2.9.0

## [2.9.0] - 2026-02-22

### Added
- **STIX Composer**: New STIX 2.1 editor interface for creating & sharing STIX 2.1 objects and bundles. Uses interactive JSON validator reporting to inspect and resolve Object <-> STIX specification mismatches.
- **STIX Visualizer**: Composer-Integrated optional STIX visualizer module
- **Visualizer kill-switch config**: Added `CONFIG.visualizer.enabled` to fully disable STIX visualizer loading/execution paths.
- **Mitigation Relationships**: Mitigation column added to the relationship view, sourced from techniques in each chain.
- **Phase Details Modal**: New modal for phase rollups (click phase in relationship view or use the Phase Details button on phase headers). Designed as high level phase overview for contained items, attached metadata & CVEs, related mitigations and average severity/confidence scores.
- **CSV Technique Import**: Paste technique IDs via CSV or newline into a modal to replace the ATT&CK library; includes a Reset ATT&CK action to restore base data.
- **Global Search**: Expanded global search panel with ranked mixed-type results (ATT&CK/CAPEC/CWE), Sticky mode, and drag-and-drop from results.
- **CSV ID Search**: Comma-separated ID search for ATT&CK, CAPEC, and CWE (supports numeric-only CAPEC/CWE entries).
- **Local iframe IPC bridge (local-mode only)**: Parent/iframe communication path between `index.html`, `explorer.html`, and `stix-builder.html` for theme sync and shared data handoff.
- **IPC debug controls**: Added `CONFIG.debugging.traceLocalIframeIPCLogs` and `CONFIG.debugging.localIframeIPCRateLimit` for traceability and request throttling.
- **IPC API docs**: Added dedicated short technical documentation in `IPC_API-DOCS.md`.

### Changed
**UI Improvements**: Redesigned Navigation & other UI Elements, consolidated all Theme toggles into one
- Phase item Explore/Edit actions now reveal on hover like Delete.
- **Resource loading behavior (visualizer disabled mode)**: STIX Composer and standalone STIX visualizer now avoid loading visualizer-owned and bundled third-party resources when `CONFIG.visualizer.enabled` is `false`.

### Security
- **Iframe containment**: Embedded explorer/composer iframes now use sandbox containment (`allow-scripts allow-same-origin allow-modals`).
- **Prototype pollution hardening**: Import parsing/sanitization now blocks dangerous keys (`__proto__`, `constructor`, `prototype`), uses safe JSON reviver parsing, null-prototype object collectors, and own-property checks in dynamic import field mapping.

#### Shared Loader Hardening
- **Pre-cache schema enforcement**: Parent shared dataset now validates required top-level shape before writing to `cache.data`.
- **Size/count guardrails**: Shared dataset now enforces per-bucket entry limits and serialized size limits before cache write.
- **IPC parity on limits**: `AF_SHARED_DATA` payload building now enforces the same shared-data limits at send-time, not only at ingest-time.
- **Immutable loader snapshots**: `window.getAttackFlowSharedData()` now returns validated clone+freeze snapshots instead of exposing mutable cache references.
- **Explorer fallback diagnostics**: Direct parent shared-loader errors/invalid payloads now emit debug trace diagnostics and safely fall back to alternate data sources.

#### Local IPC Hardening
- **Source pinning**: IPC messages are accepted only from expected frame windows.
- **Strict schema enforcement**: IPC message types and keys are allowlisted; unknown keys/types are rejected and traced.
- **Immutable shared payload**: `AF_SHARED_DATA` is shape-validated, cloned, and deep-frozen before IPC send/use.
- **Rate limiting**: Token-bucket throttling (configurable) for incoming IPC requests per frame and request type.
- **Data loading behavior**: Explorer can consume validated shared data from parent in local iframe mode to reduce redundant fetch/load paths.
- **IPC transport hardening**: Channel-only `MessageChannel` transport with session nonce binding; legacy window request/response fallback path removed.
- **Bootstrap resilience**: Parent channel bootstrap now uses bounded timeout/retry/backoff; explorer and stix-builder expose explicit terminal bootstrap-failure recovery behavior without legacy transport.

Author: Pr0cella

CHANGELOG.md

@@ -1,6 +1,47 @@
 # Changelog
 ---
 
+## [2.9.0] - 2026-02-22
+
+### Added
+- **STIX Composer**: New STIX 2.1 editor interface for creating & sharing STIX 2.1 objects and bundles. Uses interactive JSON validator reporting to inspect and resolve Object <-> STIX specification mismatches.
+- **STIX Visualizer**: Composer-Integrated optional STIX visualizer module
+- **Visualizer kill-switch config**: Added `CONFIG.visualizer.enabled` to fully disable STIX visualizer loading/execution paths.
+- **Mitigation Relationships**: Mitigation column added to the relationship view, sourced from techniques in each chain.
+- **Phase Details Modal**: New modal for phase rollups (click phase in relationship view or use the Phase Details button on phase headers). Designed as high level phase overview for contained items, attached metadata & CVEs, related mitigations and average severity/confidence scores.
+- **CSV Technique Import**: Paste technique IDs via CSV or newline into a modal to replace the ATT&CK library; includes a Reset ATT&CK action to restore base data.
+- **Global Search**: Expanded global search panel with ranked mixed-type results (ATT&CK/CAPEC/CWE), Sticky mode, and drag-and-drop from results.
+- **CSV ID Search**: Comma-separated ID search for ATT&CK, CAPEC, and CWE (supports numeric-only CAPEC/CWE entries).
+- **Local iframe IPC bridge (local-mode only)**: Parent/iframe communication path between `index.html`, `explorer.html`, and `stix-builder.html` for theme sync and shared data handoff.
+- **IPC debug controls**: Added `CONFIG.debugging.traceLocalIframeIPCLogs` and `CONFIG.debugging.localIframeIPCRateLimit` for traceability and request throttling.
+- **IPC API docs**: Added dedicated short technical documentation in `IPC_API-DOCS.md`.
+
+### Changed
+**UI Improvements**: Redesigned Navigation & other UI Elements, consolidated all Theme toggles into one
+- Phase item Explore/Edit actions now reveal on hover like Delete.
+- **Resource loading behavior (visualizer disabled mode)**: STIX Composer and standalone STIX visualizer now avoid loading visualizer-owned and bundled third-party resources when `CONFIG.visualizer.enabled` is `false`.
+
+### Security
+- **Iframe containment**: Embedded explorer/composer iframes now use sandbox containment (`allow-scripts allow-same-origin allow-modals`).
+- **Prototype pollution hardening**: Import parsing/sanitization now blocks dangerous keys (`__proto__`, `constructor`, `prototype`), uses safe JSON reviver parsing, null-prototype object collectors, and own-property checks in dynamic import field mapping.
+
+#### Shared Loader Hardening
+- **Pre-cache schema enforcement**: Parent shared dataset now validates required top-level shape before writing to `cache.data`.
+- **Size/count guardrails**: Shared dataset now enforces per-bucket entry limits and serialized size limits before cache write.
+- **IPC parity on limits**: `AF_SHARED_DATA` payload building now enforces the same shared-data limits at send-time, not only at ingest-time.
+- **Immutable loader snapshots**: `window.getAttackFlowSharedData()` now returns validated clone+freeze snapshots instead of exposing mutable cache references.
+- **Explorer fallback diagnostics**: Direct parent shared-loader errors/invalid payloads now emit debug trace diagnostics and safely fall back to alternate data sources.
+
+#### Local IPC Hardening
+- **Source pinning**: IPC messages are accepted only from expected frame windows.
+- **Strict schema enforcement**: IPC message types and keys are allowlisted; unknown keys/types are rejected and traced.
+- **Immutable shared payload**: `AF_SHARED_DATA` is shape-validated, cloned, and deep-frozen before IPC send/use.
+- **Rate limiting**: Token-bucket throttling (configurable) for incoming IPC requests per frame and request type.
+- **Data loading behavior**: Explorer can consume validated shared data from parent in local iframe mode to reduce redundant fetch/load paths.
+- **IPC transport hardening**: Channel-only `MessageChannel` transport with session nonce binding; legacy window request/response fallback path removed.
+- **Bootstrap resilience**: Parent channel bootstrap now uses bounded timeout/retry/backoff; explorer and stix-builder expose explicit terminal bootstrap-failure recovery behavior without legacy transport.
+
+
 ## [2.8.0] - 2026-02-14
 
 ### Added

README.md

@@ -4,17 +4,27 @@ An editor for creating enriched Cyber Kill Chain assessments by mapping MITRE AT
 
 ### Work in progress 
 
-![Version](https://img.shields.io/badge/version-2.8.0-blue)
+![Version](https://img.shields.io/badge/version-2.9.0-blue)
 [![MITRE ATT&CK® 18](https://img.shields.io/badge/MITRE%20ATT%26CK®-v18-red)](https://attack.mitre.org/versions/v18/)
 ![License](https://img.shields.io/badge/license-Apache%202.0-green)
 ![Dependencies](https://img.shields.io/badge/dependencies-none-brightgreen)
 
 ## Features
 
 ### Implementation
-- **Vanilla CSS & JavaScript** — No external dependencies, runs in any browser
-- **Offline Operation** — No CDN, no remote requests, no third-party dependencies
-- **Lightweight Theming Engine** — Toggle configurable light/dark theme with shared settings (via `config.js`) across views 
+- **Vanilla CSS & JavaScript** 
+    - Core modules have no external dependencies or any third party libraries.
+    - No build step and no package-manager runtime dependencies, runs in any browser
+- **Offline Operation** 
+    - No CDN or remote runtime requests; module dependencies are vendored locally and modules can be disabled.
+    - Can be used offline in a browser by opening the `index.html` file. 
+    - Offline module communication is achieved via hardened IPC channels only allowed in `file://` protocol context. Disabled by default in `config.js`. See [Local iframe IPC](#Local-iframe-IPC) for detailed information.
+    - In case the IPC Bridge is disabled or fails to initialise the application falls back to manual import of the `resources` directory
+- **STIX Visualizer Module** — Modular Visualization of STIX Bundles
+    - Visualizer Module can be disabled via `config.js` flag. See [STIX Visualizer Toggle](#STIX-Visualizer-Toggle)
+    - For a list of bundled runtime dependencies used by the visualizer see: [STIX Visualizer Dependencies](#Bundled-STIX-Visualizer-Dependencies)
+- **Lightweight Theming Engine** 
+    - Toggle configurable light/dark theme with shared settings (via `config.js`) across views 
 
 ### Resource Corpus
 - **Unified Kill Chain** — Map entities to IN → THROUGH → OUT phases
@@ -36,18 +46,22 @@ An editor for creating enriched Cyber Kill Chain assessments by mapping MITRE AT
 - **Compact Mode** — Dense ID-only tags to fit large kill chains, collapsible sidebar & hiding empty phases
 - **STIX Editor** — Edit all spec-defined fields per SDO type with vocabulary dropdowns
 
-![Preview](preview.png)
+![Preview](/docs/images/preview.png)
 
 #### Kill Chain Relationships
-- **Browsable Mapping Explorer** — Browse kill chain related CAPEC → CWE → ATT&CK → Mitigation patterns per Phase in a dedicated view
+- **Browsable Mapping Explorer** — Browse kill chain related CAPEC → CWE → ATT&CK → Mitigation patterns per Phase in a dedicated view with phase detail modal dialogs
 
-![Relations View](relations.png)
+![Relations View](/docs/images/relations.png)
 
 ### Relationship Explorer 
 - **Integrated Resource Corpus Explorer** Explore & search the complete corpus of related ATT&CK ↔ CAPEC ↔ CWE ↔ Mitigations patterns
 - **Technique Cross-References** — Item relationships & techniques referenced by ID in descriptions link to the Relationship Explorer
 
-![Explorer View](explorer.png)
+![Explorer View](/docs/images/explorer.png)
+
+### STIX Composer
+#### Interactive STIX Object/Bundle Editor & Visualizer
+![Composer View](/docs/images/visualizer.png)
 
 ## Quick Start
 
@@ -84,12 +98,13 @@ See the usecases [README](docs/Usecases/README.md) for details.
 - **Grouping demo**: Import [examples/grouping-demo.json](examples/grouping-demo.json) for a ransomware-focused TTP mapping that showcases grouping.
 - **STIX demo**: Import [examples/stix-demo.json](examples/stix-demo.json) for a full STIX 2.1 showcase with all 19 SDO types across UKC phases.
 - **STIX bundle**: Import [examples/Operation-Midnight-Eclipse-stix-bundle.json](examples/Operation-Midnight-Eclipse-stix-bundle.json) via the STIX tab's "Import STIX Bundle" button to test STIX bundle parsing (25 SDOs across 19 types + 18 phase-relationship SROs).
-
 ## Project Structure
 
 ```
 ├── index.html                      # Main application
 ├── explorer.html                   # Relationship Explorer view
+├── stix-builder.html               # STIX Composer (STIX 2.1 Bundle Creator & Visualizer)
+├── stix-builder.config.js          # STIX Composer configuration & STIX 2.1 spec reference
 ├── config.js                       # Centralized configuration 
 │                                   # (paths, colors, imports, settings)
 ├── stix-config.js                  # STIX 2.1 SDO type definitions and vocabularies
@@ -171,6 +186,64 @@ Please do not hesitate to create an issue / pull request or contact me directly
 - **XXE Protection** — Secure XML parsing with entity expansion disabled
 - **CSV Safety** — Formula injection protection on exports
 
+### Prototype Pollution Hardening
+
+Import paths and JSON processing include explicit prototype pollution defenses:
+
+- **Dangerous key blocklist** — `__proto__`, `constructor`, and `prototype` keys are rejected in parse/sanitize paths.
+- **Safe JSON parsing** — untrusted JSON is parsed with a reviver that drops dangerous prototype keys.
+- **Null-prototype accumulators** — sanitized object collectors use `Object.create(null)` for untrusted key maps.
+- **Own-property checks** — import logic uses own-property guards for dynamic field copy to avoid inherited-property abuse.
+
+### Local iframe IPC
+
+AttackFlow includes a local-use IPC bridge between `index.html` (parent) and embedded `explorer.html` / `stix-builder.html` iframes. This allows using all features by simply opening the `index.html` file in a browser, letting the IPC bridge handle all data exchange between iframes. 
+
+Note: Designed strictly for local, non-webserver usage (requires `file://` as protocol)
+
+- **Purpose**: Theme synchronization and shared data handoff to reduce redundant iframe loading paths.
+- **Scope**: Designed for local usage mode (requires `file://` protocol) and controlled by `CONFIG.ConfigIframeIPC.enableLocalIframeIPC`.
+- **Transport**: Channel-only `MessageChannel` transport (no legacy request/response fallback path).
+- **Session binding**: Per-iframe session nonce is required for channel messages.
+- **Validation**: IPC message types/keys are allowlisted; unknown keys/types are rejected.
+- **Shared payload safety**: `AF_SHARED_DATA` is schema-checked, cloned, and deep-frozen before use.
+- **Containment**: Embedded iframes are sandboxed (`allow-scripts allow-same-origin allow-modals`).
+- **Throttling**: Parent applies per-frame/per-request-type token-bucket rate limiting.
+- **Resilience**: Parent bootstrap uses bounded timeout/retry/backoff; children detect terminal bootstrap failure and recover without legacy transport.
+
+Configuration in `config.js`:
+
+- `CONFIG.ConfigIframeIPC.enableLocalIframeIPC`
+- `CONFIG.debugging.traceLocalIframeIPCLogs`
+- `CONFIG.debugging.localIframeIPCRateLimit.enabled`
+- `CONFIG.debugging.localIframeIPCRateLimit.refillPerSecond`
+- `CONFIG.debugging.localIframeIPCRateLimit.burst`
+- `CONFIG.debugging.localIframeIPCBootstrap.timeoutMs`
+- `CONFIG.debugging.localIframeIPCBootstrap.maxRetries`
+- `CONFIG.debugging.localIframeIPCBootstrap.retryBaseDelayMs`
+- `CONFIG.debugging.localIframeIPCBootstrap.retryBackoffMultiplier`
+- `CONFIG.debugging.localIframeIPCBootstrap.maxRetryDelayMs`
+- `CONFIG.debugging.localIframeIPCBootstrap.graceMs`
+
+See [IPC API DOCS](docs/IPC_API-DOCS.md) for concise architecture and threat-model documentation.
+
+### STIX Visualizer Toggle
+
+The integrated STIX visualizer can be fully disabled via config:
+
+- `CONFIG.visualizer.enabled = false`
+
+When disabled, AttackFlow prevents the visualizer from loading and executing by not injecting its own visualizer assets and bundled third-party visualizer libraries.
+
+### Bundled STIX Visualizer Dependencies
+
+The [STIX visualizer](https://github.com/oasis-open/cti-stix-visualization)  is shipped as vendored local files (no CDN):
+
+- RequireJS `2.3.6` (`stix-visualization/stix_visualizer/require.js`)
+- RequireJS domReady plugin `2.0.1` (`stix-visualization/stix_visualizer/domReady.js`)
+- vis-network (vendored build used by stix2viz; (`stix-visualization/stix_visualizer/stix2viz/visjs/vis-network.js`))
+- stix2viz module (`stix-visualization/stix_visualizer/stix2viz/stix2viz/stix2viz.js`)
+
 ### Security Objectives
 1. **No execution of untrusted content** from local or upstream data (MITRE JSON/XML, user-imported layers).
 2. **Defensive rendering**: all UI output is treated as untrusted until sanitized & encoded.
@@ -201,6 +274,14 @@ python3 scripts/extract-data.py      # Parse CAPEC/CWE
 # Sanitization runs before and after parsing to keep source and generated files clean
 ```
 
+## Installation
+
+### For Installation on servers:
+- Just drop the files on a webserver, (optionally) set CSP headers and navigate to index.html.
+
+### For local use (in a browser):
+1. Set `CONFIG.ConfigIframeIPC.enableLocalIframeIPC` to `true` and open the `index.html` file in a web browser.
+2. Upload the `resources/` directory as instructed to populate the framework database and use all application features.
 
 ## Contributing & Reporting Issues
 
@@ -226,6 +307,7 @@ AttackFlow uses data and references from the following third-party sources:
 - CAPEC: https://capec.mitre.org/
 - CWE: https://cwe.mitre.org/
 - STIX 2.1: https://oasis-open.github.io/cti-documentation/
+- STIX Visualizer (stix2viz): https://github.com/oasis-open/cti-stix-visualization
 - Unified Kill Chain: https://www.unifiedkillchain.com/
 - FontAwesome: https://github.com/FortAwesome/Font-Awesome
 

config.js

@@ -7,7 +7,7 @@
 
 const CONFIG = {
     // Application info
-    version: '2.8.0',
+    version: '2.9.0',
     changelogUrl: 'CHANGELOG.md',
 
     // Framework source files (for extraction scripts)
@@ -179,7 +179,7 @@ const CONFIG = {
     display: {
         maxNameLength: 200,      // Max width for entity names in tags
         maxDescLength: 800,      // Max description length in detail panel
-        maxMitigations: 8,       // Max mitigations to show
+        maxMitigations: 20,       // Max mitigations to show
         maxReferences: 3,        // Max references to show
         maxTitleLength: 200,     // Max kill chain title length
         maxCustomLabels: 20,     // Max labels per custom STIX item
@@ -194,9 +194,38 @@ const CONFIG = {
         clearStixOnKillChainImport: true   // Auto-clear STIX library before importing a kill chain
     },
 
+    // Debugging controls
+    debugging: {
+        traceLocalIframeIPCLogs: false, // Enable full local iframe IPC trace logs in console
+        localIframeIPCRateLimit: {
+            enabled: true,      // Apply request throttling for local iframe IPC request messages
+            refillPerSecond: 1, // Token refill rate per second
+            burst: 2            // Max burst per frame per request type
+        },
+        localIframeIPCBootstrap: {
+            timeoutMs: 1200,            // Per-attempt bootstrap timeout in milliseconds
+            maxRetries: 3,              // Total bootstrap attempts before terminal failure
+            retryBaseDelayMs: 250,      // Base delay before retry attempts
+            retryBackoffMultiplier: 2,  // Exponential backoff multiplier
+            maxRetryDelayMs: 2000,      // Upper bound for retry delay
+            graceMs: 300                // Extra wait for child-side terminal-failure watch
+        }
+    },
+
+    // Local iframe IPC behavior
+    ConfigIframeIPC: {
+        enableLocalIframeIPC: false // Enable iframe IPC bridge only for file:// local mode
+    },
+
     // Navigation behavior
     navigation: {
-        confirmOnLeave: true     // Show confirmation dialog before leaving the page
+        confirmOnLeave: true,    // Show confirmation dialog before leaving the page
+        showStixBuilder: true    // Toggle STIX Composer view in navigation
+    },
+
+    // Visualizer behavior
+    visualizer: {
+        enabled: true // Disable to prevent visualizer resources from loading/executing
     }
 };
 

docs/IPC_API-DOCS.md

@@ -0,0 +1,69 @@
+# IPC API Docs (Local iframe IPC)
+
+## Overview
+Provides a minimal, local-mode communication layer between `index.html` (parent) and embedded views (`explorer.html`, `stix-builder.html`) for:
+- theme synchronization
+- shared dataset handoff (`AF_SHARED_DATA`) to avoid redundant loading work
+
+## Scope and Purpose
+- Designed for local browser usage (`file://`) and controlled by configuration.
+- Not intended as a general cross-origin API surface.
+- IPC is restricted to embedded first-party frames used by AttackFlow.
+
+## Architecture
+- **Parent**: `index.html`
+  - Owns canonical shared data cache.
+  - Bootstraps one `MessageChannel` per iframe.
+  - Generates per-session nonce and binds it to each iframe channel.
+  - Applies bounded bootstrap timeout/retry/backoff and marks terminal retry exhaustion.
+- **Children**: `explorer.html`, `stix-builder.html`
+  - Accept channel bootstrap from parent.
+  - Send typed requests over channel.
+  - Apply validated responses.
+- **Recovery**: Children maintain explicit bootstrap-failure handling without falling back to legacy request/response messaging.
+
+## Message Types
+Requests (child -> parent):
+- `AF_REQUEST_THEME`
+- `AF_REQUEST_SHARED_DATA` (explorer path)
+
+Responses (parent -> child):
+- `AF_THEME_SYNC`
+- `AF_SHARED_DATA`
+
+Bootstrap:
+- `AF_IPC_PORT_INIT` (window message with transferred `MessagePort`, channel id, nonce)
+
+## Security and Hardening
+- Source pinning: only expected frame windows are accepted.
+- Strict allowlists: message types and payload keys are validated; unknown keys/types are rejected.
+- Nonce binding: channel messages must include correct session nonce.
+- Immutable shared data: `AF_SHARED_DATA` is schema-checked, cloned, and deep-frozen.
+- Iframe containment: iframe sandbox is enabled (`allow-scripts allow-same-origin allow-modals`).
+- Request throttling: per-frame, per-request-type token-bucket limits (configurable).
+- Channel-only transport: legacy window request/response IPC path removed.
+- Bootstrap resilience: bounded timeout + retry/backoff with terminal failure signaling in child views.
+
+## Threat Model (Local)
+Defends against:
+- unsolicited or malformed IPC messages
+- accidental protocol misuse and message-spam loops
+- over-privileged child access to parent state
+
+Assumptions:
+- attacker can potentially execute script in one frame context
+- local-mode browser constraints apply (e.g., limited origin guarantees in `file://`)
+
+## Configuration
+In `config.js`:
+- `CONFIG.ConfigIframeIPC.enableLocalIframeIPC`
+- `CONFIG.debugging.traceLocalIframeIPCLogs`
+- `CONFIG.debugging.localIframeIPCRateLimit.enabled`
+- `CONFIG.debugging.localIframeIPCRateLimit.refillPerSecond`
+- `CONFIG.debugging.localIframeIPCRateLimit.burst`
+- `CONFIG.debugging.localIframeIPCBootstrap.timeoutMs`
+- `CONFIG.debugging.localIframeIPCBootstrap.maxRetries`
+- `CONFIG.debugging.localIframeIPCBootstrap.retryBaseDelayMs`
+- `CONFIG.debugging.localIframeIPCBootstrap.retryBackoffMultiplier`
+- `CONFIG.debugging.localIframeIPCBootstrap.maxRetryDelayMs`
+- `CONFIG.debugging.localIframeIPCBootstrap.graceMs`