Add mapping to Secure Code Warrior trial #264

Matth-- · 2019-11-14T09:13:15Z

The links redirect to the trial page for Secure Code Warrior security training.

Checklist:

I have added entries to CHANGELOG.md and marked it Added/Changed/Removed
I have made corresponding changes to the documentation (if needed)

The links redirect to the trial page for Secure Code Warrior security training.

barnett · 2019-11-14T19:32:41Z

Sorry on the build issue here, got an issue having to do with forks we're working out.

adamrdavid · 2019-11-15T20:00:15Z

👋 github seems to not want to send anything to buildkite for forks. until I can figure that out, we can use this:
https://github.com/bugcrowd/vulnerability-rating-taxonomy/compare/scw-mapping

I merged it into our fork. Unfortunately access to our CI tool is not public, but you can run the tests locally by running the Dockerfile.

Currently CI is reporting a schema error in the scw mapping:

ERROR: test_mapping_schemas (test_vrt.TestVrt)
--
  | ----------------------------------------------------------------------
  | Traceback (most recent call last):
  | File "/tmp/vrt/tests/test_vrt.py", line 43, in test_mapping_schemas
  | self.validate_schema(schema_file, mapping['filename'])
  | File "/tmp/vrt/tests/test_vrt.py", line 31, in validate_schema
  | raise error
  | jsonschema.exceptions.ValidationError: 'https://integration-api.securecodewarrior.com/api/v1/trial?id=bugcrowd&mappingList=vrt&mappingKey=server_security_misconfiguration:misconfigured_dns:missing_caa_record&redirect=true' does not match '^https:\\/\\/integration-api\\.securecodewarrior\\.com\\/api\\/v1\\/trial\\?id=bugcrowd&mappingList=vrt&mappingKey=[a-z_:]*$'
  |  
  | Failed validating 'pattern' in schema[0]['properties']['scw']:
  | {'pattern': '^https:\\/\\/integration-api\\.securecodewarrior\\.com\\/api\\/v1\\/trial\\?id=bugcrowd&mappingList=vrt&mappingKey=[a-z_:]*$',
  | 'type': 'string'}
  |  
  | On instance['scw']:
  | 'https://integration-api.securecodewarrior.com/api/v1/trial?id=bugcrowd&mappingList=vrt&mappingKey=server_security_misconfiguration:misconfigured_dns:missing_caa_record&redirect=true'

- Changed "scw" key to "secure_code_warrior" so unit tests pass - Added &redirect to url validator - Re-generated the mapping file to include all the VRT identifiers. If a mapping does not exist, users will still get redirected to the trial-url but they will have to select a vulnerability before they can play a challenge.

Matth-- · 2019-11-18T11:00:35Z

Hi @adamrdavid

I did some changes so the schema validation works. Also changed the "scw" property to "secure_code_warrior" because of failing tests (Test checks if the mapping folder name has the same key as the identifier used by SCW).

adamrdavid · 2019-11-19T18:51:31Z

@Matth-- I setup github actions with this repo so if you push a commit you should be able to see the CI build.

plr0man

Well done :)

plr0man · 2019-12-03T20:06:01Z

.github/PULL_REQUEST_TEMPLATE.md


 #### [Remediation Advice Mapping](https://github.com/bugcrowd/vulnerability-rating-taxonomy/blob/master/mappings/remediation_advice/remediation_advice.json):

+#### [Secure Code Warrior](https://github.com/bugcrowd/vulnerability-rating-taxonomy/blob/master/mappings/secure_code_warrior/secure_code_warrior.json)


Can we replace Secure Code Warrior with Secure Code Warrior Mapping and add a colon at the end of the line

plr0man · 2019-12-03T20:50:44Z

mappings/secure_code_warrior/secure_code_warrior.json

+    "content": [
+        {
+            "id": "server_security_misconfiguration",
+            "secure_code_warrior": "https://integration-api.securecodewarrior.com/api/v1/trial?id=bugcrowd&mappingList=vrt&mappingKey=server_security_misconfiguration&redirect=true",


Are the links working correctly? For instance this one here takes me to https://portal.securecodewarrior.com/?utm_source=partner-integration:bugcrowd#/website-trial

hi @plr0man

We do not have a mapping for every VRT item. That's why some links will redirect to a trial page where the user can select his own category.

If this is unwanted behavior we could provide a list where only links where mappings exist.

Ah, what would be best here is to not set those values to the default but instead set the metadata default to such value. That will then automatically fallback to such value when one doesn’t exist in the mapping.

ah, I thought this one was available at https://portal.securecodewarrior.com/?utm_source=partner-integration:bugcrowd#/website-trial/web/misconfig], @barnett has a good point though. To add to that, and @barnett correct me here if I'm wrong in this case, any undeclared children nodes would inherit secure_code_warrior values from their parents. So for example if you had a subcategory with 5 variants and they all had the same mapping values then it's ok to not list the children. That of course is not an error, just a suggestion if you guys find it useful.

That's what I thought as well, but @adamrdavid would be able to confirm.

Yes parent mappings will be used if the children don't have 👍

From our point of view it is easier to leave all the urls unique. If we plan on supporting a category that has not been mapped yet, the user will get redirected to a more specific challenge without the need to change this mapping file.

In other words: with this setup modifications to the mapping on existing vrt ids will not require any change on this mapping file. We only need to update this file when a new version of VRT gets released.

barnett · 2019-12-05T00:59:13Z

.github/PULL_REQUEST_TEMPLATE.md


 #### [Remediation Advice Mapping](https://github.com/bugcrowd/vulnerability-rating-taxonomy/blob/master/mappings/remediation_advice/remediation_advice.json):

+#### [Secure Code Warrior](https://github.com/bugcrowd/vulnerability-rating-taxonomy/blob/master/mappings/secure_code_warrior/secure_code_warrior.json)


Suggested change

#### [Secure Code Warrior](https://github.com/bugcrowd/vulnerability-rating-taxonomy/blob/master/mappings/secure_code_warrior/secure_code_warrior.json)

#### [Secure Code Warrior Mapping](https://github.com/bugcrowd/vulnerability-rating-taxonomy/blob/master/mappings/secure_code_warrior/secure_code_warrior.json):

barnett · 2019-12-05T01:00:00Z

mappings/secure_code_warrior/secure_code_warrior.json

@@ -0,0 +1,1409 @@
+{
+    "metadata": {
+        "default": null


Suggested change

"default": null

"default": "https://portal.securecodewarrior.com/?utm_source=partner-integration:bugcrowd#/website-trial"

barnett · 2019-12-06T01:00:47Z

Now seeing that it isn't as much a 1:1 mapping but a formula to construct the URL, would be interesting to see how we can better support this down the road. @Matth--, when we add/change categories what is the change-management process for your side. Thinking if we just auto-create the dynamic URL how'd that work?

barnett · 2020-01-08T22:26:56Z

Hey @Matth--,

Emailed Alex as well, but we'll be auto-generating this mapping via our build process going forward, removing the need to maintain the mapping in this repository. You can see an example of the output of this auto-generated mapping here with a list of the builds (current and future ones) here. Will be sure to keep your team updated before we cut new versions so that you can keep the mapping on your side up to date 👍

With the above process done, we can close this PR. Appreciate all your help and assistance in creating the mapping 🎉

adamrdavid · 2020-01-08T22:29:25Z

Just a side note @Matth-- the file will be updated every time there is a master build or a new release and it checks which urls resolve, so it will update if you add/change categories.

Matth-- · 2020-01-10T09:56:15Z

Okay, sound like the best solution here!

Add mapping to Secure Code Warrior trial

9df82ff

The links redirect to the trial page for Secure Code Warrior security training.

Matth-- force-pushed the add-secure-code-warrior-mapping branch from 185fb63 to 9df82ff Compare November 14, 2019 09:14

adamrdavid added the mappings Relating to external mapping taxonomies label Nov 18, 2019

Merge branch 'master' into add-secure-code-warrior-mapping

78cb0f9

plr0man suggested changes Dec 3, 2019

View reviewed changes

Matth-- changed the title ~~[WIP] Add mapping to Secure Code Warrior trial~~ Add mapping to Secure Code Warrior trial Dec 4, 2019

barnett reviewed Dec 5, 2019

View reviewed changes

barnett closed this Jan 8, 2020

Matth-- deleted the add-secure-code-warrior-mapping branch January 10, 2020 09:56

adamrdavid mentioned this pull request Jan 10, 2020

Generate artifacts workflow #272

Merged

2 tasks


		#### [Remediation Advice Mapping](https://github.com/bugcrowd/vulnerability-rating-taxonomy/blob/master/mappings/remediation_advice/remediation_advice.json):

		#### [Secure Code Warrior](https://github.com/bugcrowd/vulnerability-rating-taxonomy/blob/master/mappings/secure_code_warrior/secure_code_warrior.json)

	#### [Secure Code Warrior](https://github.com/bugcrowd/vulnerability-rating-taxonomy/blob/master/mappings/secure_code_warrior/secure_code_warrior.json)
	#### [Secure Code Warrior Mapping](https://github.com/bugcrowd/vulnerability-rating-taxonomy/blob/master/mappings/secure_code_warrior/secure_code_warrior.json):

	"default": null
	"default": "https://portal.securecodewarrior.com/?utm_source=partner-integration:bugcrowd#/website-trial"

Uh oh!

Add mapping to Secure Code Warrior trial #264

Add mapping to Secure Code Warrior trial #264

Uh oh!

Conversation

Matth-- commented Nov 14, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist:

Uh oh!

barnett commented Nov 14, 2019

Uh oh!

adamrdavid commented Nov 15, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Matth-- commented Nov 18, 2019

Uh oh!

adamrdavid commented Nov 19, 2019

Uh oh!

plr0man left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

barnett Dec 4, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

barnett Dec 5, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

barnett commented Dec 6, 2019

Uh oh!

barnett commented Jan 8, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

adamrdavid commented Jan 8, 2020

Uh oh!

Matth-- commented Jan 10, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Matth-- commented Nov 14, 2019 •

edited

Loading

adamrdavid commented Nov 15, 2019 •

edited

Loading

barnett Dec 4, 2019 •

edited

Loading

barnett Dec 5, 2019 •

edited

Loading

barnett commented Jan 8, 2020 •

edited

Loading