Capec scripts by sydseter · Pull Request #2054 · OWASP/cornucopia

sydseter · 2026-01-21T15:45:04Z

In this pull-request:

Additional Utility Scripts

Converting CAPEC Data

The scripts/convertCAPEC.py script converts CAPEC (Common Attack Pattern Enumeration and Classification) JSON data into Markdown format for the Cornucopia website taxonomy.

python ./scripts/convertCAPEC.py --help
usage: convertCAPEC.py [-h] [-o OUTPUT_PATH] [-i INPUT_PATH] [-d]

Convert CAPEC JSON to Cornucopia format

options:
  -h, --help            show this help message and exit
  -o OUTPUT_PATH, --output-path OUTPUT_PATH
                        Path to store converted CAPEC files
  -i INPUT_PATH, --input-path INPUT_PATH
                        Path to read CAPEC JSON files from
  -d, --debug           Output additional information to debug script

Example usage:

# Convert CAPEC data using default paths
python scripts/convertCAPEC.py

# Convert with custom input and output paths
python scripts/convertCAPEC.py -i data/capec-3.9/3000.json -o cornucopia.owasp.org/data/taxonomy/en/CAPEC-3.9

# Enable debug logging
python scripts/convertCAPEC.py -d

Default paths:

Input: cornucopia.owasp.org/data/capec-3.9/3000.json
Output: cornucopia.owasp.org/data/taxonomy/en/CAPEC-3.9/
The script creates individual Markdown files for each CAPEC attack pattern with descriptions and links to the official CAPEC database.

Converting CAPEC Mappings to ASVS Format

The scripts/convertCAPECMapToASVSMap.py script processes webapp-mappings YAML files and generates a consolidated CAPEC-to-ASVS (Application Security Verification Standard) mapping file.

python ./scripts/convertCAPECMapToASVSMap.py --help
usage: convertCAPECMapToASVSMap.py [-h] [-i INPUT_PATH] [-o OUTPUT_PATH] [-d]

Convert webapp-mappings YAML to CAPEC-to-ASVS mapping format

options:
  -h, --help            show this help message and exit
  -i INPUT_PATH, --input-path INPUT_PATH
                        Path to input webapp-mappings YAML file
  -o OUTPUT_PATH, --output-path OUTPUT_PATH
                        Path to save converted CAPEC-to-ASVS mapping YAML file
  -d, --debug           Output additional information to debug script

Example usage:

# Convert mappings using default paths
python scripts/convertCAPECMapToASVSMap.py

# Convert with custom input and output paths
python scripts/convertCAPECMapToASVSMap.py -i source/webapp-mappings-3.0.yaml -o source/webapp-capec-3.0.yaml

# Enable debug logging
python scripts/convertCAPECMapToASVSMap.py -d

Default paths:

Input: source/webapp-mappings-3.0.yaml
Output: source/webapp-capec-3.0.yaml
The script:

Reads CAPEC mappings from the suits -> cards -> capec_map structure
Merges all OWASP ASVS requirements for each unique CAPEC code
Outputs a unified YAML file mapping CAPEC codes to their associated ASVS requirements
Output format:

54:
  owasp_asvs: [4.3.2, 13.2.2, 13.4.1, ...]
116:
  owasp_asvs: [13.2.2, 15.2.3, ...]

…l quality and readability

qltysh · 2026-01-21T15:47:04Z

❌ 8 blocking issues (8 total)

Tool	Category	Rule	Count
hadolint	Lint	Avoid use of cache directory with pip. Use `pip install \-\-no\-cache\-dir <package>`	2	❌
hadolint	Lint	Pin versions in pip. Instead of `pip install <package>` use `pip install <package>==<version>` or `pip install \-\-requirement <requirements file>`	2	❌
actionlint	Lint	could not read reusable workflow file for "./.github/workflows/build-website.yaml": open /home/runner/work/cornucopia/.github/workflows/build-website.yaml: no such file or directory	2	❌
hadolint	Lint	Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check	1	❌
hadolint	Lint	Multiple consecutive `RUN` instructions. Consider consolidation.	1	❌

README.md

tests/test_files/source/webapp-mappings-3.0.yaml

tests/scripts/convertCAPECMapToASVSMap_utest.py

tests/scripts/convertCAPEC_utest.py

tests/scripts/convert_utest.py

tests/test_files/source/webapp-mappings-3.0.yaml

tests/scripts/convert_utest.py

README.md

tests/scripts/convertCAPECMapToASVSMap_itest.py

tests/scripts/convertCAPECMapToASVSMap_utest.py

tests/scripts/convertCAPEC_itest.py

tests/scripts/convertCAPEC_utest.py

tests/scripts/convert_utest.py

tests/scripts/convertCAPECMapToASVSMap_utest.py

tests/scripts/convertCAPEC_utest.py

tests/scripts/convert_utest.py

.clusterfuzzlite/Dockerfile

scripts/convertCAPEC.py

.clusterfuzzlite/Dockerfile

github-actions · 2026-01-22T10:58:30Z

Build artifacts:

Name	Link
Output files	cornucopia-build-files.07056bd8363e8f489be10c18a72ae27fff09c17a.zip

github-actions · 2026-01-22T11:00:01Z

Build artifacts:

Name	Link
Output files	cornucopia-build-files.a68932794d3a95ac0e98185bcadb044331e905cc.zip

.clusterfuzzlite/Dockerfile

github-actions · 2026-01-22T11:15:20Z

Build artifacts:

Name	Link
Output files	cornucopia-build-files.ae8a3b9b57c0f91302523230b97935be4f2ef1f9.zip

github-actions · 2026-01-22T11:42:56Z

Build artifacts:

Name	Link
Output files	cornucopia-build-files.51a0c2d008109c4b2fa261577ad5c1bdc23dfcd9.zip

sydseter · 2026-01-22T12:05:25Z

It doesn't look like I am able to fix the clusterfucker. I need to fix this separately. The fuzzing has been failing due to dependency issues for some time.

github-actions · 2026-01-22T12:09:17Z

Build artifacts:

Name	Link
Output files	cornucopia-build-files.6dd6588a84163771088153c07ab3ed8641bea3ce.zip

github-actions · 2026-01-22T12:14:16Z

Build artifacts:

Name	Link
Output files	cornucopia-build-files.4773f159af86cae227871f75c7f8e6ed0399a7ef.zip

github-actions · 2026-01-22T12:21:58Z

Build artifacts:

Name	Link
Output files	cornucopia-build-files.0b1fe3a7ddcc75bd031b1cc0df6c6b2a3f5fbbad.zip

github-actions · 2026-01-22T12:23:04Z

Build artifacts:

Name	Link
Output files	cornucopia-build-files.5318f4cfb3d79ab555dc9e6af54051d6413ccc1f.zip

github-actions · 2026-01-22T12:33:31Z

Build artifacts:

Name	Link
Output files	cornucopia-build-files.ad807c5b3ccee0deb8a3aaea7727e50bf477616a.zip

qltysh · 2026-01-22T14:34:09Z

.clusterfuzzlite/Dockerfile

+    make \
+    libxml2-dev \
+    libxslt-dev \
+    python3-dev \


Sort these package names alphanumerically. [radarlint-iac:docker:S7018]

qltysh · 2026-01-22T14:34:09Z

.clusterfuzzlite/Dockerfile

-RUN apt-get install -y python3-pip
-RUN curl -sS https://bootstrap.pypa.io/get-pip.py | python3.10
-RUN python3.10 -m pip install --upgrade wheel setuptools setuptools_scm PyInstaller==6.13.0
+RUN curl -sS https://bootstrap.pypa.io/get-pip.py | python3


Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check [hadolint:DL4006]

qltysh · 2026-01-22T14:34:09Z

.clusterfuzzlite/Dockerfile

-RUN curl -sS https://bootstrap.pypa.io/get-pip.py | python3.10
-RUN python3.10 -m pip install --upgrade wheel setuptools setuptools_scm PyInstaller==6.13.0
+RUN curl -sS https://bootstrap.pypa.io/get-pip.py | python3
+RUN python3 -m pip install --upgrade wheel setuptools setuptools_scm PyInstaller==6.18.0


Found 3 issues:

1. Avoid use of cache directory with pip. Use pip install --no-cache-dir [hadolint:DL3042]

2. Pin versions in pip. Instead of pip install use pip install == or pip install --requirement [hadolint:DL3013]

3. Sort these package names alphanumerically. [radarlint-iac:docker:S7018]

qltysh · 2026-01-22T14:34:09Z

.github/workflows/run-tests-for-patches.yaml

+  call-run-website-tests:
+    name: Build and run Website Tests
+    needs: hardening
+    uses: ./.github/workflows/build-website.yaml


could not read reusable workflow file for "./.github/workflows/build-website.yaml": open /home/runner/work/cornucopia/.github/workflows/build-website.yaml: no such file or directory [actionlint:workflow-call]

qltysh · 2026-01-22T14:34:09Z

.github/workflows/run-tests-for-patches.yaml

+  call-run-build-copi-tests:
+    name: Build and run COPI Tests
+    needs: hardening
+    uses: ./.github/workflows/copi-build.yaml


could not read reusable workflow file for "./.github/workflows/copi-build.yaml": open /home/runner/work/cornucopia/.github/workflows/copi-build.yaml: no such file or directory [actionlint:workflow-call]

qltysh · 2026-01-22T14:34:09Z

Dockerfile

    make
 COPY --chown=builder:union requirements.txt ./
 RUN pip install -r requirements.txt --require-hashes
+RUN pip install pipenv


Found 3 issues:

1. Avoid use of cache directory with pip. Use pip install --no-cache-dir [hadolint:DL3042]

2. Pin versions in pip. Instead of pip install use pip install == or pip install --requirement [hadolint:DL3013]

3. Multiple consecutive RUN instructions. Consider consolidation. [hadolint:DL3059]

sydseter · 2026-01-22T15:28:51Z

superseeded by #2054

github-actions · 2026-01-22T15:29:07Z

Build artifacts:

Name	Link
Output files	cornucopia-build-files.a620955835bbdf261e84c2ca3f0e87549e64e68c.zip

sydseter added 6 commits January 20, 2026 15:37

Adding more tests and refactoring code in order to improve the overal…

1805397

…l quality and readability

Get rid of warnings

39fcbb2

Remove script

ca273ec

Fix linux build issue

9793bbf

Try to resolve path depending on os

bf077c3

Adding capec scripts

2e4d7e1

sydseter requested review from cw-owasp and rewtd as code owners January 21, 2026 15:45

qltysh bot reviewed Jan 21, 2026

View reviewed changes

Fix convert test

7409bb2

qltysh bot reviewed Jan 21, 2026

View reviewed changes

Fix style issues

509c618

qltysh bot reviewed Jan 21, 2026

View reviewed changes

Fix test and formating

f5e6b74

qltysh bot reviewed Jan 21, 2026

View reviewed changes

Fix code style issues

2aa8400

qltysh bot reviewed Jan 22, 2026

View reviewed changes

Fix build issues

062b036

qltysh bot reviewed Jan 22, 2026

View reviewed changes

.clusterfuzzlite/Dockerfile Outdated Show resolved Hide resolved

sydseter added 4 commits January 22, 2026 09:01

Resolve merge issues

69e3d65

Resolve merge issues

6fa8fa4

Update lock file

46c04b6

Fix coding style issues

e814e1f

qltysh bot reviewed Jan 22, 2026

View reviewed changes

Fix possible type juggling issues

d768c12

qltysh bot reviewed Jan 22, 2026

View reviewed changes

scripts/convertCAPEC.py Show resolved Hide resolved

scripts/convertCAPEC.py Outdated Show resolved Hide resolved

Fix style isues for dockerfile

60f003a

qltysh bot reviewed Jan 22, 2026

View reviewed changes

Fix more coding style issues

286fcbb

Try different package

58a2825

qltysh bot reviewed Jan 22, 2026

View reviewed changes

.clusterfuzzlite/Dockerfile Outdated Show resolved Hide resolved

Update deps

3e1085f

Install the clusterfuck dependencies in two runs

6ca87b6

qltysh bot reviewed Jan 22, 2026

View reviewed changes

.clusterfuzzlite/Dockerfile Outdated Show resolved Hide resolved

.clusterfuzzlite/Dockerfile Show resolved Hide resolved

.clusterfuzzlite/Dockerfile Show resolved Hide resolved

.clusterfuzzlite/Dockerfile Outdated Show resolved Hide resolved

sydseter added 2 commits January 22, 2026 12:30

Abort clusterfuck linting fixes

c9a901e

Ensure build breaks if the coverage is too low

dd74ecd

sydseter added 3 commits January 22, 2026 12:44

Add vitest.config

020188f

Correctly update deps

f5ada75

Try to go back to the previous know good state

ce8af4d

sydseter mentioned this pull request Jan 22, 2026

Adding more tests and refactoring code in order to improve the overall quality and readability #2051

Closed

sydseter added 2 commits January 22, 2026 15:16

Fix the fuzzer

ad0fd36

Upgrade to python 3.12 and fix the fuzzers

4817ee1

qltysh bot reviewed Jan 22, 2026

View reviewed changes

sydseter added 2 commits January 22, 2026 15:47

Ensure pipenv is installe

bf645e6

Ensure lf is correct

9cf2794

sydseter closed this Jan 22, 2026

sydseter deleted the capec-scripts branch February 13, 2026 17:10

Uh oh!

Conversation

sydseter commented Jan 21, 2026

Additional Utility Scripts

Converting CAPEC Data

Converting CAPEC Mappings to ASVS Format

Uh oh!

qltysh bot commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ 8 blocking issues (8 total)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Jan 22, 2026

Build artifacts:

Uh oh!

github-actions bot commented Jan 22, 2026

Build artifacts:

Uh oh!

Uh oh!

qltysh bot commented Jan 21, 2026 •

edited

Loading