Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

update(query): add CWE infos to openAPI queries #7181

Merged
merged 11 commits into from
Sep 18, 2024
Merged

update(query): add CWE infos to openAPI queries #7181

Show file tree
Hide file tree
Changes from 8 commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
5d83781
add cwe infos to all openAPI queries
ArturRibeiro-CX Jul 3, 2024
759882e
update query names on positive expected results
ArturRibeiro-CX Jul 3, 2024
7516bb0
update e2e with cwe and cloudProvider fields
ArturRibeiro-CX Jul 3, 2024
66cc1d2
Merge branch 'master' into AST-45283-openAPI
ArturRibeiro-CX Jul 4, 2024
571c5c5
Merge branch 'master' into AST-45283-openAPI
ArturRibeiro-CX Jul 5, 2024
31beec9
Merge branch 'master' into AST-45283-openAPI
cx-ruiaraujo Jul 22, 2024
8ce1829
Merge branch 'master' into AST-45283-openAPI
ArturRibeiro-CX Aug 16, 2024
52003cd
Merge branch 'master' into AST-45283-openAPI
ArturRibeiro-CX Sep 13, 2024
8c0f3c9
remove empty description text and add cwe that was missing
ArturRibeiro-CX Sep 16, 2024
64b6dac
Merge branch 'master' into AST-45283-openAPI
ArturRibeiro-CX Sep 18, 2024
11e027e
Merge branch 'master' into AST-45283-openAPI
ArturRibeiro-CX Sep 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/basepath_with_wrong_format/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#schema",
"platform": "OpenAPI",
"descriptionID": "c97fafa0",
"cwe": ""
"cloudProvider": "common",
"cwe": "20"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/body_parameter_with_wrong_property/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#parameterObject",
"platform": "OpenAPI",
"descriptionID": "93b15115",
"cwe": ""
"cloudProvider": "common",
"cwe": "20"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/body_parameter_without_schema/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#parameterObject",
"platform": "OpenAPI",
"descriptionID": "3074f818",
"cwe": ""
"cloudProvider": "common",
"cwe": "20"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/constraining_enum_property/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#schemaObject",
"platform": "OpenAPI",
"descriptionID": "63cd2785",
"cwe": ""
"cloudProvider": "common",
"cwe": "20"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/file_parameter_with_wrong_consumes_property/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#operation-object",
"platform": "OpenAPI",
"descriptionID": "f6b7b31a",
"cwe": ""
"cloudProvider": "common",
"cwe": "20"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/global_schemes_uses_http/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#swaggerObject",
"platform": "OpenAPI",
"descriptionID": "11bb39ad",
"cwe": ""
"cloudProvider": "common",
"cwe": "319"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/global_security_using_password_flow/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#securityRequirementObject",
"platform": "OpenAPI",
"descriptionID": "14a00e4a",
"cwe": ""
"cloudProvider": "common",
"cwe": "285"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/host_with_invalid_pattern/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#swagger-object",
"platform": "OpenAPI",
"descriptionID": "d11c994c",
"cwe": ""
"cloudProvider": "common",
"cwe": "20"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/implicit_flow_oauth2/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#securitySchemeObject",
"platform": "OpenAPI",
"descriptionID": "a879610a",
"cwe": ""
"cloudProvider": "common",
"cwe": "285"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/invalid_media_type_value/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/#media-type-object",
"platform": "OpenAPI",
"descriptionID": "bde04b9d",
"cwe": ""
"cloudProvider": "common",
"cwe": "710"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/invalid_oauth2_token_url/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#security-scheme-object",
"platform": "OpenAPI",
"descriptionID": "d6163b1e",
"cwe": ""
"cloudProvider": "common",
"cwe": "284"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/invalid_oauth_authorization_url/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#securitySchemeObject",
"platform": "OpenAPI",
"descriptionID": "720629e5",
"cwe": ""
"cloudProvider": "common",
"cwe": "285"
}
5 changes: 3 additions & 2 deletions assets/queries/openAPI/2.0/json_reference_does_not_exists_parameter/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,12 @@
{
"id": "fb889ae9-2d16-40b5-b41f-9da716c5abc1",
"queryName": "Parameter JSON Reference Does Not Exists (v2)",
"queryName": "Parameter JSON Reference Does Not Exist (v2)",
"severity": "INFO",
"category": "Structure and Semantics",
"descriptionText": "Parameter reference should exist on parameters definition field",
"descriptionUrl": "https://swagger.io/specification/v2/#parameterObject",
"platform": "OpenAPI",
"descriptionID": "7260680f",
"cwe": ""
"cloudProvider": "common",
"cwe": "20"
}
4 changes: 2 additions & 2 deletions ...s/openAPI/2.0/json_reference_does_not_exists_parameter/test/positive_expected_result.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
[
{
"queryName": "Parameter JSON Reference Does Not Exists (v2)",
"queryName": "Parameter JSON Reference Does Not Exist (v2)",
"severity": "INFO",
"line": 19,
"filename": "positive1.json"
},
{
"queryName": "Parameter JSON Reference Does Not Exists (v2)",
"queryName": "Parameter JSON Reference Does Not Exist (v2)",
"severity": "INFO",
"line": 14,
"filename": "positive2.yaml"
Expand Down
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/json_reference_does_not_exists_response/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#responsesDefinitionsObject",
"platform": "OpenAPI",
"descriptionID": "213a6df0",
"cwe": ""
"cloudProvider": "common",
"cwe": "20"
}
7 changes: 4 additions & 3 deletions assets/queries/openAPI/2.0/json_reference_does_not_exists_schema/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,12 @@
{
"id": "98295b32-ec09-4b5b-89a9-39853197f914",
"queryName": "Schema JSON Reference Does Not Exists (v2)",
"queryName": "Schema JSON Reference Does Not Exist (v2)",
"severity": "INFO",
"category": "Structure and Semantics",
"descriptionText": "Schema reference should exists on definitions field",
"descriptionText": "Schema reference should exist on definitions field",
"descriptionUrl": "https://swagger.io/specification/v2/#definitionsObject",
"platform": "OpenAPI",
"descriptionID": "6da8f0da",
"cwe": ""
"cloudProvider": "common",
"cwe": "20"
}
4 changes: 2 additions & 2 deletions ...ries/openAPI/2.0/json_reference_does_not_exists_schema/test/positive_expected_result.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
[
{
"queryName": "Schema JSON Reference Does Not Exists (v2)",
"queryName": "Schema JSON Reference Does Not Exist (v2)",
"severity": "INFO",
"line": 15,
"filename": "positive1.json"
},
{
"queryName": "Schema JSON Reference Does Not Exists (v2)",
"queryName": "Schema JSON Reference Does Not Exist (v2)",
"severity": "INFO",
"line": 14,
"filename": "positive2.yaml"
Expand Down
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/multi_body_parameters_same_operation/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#parameterObject",
"platform": "OpenAPI",
"descriptionID": "817fa38a",
"cwe": ""
"cloudProvider": "common",
"cwe": "20"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/multi_collectionformat_not_valid_in_parameter/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#parameterObject",
"platform": "OpenAPI",
"descriptionID": "e0b264a9",
"cwe": ""
"cloudProvider": "common",
"cwe": "20"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/non_body_parameter_with_schema/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#parameterObject",
"platform": "OpenAPI",
"descriptionID": "e135be5b",
"cwe": ""
"cloudProvider": "common",
"cwe": "20"
}
3 changes: 2 additions & 1 deletion .../queries/openAPI/2.0/non_oauth2_security_requirement_defining_oauth2_scopes/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
"descriptionUrl": "https://swagger.io/specification/v2/#securityRequirementObject",
"platform": "OpenAPI",
"descriptionID": "33e1e674",
"cwe": "",
"cloudProvider": "common",
"cwe": "20",
"oldSeverity": "HIGH"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/object_without_required_property/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/",
"platform": "OpenAPI",
"descriptionID": "0bc1b81e",
"cwe": ""
"cloudProvider": "common",
"cwe": "20"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/operation_example_mismatch_produces_mediatype/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#exampleObject",
"platform": "OpenAPI",
"descriptionID": "77f2d405",
"cwe": ""
"cloudProvider": "common",
"cwe": "20"
}
3 changes: 2 additions & 1 deletion ...ts/queries/openAPI/2.0/operation_object_parameters_with_body_and_formatdata/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#parameterObject",
"platform": "OpenAPI",
"descriptionID": "007c8e83",
"cwe": ""
"cloudProvider": "common",
"cwe": "20"
}
5 changes: 3 additions & 2 deletions assets/queries/openAPI/2.0/operation_object_without_consumes/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,10 @@
"queryName": "Operation Object Without 'consumes'",
"severity": "MEDIUM",
"category": "Insecure Configurations",
"descriptionText": "Operation Object should have 'consumes' feild defined for 'POST', 'PUT' and 'PATCH' operations",
"descriptionText": "Operation Object should have 'consumes' field defined for 'POST', 'PUT' and 'PATCH' operations",
"descriptionUrl": "https://swagger.io/specification/v2/#operation-object",
"platform": "OpenAPI",
"descriptionID": "de859594",
"cwe": ""
"cloudProvider": "common",
"cwe": "710"
}
5 changes: 3 additions & 2 deletions assets/queries/openAPI/2.0/operation_object_without_produces/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,10 @@
"queryName": "Operation Object Without 'produces'",
"severity": "MEDIUM",
"category": "Insecure Configurations",
"descriptionText": "Operation Object should have 'produces' feild defined for 'GET'operation",
"descriptionText": "Operation Object should have 'produces' field defined for 'GET'operation",
"descriptionUrl": "https://swagger.io/specification/v2/#operation-object",
"platform": "OpenAPI",
"descriptionID": "1736226c",
"cwe": ""
"cloudProvider": "common",
"cwe": "665"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/operation_summary_too_long/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
"descriptionUrl": "https://swagger.io/specification/v2/#operation-object",
"platform": "OpenAPI",
"descriptionID": "60a0b99e",
"cwe": "",
"cloudProvider": "common",
"cwe": "710",
"oldSeverity": "LOW"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/operation_using_basic_auth/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
"descriptionUrl": "https://swagger.io/specification/v2/#operation-object",
"platform": "OpenAPI",
"descriptionID": "bb3bb0b3",
"cwe": "",
"cloudProvider": "common",
"cwe": "284",
"oldSeverity": "LOW"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/operation_using_implicit_flow/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
"descriptionUrl": "https://swagger.io/specification/v2/#operation-object",
"platform": "OpenAPI",
"descriptionID": "5f7dafc1",
"cwe": "",
"cloudProvider": "common",
"cwe": "284",
"oldSeverity": "LOW"
}
1 change: 1 addition & 0 deletions assets/queries/openAPI/2.0/operation_using_password_flow/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#operation-object",
"platform": "OpenAPI",
"descriptionID": "e0279bb3",
"cloudProvider": "common",
"cwe": ""
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/parameter_file_type_not_in_formdata/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#parameterObject",
"platform": "OpenAPI",
"descriptionID": "e8a62738",
"cwe": ""
"cloudProvider": "common",
"cwe": "20"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/parameter_object_incorrect_ref/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#parameter-object",
"platform": "OpenAPI",
"descriptionID": "9b33f092",
"cwe": ""
"cloudProvider": "common",
"cwe": "20"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/path_scheme_accepts_http/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#operationObject",
"platform": "OpenAPI",
"descriptionID": "4ac6f671",
"cwe": ""
"cloudProvider": "common",
"cwe": "319"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/property_not_unique/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#schemaObject",
"platform": "OpenAPI",
"descriptionID": "eb2e14e6",
"cwe": ""
"cloudProvider": "common",
"cwe": "20"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/response_object_incorrect_ref/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#responses-object",
"platform": "OpenAPI",
"descriptionID": "7a486064",
"cwe": ""
"cloudProvider": "common",
"cwe": "20"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/schema_object_incorrect_ref/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#schema-object",
"platform": "OpenAPI",
"descriptionID": "8389f514",
"cwe": ""
"cloudProvider": "common",
"cwe": "20"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/schema_with_additional_properties_set_as_boolean/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#schema-object",
"platform": "OpenAPI",
"descriptionID": "2509db0d",
"cwe": ""
"cloudProvider": "common",
"cwe": "710"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/schemes_uses_http copy/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#swaggerObject",
"platform": "OpenAPI",
"descriptionID": "34948b49",
"cwe": ""
"cloudProvider": "common",
"cwe": "319"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/security_definitions_allows_password_flow/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#securitySchemeObject",
"platform": "OpenAPI",
"descriptionID": "7b681b12",
"cwe": ""
"cloudProvider": "common",
"cwe": "285"
}
3 changes: 2 additions & 1 deletion assets/queries/openAPI/2.0/security_definitions_undefined_or_empty/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,6 @@
"descriptionUrl": "https://swagger.io/specification/v2/#securityDefinitionsObject",
"platform": "OpenAPI",
"descriptionID": "170dbeca",
"cwe": ""
"cloudProvider": "common",
"cwe": "284"
}
Loading
Loading