Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[MASWE-0001, MASWE-0027, MASWE-0108] MAS Risks and Tests (PREVIEW DRAFT) #2518

Merged
merged 55 commits into from
Feb 14, 2024

Conversation

cpholguera
Copy link
Collaborator

@cpholguera cpholguera commented Jan 19, 2024

This is a preview of the new implementation of risks and tests for the MAS project.

Guidelines

The guidelines for writing these new components are available here and are open for feedback. Be sure to read them before providing feedback to the PR.

Risks, Tests & Examples

It contains 3 new risks, including 1 test per risk and at least 1 example per test. The file structure is as follows: risks/<masvs_category>/<masvs_control_alias>/<risk_alias>/<test_alias>/example-*/

We recommend that you start the review in this order:

  1. MASVS-CRYPTO: risks/MASVS-CRYPTO/1-strong-crypto/insecure-random/risk.md
  • then navigate into the tests and examples.
  1. MASVS-PRIVACY: risks/MASVS-PRIVACY/1-data-minimization/sensitive-data-in-network-traffic/risk.md
  • then navigate into the tests and examples.
  1. MASVS-STORAGE: risks/MASVS-STORAGE/2-prevent-data-leakage/data-in-logs/risk.md

This draft also includes 2 new components: mitigations and prerequisites. Feel free to review and provide feedback on these as well.

In addition, you can review and provide feedback on the new or updated tools/techniques.

DISCLAIMER

This is a "preview draft", expect it to change daily. We will be incorporating suggestions and new changes at any time until we finalize it. Please do not open new PRs with new risks/tests, we will not accept any new components until this draft is finalized.

How to provide feedback

Closes #2591

cpholguera and others added 30 commits October 13, 2023 12:00
…test. Examples and rules were separated into folders.
@cpholguera cpholguera self-assigned this Jan 19, 2024
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We'll provide a very simple skeleton app with, say, a button and placeholders to copy and paste the samples so that everyone can test the apps with the exact same configuration.

@thomascannon
Copy link
Collaborator

Which pre-reqs format are we going for in test.md, YAML front matter or markdown? Both are used in the current examples:

Screenshot 2024-02-13 112654

@cpholguera cpholguera merged commit 6348acd into master Feb 14, 2024
1 of 3 checks passed
@cpholguera cpholguera deleted the mastg-risks-and-tests branch February 14, 2024 18:08
@cpholguera cpholguera changed the title [PREVIEW DRAFT] MAS Risks and Tests [MASWE-0001, MASWE-0027, MASWE-0108] MAS Risks and Tests (PREVIEW DRAFT) Jul 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
3 participants