Skip to content

Commit c63dcdd

Browse files
Nora Zinaeddinbruntib
Nora Zinaeddin
authored and
bruntib
committed
Add OWASP Top 10 guideline
1 parent be329db commit c63dcdd

File tree

4 files changed

+75
-1
lines changed

4 files changed

+75
-1
lines changed

‎config/guidelines/owasp-top-10-2021.yaml

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
guideline: owasp-top-10-2021
2+
guideline_title: OWASP Top 10 Web Application Security Risks 2021
3+
rules:
4+
- rule_id: owasp-A01-2021
5+
title: Broken Access Control
6+
rule_url: https://owasp.org/Top10/A01_2021-Broken_Access_Control/
7+
- rule_id: owasp-A02-2021
8+
title: Cryptographic Failures
9+
rule_url: https://owasp.org/Top10/A02_2021-Cryptographic_Failures/
10+
- rule_id: owasp-A03-2021
11+
title: Injection
12+
rule_url: https://owasp.org/Top10/A03_2021-Injection/
13+
- rule_id: owasp-A04-2021
14+
title: Insecure Design
15+
rule_url: https://owasp.org/Top10/A04_2021-Insecure_Design/
16+
- rule_id: owasp-A05-2021
17+
title: Security Misconfiguration
18+
rule_url: https://owasp.org/Top10/A05_2021-Security_Misconfiguration/
19+
- rule_id: owasp-A06-2021
20+
title: Vulnerable and Outdated Components
21+
rule_url: https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/
22+
- rule_id: owasp-A07-2021
23+
title: Identification and Authentication Failures
24+
rule_url: https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/
25+
- rule_id: owasp-A08-2021
26+
title: Software and Data Integrity Failures
27+
rule_url: https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/
28+
- rule_id: owasp-A09-2021
29+
title: Security Logging and Monitoring Failures
30+
rule_url: https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/
31+
- rule_id: owasp-A10-2021
32+
title: Server-Side Request Forgery (SSRF)
33+
rule_url: https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/

‎config/labels/analyzers/clang-tidy.json

+20
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,8 @@
139139
],
140140
"android-cloexec-open": [
141141
"doc_url:https://clang.llvm.org/extra/clang-tidy/checks/android/cloexec-open.html",
142+
"guideline:owasp-top-10-2021",
143+
"owasp-top-10-2021:owasp-A01-2021",
142144
"severity:HIGH"
143145
],
144146
"android-cloexec-pipe": [
@@ -649,11 +651,13 @@
649651
"bugprone-suspicious-memset-usage": [
650652
"doc_url:https://clang.llvm.org/extra/clang-tidy/checks/bugprone/suspicious-memset-usage.html",
651653
"guideline:sei-cert-c",
654+
"guideline:owasp-top-10-2021",
652655
"profile:default",
653656
"profile:extreme",
654657
"profile:security",
655658
"profile:sensitive",
656659
"sei-cert-c:int31-c",
660+
"owasp-top-10-2021:owasp-A04-2021",
657661
"severity:HIGH"
658662
],
659663
"bugprone-suspicious-missing-comma": [
@@ -743,12 +747,14 @@
743747
"bugprone-undefined-memory-manipulation": [
744748
"doc_url:https://clang.llvm.org/extra/clang-tidy/checks/bugprone/undefined-memory-manipulation.html",
745749
"guideline:sei-cert-cpp",
750+
"guideline:owasp-top-10-2021",
746751
"profile:default",
747752
"profile:extreme",
748753
"profile:security",
749754
"profile:sensitive",
750755
"sei-cert-cpp:exp62-cpp",
751756
"sei-cert-cpp:oop57-cpp",
757+
"owasp-top-10-2021:owasp-A01-2021",
752758
"severity:MEDIUM"
753759
],
754760
"bugprone-undelegated-constructor": [
@@ -792,6 +798,7 @@
792798
"doc_url:https://clang.llvm.org/extra/clang-tidy/checks/bugprone/unsafe-functions.html",
793799
"guideline:cwe-top-25-2024",
794800
"guideline:sei-cert-c",
801+
"guideline:owasp-top-10-2021",
795802
"profile:extreme",
796803
"profile:security",
797804
"profile:sensitive",
@@ -800,6 +807,7 @@
800807
"cwe-top-25-2024:cwe-787",
801808
"sei-cert-c:msc24-c",
802809
"sei-cert-c:msc33-c",
810+
"owasp-top-10-2021:owasp-A04-2021",
803811
"severity:LOW"
804812
],
805813
"bugprone-unused-local-non-trivial-variable": [
@@ -923,10 +931,12 @@
923931
"cert-env33-c": [
924932
"doc_url:https://clang.llvm.org/extra/clang-tidy/checks/cert/env33-c.html",
925933
"guideline:sei-cert-c",
934+
"guideline:owasp-top-10-2021",
926935
"profile:extreme",
927936
"profile:security",
928937
"profile:sensitive",
929938
"sei-cert-c:env33-c",
939+
"owasp-top-10-2021:owasp-A03-2021",
930940
"severity:MEDIUM"
931941
],
932942
"cert-err09-cpp": [
@@ -1029,10 +1039,14 @@
10291039
],
10301040
"cert-msc30-c": [
10311041
"doc_url:https://clang.llvm.org/extra/clang-tidy/checks/cert/msc30-c.html",
1042+
"guideline:owasp-top-10-2021",
1043+
"owasp-top-10-2021:owasp-A02-2021",
10321044
"severity:LOW"
10331045
],
10341046
"cert-msc32-c": [
10351047
"doc_url:https://clang.llvm.org/extra/clang-tidy/checks/cert/msc32-c.html",
1048+
"guideline:owasp-top-10-2021",
1049+
"owasp-top-10-2021:owasp-A02-2021",
10361050
"severity:MEDIUM"
10371051
],
10381052
"cert-msc33-c": [
@@ -1047,22 +1061,26 @@
10471061
"doc_url:https://clang.llvm.org/extra/clang-tidy/checks/cert/msc50-cpp.html",
10481062
"guideline:sei-cert-c",
10491063
"guideline:sei-cert-cpp",
1064+
"guideline:owasp-top-10-2021",
10501065
"profile:extreme",
10511066
"profile:security",
10521067
"profile:sensitive",
10531068
"sei-cert-c:msc30-c",
10541069
"sei-cert-cpp:msc50-cpp",
1070+
"owasp-top-10-2021:owasp-A02-2021",
10551071
"severity:LOW"
10561072
],
10571073
"cert-msc51-cpp": [
10581074
"doc_url:https://clang.llvm.org/extra/clang-tidy/checks/cert/msc51-cpp.html",
10591075
"guideline:sei-cert-c",
10601076
"guideline:sei-cert-cpp",
1077+
"guideline:owasp-top-10-2021",
10611078
"profile:extreme",
10621079
"profile:security",
10631080
"profile:sensitive",
10641081
"sei-cert-c:msc32-c",
10651082
"sei-cert-cpp:msc51-cpp",
1083+
"owasp-top-10-2021:owasp-A02-2021",
10661084
"severity:MEDIUM"
10671085
],
10681086
"cert-msc54-cpp": [
@@ -5897,8 +5915,10 @@
58975915
"concurrency-mt-unsafe": [
58985916
"doc_url:https://clang.llvm.org/extra/clang-tidy/checks/concurrency/mt-unsafe.html",
58995917
"guideline:sei-cert-c",
5918+
"guideline:owasp-top-10-2021",
59005919
"profile:security",
59015920
"sei-cert-c:con33-c",
5921+
"owasp-top-10-2021:owasp-A02-2021",
59025922
"severity:MEDIUM"
59035923
],
59045924
"concurrency-thread-canceltype-asynchronous": [

‎config/labels/analyzers/clangsa.json

+16
Original file line numberDiff line numberDiff line change
@@ -802,6 +802,7 @@
802802
"optin.taint.GenericTaint": [
803803
"doc_url:https://clang.llvm.org/docs/analyzer/checkers.html#optin-taint-generictaint-c-c",
804804
"guideline:cwe-top-25-2024",
805+
"guideline:owasp-top-10-2021",
805806
"profile:extreme",
806807
"profile:sensitive",
807808
"cwe-top-25-2024:cwe-20",
@@ -811,18 +812,27 @@
811812
"cwe-top-25-2024:cwe-79",
812813
"cwe-top-25-2024:cwe-89",
813814
"cwe-top-25-2024:cwe-94",
815+
"owasp-top-10-2021:owasp-A01-2021",
816+
"owasp-top-10-2021:owasp-A03-2021",
817+
"owasp-top-10-2021:owasp-A04-2021",
818+
"owasp-top-10-2021:owasp-A08-2021",
819+
"owasp-top-10-2021:owasp-A10-2021",
814820
"severity:HIGH"
815821
],
816822
"optin.taint.TaintedAlloc": [
817823
"doc_url:https://clang.llvm.org/docs/analyzer/checkers.html#optin-taint-taintedalloc-c-c",
824+
"guideline:owasp-top-10-2021",
818825
"profile:extreme",
819826
"profile:sensitive",
827+
"owasp-top-10-2021:owasp-A03-2021",
820828
"severity:HIGH"
821829
],
822830
"optin.taint.TaintedDiv": [
823831
"doc_url:https://clang.llvm.org/docs/analyzer/checkers.html#optin-taint-tainteddiv-c-c-objc",
832+
"guideline:owasp-top-10-2021",
824833
"profile:extreme",
825834
"profile:sensitive",
835+
"owasp-top-10-2021:owasp-A03-2021",
826836
"severity:HIGH"
827837
],
828838
"optin.taint.TaintPropagation": [
@@ -970,11 +980,13 @@
970980
"security.SetgidSetuidOrder": [
971981
"doc_url:https://clang.llvm.org/docs/analyzer/checkers.html#security-setgidsetuidorder-c",
972982
"guideline:sei-cert-c",
983+
"guideline:owasp-top-10-2021",
973984
"profile:default",
974985
"profile:extreme",
975986
"profile:security",
976987
"profile:sensitive",
977988
"sei-cert-c:pos36-c",
989+
"owasp-top-10-2021:owasp-A04-2021",
978990
"severity:MEDIUM"
979991
],
980992
"security.cert.env.InvalidPtr": [
@@ -1051,16 +1063,20 @@
10511063
],
10521064
"security.insecureAPI.mktemp": [
10531065
"doc_url:https://clang.llvm.org/docs/analyzer/checkers.html#security-insecureapi-mktemp-c",
1066+
"guideline:owasp-top-10-2021",
10541067
"profile:default",
10551068
"profile:extreme",
10561069
"profile:sensitive",
1070+
"owasp-top-10-2021:owasp-A01-2021",
10571071
"severity:MEDIUM"
10581072
],
10591073
"security.insecureAPI.rand": [
10601074
"doc_url:https://clang.llvm.org/docs/analyzer/checkers.html#security-insecureapi-rand-c",
1075+
"guideline:owasp-top-10-2021",
10611076
"profile:default",
10621077
"profile:extreme",
10631078
"profile:sensitive",
1079+
"owasp-top-10-2021:owasp-A02-2021",
10641080
"severity:MEDIUM"
10651081
],
10661082
"security.insecureAPI.strcpy": [

‎web/server/vue-cli/src/components/Statistics/Guideline/GuidelineStatistics.vue

+6-1
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,11 @@ export default {
182182
id: "cwe-top-25-2024",
183183
name: "CWE Top 25 Most Dangerous Software Weaknesses 2024",
184184
value: 2
185+
},
186+
{
187+
id: "owasp-top-10-2021",
188+
name: "OWASP Top 10 Web Application Security Risks 2021",
189+
value: 3
185190
}
186191
];
187192
@@ -196,7 +201,7 @@ export default {
196201
runs: null,
197202
runData: [],
198203
selectedCheckerName: null,
199-
selectedGuidelineIndexes: [ 0, 1, 2 ],
204+
selectedGuidelineIndexes: [ 0, 1, 2, 3 ],
200205
showRuns: {
201206
enabled: false,
202207
disabled: false,

0 commit comments

Comments
 (0)