git clone https://github.com/OWASP/common-requirement-enumeration-Copy sqlite database to required location -
cp cres/db.sqlite standards_cache.sqlite+```bash +git clone https://github.com/OWASP/common-requirement-enumeration + +# Copy the sqlite database to the required location +cp cres/db.sqlite standards_cache.sqlite -Install dependencies -
make install+# Install the dependencies +make install +``` +On the first run, you'll also need to apply any pending database migrations: -Running -------- +```bash +make migrate-upgrade +``` + +## Running To run the CLI application, you can run +
python cre.py --helpTo download a remote cre spreadsheet locally you can run +
python cre.py --review --from_spreadsheet < google sheets url>To add a remote spreadsheet to your local database you can run +
python cre.py --add --from_spreadsheet < google sheets url>To run the web application for development you can run +
make dev-runAlternatively, you can use the dockerfile with +
make docker && make docker-runTo run the web application for production you need gunicorn and you can run from within the cre_sync dir +
make prod-run-Developing ---- +## Developing + You can run backend tests with +
make test-You can run get a coverage report with + +You can run get a coverage report with +
make cover+ Try to keep the coverage above 70% Repo Moved here from https://github.com/northdpole/www-project-integration-standards -Contributing ---- -Please see [Contributing](CONTRIBUTING.md) for contributing instructions +## Contributing +Please see [Contributing](CONTRIBUTING.md) for contributing instructions -Development Notes ---- +## Development Notes - [ ] add tests -- [x] defs -- [x] db -- [x] parsers -- [ ] mapping_add ( done for important methods ) argparse logic only remains +- [x] defs +- [x] db +- [x] parsers +- [ ] mapping_add ( done for important methods ) argparse logic only remains - [x] spreadsheet_utils -- [ ] frontend - -- [x] add parse from export format -- [x] add parse from export format where the root doc is a standard and it links to cres or groups -- [x] add parse from spreadsheet with unknown standards (for key,val in items add_standard) -- [x] merge spreadsheet to yaml and mapping add, they do the same thing -- [x] add the ability for standards to link other standards, then you can handle assigning CREs yourself -- [x] support importing yaml export files of more than 1 levels deep -- [x] add export for Standards unmapped to CREs as lone standards (useful for visibility) -- [x] add sparse_spreadsheet_export functionality one level of mapping per row, either everything that maps to standard X or everything that maps to CRE x -- [x] add parse from export format -- [x] add github actions ci -- [x] make into flask rest api -- [x] > refer use case (search by cre) -- [x] > search by standard -- [x] add the ability for a mapping document to have multiple yamls in it -- [x] add db integration of tags -- [x] add tags in db (search by tag, export with tags etc) -- [x] add parser integration of tags (parse the new new new spreadsheet template which incorporates tags) -- [x] add search by tag in rest -- [x] add dockerfile -- [x] add conditional export (select the standards you want exported get mappings between them) (gap analysis use case) ~ -- Done +- [ ] frontend + +- [x] add parse from export format +- [x] add parse from export format where the root doc is a standard and it links to cres or groups +- [x] add parse from spreadsheet with unknown standards (for key,val in items add_standard) +- [x] merge spreadsheet to yaml and mapping add, they do the same thing +- [x] add the ability for standards to link other standards, then you can handle assigning CREs yourself +- [x] support importing yaml export files of more than 1 levels deep +- [x] add export for Standards unmapped to CREs as lone standards (useful for visibility) +- [x] add sparse_spreadsheet_export functionality one level of mapping per row, either everything that maps to standard X or everything that maps to CRE x +- [x] add parse from export format +- [x] add github actions ci +- [x] make into flask rest api +- [x] > refer use case (search by cre) +- [x] > search by standard +- [x] add the ability for a mapping document to have multiple yamls in it +- [x] add db integration of tags +- [x] add tags in db (search by tag, export with tags etc) +- [x] add parser integration of tags (parse the new new new spreadsheet template which incorporates tags) +- [x] add search by tag in rest +- [x] add dockerfile +- [x] add conditional export (select the standards you want exported get mappings between them) (gap analysis use case) ~ -- Done - [x] add flask cover command from here https://github.com/miguelgrinberg/flasky/blob/master/flasky.py#L33 - [x] Make Standards versioned ~ -- Done -- [x] write frontend -- [x] make results per page a config item from env -- [x] migrate to new repo -- [x] add black autoformater -- [x] merge frontend changes to master -- [x] Typed Python? +- [x] write frontend +- [x] make results per page a config item from env +- [x] migrate to new repo +- [x] add black autoformater +- [x] merge frontend changes to master +- [x] Typed Python? = Future Considerations = diff --git a/application/frontend/src/components/ExportButton/export-button.scss b/application/frontend/src/components/ExportButton/export-button.scss new file mode 100644 index 000000000..cec0a1faa --- /dev/null +++ b/application/frontend/src/components/ExportButton/export-button.scss @@ -0,0 +1,5 @@ +a.export-button { + font-size: 1.2rem; + margin-left: 1rem; + cursor: pointer; +} diff --git a/application/frontend/src/components/ExportButton/export-button.tsx b/application/frontend/src/components/ExportButton/export-button.tsx new file mode 100644 index 000000000..fe4f4e020 --- /dev/null +++ b/application/frontend/src/components/ExportButton/export-button.tsx @@ -0,0 +1,74 @@ +import './export-button.scss'; + +import React, { useState } from 'react'; +import { Loader } from 'semantic-ui-react'; + +interface IExportButton { + fetchURL: string; + fetchParams?: any; +} + +const openURLInNewTab = (url: string): void => { + const newWindow = window.open(url, '_blank', 'noopener,noreferrer'); + if (newWindow) newWindow.opener = null; +}; + +/** + * Returns the export URL for a given API endpoint. + * Handles the CRE, search and standard endpoints. + * + * Also handles query parameters as part of the `url` or as part of `params`. + * @param url original fetch URL + * @param params (optional) parameters that were passed to Axios + * @returns computed request url to get an export of the endpoint + */ +const getExportURL = (url: string, params?: string[][]): string => { + const EXPORT_STRING = '/export'; + if (url.includes('?')) { + const [prefix, queryParams] = url.split('?'); + return prefix + EXPORT_STRING + '?' + queryParams; + } + + if (params) { + return url + '/export?' + new URLSearchParams(params['params']).toString(); + } + + return url + EXPORT_STRING; +}; + +const ExportButton = ({ fetchURL, fetchParams }: IExportButton) => { + const [isLoading, setLoading] = useState(false); + + const fetchSpreadsheetURLAndOpen = () => { + setLoading(true); + + fetch(getExportURL(fetchURL, fetchParams)) + .then((response) => response.json()) + .then((data) => { + if (!data || !data.status || data.status !== 'ok') { + window.alert('Failed to export CRE data'); + } + + openURLInNewTab(data.spreadsheetURL); + + // Timeout is added so we don't get a flashing effect + setTimeout(() => { + setLoading(false); + }, 500); + }); + }; + + return ( + fetchSpreadsheetURLAndOpen()}> + 🔗 Export + {isLoading && ( + <> + {' '} +
- CRE is an interactive content linking platform for uniting security standards and guidelines. It offers easy and robust access to relevant information when designing, developing, testing and procuring secure software. + CRE is an interactive content linking platform for uniting security standards and guidelines. It + offers easy and robust access to relevant information when designing, developing, testing and + procuring secure software.
-- Independent software security professionals got together to find a solution for the complexity and fragmentation in today’s landscape of security standards and guidelines. These people are Spyros Gasteratos, Elie Saad, Rob van der Veer and friends, in close collaboration with the SKF, OpenSSF and Owasp Top 10 project. + Independent software security professionals got together to find a solution for the complexity and + fragmentation in today’s landscape of security standards and guidelines. These people are Spyros + Gasteratos, Elie Saad, Rob van der Veer and friends, in close collaboration with the SKF, OpenSSF and + Owasp Top 10 project.
-- The CRE links each section of a standard to a shared topic (a Common Requirement), causing that section to also link with all other resources that map to the same topic. This 1) enables users to find all combined information from relevant sources, 2) it facilitates a shared and better understanding of cyber security, and 3) it allows standard makers to have links that keep working and offer all the information that readers need, so they don’t have to cover it all themselves. The CRE maintains itself: topic links in the standard text are scanned automatically. Furthermore, topics are linked with related other topics, creating a semantic web for security. + The CRE links each section of a standard to a shared topic (a Common Requirement), causing that + section to also link with all other resources that map to the same topic. This 1) enables users to + find all combined information from relevant sources, 2) it facilitates a shared and better + understanding of cyber security, and 3) it allows standard makers to have links that keep working and + offer all the information that readers need, so they don’t have to cover it all themselves. The CRE + maintains itself: topic links in the standard text are scanned automatically. Furthermore, topics are + linked with related other topics, creating a semantic web for security.
- Example: the session time-out topic will take the user to relevant criteria in several standards - , and to testing guides, development tips, more technical detail, threat descriptions, articles etc. - From there, the user can navigate to resources about session management in general. + Example: the session time-out topic will take the user to relevant criteria in several + standards , and to testing guides, development tips, more technical detail, threat descriptions, + articles etc. From there, the user can navigate to resources about session management in general.
+ Moreover, standards can use the CRE project to maintain permanent links to other standards. For example ASVS Deeplink could be maintained by ASVS and always redirect to an ASVS entry on github while the following will redirect to the specific section ASVS v9.2.5
-- CRE is currently in beta and has linked OWASP standards (Top 10, ASVS, Proactive Controls, Cheat sheets, Testing guide), plus several other sources (CWE, NIST-800 53, NIST-800 63b), as part of the + CRE is currently in beta and has linked OWASP standards (Top 10, ASVS, Proactive Controls, Cheat + sheets, Testing guide), plus several other sources (CWE, NIST-800 53, NIST-800 63b), as part of the OWASP Integration standard project .
-- Contact us (rob.vanderveer [at] owasp.org) to join the movement. Currently, a stakeholder group is being formed. + Contact us (rob.vanderveer [at] owasp.org) to join the movement. Currently, a stakeholder group is + being formed.
- For more details, see this - presentation video + For more details, see this + + {' '} + presentation video + , or read the - CRE explanation document + + {' '} + CRE explanation document + .
-See the CRE search bar (beta version). Try searching for Top10 2017 as standard and click around, or 482-866 + as CRE-ID, to get an idea, or search for "Session", or an overview of all top-level topics.