[MASWE-0001, MASWE-0027, MASWE-0108] MAS Risks and Tests (PREVIEW DRAFT)

[cpholguera]

This is a preview of the new implementation of risks and tests for the MAS project.

Guidelines

The guidelines for writing these new components are available here and are open for feedback. Be sure to read them before providing feedback to the PR.

Risks, Tests & Examples

It contains 3 new risks, including 1 test per risk and at least 1 example per test. The file structure is as follows: risks/<masvs_category>/<masvs_control_alias>/<risk_alias>/<test_alias>/example-*/

We recommend that you start the review in this order:

1. MASVS-CRYPTO: risks/MASVS-CRYPTO/1-strong-crypto/insecure-random/risk.md

• then navigate into the tests and examples.

2. MASVS-PRIVACY: risks/MASVS-PRIVACY/1-data-minimization/sensitive-data-in-network-traffic/risk.md

• then navigate into the tests and examples.

3. MASVS-STORAGE: risks/MASVS-STORAGE/2-prevent-data-leakage/data-in-logs/risk.md

• then navigate into the tests and examples.
• Closes New Risk - Insertion of Sensitive Data into Logs [data-in-logs] #2539

This draft also includes 2 new components: mitigations and prerequisites. Feel free to review and provide feedback on these as well.

In addition, you can review and provide feedback on the new or updated tools/techniques.

DISCLAIMER

This is a "preview draft", expect it to change daily. We will be incorporating suggestions and new changes at any time until we finalize it. Please do not open new PRs with new risks/tests, we will not accept any new components until this draft is finalized.

How to provide feedback

• Guidelines: Please include comments on the guidelines directly in the Google Doc using the "Comment" function.

• Pull Request: Please include comments directly in this pull request using GitHub comment function.

Closes #2591

[cpholguera]

We'll provide a very simple skeleton app with, say, a button and placeholders to copy and paste the samples so that everyone can test the apps with the exact same configuration.

[thomascannon]

Which pre-reqs format are we going for in test.md, YAML front matter or markdown? Both are used in the current examples: