Skip to content

Commit 09a0afb

Browse files
Suresh-Krishna-PSuresh-Krishna-P
authored
Merge branch 'master' into patch-1
2 parents f3442d7 + 32d01cf commit 09a0afb

File tree

16 files changed

+601
-272
lines changed

16 files changed

+601
-272
lines changed

‎.github/workflows/run-tests-generate-output.yaml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
name: Run Tests and generate output files
22
# Controls when the workflow will run
33
on:
4-
# Triggers the workflow on push or pull request events but only for the main branch
5-
pull_request:
4+
# Triggers the workflow on pull request events
5+
# Using pull_request_target allows the build artifacts link to be posted as a comment
6+
# even for PRs from forked repositories.
7+
pull_request_target:
68
paths:
79
- 'source/**'
810
- 'scripts/convert**'
@@ -33,8 +35,9 @@ jobs:
3335
- name: Checkout repository
3436
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3537
with:
36-
ref: ${{ github.event.pull_request.head.ref }}
38+
ref: ${{ github.event.pull_request.head.sha }}
3739
repository: ${{ github.event.pull_request.head.repo.full_name }}
40+
persist-credentials: false
3841
# Set the pip environment up
3942
- name: Get Python
4043
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
@@ -122,7 +125,7 @@ jobs:
122125
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
123126
with:
124127
retention-days: 5
125-
name: cornucopia-build-files.${{ github.sha }}.zip
128+
name: cornucopia-build-files.${{ github.event.pull_request.head.sha }}.zip
126129
path: |
127130
output/cornucopia-build-files.zip
128131
commentpr:
@@ -144,7 +147,7 @@ jobs:
144147
145148
| Name | Link |
146149
|------|------|
147-
| Output files | [cornucopia-build-files.${{ github.sha }}.zip](${{needs.uploadoutputfiles.outputs.artifact-url}}) |
150+
| Output files | [cornucopia-build-files.${{ github.event.pull_request.head.sha }}.zip](${{needs.uploadoutputfiles.outputs.artifact-url}}) |
148151
149152
with:
150153
script: |

‎.github/workflows/run-tests.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,9 @@ jobs:
1616
- name: Checkout repository
1717
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1818
with:
19-
ref: ${{ github.event.pull_request.head.ref }}
19+
ref: ${{ github.event.pull_request.head.sha }}
2020
repository: ${{ github.event.pull_request.head.repo.full_name }}
21+
persist-credentials: false
2122
# Set the pip environment up
2223
- name: Get Python
2324
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ USER builder
3131
ARG workdir
3232
WORKDIR ${workdir}
3333
COPY --chown=builder:union Pipfile Pipfile.lock ./
34-
RUN pipenv --python "$(which python)" install --ignore-pipfile --dev
34+
RUN pipenv --python "$(which python)" install --no-cache-dir --ignore-pipfile --dev
3535
ENTRYPOINT ["/usr/local/bin/pipenv"]
3636

3737
FROM mvdan/shfmt@sha256:caa0324bdba08f42452a19e6a8462dda9852a1e43ad16185ec3d1ad66524a504 AS shfmt

‎Pipfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ verify_ssl = true
55

66
[dev-packages]
77
black = "==26.1.0"
8-
coverage = "==7.13.2"
8+
coverage = "==7.13.3"
99
flake8 = "==7.3.0"
1010
httpretty = "==1.1.4"
1111
mypy = "==1.19.1"

‎Pipfile.lock‎

Lines changed: 94 additions & 95 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎cornucopia.owasp.org/data/cards/mobileapp-cards-1.1-en/authentication-&-authorization/AA6/explanation.md‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,30 @@
11
## Scenario: Anant can perform sensitive operations without additional authentication because authentication requirements are too weak or missing
22

3+
Anant wants to see his saved "Ultra Secret" note in the app. The app asks for a PIN to "unlock" the note view. Anant bypasses the UI check using instrumentation. Because the note was encrypted with a hardcoded key (or no key bound to the biometric), he successfully views the note without providing the PIN.
4+
35
### Example
46

7+
Anant opens his "Vault" app. He navigates to the "View Secret" page. The app prompts for a fingerprint. Anant uses a script to hook the `onAuthenticationSucceeded` callback or the boolean check `isUnlocked`, forcing it to true. The app, which merely hid the text field behind a view overlap, now reveals the secret text. If the app had used the Android Keystore to encrypt the note, Anant's bypass would have failed because the decryption key would never have been released by the OS.
8+
59
## Threat Modeling
610

711
### STRIDE
812

13+
This scenario falls under the **Tampering** and **Information Disclosure** categories of STRIDE.
14+
15+
Anant performs **Tampering** by modifying the application's runtime logic to bypass the check, leading to **Information Disclosure** of the sensitive note.
16+
917
### What can go wrong?
1018

19+
**Logic-Only Gates:** Relying on simple boolean flags (e.g., `if (isUnlocked)`) allows attackers to flip the flag and bypass the check.
20+
21+
**Insecure Storage:** If data is stored in plain text or encrypted with a static key, bypassing the authentication screen grants immediate access to the data.
22+
1123
### What are we going to do about it?
1224

25+
**Android Keystore / iOS Keychain:** Use cryptographic keys that mandate user authentication (e.g., `setUserAuthenticationRequired(true)`).
26+
27+
**Crypto-Binding:** Ensure the sensitive data can only be decrypted using the key that is released *only* after a successful biometric or PIN verification.
28+
1329

14-
https://mas.owasp.org/MASWE/MASVS-AUTH/MASWE-0029/
30+
https://mas.owasp.org/MASTG/tests/ios/MASVS-AUTH/MASTG-TEST-0064/#static-analysis

‎cornucopia.owasp.org/data/website/pages/about/en/index.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ Additionally, Adam Shostack maintains a list of tabletop security games and rela
5656

5757
Cornucopia is developed, maintained, updated and promoted by a worldwide team of volunteers. The contributors to date have been:
5858

59+
- Abhijit Sahoo
5960
- Artim Banyte
6061
- Simon Bennetts
6162
- Thomas Berson

‎cornucopia.owasp.org/svelte.config.js‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,166 @@ export default {
3131
throw new Error(message);
3232
},
3333
entries: [
34+
'/cards/AAA',
35+
'/cards/AA2',
36+
'/cards/AA3',
37+
'/cards/AA4',
38+
'/cards/AA5',
39+
'/cards/AA6',
40+
'/cards/AA7',
41+
'/cards/AA8',
42+
'/cards/AA9',
43+
'/cards/AAX',
44+
'/cards/AAJ',
45+
'/cards/AAQ',
46+
'/cards/AAK',
47+
'/cards/PCA',
48+
'/cards/PC2',
49+
'/cards/PC3',
50+
'/cards/PC4',
51+
'/cards/PC5',
52+
'/cards/PC6',
53+
'/cards/PC7',
54+
'/cards/PC8',
55+
'/cards/PC9',
56+
'/cards/PCX',
57+
'/cards/PCJ',
58+
'/cards/PCQ',
59+
'/cards/PCK',
60+
'/cards/NSA',
61+
'/cards/NS2',
62+
'/cards/NS3',
63+
'/cards/NS4',
64+
'/cards/NS5',
65+
'/cards/NS6',
66+
'/cards/NS7',
67+
'/cards/NS8',
68+
'/cards/NS9',
69+
'/cards/NSX',
70+
'/cards/NSJ',
71+
'/cards/NSQ',
72+
'/cards/NSK',
73+
'/cards/RSA',
74+
'/cards/RS2',
75+
'/cards/RS3',
76+
'/cards/RS4',
77+
'/cards/RS5',
78+
'/cards/RS6',
79+
'/cards/RS7',
80+
'/cards/RS8',
81+
'/cards/RS9',
82+
'/cards/RSX',
83+
'/cards/RSJ',
84+
'/cards/RSQ',
85+
'/cards/RSK',
86+
'/cards/CRMA',
87+
'/cards/CRM2',
88+
'/cards/CRM3',
89+
'/cards/CRM4',
90+
'/cards/CRM5',
91+
'/cards/CRM6',
92+
'/cards/CRM7',
93+
'/cards/CRM8',
94+
'/cards/CRM9',
95+
'/cards/CRMX',
96+
'/cards/CRMJ',
97+
'/cards/CRMQ',
98+
'/cards/CRMK',
99+
'/cards/CMA',
100+
'/cards/CM2',
101+
'/cards/CM3',
102+
'/cards/CM4',
103+
'/cards/CM5',
104+
'/cards/CM6',
105+
'/cards/CM7',
106+
'/cards/CM8',
107+
'/cards/CM9',
108+
'/cards/CMX',
109+
'/cards/CMJ',
110+
'/cards/CMQ',
111+
'/cards/CMK',
112+
'/cards/JOAM',
113+
'/cards/JOBM',
114+
'/cards/VEA',
115+
'/cards/VE2',
116+
'/cards/VE3',
117+
'/cards/VE4',
118+
'/cards/VE5',
119+
'/cards/VE6',
120+
'/cards/VE7',
121+
'/cards/VE8',
122+
'/cards/VE9',
123+
'/cards/VEX',
124+
'/cards/VEJ',
125+
'/cards/VEQ',
126+
'/cards/VEK',
127+
'/cards/ATA',
128+
'/cards/AT2',
129+
'/cards/AT3',
130+
'/cards/AT4',
131+
'/cards/AT5',
132+
'/cards/AT6',
133+
'/cards/AT7',
134+
'/cards/AT8',
135+
'/cards/AT9',
136+
'/cards/ATX',
137+
'/cards/ATJ',
138+
'/cards/ATQ',
139+
'/cards/ATK',
140+
'/cards/SMA',
141+
'/cards/SM2',
142+
'/cards/SM3',
143+
'/cards/SM4',
144+
'/cards/SM5',
145+
'/cards/SM6',
146+
'/cards/SM7',
147+
'/cards/SM8',
148+
'/cards/SM9',
149+
'/cards/SMX',
150+
'/cards/SMJ',
151+
'/cards/SMQ',
152+
'/cards/SMK',
153+
'/cards/AZA',
154+
'/cards/AZ2',
155+
'/cards/AZ3',
156+
'/cards/AZ4',
157+
'/cards/AZ5',
158+
'/cards/AZ6',
159+
'/cards/AZ7',
160+
'/cards/AZ8',
161+
'/cards/AZ9',
162+
'/cards/AZX',
163+
'/cards/AZJ',
164+
'/cards/AZQ',
165+
'/cards/AZK',
166+
'/cards/CRA',
167+
'/cards/CR2',
168+
'/cards/CR3',
169+
'/cards/CR4',
170+
'/cards/CR5',
171+
'/cards/CR6',
172+
'/cards/CR7',
173+
'/cards/CR8',
174+
'/cards/CR9',
175+
'/cards/CRX',
176+
'/cards/CRJ',
177+
'/cards/CRQ',
178+
'/cards/CRK',
179+
'/cards/CA',
180+
'/cards/C2',
181+
'/cards/C3',
182+
'/cards/C4',
183+
'/cards/C5',
184+
'/cards/C6',
185+
'/cards/C7',
186+
'/cards/C8',
187+
'/cards/C9',
188+
'/cards/CX',
189+
'/cards/CJ',
190+
'/cards/CQ',
191+
'/cards/CK',
192+
'/cards/JOA',
193+
'/cards/JOB',
34194
'/cards/ACA',
35195
'/cards/AC2',
36196
'/cards/AC3',

‎install_cornucopia_deps.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ iniconfig == 2.1.0 --hash=sha256:3abbd2e30b36733fee78f9c7f7308f2d0050e88f0087fd2
3232
pluggy == 1.6.0 --hash=sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3 --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
3333
exceptiongroup == 1.3.0 --hash=sha256:4d111e6e0c13d0644cad6ddaa7ed0261a0b36971f6d23e7ec9b4b9097da78a10 --hash=sha256:b241f5885f560bc56a59ee63ca4c6a8bfa46ae4ad651af316d4e81817bb9fd88
3434
python-dateutil == 2.9.0.post0 --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3
35-
tqdm == 4.67.2 --hash=sha256:649aac53964b2cb8dec76a14b405a4c0d13612cb8933aae547dd144eacc99653 --hash=sha256:9a12abcbbff58b6036b2167d9d3853042b9d436fe7330f06ae047867f2f8e0a7
35+
tqdm == 4.67.3 --hash=sha256:7d825f03f89244ef73f1d4ce193cb1774a8179fd96f31d7e1dcde62092b960bb --hash=sha256:ee1e4c0e59148062281c49d80b25b67771a127c85fc9676d3be5f243206826bf
3636
attrs == 25.3.0 --hash=sha256:427318ce031701fea540783410126f03899a97ffc6f61596ad581ac2e40e3bc3 --hash=sha256:75d7cefc7fb576747b2c81b4442d4d4a1ce0900973527c011d1030fd3bf4af1b
3737
sortedcontainers == 2.4.0 --hash=sha256:a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0
3838
pathvalidate == 3.3.1 --hash=sha256:5263baab691f8e1af96092fa5137ee17df5bdfbd6cff1fcac4d6ef4bc2e1735f --hash=sha256:b18c07212bfead624345bb8e1d6141cdcf15a39736994ea0b94035ad2b1ba177

resources/templates/owasp_cornucopia_webapp_ver_guide_bridge_lang.docx renamed to resources/templates/owasp_cornucopia_webapp_ver_guide_bridge_lang.odt

3.14 MB
Binary file not shown.

0 commit comments

Comments
 (0)