Skip to content

Commit 4826d25

Browse files
Bornunique911Bornunique911
committed
test: OWASP mapping fixtures for GSoC ETL validation
1 parent 19f12ba commit 4826d25

8 files changed

Lines changed: 503 additions & 0 deletions

‎application/tests/fixtures/owasp_mappings/owasp_aisvs_1_0.json‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
[
2+
{
3+
"section_id": "AISVS1",
4+
"section": "Training Data Governance & Bias Management",
5+
"hyperlink": "https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C01-Training-Data-Governance.md",
6+
"cre_ids": ["227-045", "307-507"]
7+
},
8+
{
9+
"section_id": "AISVS2",
10+
"section": "User Input Validation",
11+
"hyperlink": "https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C02-User-Input-Validation.md",
12+
"cre_ids": ["031-447", "760-764"]
13+
},
14+
{
15+
"section_id": "AISVS3",
16+
"section": "Model Lifecycle Management & Change Control",
17+
"hyperlink": "https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md",
18+
"cre_ids": ["148-853", "613-285"]
19+
},
20+
{
21+
"section_id": "AISVS4",
22+
"section": "Infrastructure, Configuration & Deployment Security",
23+
"hyperlink": "https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C04-Infrastructure.md",
24+
"cre_ids": ["233-748", "486-813"]
25+
},
26+
{
27+
"section_id": "AISVS5",
28+
"section": "Access Control & Identity for AI Components & Users",
29+
"hyperlink": "https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C05-Access-Control-and-Identity.md",
30+
"cre_ids": ["633-428", "724-770"]
31+
},
32+
{
33+
"section_id": "AISVS6",
34+
"section": "Supply Chain Security for Models, Frameworks & Data",
35+
"hyperlink": "https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C06-Supply-Chain.md",
36+
"cre_ids": ["613-285", "613-287", "863-521"]
37+
},
38+
{
39+
"section_id": "AISVS7",
40+
"section": "Model Behavior, Output Control & Safety Assurance",
41+
"hyperlink": "https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C07-Model-Behavior.md",
42+
"cre_ids": ["064-808", "141-555"]
43+
},
44+
{
45+
"section_id": "AISVS8",
46+
"section": "Memory, Embeddings & Vector Database Security",
47+
"hyperlink": "https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md",
48+
"cre_ids": ["126-668", "538-770"]
49+
},
50+
{
51+
"section_id": "AISVS9",
52+
"section": "Autonomous Orchestration & Agentic Action Security",
53+
"hyperlink": "https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md",
54+
"cre_ids": ["117-371", "650-560"]
55+
},
56+
{
57+
"section_id": "AISVS10",
58+
"section": "Model Context Protocol (MCP) Security",
59+
"hyperlink": "https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C10-MCP-Security.md",
60+
"cre_ids": ["307-507", "715-223"]
61+
},
62+
{
63+
"section_id": "AISVS11",
64+
"section": "Adversarial Robustness & Privacy Defense",
65+
"hyperlink": "https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C11-Adversarial-Robustness.md",
66+
"cre_ids": ["141-555", "623-550"]
67+
},
68+
{
69+
"section_id": "AISVS12",
70+
"section": "Privacy Protection & Personal Data Management",
71+
"hyperlink": "https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C12-Privacy.md",
72+
"cre_ids": ["126-668", "227-045", "482-866"]
73+
},
74+
{
75+
"section_id": "AISVS13",
76+
"section": "Monitoring, Logging & Anomaly Detection",
77+
"hyperlink": "https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C13-Monitoring-and-Logging.md",
78+
"cre_ids": ["058-083", "148-420", "402-706", "843-841"]
79+
},
80+
{
81+
"section_id": "AISVS14",
82+
"section": "Human Oversight, Accountability & Governance",
83+
"hyperlink": "https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C14-Human-Oversight.md",
84+
"cre_ids": ["162-655", "766-162"]
85+
}
86+
]

‎application/tests/fixtures/owasp_mappings/owasp_api_top10_2023.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
[
2+
{
3+
"section_id": "API1",
4+
"section": "Broken Object Level Authorization",
5+
"hyperlink": "https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/",
6+
"cre_ids": ["304-667", "724-770"]
7+
},
8+
{
9+
"section_id": "API2",
10+
"section": "Broken Authentication",
11+
"hyperlink": "https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/",
12+
"cre_ids": ["177-260", "586-842", "633-428"]
13+
},
14+
{
15+
"section_id": "API3",
16+
"section": "Broken Object Property Level Authorization",
17+
"hyperlink": "https://owasp.org/API-Security/editions/2023/en/0xa3-broken-object-property-level-authorization/",
18+
"cre_ids": ["538-770", "724-770", "128-128"]
19+
},
20+
{
21+
"section_id": "API4",
22+
"section": "Unrestricted Resource Consumption",
23+
"hyperlink": "https://owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/",
24+
"cre_ids": ["623-550"]
25+
},
26+
{
27+
"section_id": "API5",
28+
"section": "Broken Function Level Authorization",
29+
"hyperlink": "https://owasp.org/API-Security/editions/2023/en/0xa5-broken-function-level-authorization/",
30+
"cre_ids": ["650-560", "724-770"]
31+
},
32+
{
33+
"section_id": "API6",
34+
"section": "Unrestricted Access to Sensitive Business Flows",
35+
"hyperlink": "https://owasp.org/API-Security/editions/2023/en/0xa6-unrestricted-access-to-sensitive-business-flows/",
36+
"cre_ids": ["534-605", "630-573"]
37+
},
38+
{
39+
"section_id": "API7",
40+
"section": "Server Side Request Forgery",
41+
"hyperlink": "https://owasp.org/API-Security/editions/2023/en/0xa7-server-side-request-forgery/",
42+
"cre_ids": ["028-728", "657-084"]
43+
},
44+
{
45+
"section_id": "API8",
46+
"section": "Security Misconfiguration",
47+
"hyperlink": "https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/",
48+
"cre_ids": ["486-813"]
49+
},
50+
{
51+
"section_id": "API9",
52+
"section": "Improper Inventory Management",
53+
"hyperlink": "https://owasp.org/API-Security/editions/2023/en/0xa9-improper-inventory-management/",
54+
"cre_ids": ["162-655", "863-521"]
55+
},
56+
{
57+
"section_id": "API10",
58+
"section": "Unsafe Consumption of APIs",
59+
"hyperlink": "https://owasp.org/API-Security/editions/2023/en/0xaa-unsafe-consumption-of-apis/",
60+
"cre_ids": ["715-223"]
61+
}
62+
]

‎application/tests/fixtures/owasp_mappings/owasp_cheatsheets_supplement.json‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
[
2+
{
3+
"section": "Authorization Cheat Sheet",
4+
"hyperlink": "https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html",
5+
"cre_ids": ["128-128", "117-371"]
6+
},
7+
{
8+
"section": "REST Security Cheat Sheet",
9+
"hyperlink": "https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html",
10+
"cre_ids": ["118-110", "724-770", "623-550"]
11+
},
12+
{
13+
"section": "Server Side Request Forgery Prevention Cheat Sheet",
14+
"hyperlink": "https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html",
15+
"cre_ids": ["028-728", "657-084"]
16+
},
17+
{
18+
"section": "Docker Security Cheat Sheet",
19+
"hyperlink": "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html",
20+
"cre_ids": ["233-748", "486-813"]
21+
},
22+
{
23+
"section": "Kubernetes Security Cheat Sheet",
24+
"hyperlink": "https://cheatsheetseries.owasp.org/cheatsheets/Kubernetes_Security_Cheat_Sheet.html",
25+
"cre_ids": ["467-784", "233-748", "486-813"]
26+
},
27+
{
28+
"section": "Secure Cloud Architecture Cheat Sheet",
29+
"hyperlink": "https://cheatsheetseries.owasp.org/cheatsheets/Secure_Cloud_Architecture_Cheat_Sheet.html",
30+
"cre_ids": ["155-155", "467-784"]
31+
},
32+
{
33+
"section": "LLM Prompt Injection Prevention Cheat Sheet",
34+
"hyperlink": "https://cheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html",
35+
"cre_ids": ["161-451", "760-764"]
36+
},
37+
{
38+
"section": "AI Agent Security Cheat Sheet",
39+
"hyperlink": "https://cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html",
40+
"cre_ids": ["117-371", "650-560", "126-668"]
41+
},
42+
{
43+
"section": "Secure AI Model Ops Cheat Sheet",
44+
"hyperlink": "https://cheatsheetseries.owasp.org/cheatsheets/Secure_AI_Model_Ops_Cheat_Sheet.html",
45+
"cre_ids": ["148-853", "613-285", "613-287"]
46+
}
47+
]

‎application/tests/fixtures/owasp_mappings/owasp_kubernetes_top10_2022.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
[
2+
{
3+
"section_id": "K01",
4+
"section": "Insecure Workload Configurations",
5+
"hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K01-insecure-workload-configurations",
6+
"cre_ids": ["233-748", "486-813"]
7+
},
8+
{
9+
"section_id": "K02",
10+
"section": "Supply Chain Vulnerabilities",
11+
"hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K02-supply-chain-vulnerabilities",
12+
"cre_ids": ["613-285", "613-287"]
13+
},
14+
{
15+
"section_id": "K03",
16+
"section": "Overly Permissive RBAC Configurations",
17+
"hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K03-overly-permissive-rbac-configurations",
18+
"cre_ids": ["128-128", "724-770"]
19+
},
20+
{
21+
"section_id": "K04",
22+
"section": "Lack of Centralized Policy Enforcement",
23+
"hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K04-lack-of-centralized-policy-enforcement",
24+
"cre_ids": ["117-371"]
25+
},
26+
{
27+
"section_id": "K05",
28+
"section": "Inadequate Logging and Monitoring",
29+
"hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K05-inadequate-logging-and-monitoring",
30+
"cre_ids": ["058-083", "148-420", "402-706", "843-841"]
31+
},
32+
{
33+
"section_id": "K06",
34+
"section": "Broken Authentication Mechanisms",
35+
"hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K06-broken-authentication-mechanisms",
36+
"cre_ids": ["177-260", "586-842", "633-428"]
37+
},
38+
{
39+
"section_id": "K07",
40+
"section": "Missing Network Segmentation Controls",
41+
"hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K07-missing-network-segmentation-controls",
42+
"cre_ids": ["132-146", "467-784", "515-021"]
43+
},
44+
{
45+
"section_id": "K08",
46+
"section": "Secrets Management Failures",
47+
"hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K08-secrets-management-failures",
48+
"cre_ids": ["340-375", "774-888", "813-610"]
49+
},
50+
{
51+
"section_id": "K09",
52+
"section": "Misconfigured Cluster Components",
53+
"hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K09-misconfigured-cluster-components",
54+
"cre_ids": ["233-748", "486-813"]
55+
},
56+
{
57+
"section_id": "K10",
58+
"section": "Outdated and Vulnerable Kubernetes Components",
59+
"hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K10-outdated-and-vulnerable-kubernetes-components",
60+
"cre_ids": ["053-751", "715-334", "863-521"]
61+
}
62+
]

‎application/tests/fixtures/owasp_mappings/owasp_kubernetes_top10_2025.json‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
[
2+
{
3+
"section_id": "K01",
4+
"section": "Insecure Workload Configurations",
5+
"hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/",
6+
"cre_ids": ["233-748", "486-813"],
7+
"fallback_section_ids": ["K01"]
8+
},
9+
{
10+
"section_id": "K02",
11+
"section": "Overly Permissive Authorization Configurations",
12+
"hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/",
13+
"cre_ids": ["128-128", "724-770"],
14+
"fallback_section_ids": ["K03"]
15+
},
16+
{
17+
"section_id": "K03",
18+
"section": "Secrets Management Failures",
19+
"hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/",
20+
"cre_ids": ["340-375", "774-888", "813-610"],
21+
"fallback_section_ids": ["K08"]
22+
},
23+
{
24+
"section_id": "K04",
25+
"section": "Lack Of Cluster Level Policy Enforcement",
26+
"hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/",
27+
"cre_ids": ["117-371"],
28+
"fallback_section_ids": ["K04"]
29+
},
30+
{
31+
"section_id": "K05",
32+
"section": "Missing Network Segmentation Controls",
33+
"hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/",
34+
"cre_ids": ["132-146", "467-784", "515-021"],
35+
"fallback_section_ids": ["K07"]
36+
},
37+
{
38+
"section_id": "K06",
39+
"section": "Overly Exposed Kubernetes Components",
40+
"hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/",
41+
"cre_ids": ["152-725", "640-364"],
42+
"fallback_section_ids": ["K09"]
43+
},
44+
{
45+
"section_id": "K07",
46+
"section": "Misconfigured And Vulnerable Cluster Components",
47+
"hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/",
48+
"cre_ids": ["053-751", "233-748", "486-813", "715-334"],
49+
"fallback_section_ids": ["K09", "K10"]
50+
},
51+
{
52+
"section_id": "K08",
53+
"section": "Cluster To Cloud Lateral Movement",
54+
"hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/",
55+
"cre_ids": ["132-146", "640-364", "724-770"],
56+
"fallback_section_ids": ["K03", "K07"]
57+
},
58+
{
59+
"section_id": "K09",
60+
"section": "Broken Authentication Mechanisms",
61+
"hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/",
62+
"cre_ids": ["177-260", "586-842", "633-428"],
63+
"fallback_section_ids": ["K06"]
64+
},
65+
{
66+
"section_id": "K10",
67+
"section": "Inadequate Logging And Monitoring",
68+
"hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/",
69+
"cre_ids": ["058-083", "148-420", "402-706", "843-841"],
70+
"fallback_section_ids": ["K05"]
71+
}
72+
]

‎application/tests/fixtures/owasp_mappings/owasp_llm_top10_2025.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
[
2+
{
3+
"section_id": "LLM01",
4+
"section": "Prompt Injection",
5+
"hyperlink": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/",
6+
"cre_ids": ["161-451", "760-764"]
7+
},
8+
{
9+
"section_id": "LLM02",
10+
"section": "Sensitive Information Disclosure",
11+
"hyperlink": "https://genai.owasp.org/llmrisk/llm022025-sensitive-information-disclosure/",
12+
"cre_ids": ["126-668", "227-045"]
13+
},
14+
{
15+
"section_id": "LLM03",
16+
"section": "Supply Chain",
17+
"hyperlink": "https://genai.owasp.org/llmrisk/llm032025-supply-chain/",
18+
"cre_ids": ["613-285", "613-287"]
19+
},
20+
{
21+
"section_id": "LLM04",
22+
"section": "Data and Model Poisoning",
23+
"hyperlink": "https://genai.owasp.org/llmrisk/llm042025-data-and-model-poisoning/",
24+
"cre_ids": ["307-507", "613-287"]
25+
},
26+
{
27+
"section_id": "LLM05",
28+
"section": "Improper Output Handling",
29+
"hyperlink": "https://genai.owasp.org/llmrisk/llm052025-improper-output-handling/",
30+
"cre_ids": ["064-808"]
31+
},
32+
{
33+
"section_id": "LLM06",
34+
"section": "Excessive Agency",
35+
"hyperlink": "https://genai.owasp.org/llmrisk/llm062025-excessive-agency/",
36+
"cre_ids": ["117-371", "650-560"]
37+
},
38+
{
39+
"section_id": "LLM07",
40+
"section": "System Prompt Leakage",
41+
"hyperlink": "https://genai.owasp.org/llmrisk/llm072025-system-prompt-leakage/",
42+
"cre_ids": ["126-668", "227-045"]
43+
},
44+
{
45+
"section_id": "LLM08",
46+
"section": "Vector and Embedding Weaknesses",
47+
"hyperlink": "https://genai.owasp.org/llmrisk/llm082025-vector-and-embedding-weaknesses/",
48+
"cre_ids": ["126-668", "538-770"]
49+
},
50+
{
51+
"section_id": "LLM09",
52+
"section": "Misinformation",
53+
"hyperlink": "https://genai.owasp.org/llmrisk/llm092025-misinformation/",
54+
"cre_ids": ["141-555"]
55+
},
56+
{
57+
"section_id": "LLM10",
58+
"section": "Unbounded Consumption",
59+
"hyperlink": "https://genai.owasp.org/llmrisk/llm102025-unbounded-consumption/",
60+
"cre_ids": ["267-031", "623-550"]
61+
}
62+
]

0 commit comments

Comments
 (0)