Proposal: Add observed_encoding attribute to StringObjectPropertyType

Status: Closed
Comment Period Closes: 12/17/2013
Affects Backwards Compatibility: NO
Relevant Issue: https://github.com/CybOXProject/schemas/issues/134

Background Information

In general, CybOX documents will usually be encoded as UTF-8 for storage and transmission. In some cases, the encoding of strings as they were observed is important. Some places in CybOX specify this already, such as Content_Encoding in HTTPResponseHeaderFieldsType in HTTP_Session_Object.xsd. However, it might also be useful in Email subjects, bodies, and sender names, among other fields.

Proposal

The following attribute should be added to the StringObjectPropertyType:

<xs:attribute name="observed_encoding" type="xs:string">
    <xs:annotation>
        <xs:documentation>This field is optional and specifies the encoding of the string when it is/was observed. This may be different from the encoding used to represent the string within this element.</xs:documentation>
        <xs:documentation>Values should be taken from https://www.iana.org/assignments/character-sets/character-sets.xhtml .</xs:documentation>
    </xs:annotation>
</xs:attribute>

Impact

There is no expected compatibility impact. This field records additional information beyond what was possible to represent in previous versions of CybOX. Because the field is optional, both producers and consumers who are not interested in the information contained in this field may ignore it.

Requested Feedback

1. Is there value in representing the string's encoding "in the wild"?
2. Is there a better way to represent this information than by adding this attribute?