Linq XML Xelement with Namespace Returns Null

Question

我正在解析从离线配置文件审核生成的 .nessus 文件。我已经为 ReportItem 节点设置了一个 Linq 并验证了命名空间是否有效，但是当我尝试获取 cm:compliance-solution 值时它 returns null（已验证此元素中也有一个值）。

这是我正在使用的 Linq——fixText 变量是问题所在（通过注释掉所有其他变量来验证）

XElement xelement = XElement.Load(fileName);
IEnumerable<XElement> findings = xelement.Elements();
XNamespace ns = xelement.GetNamespaceOfPrefix("cm");

var findingDetails = from f in findings.Descendants("ReportItem")
             select new
                 {
                      title = f.Element(ns + "compliance-check-name").Value,
                      description = f.Element("description").Value,
                      vulLevel = f.Element(ns + "compliance-result").Value,
                      fixText = f.Element(ns + "compliance-solution").Value,
                      testID = f.Element(ns + "compliance-check-id").Value,
                      source = f.Element(ns + "compliance-audit-file").Value
                 };

这是我正在处理的示例 .nessus 文件：

<?xml version="1.0" ?>
<NessusClientData_v2 xmlns:cm="http://www.nessus.org/cm">
<Policy><policyName>Offline Config Audit</policyName>
</Policy>
<Report name="Router">
<ReportHost name="router-001.config"><HostProperties>
<tag name="source_type">offline_audit</tag>
<tag name="source_name">Cisco</tag>
<tag name="operating-system">Cisco IOS</tag>
<tag name="host-fqdn">router-001</tag>
<tag name="HOST_END">Fri Jun 29 09:56:38 2018</tag>
</HostProperties>
<ReportItem port="0" svc_name="general" protocol="tcp" severity="2" pluginID="46689" pluginName="Cisco IOS Compliance Checks" pluginFamily="Policy Compliance">
<compliance>true</compliance>
<fname>cisco_compliance_check.nbin</fname>
<plugin_modification_date>2018/05/31</plugin_modification_date>
<plugin_name>Cisco IOS Compliance Checks</plugin_name>
<plugin_publication_date>2010/05/17</plugin_publication_date>
<plugin_type>local</plugin_type>
<risk_factor>None</risk_factor>
<script_version>$Revision: 1.278 $</script_version>
<cm:compliance-check-name>NET-VLAN-024 - Restricted VLAN not assigned to non-802.1x device.</cm:compliance-check-name>
<description>&quot;NET-VLAN-024 - Restricted VLAN not assigned to non-802.1x device.&quot; : [WARNING] The SA will ensure a packet filter is implemented to filter the enclave traffic to and from printer VLANs to allow only print traffic.

 A firewall rule set can filter network traffic within the printer VLAN to only expected printer protocols. The SA managing the local enclave should identify the printer port traffic within the enclave. Ports commonly used by printers are typically tcp port 515, 631, 1782 and tcp ports 9100, 9101, 9102 but others are used throughout the industry. The SA can review RFC 1700 Port Assignments and review printer vendor documents for the filter rule-set.

 NOTE: This check is derived from the L3 switch guidance, if the scan target is a router the check can be ignored.
 NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution : 

Define the filter on the VLAN ACL or build a firewall ruleset to accomplish the requirment.

See Also : 

https://iasecontent.disa.mil/stigs/zip/U_Network_Perimeter_Router_L3_Switch_V8R28_STIG.zip

Reference(s) : 

8500.2|ECND-2,CAT|II,Rule-ID|SV-20089r1_rule,STIG-ID|NET-VLAN-024,Vuln-ID|V-18545 </description>
<cm:compliance-audit-file>DISA_STIG_Cisco_Perimeter_Router_L3_Switch_V8R28.audit</cm:compliance-audit-file>
<cm:compliance-check-id>acfebcd97143973eabbc5132d9035dcc</cm:compliance-check-id>
<cm:compliance-info>The SA will ensure a packet filter is implemented to filter the enclave traffic to and from printer VLANs to allow only print traffic.

 A firewall rule set can filter network traffic within the printer VLAN to only expected printer protocols. The SA managing the local enclave should identify the printer port traffic within the enclave. Ports commonly used by printers are typically tcp port 515, 631, 1782 and tcp ports 9100, 9101, 9102 but others are used throughout the industry. The SA can review RFC 1700 Port Assignments and review printer vendor documents for the filter rule-set.

 NOTE: This check is derived from the L3 switch guidance, if the scan target is a router the check can be ignored.
 NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
</cm:compliance-info>
<cm:compliance-result>WARNING</cm:compliance-result>
<cm:compliance-reference>8500.2|ECND-2,CAT|II,Rule-ID|SV-20089r1_rule,STIG-ID|NET-VLAN-024,Vuln-ID|V-18545
</cm:compliance-reference>
<cm:compliance-solution>Define the filter on the VLAN ACL or build a firewall ruleset to accomplish the requirment.
</cm:compliance-solution>
<cm:compliance-see-also>https://iasecontent.disa.mil/stigs/zip/U_Network_Perimeter_Router_L3_Switch_V8R28_STIG.zip
</cm:compliance-see-also>
</ReportItem>
</ReportHost>
</Report>
</NessusClientData_v2>

错误详情：

System.NullReferenceException
HResult=0x80004003
Message=Object reference not set to an instance of an object.

Answer 1

我运行你的代码对照这个例子，一切都很顺利。

尝试在 select 部分使用 ?.Value 以更轻松地查找空值。

Linq XML Xelement with Namespace Returns Null

Linq XML Xelement with Namespace Returns Null

c#

linq

linq-to-xml

xml-parsing

nessus