional">
				<xs:annotation>
					<xs:documentation>
						(DEPRECATED) Human analysis will tell whether
						this is a false-positive (1) or not (0)
					</xs:documentation>
				</xs:annotation>
				<xs:simpleType>
					<xs:restriction base="xs:integer">
						<xs:minInclusive value="0" />
						<xs:maxInclusive value="1" />
					</xs:restriction>
				</xs:simpleType>
			</xs:attribute>
			<xs:attribute name="correctness" use="optional">
				<xs:annotation>
					<xs:documentation>
						Human analysis will tell whether the weakness
						exists (true), exists but is insignificant
						(insignificant), could not be confirmed (unknown)
						or is not a weakness (false)
					</xs:documentation>
				</xs:annotation>
				<xs:simpleType>
					<xs:restriction base="xs:string">
						<xs:enumeration value="true" />
						<xs:enumeration value="insignificant" />
						<xs:enumeration value="unknown" />
						<xs:enumeration value="false" />
					</xs:restriction>
				</xs:simpleType>
			</xs:attribute>
		</xs:complexType>
	</xs:element>
</xs:schema>
