OWASP Cornucopia is a mechanism in the form of a card game to assist software development teams identify security requirements in Agile, conventional and formal development processes. It is language, platform and technology agnostic.
The cross-references on the Web App Edition deck relate to the following versions of other OWASP and external resources:
- OWASP SCP OWASP_Secure_Coding_Practices_Checklist v2
- OWASP ASVS OWASP_Application_Security_Verification_Standard v4 (2019)
- OWASP AppSensor AppSensor_DetectionPoints
- CAPEC Mitre Common Attack Pattern Enumeration and Classification v1.7.1
- SAFECode SAFECode Practical Security Stories and Security Tasks for Agile Development Environments July 2012
- MASTG OWASP Mobile Application Security Testing Guide 1.7
- MASVS OWASP Mobile Application Security Verification Standard 2.0
Cornucopia was originally conceived and created by Colin Watson and has since had contributions from a worldwide team of volunteers. Please see Project Page for more details.
© 2024 OWASP Foundation Except, where otherwise noted, content in this repository is licensed under a CC-BY-SA-3.0
© 2010 Microsoft Corporation. Text for Elevation of Privilege (EoP) is licensed under CC-BY-SA-3.0
Text and code mapping for OWASP Cornucopia Mobile App Edition is licensed under CC-BY-SA-3.0
Text and code mapping for OWASP Cornucopia Website App Edition is licensed under CC-BY-SA-3.0
For font licensing, please read font README.md
Copyright (C) 2017, Oleksandr Kucherenko under MIT
Merges to the main branch will generate new DOCX and IDML files to use to print off new version of the deck but if you wish to produce these locally yourself then use the ./scripts/convert.py scipt to do this:
(cornucopia) ➜ cornucopia git:(master) ✗ python ./scripts/convert.py --help
usage: convert.py [-h] [-i INPUTFILE] [-v VERSION] [-o OUTPUTFILE] [-p] [-d] [-l LANGUAGE] [-t TEMPLATE] [-e EDITION]
[-lt LAYOUT]
Tool to output OWASP Cornucopia playing cards into different file types and languages.
Example usage: $ scripts/convert.py --pdf -lt guide -l es -v 2.00
Example usage: $ scripts/convert.py -t tarot -l en -lt cards -v 1.0 -e eop -i ./resources/templates/eop_ver_cards_tarot_lang.idml -o ./output/eop-1.0-cards-en.idml
Example usage: c:\cornucopia\scripts\convert.py -t bridge -lt cards -l fr -v 2.00 -o 'my_output_folder\owasp_cornucopia_edition_version_layout_language_template.idml'
options:
-h, --help show this help message and exit
-i INPUTFILE, --inputfile INPUTFILE
Input (template) file to use.
Default=resources\templates\owasp_cornucopia_edition_ver_layout_document_template_lang.(docx|idml)
Template type is dependent on the file (-o) specified.
-v VERSION, --version VERSION
Output version to produce. [`all`, `latest`, `1.00`, `1.22`, `2.00`]
Version 1.22 and 1.2x will deliver cards mapped to ASVS 3.0
Version 2.00 and 2.0x will deliver cards mapped to ASVS 4.0
Version 1.00 and 1.0x will deliver cards mapped to MASVS 2.0
Version all will deliver all versions of cornucopia
Version latest will deliver the latest deck versions of cornucopia
You can also specify another version explicitly if needed. If so, there needs to be a yaml file in the source folder where the name contains the version code. Eg. edition-template-ver-lang.yaml
-o OUTPUTFILE, --outputfile OUTPUTFILE
Specify a path and name of output file to generate. (caution: existing file will be overwritten).
Eg. output\owasp_cornucopia_edition_ver_layout_document_template_lang.(docx|pdf|idml)
-p, --pdf Whether to generate a pdf in addition to the printable document. Does not generate a pdf by default. Only docx can be converted to pdf for the moment.
-d, --debug Output additional information to debug script
-l LANGUAGE, --language LANGUAGE
Output language to produce. [`en`, `es`, `fr`, `nl`, `no-nb`, `pt-br`] you can also specify your own language file. If so, there needs to be a yaml file in the source folder where the name ends with the language code. Eg. edition-template-ver-lang.yaml
-t TEMPLATE, --template TEMPLATE
From which template to produce the document. [`bridge`, `bridge_qr`, `tarot` or `tarot_qr`]
Templates need to be added to ./resource/templates or specified with (-i or --inputfile)
Bridge cards are 2.25 x 3.5 inch and have the mappings printed on them,
tarot cards are 2.75 x 4.75 (71 x 121 mm) inch large,
qr cards have a QRCode that points to an maintained list.
You can also speficy your own template. If so, there needs to be a file in the templates folder where the name contains the template code. Eg. owasp_cornucopia_edition_ver_layout_template_lang.idml
-e EDITION, --edition EDITION
Output decks to produce. [`all`, `webapp` or `mobileapp`]
The various Cornucopia decks. `web` will give you the Website App edition.
`mobileapp` will give you the Mobile App edition.
You can also speficy your own edition. If so, there needs to be a yaml file in the source folder where the name contains the edition code. Eg. edition-template-ver-lang.yaml
-lt LAYOUT, --layout LAYOUT
Document layouts to produce. [`all`, `guide`, `leaflet` or `cards`]
The various Cornucopia document layouts.
`cards` will output the high quality print card deck.
`guide` will generate the docx guide with the low quality print deck.
`leaflet` will output the high quality print leaflet.
You can also speficy your own layout. If so, there needs to be a yaml file in the source folder where the name contains the layout code. Eg. edition-layout-ver-lang.yaml
The latest printable files are released under the pre-release. Please download final printable files from there.
The docx/pdf files can be easily printed by any desktop printer, but for the best quality use the idml InDesign files. When sending the files to a printing facility you may have to supply the fonts that has been used in order to create the work.
In case the printing facility doesn't have the fonts at hand you'll find the installable fonts under resources/templates/Fonts
in this repository. They are both open source and free for commercial use.
The fonts can also be downloaded from the web.
Fivo Sans: https://www.fontsc.com/font/fivo-sans
Atkinson Hyperlegible: https://brailleinstitute.org/freefont
The following fonts are used:
- Deck: Fivo Sans and Atkinson Hyperlegible
- Leaflet: Fivo Sans
- case
- Noto Sans Condensed Bold
- Noto Sans Condensed Extra Bold
- Noto Sans Condensed Medium
- Noto Sans ExtraCondensed Extra Bold
- Noto Sans ExtraCondensed Extra Medium
- Logos:
- Noto Sans Condensed Bold
- Noto Sans Condensed Extra Bold
- Noto Sans Extra Condensed Extra Bold
The "bridge" files are (2.25 x 3.5" or 57mm x 88.8mm) standard playing cards. The "tarot" files are (2.75 x 4.75" or 71mm x 121 mm) standard playing cards.
The "bridge" is 60 x 89.25 mm x 27.15 mm The "tarot" is 122.2 x 73.1 x 29.1 mm
the "tarrot" box has standard dimensions used by Agile Stationary to print their Cyber Security Cornucopia Edition. the "bridge" box may need some refitting if used.
The "bridge" files are 55mm x 87mm The "tarot" files are (2.75 x 4.75")
The "bridge" and "tarot" version is 16-20 page spread depending on in which language you print.
Please be aware, that the table of content for the indesign leaflet has to be adjusted for all language versions before printing except for the english version!! This is because indesign does not support auto adjusting the TOC. You may need to adjust the font size to fit either a 16 or a 20 page leaflet spread. DO NOT PRINT an 18 Page leaflet! It won't look good.
A standard blead set to 3mm for all 4 sides.
Use 300gsm for both the bridge cards and the tarot cards. For the case, we would recommend folding box board with anti-scuff lamination and 100gsm uncoated stock for the leaflet. The leaflets could also be laminated, but it might make them springy.
Please install git-lfs to ensure you can download the output files.
Install from https://git-lfs.com/
Then pull the binaries from git lfs.
git lfs pull
Before you push your changes please format files with
make fmt
run static analysis checks
make static-check
run all available smoke, unit and integration tests
make test
check that your code have sufficient test coverage
make coverage-check
We are using ClusterFuzzlite as a continuous fuzzing solution in order to run tests locally you need oss-fuzz. For more information on how to write tests see: https://google.github.io/clusterfuzzlite/build-integration/python-lang/
How to test locally:
export PATH_TO_PROJECT=$(pwd)
cd ../
git clone https://github.com/google/oss-fuzz
cd ../oss-fuzz
python infra/helper.py build_image --external $PATH_TO_PROJECT
python infra/helper.py build_fuzzers --external $PATH_TO_PROJECT --sanitizer address
python infra/helper.py check_build --external $PATH_TO_PROJECT --sanitizer address
All python unit tests with fixtures in testdata
folder support updating golden files from real output of tests
make python-test-update-golden-files
this is useful if you have made changes in code and you do not want to update all fixtures manually or when you have updated inputs and therefore fixtures needs to be updated.
Instead of manually running those commands, you may wish to add them to the Git pre-commit hook. This will mean that the commands will run automatically whenever you commit your changes. If the command fails, then the commit will not be completed.
-
In the project root, open your
.git
directory -
Create a file called
pre-commit
(no suffix) -
Add the following code:
#!/bin/sh make fmt make static-check make test make coverage-check
-
Save the file.
-
All done. Now whenever you commit changes, Git will run the commands in that file.
This repository follows semver approach. Release a new
version means to tag commit in master
branch. Please do not use same tag
twice.
To avoid common mistakes there is a script which will guide you through process and push correct tag from your machine.
To release a new patch:
make release
make release-patch
To release a new minor version:
make release-minor
To release a new major version:
make release-major
Once the
Docker images are build in [Jenkins][4] and published to [Artifactory][5] keeping 3 tags:
latest
mirrors state ofmaster
branch.current
mirrors state of the most recent Git tag.previous
mirrors state of the previous Git tag.
Images are also pushed with git describe
version.