使用 xml 和 python 嵌套

Question

我正在尝试访问supplemental-guidance标签中的description标签。 我目前在每个 Nist 控制number 、 title 、 baseline-impact和priority打印出以下信息。 现在我试图打印出supplemental-guidance标签中的description ，但我似乎无法在不查找所有描述标签的情况下单独访问它。 提前感谢您的帮助！ 完整的 nist 文件在这里注意：并非所有控件都有 3 个基线标签，所以说 Element[8][0] 不会工作 xmlFile.xml

<?xml version="1.0" encoding="UTF-8"?>
<controls>
  <control>
    <family>ACCESS CONTROL</family>
    <number>AC-1</number>
    <title>ACCESS CONTROL POLICY AND PROCEDURES</title>
    <priority>P1</priority>
    <baseline-impact>LOW</baseline-impact>
    <baseline-impact>MODERATE</baseline-impact>
    <baseline-impact>HIGH</baseline-impact>
    <statement>
      <description>The organization:</description>
      <statement>
        <number>AC-1a.</number>
        <description>
        Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:
        </description>
        <statement>
          <number>AC-1a.1.</number>
          <description>
          An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
          </description>
        </statement>
        <statement>
          <number>AC-1a.2.</number>
          <description>
          Procedures to facilitate the implementation of the access control policy and associated access controls; and
          </description>
        </statement>
      </statement>
      <statement>
        <number>AC-1b.</number>
        <description>Reviews and updates the current:</description>
      <statement>
        <number>AC-1b.1.</number>
        <description>
        Access control policy [Assignment: organization-defined frequency]; and
        </description>
      </statement>
      <statement>
        <number>AC-1b.2.</number>
        <description>
        Access control procedures [Assignment: organization-defined frequency].
        </description>
      </statement>
     </statement>
    </statement>
    <supplemental-guidance>
      <description>
      This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AC family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures.
      </description>
      <related>PM-9</related>
    </supplemental-guidance>
    <references>
      <reference>
        <item xml:lang="en-US" href="https://csrc.nist.gov/publications/search?keywords-lg=800-12">NIST Special Publication 800-12</item>
      </reference>
      <reference>
        <item xml:lang="en-US" href="https://csrc.nist.gov/publications/search?keywords-lg=800-100">NIST Special Publication 800-100</item>
      </reference>
    </references>
  </control>
</controls>

导出XML到Excel.py

import xml.etree.ElementTree as ET 
import csv


xmlFile='/Users/username/Desktop/xmlFile.xml'
tree = ET.parse(xmlFile) 
root = tree.getroot()

# open a file for writing
excelFile = open('/Users/username/Desktop/security_controls.csv', 'w')

# creates the csv writer object / varible to write to csv
csvwriter = csv.writer(excelFile)
# list that contains the header
list_head = []
count = 0

for element in root.findall('control'):
    list_nodes=[]
    # address_list = []
    if count == 0:
        number = element.find('number').tag
        list_head.append(number)
        title = element.find('title').tag
        list_head.append(title)
        priority = element.find('priority').tag
        list_head.append(priority)

        # baseline_impact = element.find('baseline-impact').tag
        # list_head.append(baseline_impact)

        baseline_impact = element[4].tag
        list_head.append(baseline_impact)

        supplemental_guidance = element.find('supplemental-guidance').tag
        list_head.append(supplemental_guidance)

        reference = element.find('references').tag
        list_head.append(reference)

        csvwriter.writerow(list_head)
        count = count + 1

    number = element.find('number').text
    list_nodes.append(number)

    title = element.find('title').text
    list_nodes.append(title)

    if element.find('priority') is not None:
        priority = element.find('priority').text
        list_nodes.append(priority)
    else:
        priority = 'none'
        list_nodes.append(priority)

    if element.find('baseline-impact') is not None:
        if element[5].tag == 'baseline-impact':
            value = element[5].text + ', '
            if element[6].tag == 'baseline-impact':
                value += element[6].text + ', '
        baseline_impact = element.find('baseline-impact').text +', ' + value
        list_nodes.append(baseline_impact[:-2])
    else:
        baseline_impact = 'NONE'
        list_nodes.append(baseline_impact)

    if element.find('supplemental-guidance'):
        # trying to drill into the nested elements within the 'supplemental-guidance' tag 
        # and print out the description 

    csvwriter.writerow(list_nodes)
excelFile.close()

Answer 1

我正在尝试访问补充指导标签中的描述标签

您可以使用XPath的通过查找特定的节点做正是这一点。

'.//supplemental-guidance/description'应该'.//supplemental-guidance/description'您的需求。

使用您的 xml 输出进行演示：

In [20]: tree = ET.parse('/tmp/so.xml')

In [21]: root = tree.getroot()

In [22]: for element in root.findall('control'):
    ...:     print(element.find('.//supplemental-guidance/description').text)
    ...:

      This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AC family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures.