From 55c8352cbac45d8a547b2be3200f49208a5892a7 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 9 Feb 2021 20:44:50 +0100 Subject: [PATCH 1/6] Restructure yamls --- bib.php | 10 +- composer.json | 7 + composer.lock | 359 +++++ .../Build/1/DefinedBuildProcess.yaml | 23 + ...stingOfArtifactsInVirtualEnvironments.yaml | 24 + .../Build/3/SigningOfArtifacts.yaml | 22 + .../Build/3/SigningOfCode.yaml | 19 + .../1/DefinedDeploymentProcess.yaml | 18 + .../Deployment/2/BackupBeforeDeployment.yaml | 22 + ...nmentDependingConfigurationParameters.yaml | 18 + .../Deployment/2/UsageOfTrustedImages.yaml | 21 + .../3/HandoverOfConfidentialParameters.yaml | 26 + .../3/InventoryOfRunningArtifacts.yaml | 19 + .../3/RollingUpdateOnDeployment.yaml | 19 + .../3/SameArtifactForEnvironments.yaml | 22 + .../Deployment/3/UsageOfFeatureToggles.yaml | 23 + .../1/APatchPolicyIsDefined.yaml | 17 + .../1/AutomatedPrsForPatches.yaml | 22 + .../2/NightlyBuildOfImages.yaml | 14 + .../2/ReductionOfTheAttackSurface.yaml | 20 + .../2/UsageOfAMaximumLifetimeForImages.yaml | 18 + ...UsageOfAShortMaximumLifetimeForImages.yaml | 25 + ...rmationSecurityTargetsAreCommunicated.yaml | 17 + ...SimpleThreatModellingOnTechnicalLevel.yaml | 56 + ...fSimpleThreatModellingOnBusinessLevel.yaml | 19 + .../2/CreationOfSimpleAbuseStories.yaml | 22 + .../ConductionOfAdvancedThreatModelling.yaml | 31 + .../4/CreationOfAdvancedAbuseStories.yaml | 25 + ...ecurityTrainingsForSoftwareDevelopers.yaml | 19 + .../1/SecurityConsultingOnRequest.yaml | 19 + .../2/EachTeamHasASecurityChampion.yaml | 19 + .../2/RegularSecurityTrainingForAll.yaml | 20 + ...arSecurityTrainingOfSecurityChampions.yaml | 18 + .../2/RewardOfGoodCommunication.yaml | 21 + ...ionOfBuild-It,Break-It,Fix-ItContests.yaml | 18 + ...WithDevelopersAndSystemAdministrators.yaml | 20 + .../3/RegularSecurityTrainingForEveryone.yaml | 17 + .../3/Security-Lessoned-Learned.yaml | 16 + .../4/AligningSecurityInTeams.yaml | 18 + ...tionOfCollaborativeTeamSecurityChecks.yaml | 16 + .../4/ConductionOfWarGames.yaml | 18 + ...pleBcdrPracticesForCriticalComponents.yaml | 17 + .../3/ApprovalByReviewingAnyNewVersion.yaml | 19 + .../DefinitionOfAChangeManagementProcess.yaml | 15 + .../PreventionOfUnauthorizedInstallation.yaml | 19 + .../1/ApplicationHardeningLevel1.yaml | 44 + .../2/App.HardeningLevel2.yaml | 25 + .../3/App.HardeningLevel3.yaml | 26 + .../4/FullCoverageOfApp.HardeningLevel3.yaml | 26 + ...solatedNetworksForVirtualEnvironments.yaml | 23 + .../1/SimpleAccessControlForSystems.yaml | 18 + .../UsageOfTestAndProductionEnvironments.yaml | 18 + ...nsAreRunningInVirtualizedEnvironments.yaml | 16 + .../2/CheckingTheSourcesOfUsedLibraries.yaml | 18 + .../2/FilterOutgoingTraffic.yaml | 20 + .../2/TheClusterIsHardened.yaml | 22 + ...UsageOfSecurityByDefaultForComponents.yaml | 20 + .../2/VirtualEnvironmentsAreLimited.yaml | 21 + .../Infrastructure Hardening/3/2Fa.yaml | 19 + .../3/ImmutableInfrastructure.yaml | 20 + .../3/InfrastructureAsCode.yaml | 20 + ...leBasedAuthenticationAndAuthorization.yaml | 20 + .../3/Versioning.yaml | 20 + ...ionOfSystemCallsInVirtualEnvironments.yaml | 17 + .../4/Microservice-Architecture.yaml | 16 + ...onNearEnvironmentsAreUsedByDevelopers.yaml | 23 + .../4/UsageOfAChaosMonkey.yaml | 18 + .../Logging/1/CentralizedSystemLogging.yaml | 18 + .../Logging/1/LoggingOfSecurityEvents.yaml | 18 + .../Logging/1/PiiLoggingConcept.yaml | 18 + .../Logging/2/VisualizedLogging.yaml | 22 + .../3/CentralizedApplicationLogging.yaml | 22 + .../4/CorrelationOfSecurityEvents.yaml | 20 + .../1/SimpleApplicationMetrics.yaml | 16 + .../Monitoring/1/SimpleSystemMetrics.yaml | 18 + .../Monitoring/2/Alerting.yaml | 20 + .../Monitoring/2/VisualizedMetrics.yaml | 17 + ...dvancedAvailablityAndStabilityMetrics.yaml | 18 + .../3/AdvancedWebapplicationMetrics.yaml | 18 + .../3/DeactivationOfUnusedMetrics.yaml | 17 + .../Monitoring/3/GroupingOfMetrics.yaml | 15 + .../Monitoring/3/TargetedAlerting.yaml | 20 + .../4/CoverageAndControlMetrics.yaml | 22 + .../Monitoring/4/DefenceMetrics.yaml | 21 + .../4/MetricsAreCombinedWithTests.yaml | 16 + .../4/ScreensWithMetricVisualization.yaml | 18 + ...curityUnitTestsForImportantComponents.yaml | 22 + ...ntegrationTestsForImportantComponents.yaml | 18 + ...urityRelatedModuleAndIntegrationTests.yaml | 18 + .../Application tests/4/SmokeTest.yaml | 21 + .../1/DefinitionOfQualityGates.yaml | 20 + .../1/SimpleFalsePositiveTreatment.yaml | 21 + ...mentOfDefectsWithSeverityHighOrHigher.yaml | 16 + .../2/SimpleVisualizationOfDefects.yaml | 23 + ...bilityIssuesIntoTheDevelopmentProcess.yaml | 23 + .../TreatmentOfDefectsWithSeverityMiddle.yaml | 16 + .../4/AdvancedVisualizationOfDefects.yaml | 21 + .../4/ReproducibleDefectTickets.yaml | 21 + .../4/TreatmentOfAllDefects.yaml | 15 + ...UsageOfAVulnerabilityManagementSystem.yaml | 23 + .../1/SimpleScan.yaml | 24 + ...CoverageOfClientSideDynamicComponents.yaml | 21 + .../2/UsageOfDifferentRoles.yaml | 19 + .../3/CoverageOfHiddenEndpoints.yaml | 17 + .../3/CoverageOfMoreInputVectors.yaml | 19 + .../3/CoverageOfSequentialOperations.yaml | 19 + .../3/UsageOfMultipleScanners.yaml | 19 + .../4/CoverageAnalysis.yaml | 16 + ...verageOfServiceToServiceCommunication.yaml | 17 + .../1/TestForExposedServices.yaml | 23 + .../2/TestNetworkSegmentation.yaml | 20 + ...OfTheConfigurationOfCloudEnvironments.yaml | 21 + .../3/WeakPasswordTest.yaml | 17 + .../4/LoadTests.yaml | 17 + ...ideComponentsWithKnownVulnerabilities.yaml | 19 + ...lysisForImportantServerSideComponents.yaml | 19 + ...lysisForImportantClientSideComponents.yaml | 22 + ...ideComponentsWithKnownVulnerabilities.yaml | 19 + .../4/ExclusionOfSourceCodeDuplicates.yaml | 19 + ...icAnalysisForAllSelfWrittenComponents.yaml | 19 + .../4/StylisticAnalysis.yaml | 18 + .../4/UsageOfMultipleAnalysers.yaml | 21 + .../1/StoredSecrets.yaml | 20 + .../2/TestClusterDeploymentResources.yaml | 21 + .../2/TestOfVirtualizedEnvironments.yaml | 16 + .../2/TestTheClouldConfiguration.yaml | 21 + ...heDefinitionOfVirtualizedEnvironments.yaml | 23 + .../3/CheckForImageLifetime.yaml | 17 + .../3/CheckForMalware.yaml | 18 + .../3/CheckForNewImageVersion.yaml | 17 + .../4/CheckForKnownVulnerabilities.yaml | 19 + ...sInInfrastructureWithNewImageVersions.yaml | 22 + ...tureComponentsForKnownVulnerabilities.yaml | 25 + .../1/DefaultSettingsForIntensity.yaml | 16 + .../Test-Intensity/1/HighTestIntensity.yaml | 16 + .../2/DeactivatingOfUnneededTests.yaml | 20 + .../Test-Intensity/2/RegularTests.yaml | 18 + ...eationAndApplicationOfATestingConcept.yaml | 21 + data.php | 8 +- data/CultureandOrg.yml | 2 +- detail.php | 3 +- newFolder.php | 43 + selectedData.csv | 12 + vendor/autoload.php | 7 + vendor/bin/yaml-lint | 1 + vendor/composer/ClassLoader.php | 445 ++++++ vendor/composer/LICENSE | 19 + vendor/composer/autoload_classmap.php | 9 + vendor/composer/autoload_files.php | 11 + vendor/composer/autoload_namespaces.php | 11 + vendor/composer/autoload_psr4.php | 12 + vendor/composer/autoload_real.php | 73 + vendor/composer/autoload_static.php | 64 + vendor/composer/installed.json | 354 +++++ vendor/erusev/parsedown-extra/.travis.yml | 30 + vendor/erusev/parsedown-extra/LICENSE.txt | 20 + .../erusev/parsedown-extra/ParsedownExtra.php | 538 +++++++ vendor/erusev/parsedown-extra/README.md | 31 + vendor/erusev/parsedown-extra/composer.json | 33 + .../erusev/parsedown-extra/phpunit.xml.dist | 8 + .../test/ParsedownExtraTest.php | 11 + .../parsedown-extra/test/TestParsedown.php | 9 + .../test/data/abbreviation.html | 3 + .../parsedown-extra/test/data/abbreviation.md | 7 + .../test/data/compound_footnote.html | 18 + .../test/data/compound_footnote.md | 14 + .../test/data/definition_list.html | 17 + .../test/data/definition_list.md | 20 + .../parsedown-extra/test/data/footnote.html | 20 + .../parsedown-extra/test/data/footnote.md | 11 + .../test/data/markdown_inside_markup.html | 25 + .../test/data/markdown_inside_markup.md | 32 + .../test/data/special_attributes.html | 6 + .../test/data/special_attributes.md | 12 + {bib => vendor/erusev}/parsedown/LICENSE.txt | 0 .../erusev}/parsedown/Parsedown.php | 0 {bib => vendor/erusev}/parsedown/README.md | 0 .../erusev}/parsedown/composer.json | 0 vendor/mnapoli/front-yaml/.gitattributes | 5 + vendor/mnapoli/front-yaml/.gitignore | 5 + vendor/mnapoli/front-yaml/LICENSE | 18 + vendor/mnapoli/front-yaml/README.md | 86 ++ vendor/mnapoli/front-yaml/composer.json | 23 + vendor/mnapoli/front-yaml/phpunit.xml.dist | 21 + .../Bridge/CommonMark/CommonMarkParser.php | 33 + .../src/Bridge/Parsedown/ParsedownParser.php | 33 + .../src/Bridge/Symfony/SymfonyYAMLParser.php | 38 + vendor/mnapoli/front-yaml/src/Document.php | 53 + .../src/Markdown/MarkdownParser.php | 26 + vendor/mnapoli/front-yaml/src/Parser.php | 84 ++ .../front-yaml/src/YAML/YAMLParser.php | 26 + .../symfony/deprecation-contracts/.gitignore | 3 + .../deprecation-contracts/CHANGELOG.md | 5 + vendor/symfony/deprecation-contracts/LICENSE | 19 + .../symfony/deprecation-contracts/README.md | 26 + .../deprecation-contracts/composer.json | 35 + .../deprecation-contracts/function.php | 27 + vendor/symfony/polyfill-ctype/Ctype.php | 227 +++ vendor/symfony/polyfill-ctype/LICENSE | 19 + vendor/symfony/polyfill-ctype/README.md | 12 + vendor/symfony/polyfill-ctype/bootstrap.php | 50 + vendor/symfony/polyfill-ctype/bootstrap80.php | 46 + vendor/symfony/polyfill-ctype/composer.json | 38 + vendor/symfony/yaml/CHANGELOG.md | 224 +++ vendor/symfony/yaml/Command/LintCommand.php | 248 ++++ vendor/symfony/yaml/Dumper.php | 142 ++ vendor/symfony/yaml/Escaper.php | 103 ++ .../symfony/yaml/Exception/DumpException.php | 21 + .../yaml/Exception/ExceptionInterface.php | 21 + .../symfony/yaml/Exception/ParseException.php | 133 ++ .../yaml/Exception/RuntimeException.php | 21 + vendor/symfony/yaml/Inline.php | 794 ++++++++++ vendor/symfony/yaml/LICENSE | 19 + vendor/symfony/yaml/Parser.php | 1308 +++++++++++++++++ vendor/symfony/yaml/README.md | 13 + vendor/symfony/yaml/Resources/bin/yaml-lint | 45 + vendor/symfony/yaml/Tag/TaggedValue.php | 38 + vendor/symfony/yaml/Unescaper.php | 138 ++ vendor/symfony/yaml/Yaml.php | 102 ++ vendor/symfony/yaml/composer.json | 42 + yaml2md.php | 16 - 221 files changed, 9382 insertions(+), 27 deletions(-) create mode 100644 composer.json create mode 100644 composer.lock create mode 100755 data-new/Build and Deployment/Build/1/DefinedBuildProcess.yaml create mode 100755 data-new/Build and Deployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml create mode 100755 data-new/Build and Deployment/Build/3/SigningOfArtifacts.yaml create mode 100755 data-new/Build and Deployment/Build/3/SigningOfCode.yaml create mode 100755 data-new/Build and Deployment/Deployment/1/DefinedDeploymentProcess.yaml create mode 100755 data-new/Build and Deployment/Deployment/2/BackupBeforeDeployment.yaml create mode 100755 data-new/Build and Deployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml create mode 100755 data-new/Build and Deployment/Deployment/2/UsageOfTrustedImages.yaml create mode 100755 data-new/Build and Deployment/Deployment/3/HandoverOfConfidentialParameters.yaml create mode 100755 data-new/Build and Deployment/Deployment/3/InventoryOfRunningArtifacts.yaml create mode 100755 data-new/Build and Deployment/Deployment/3/RollingUpdateOnDeployment.yaml create mode 100755 data-new/Build and Deployment/Deployment/3/SameArtifactForEnvironments.yaml create mode 100755 data-new/Build and Deployment/Deployment/3/UsageOfFeatureToggles.yaml create mode 100755 data-new/Build and Deployment/Patch Management/1/APatchPolicyIsDefined.yaml create mode 100755 data-new/Build and Deployment/Patch Management/1/AutomatedPrsForPatches.yaml create mode 100755 data-new/Build and Deployment/Patch Management/2/NightlyBuildOfImages.yaml create mode 100755 data-new/Build and Deployment/Patch Management/2/ReductionOfTheAttackSurface.yaml create mode 100755 data-new/Build and Deployment/Patch Management/2/UsageOfAMaximumLifetimeForImages.yaml create mode 100755 data-new/Build and Deployment/Patch Management/4/UsageOfAShortMaximumLifetimeForImages.yaml create mode 100755 data-new/Culture and Organization/Design/0/InformationSecurityTargetsAreCommunicated.yaml create mode 100755 data-new/Culture and Organization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml create mode 100755 data-new/Culture and Organization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml create mode 100755 data-new/Culture and Organization/Design/2/CreationOfSimpleAbuseStories.yaml create mode 100755 data-new/Culture and Organization/Design/3/ConductionOfAdvancedThreatModelling.yaml create mode 100755 data-new/Culture and Organization/Design/4/CreationOfAdvancedAbuseStories.yaml create mode 100755 data-new/Culture and Organization/Education and Guidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml create mode 100755 data-new/Culture and Organization/Education and Guidance/1/SecurityConsultingOnRequest.yaml create mode 100755 data-new/Culture and Organization/Education and Guidance/2/EachTeamHasASecurityChampion.yaml create mode 100755 data-new/Culture and Organization/Education and Guidance/2/RegularSecurityTrainingForAll.yaml create mode 100755 data-new/Culture and Organization/Education and Guidance/2/RegularSecurityTrainingOfSecurityChampions.yaml create mode 100755 data-new/Culture and Organization/Education and Guidance/2/RewardOfGoodCommunication.yaml create mode 100755 data-new/Culture and Organization/Education and Guidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml create mode 100755 data-new/Culture and Organization/Education and Guidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml create mode 100755 data-new/Culture and Organization/Education and Guidance/3/RegularSecurityTrainingForEveryone.yaml create mode 100755 data-new/Culture and Organization/Education and Guidance/3/Security-Lessoned-Learned.yaml create mode 100755 data-new/Culture and Organization/Education and Guidance/4/AligningSecurityInTeams.yaml create mode 100755 data-new/Culture and Organization/Education and Guidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml create mode 100755 data-new/Culture and Organization/Education and Guidance/4/ConductionOfWarGames.yaml create mode 100755 data-new/Culture and Organization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml create mode 100755 data-new/Culture and Organization/Process/3/ApprovalByReviewingAnyNewVersion.yaml create mode 100755 data-new/Culture and Organization/Process/3/DefinitionOfAChangeManagementProcess.yaml create mode 100755 data-new/Culture and Organization/Process/3/PreventionOfUnauthorizedInstallation.yaml create mode 100755 data-new/Implementation/Application Hardening/1/ApplicationHardeningLevel1.yaml create mode 100755 data-new/Implementation/Application Hardening/2/App.HardeningLevel2.yaml create mode 100755 data-new/Implementation/Application Hardening/3/App.HardeningLevel3.yaml create mode 100755 data-new/Implementation/Application Hardening/4/FullCoverageOfApp.HardeningLevel3.yaml create mode 100755 data-new/Implementation/Infrastructure Hardening/1/IsolatedNetworksForVirtualEnvironments.yaml create mode 100755 data-new/Implementation/Infrastructure Hardening/1/SimpleAccessControlForSystems.yaml create mode 100755 data-new/Implementation/Infrastructure Hardening/1/UsageOfTestAndProductionEnvironments.yaml create mode 100755 data-new/Implementation/Infrastructure Hardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml create mode 100755 data-new/Implementation/Infrastructure Hardening/2/CheckingTheSourcesOfUsedLibraries.yaml create mode 100755 data-new/Implementation/Infrastructure Hardening/2/FilterOutgoingTraffic.yaml create mode 100755 data-new/Implementation/Infrastructure Hardening/2/TheClusterIsHardened.yaml create mode 100755 data-new/Implementation/Infrastructure Hardening/2/UsageOfSecurityByDefaultForComponents.yaml create mode 100755 data-new/Implementation/Infrastructure Hardening/2/VirtualEnvironmentsAreLimited.yaml create mode 100755 data-new/Implementation/Infrastructure Hardening/3/2Fa.yaml create mode 100755 data-new/Implementation/Infrastructure Hardening/3/ImmutableInfrastructure.yaml create mode 100755 data-new/Implementation/Infrastructure Hardening/3/InfrastructureAsCode.yaml create mode 100755 data-new/Implementation/Infrastructure Hardening/3/RoleBasedAuthenticationAndAuthorization.yaml create mode 100755 data-new/Implementation/Infrastructure Hardening/3/Versioning.yaml create mode 100755 data-new/Implementation/Infrastructure Hardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml create mode 100755 data-new/Implementation/Infrastructure Hardening/4/Microservice-Architecture.yaml create mode 100755 data-new/Implementation/Infrastructure Hardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml create mode 100755 data-new/Implementation/Infrastructure Hardening/4/UsageOfAChaosMonkey.yaml create mode 100755 data-new/Information Gathering/Logging/1/CentralizedSystemLogging.yaml create mode 100755 data-new/Information Gathering/Logging/1/LoggingOfSecurityEvents.yaml create mode 100755 data-new/Information Gathering/Logging/1/PiiLoggingConcept.yaml create mode 100755 data-new/Information Gathering/Logging/2/VisualizedLogging.yaml create mode 100755 data-new/Information Gathering/Logging/3/CentralizedApplicationLogging.yaml create mode 100755 data-new/Information Gathering/Logging/4/CorrelationOfSecurityEvents.yaml create mode 100755 data-new/Information Gathering/Monitoring/1/SimpleApplicationMetrics.yaml create mode 100755 data-new/Information Gathering/Monitoring/1/SimpleSystemMetrics.yaml create mode 100755 data-new/Information Gathering/Monitoring/2/Alerting.yaml create mode 100755 data-new/Information Gathering/Monitoring/2/VisualizedMetrics.yaml create mode 100755 data-new/Information Gathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml create mode 100755 data-new/Information Gathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml create mode 100755 data-new/Information Gathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml create mode 100755 data-new/Information Gathering/Monitoring/3/GroupingOfMetrics.yaml create mode 100755 data-new/Information Gathering/Monitoring/3/TargetedAlerting.yaml create mode 100755 data-new/Information Gathering/Monitoring/4/CoverageAndControlMetrics.yaml create mode 100755 data-new/Information Gathering/Monitoring/4/DefenceMetrics.yaml create mode 100755 data-new/Information Gathering/Monitoring/4/MetricsAreCombinedWithTests.yaml create mode 100755 data-new/Information Gathering/Monitoring/4/ScreensWithMetricVisualization.yaml create mode 100755 data-new/Test and Verification/Application tests/2/SecurityUnitTestsForImportantComponents.yaml create mode 100755 data-new/Test and Verification/Application tests/3/SecurityIntegrationTestsForImportantComponents.yaml create mode 100755 data-new/Test and Verification/Application tests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml create mode 100755 data-new/Test and Verification/Application tests/4/SmokeTest.yaml create mode 100755 data-new/Test and Verification/Consolidation/1/DefinitionOfQualityGates.yaml create mode 100755 data-new/Test and Verification/Consolidation/1/SimpleFalsePositiveTreatment.yaml create mode 100755 data-new/Test and Verification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml create mode 100755 data-new/Test and Verification/Consolidation/2/SimpleVisualizationOfDefects.yaml create mode 100755 data-new/Test and Verification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml create mode 100755 data-new/Test and Verification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml create mode 100755 data-new/Test and Verification/Consolidation/4/AdvancedVisualizationOfDefects.yaml create mode 100755 data-new/Test and Verification/Consolidation/4/ReproducibleDefectTickets.yaml create mode 100755 data-new/Test and Verification/Consolidation/4/TreatmentOfAllDefects.yaml create mode 100755 data-new/Test and Verification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml create mode 100755 data-new/Test and Verification/Dynamic depth for applications/1/SimpleScan.yaml create mode 100755 data-new/Test and Verification/Dynamic depth for applications/2/CoverageOfClientSideDynamicComponents.yaml create mode 100755 data-new/Test and Verification/Dynamic depth for applications/2/UsageOfDifferentRoles.yaml create mode 100755 data-new/Test and Verification/Dynamic depth for applications/3/CoverageOfHiddenEndpoints.yaml create mode 100755 data-new/Test and Verification/Dynamic depth for applications/3/CoverageOfMoreInputVectors.yaml create mode 100755 data-new/Test and Verification/Dynamic depth for applications/3/CoverageOfSequentialOperations.yaml create mode 100755 data-new/Test and Verification/Dynamic depth for applications/3/UsageOfMultipleScanners.yaml create mode 100755 data-new/Test and Verification/Dynamic depth for applications/4/CoverageAnalysis.yaml create mode 100755 data-new/Test and Verification/Dynamic depth for applications/4/CoverageOfServiceToServiceCommunication.yaml create mode 100755 data-new/Test and Verification/Dynamic depth for infrastructure/1/TestForExposedServices.yaml create mode 100755 data-new/Test and Verification/Dynamic depth for infrastructure/2/TestNetworkSegmentation.yaml create mode 100755 data-new/Test and Verification/Dynamic depth for infrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml create mode 100755 data-new/Test and Verification/Dynamic depth for infrastructure/3/WeakPasswordTest.yaml create mode 100755 data-new/Test and Verification/Dynamic depth for infrastructure/4/LoadTests.yaml create mode 100755 data-new/Test and Verification/Static depth for applications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml create mode 100755 data-new/Test and Verification/Static depth for applications/2/StaticAnalysisForImportantServerSideComponents.yaml create mode 100755 data-new/Test and Verification/Static depth for applications/3/StaticAnalysisForImportantClientSideComponents.yaml create mode 100755 data-new/Test and Verification/Static depth for applications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml create mode 100755 data-new/Test and Verification/Static depth for applications/4/ExclusionOfSourceCodeDuplicates.yaml create mode 100755 data-new/Test and Verification/Static depth for applications/4/StaticAnalysisForAllSelfWrittenComponents.yaml create mode 100755 data-new/Test and Verification/Static depth for applications/4/StylisticAnalysis.yaml create mode 100755 data-new/Test and Verification/Static depth for applications/4/UsageOfMultipleAnalysers.yaml create mode 100755 data-new/Test and Verification/Static depth for infrastructure/1/StoredSecrets.yaml create mode 100755 data-new/Test and Verification/Static depth for infrastructure/2/TestClusterDeploymentResources.yaml create mode 100755 data-new/Test and Verification/Static depth for infrastructure/2/TestOfVirtualizedEnvironments.yaml create mode 100755 data-new/Test and Verification/Static depth for infrastructure/2/TestTheClouldConfiguration.yaml create mode 100755 data-new/Test and Verification/Static depth for infrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml create mode 100755 data-new/Test and Verification/Static depth for infrastructure/3/CheckForImageLifetime.yaml create mode 100755 data-new/Test and Verification/Static depth for infrastructure/3/CheckForMalware.yaml create mode 100755 data-new/Test and Verification/Static depth for infrastructure/3/CheckForNewImageVersion.yaml create mode 100755 data-new/Test and Verification/Static depth for infrastructure/4/CheckForKnownVulnerabilities.yaml create mode 100755 data-new/Test and Verification/Static depth for infrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml create mode 100755 data-new/Test and Verification/Static depth for infrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml create mode 100755 data-new/Test and Verification/Test-Intensity/1/DefaultSettingsForIntensity.yaml create mode 100755 data-new/Test and Verification/Test-Intensity/1/HighTestIntensity.yaml create mode 100755 data-new/Test and Verification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml create mode 100755 data-new/Test and Verification/Test-Intensity/2/RegularTests.yaml create mode 100755 data-new/Test and Verification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml create mode 100644 newFolder.php create mode 100755 selectedData.csv create mode 100644 vendor/autoload.php create mode 120000 vendor/bin/yaml-lint create mode 100644 vendor/composer/ClassLoader.php create mode 100644 vendor/composer/LICENSE create mode 100644 vendor/composer/autoload_classmap.php create mode 100644 vendor/composer/autoload_files.php create mode 100644 vendor/composer/autoload_namespaces.php create mode 100644 vendor/composer/autoload_psr4.php create mode 100644 vendor/composer/autoload_real.php create mode 100644 vendor/composer/autoload_static.php create mode 100644 vendor/composer/installed.json create mode 100644 vendor/erusev/parsedown-extra/.travis.yml create mode 100644 vendor/erusev/parsedown-extra/LICENSE.txt create mode 100644 vendor/erusev/parsedown-extra/ParsedownExtra.php create mode 100644 vendor/erusev/parsedown-extra/README.md create mode 100644 vendor/erusev/parsedown-extra/composer.json create mode 100644 vendor/erusev/parsedown-extra/phpunit.xml.dist create mode 100644 vendor/erusev/parsedown-extra/test/ParsedownExtraTest.php create mode 100644 vendor/erusev/parsedown-extra/test/TestParsedown.php create mode 100644 vendor/erusev/parsedown-extra/test/data/abbreviation.html create mode 100644 vendor/erusev/parsedown-extra/test/data/abbreviation.md create mode 100644 vendor/erusev/parsedown-extra/test/data/compound_footnote.html create mode 100644 vendor/erusev/parsedown-extra/test/data/compound_footnote.md create mode 100644 vendor/erusev/parsedown-extra/test/data/definition_list.html create mode 100644 vendor/erusev/parsedown-extra/test/data/definition_list.md create mode 100644 vendor/erusev/parsedown-extra/test/data/footnote.html create mode 100644 vendor/erusev/parsedown-extra/test/data/footnote.md create mode 100644 vendor/erusev/parsedown-extra/test/data/markdown_inside_markup.html create mode 100644 vendor/erusev/parsedown-extra/test/data/markdown_inside_markup.md create mode 100644 vendor/erusev/parsedown-extra/test/data/special_attributes.html create mode 100644 vendor/erusev/parsedown-extra/test/data/special_attributes.md rename {bib => vendor/erusev}/parsedown/LICENSE.txt (100%) mode change 100755 => 100644 rename {bib => vendor/erusev}/parsedown/Parsedown.php (100%) mode change 100755 => 100644 rename {bib => vendor/erusev}/parsedown/README.md (100%) mode change 100755 => 100644 rename {bib => vendor/erusev}/parsedown/composer.json (100%) mode change 100755 => 100644 create mode 100644 vendor/mnapoli/front-yaml/.gitattributes create mode 100644 vendor/mnapoli/front-yaml/.gitignore create mode 100644 vendor/mnapoli/front-yaml/LICENSE create mode 100644 vendor/mnapoli/front-yaml/README.md create mode 100644 vendor/mnapoli/front-yaml/composer.json create mode 100644 vendor/mnapoli/front-yaml/phpunit.xml.dist create mode 100644 vendor/mnapoli/front-yaml/src/Bridge/CommonMark/CommonMarkParser.php create mode 100644 vendor/mnapoli/front-yaml/src/Bridge/Parsedown/ParsedownParser.php create mode 100644 vendor/mnapoli/front-yaml/src/Bridge/Symfony/SymfonyYAMLParser.php create mode 100644 vendor/mnapoli/front-yaml/src/Document.php create mode 100644 vendor/mnapoli/front-yaml/src/Markdown/MarkdownParser.php create mode 100644 vendor/mnapoli/front-yaml/src/Parser.php create mode 100644 vendor/mnapoli/front-yaml/src/YAML/YAMLParser.php create mode 100644 vendor/symfony/deprecation-contracts/.gitignore create mode 100644 vendor/symfony/deprecation-contracts/CHANGELOG.md create mode 100644 vendor/symfony/deprecation-contracts/LICENSE create mode 100644 vendor/symfony/deprecation-contracts/README.md create mode 100644 vendor/symfony/deprecation-contracts/composer.json create mode 100644 vendor/symfony/deprecation-contracts/function.php create mode 100644 vendor/symfony/polyfill-ctype/Ctype.php create mode 100644 vendor/symfony/polyfill-ctype/LICENSE create mode 100644 vendor/symfony/polyfill-ctype/README.md create mode 100644 vendor/symfony/polyfill-ctype/bootstrap.php create mode 100644 vendor/symfony/polyfill-ctype/bootstrap80.php create mode 100644 vendor/symfony/polyfill-ctype/composer.json create mode 100644 vendor/symfony/yaml/CHANGELOG.md create mode 100644 vendor/symfony/yaml/Command/LintCommand.php create mode 100644 vendor/symfony/yaml/Dumper.php create mode 100644 vendor/symfony/yaml/Escaper.php create mode 100644 vendor/symfony/yaml/Exception/DumpException.php create mode 100644 vendor/symfony/yaml/Exception/ExceptionInterface.php create mode 100644 vendor/symfony/yaml/Exception/ParseException.php create mode 100644 vendor/symfony/yaml/Exception/RuntimeException.php create mode 100644 vendor/symfony/yaml/Inline.php create mode 100644 vendor/symfony/yaml/LICENSE create mode 100644 vendor/symfony/yaml/Parser.php create mode 100644 vendor/symfony/yaml/README.md create mode 100755 vendor/symfony/yaml/Resources/bin/yaml-lint create mode 100644 vendor/symfony/yaml/Tag/TaggedValue.php create mode 100644 vendor/symfony/yaml/Unescaper.php create mode 100644 vendor/symfony/yaml/Yaml.php create mode 100644 vendor/symfony/yaml/composer.json delete mode 100644 yaml2md.php diff --git a/bib.php b/bib.php index 6ee59b84b..dfbe16a62 100644 --- a/bib.php +++ b/bib.php @@ -1,9 +1,11 @@ =5.3.0" + }, + "require-dev": { + "phpunit/phpunit": "^4.8.35" + }, + "type": "library", + "autoload": { + "psr-0": { + "Parsedown": "" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Emanuil Rusev", + "email": "hello@erusev.com", + "homepage": "http://erusev.com" + } + ], + "description": "Parser for Markdown.", + "homepage": "http://parsedown.org", + "keywords": [ + "markdown", + "parser" + ], + "time": "2019-12-30T22:54:17+00:00" + }, + { + "name": "erusev/parsedown-extra", + "version": "0.8.1", + "source": { + "type": "git", + "url": "https://github.com/erusev/parsedown-extra.git", + "reference": "91ac3ff98f0cea243bdccc688df43810f044dcef" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/erusev/parsedown-extra/zipball/91ac3ff98f0cea243bdccc688df43810f044dcef", + "reference": "91ac3ff98f0cea243bdccc688df43810f044dcef", + "shasum": "" + }, + "require": { + "erusev/parsedown": "^1.7.4" + }, + "require-dev": { + "phpunit/phpunit": "^4.8.35" + }, + "type": "library", + "autoload": { + "psr-0": { + "ParsedownExtra": "" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Emanuil Rusev", + "email": "hello@erusev.com", + "homepage": "http://erusev.com" + } + ], + "description": "An extension of Parsedown that adds support for Markdown Extra.", + "homepage": "https://github.com/erusev/parsedown-extra", + "keywords": [ + "markdown", + "markdown extra", + "parsedown", + "parser" + ], + "time": "2019-12-30T23:20:37+00:00" + }, + { + "name": "mnapoli/front-yaml", + "version": "1.8.0", + "source": { + "type": "git", + "url": "https://github.com/mnapoli/FrontYAML.git", + "reference": "76baa8ca538e111bfe53ac49c6a512ec5ea2bf54" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/mnapoli/FrontYAML/zipball/76baa8ca538e111bfe53ac49c6a512ec5ea2bf54", + "reference": "76baa8ca538e111bfe53ac49c6a512ec5ea2bf54", + "shasum": "" + }, + "require": { + "erusev/parsedown": "~1.0", + "php": ">=7.3", + "symfony/yaml": "~2.1|^3.0|^4.0|^5.0" + }, + "require-dev": { + "league/commonmark": "~1.4", + "phpunit/phpunit": "^9.4" + }, + "type": "library", + "autoload": { + "psr-4": { + "Mni\\FrontYAML\\": "src/" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "time": "2020-12-04T10:52:19+00:00" + }, + { + "name": "symfony/deprecation-contracts", + "version": "v2.2.0", + "source": { + "type": "git", + "url": "https://github.com/symfony/deprecation-contracts.git", + "reference": "5fa56b4074d1ae755beb55617ddafe6f5d78f665" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/symfony/deprecation-contracts/zipball/5fa56b4074d1ae755beb55617ddafe6f5d78f665", + "reference": "5fa56b4074d1ae755beb55617ddafe6f5d78f665", + "shasum": "" + }, + "require": { + "php": ">=7.1" + }, + "type": "library", + "extra": { + "branch-alias": { + "dev-master": "2.2-dev" + }, + "thanks": { + "name": "symfony/contracts", + "url": "https://github.com/symfony/contracts" + } + }, + "autoload": { + "files": [ + "function.php" + ] + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Nicolas Grekas", + "email": "p@tchwork.com" + }, + { + "name": "Symfony Community", + "homepage": "https://symfony.com/contributors" + } + ], + "description": "A generic function and convention to trigger deprecation notices", + "homepage": "https://symfony.com", + "funding": [ + { + "url": "https://symfony.com/sponsor", + "type": "custom" + }, + { + "url": "https://github.com/fabpot", + "type": "github" + }, + { + "url": "https://tidelift.com/funding/github/packagist/symfony/symfony", + "type": "tidelift" + } + ], + "time": "2020-09-07T11:33:47+00:00" + }, + { + "name": "symfony/polyfill-ctype", + "version": "v1.22.0", + "source": { + "type": "git", + "url": "https://github.com/symfony/polyfill-ctype.git", + "reference": "c6c942b1ac76c82448322025e084cadc56048b4e" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/symfony/polyfill-ctype/zipball/c6c942b1ac76c82448322025e084cadc56048b4e", + "reference": "c6c942b1ac76c82448322025e084cadc56048b4e", + "shasum": "" + }, + "require": { + "php": ">=7.1" + }, + "suggest": { + "ext-ctype": "For best performance" + }, + "type": "library", + "extra": { + "branch-alias": { + "dev-main": "1.22-dev" + }, + "thanks": { + "name": "symfony/polyfill", + "url": "https://github.com/symfony/polyfill" + } + }, + "autoload": { + "psr-4": { + "Symfony\\Polyfill\\Ctype\\": "" + }, + "files": [ + "bootstrap.php" + ] + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Gert de Pagter", + "email": "BackEndTea@gmail.com" + }, + { + "name": "Symfony Community", + "homepage": "https://symfony.com/contributors" + } + ], + "description": "Symfony polyfill for ctype functions", + "homepage": "https://symfony.com", + "keywords": [ + "compatibility", + "ctype", + "polyfill", + "portable" + ], + "funding": [ + { + "url": "https://symfony.com/sponsor", + "type": "custom" + }, + { + "url": "https://github.com/fabpot", + "type": "github" + }, + { + "url": "https://tidelift.com/funding/github/packagist/symfony/symfony", + "type": "tidelift" + } + ], + "time": "2021-01-07T16:49:33+00:00" + }, + { + "name": "symfony/yaml", + "version": "v5.2.3", + "source": { + "type": "git", + "url": "https://github.com/symfony/yaml.git", + "reference": "338cddc6d74929f6adf19ca5682ac4b8e109cdb0" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/symfony/yaml/zipball/338cddc6d74929f6adf19ca5682ac4b8e109cdb0", + "reference": "338cddc6d74929f6adf19ca5682ac4b8e109cdb0", + "shasum": "" + }, + "require": { + "php": ">=7.2.5", + "symfony/deprecation-contracts": "^2.1", + "symfony/polyfill-ctype": "~1.8" + }, + "conflict": { + "symfony/console": "<4.4" + }, + "require-dev": { + "symfony/console": "^4.4|^5.0" + }, + "suggest": { + "symfony/console": "For validating YAML files using the lint command" + }, + "bin": [ + "Resources/bin/yaml-lint" + ], + "type": "library", + "autoload": { + "psr-4": { + "Symfony\\Component\\Yaml\\": "" + }, + "exclude-from-classmap": [ + "/Tests/" + ] + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Fabien Potencier", + "email": "fabien@symfony.com" + }, + { + "name": "Symfony Community", + "homepage": "https://symfony.com/contributors" + } + ], + "description": "Loads and dumps YAML files", + "homepage": "https://symfony.com", + "funding": [ + { + "url": "https://symfony.com/sponsor", + "type": "custom" + }, + { + "url": "https://github.com/fabpot", + "type": "github" + }, + { + "url": "https://tidelift.com/funding/github/packagist/symfony/symfony", + "type": "tidelift" + } + ], + "time": "2021-02-03T04:42:09+00:00" + } + ], + "packages-dev": [], + "aliases": [], + "minimum-stability": "stable", + "stability-flags": [], + "prefer-stable": false, + "prefer-lowest": false, + "platform": [], + "platform-dev": [], + "plugin-api-version": "1.1.0" +} diff --git a/data-new/Build and Deployment/Build/1/DefinedBuildProcess.yaml b/data-new/Build and Deployment/Build/1/DefinedBuildProcess.yaml new file mode 100755 index 000000000..cefc8663b --- /dev/null +++ b/data-new/Build and Deployment/Build/1/DefinedBuildProcess.yaml @@ -0,0 +1,23 @@ +--- +risk: Performing builds without a defined process is error prone. For example, as + a result of incorrect security related configuration. +measure: A well defined build process lowers the possibility of errors during the + build process. +evidence: The build process is defined in REPLACE-ME Pipeline + in the folder vars. Projects are using a Jenkinsfile to use the defined + process. +difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 2 +usefulness: 4 +level: 1 +implementation: +- CI/CD Tools, e.g. Jenkins +- Container technologies and orchestration like Docker, Kubernetes +samm2: i-secure-build|A|1 +iso27001-2017: +- 12.1.1 +- 14.2.2 +id: DefinedBuildProcess +... diff --git a/data-new/Build and Deployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml b/data-new/Build and Deployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml new file mode 100755 index 000000000..8b60def28 --- /dev/null +++ b/data-new/Build and Deployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml @@ -0,0 +1,24 @@ +--- +risk: While building and testing artifacts, third party systems, application frameworks + and 3rd party libraries are used. These might be malicious as a result of vulnerable + libraries or because they are altered during the delivery phase. +measure: Each step during within the build and testing phase is performed in a separate + virtual environments, which is destroyed afterward. +meta: + implementationGuide: Depending on your envirnoment, usage of virtual machines or + container technoligy is a good way. After the build, the filesystem should not + be used again in other builds. +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 +usefulness: 2 +implementation: +- Container technologies and orchestration like Docker, Kubernetes +- CI/CD Tools, e.g. Jenkins +level: 2 +samm2: i-secure-build|A|2 +iso27001-2017: +- 14.2.6 +id: BuildingAndTestingOfArtifactsInVirtualEnvironments +... diff --git a/data-new/Build and Deployment/Build/3/SigningOfArtifacts.yaml b/data-new/Build and Deployment/Build/3/SigningOfArtifacts.yaml new file mode 100755 index 000000000..271d04573 --- /dev/null +++ b/data-new/Build and Deployment/Build/3/SigningOfArtifacts.yaml @@ -0,0 +1,22 @@ +--- +risk: Unauthorized manipulation of artifacts might be difficult to spot. For example, + this may result in images with malicious code in the Docker registry. +measure: Digitally signing artifacts for all steps during the build and especially + docker images, helps to ensure their integrity. +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 +usefulness: 4 +level: 3 +implementation: +- Docker Content Trust +- in-toto +dependsOn: +- Defined build process +samm: OA3-B +samm2: i-secure-build|A|1 +iso27001-2017: +- 14.2.6 +id: SigningOfArtifacts +... diff --git a/data-new/Build and Deployment/Build/3/SigningOfCode.yaml b/data-new/Build and Deployment/Build/3/SigningOfCode.yaml new file mode 100755 index 000000000..3581acf0c --- /dev/null +++ b/data-new/Build and Deployment/Build/3/SigningOfCode.yaml @@ -0,0 +1,19 @@ +--- +risk: Unauthorized manipulation of source code might be difficult to spot. +measure: Digitally signing commits helps to prevent unauthorized manipulation of source + code. +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 +usefulness: 3 +level: 3 +implementation: ~ +dependsOn: +- Defined build process +samm: OA3-B +samm2: i-secure-build|A|2 +iso27001-2017: +- 14.2.6 +id: SigningOfCode +... diff --git a/data-new/Build and Deployment/Deployment/1/DefinedDeploymentProcess.yaml b/data-new/Build and Deployment/Deployment/1/DefinedDeploymentProcess.yaml new file mode 100755 index 000000000..59c98d5bc --- /dev/null +++ b/data-new/Build and Deployment/Deployment/1/DefinedDeploymentProcess.yaml @@ -0,0 +1,18 @@ +--- +risk: Deployments without a defined process are error prone thus allowing old or untested + artifact to be deployed. +measure: A defined deployment process significantly lowers the likelihood of errors + during the deployment phase. +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 +usefulness: 4 +level: 1 +implementation: Jenkins, Docker +samm2: i-secure-deployment|A|1 +iso27001-2017: +- 12.1.1 +- 14.2.2 +id: DefinedDeploymentProcess +... diff --git a/data-new/Build and Deployment/Deployment/2/BackupBeforeDeployment.yaml b/data-new/Build and Deployment/Deployment/2/BackupBeforeDeployment.yaml new file mode 100755 index 000000000..1b34926fb --- /dev/null +++ b/data-new/Build and Deployment/Deployment/2/BackupBeforeDeployment.yaml @@ -0,0 +1,22 @@ +--- +risk: If errors are experienced during the deployment process you want to deploy an + old release. However, due to changes in the database this is often unfeasible. +measure: Performing automated backups before deployment can help facilitate deployments + whilst testing the backup restore processes. +difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 +usefulness: 4 +level: 2 +implementation: A complete database backup might be performed*. For large and complex + environments, a Point in Time Recovery for databases should be implemented. +dependsOn: +- Defined deployment process +samm: OE2-A +samm2: TODO +iso27001-2017: +- "12.3" +- 14.2.6 +id: BackupBeforeDeployment +... diff --git a/data-new/Build and Deployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml b/data-new/Build and Deployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml new file mode 100755 index 000000000..8423b8712 --- /dev/null +++ b/data-new/Build and Deployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml @@ -0,0 +1,18 @@ +--- +risk: Attackers who compromise source code can see confidential access information + like database credentials. +measure: Configuration parameters are set for each environment not in the source code. +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 +usefulness: 4 +level: 2 +implementation: "" +samm: SA2-A +samm2: i-secure-deployment|B|1 +iso27001-2017: +- 9.4.5 +- 14.2.6 +id: EnvironmentDependingConfigurationParameters +... diff --git a/data-new/Build and Deployment/Deployment/2/UsageOfTrustedImages.yaml b/data-new/Build and Deployment/Deployment/2/UsageOfTrustedImages.yaml new file mode 100755 index 000000000..79fc48227 --- /dev/null +++ b/data-new/Build and Deployment/Deployment/2/UsageOfTrustedImages.yaml @@ -0,0 +1,21 @@ +--- +risk: Developers or operations might start random images in the production cluster + which have malicous code or known vulnerabilities. +measure: Create image assessment criteria, perform an evaluation of images and create + a whitelist of artifacts/container images/virtual machine images. +implementation: Kubernetes Admission Controller can whitelist registries and/or whitelist + a signing key. +difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 +usefulness: 3 +level: 2 +samm2: i-secure-deployment|A|2 +iso27001-2017: +- 15.1.1 +- 15.1.2 +- 15.1.3 +- 14.1.3 +id: UsageOfTrustedImages +... diff --git a/data-new/Build and Deployment/Deployment/3/HandoverOfConfidentialParameters.yaml b/data-new/Build and Deployment/Deployment/3/HandoverOfConfidentialParameters.yaml new file mode 100755 index 000000000..e5f97c8f0 --- /dev/null +++ b/data-new/Build and Deployment/Deployment/3/HandoverOfConfidentialParameters.yaml @@ -0,0 +1,26 @@ +--- +risk: Attackers who compromise a system can see confidential access information like + database credentials. Parameters are often used to set credentials, for example + by starting containers or applications. These parameters can often be seen by any + one listing running processes on the target system. +measure: By using encryption, it is harder to read credentials , e.g. from the file + system. Also, the usage of a credential management system can help protect credentials. +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 +usefulness: 4 +level: 3 +implementation: "" +dependsOn: +- Environment depending configuration parameters +samm: SA2-A +samm2: i-secure-deployment|B|2 TODO might be 1 +iso27001-2017: +- 14.1.3 +- 13.1.3 +- 9.4.3 +- 9.4.1 +- 10.1.2 +id: HandoverOfConfidentialParameters +... diff --git a/data-new/Build and Deployment/Deployment/3/InventoryOfRunningArtifacts.yaml b/data-new/Build and Deployment/Deployment/3/InventoryOfRunningArtifacts.yaml new file mode 100755 index 000000000..361374ef1 --- /dev/null +++ b/data-new/Build and Deployment/Deployment/3/InventoryOfRunningArtifacts.yaml @@ -0,0 +1,19 @@ +--- +risk: In case a vulnerability of severity high or critical exists, it needs to be + known where an artifacts with that vulnerability is deployed with which dependencies. +measure: A documented inventory or a possibility to gather the needed information + (e.g. the documentation of which script needs to be run by whoom) must be in place. +dependsOn: +- Defined deployment process +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 3 +usefulness: 3 +level: 3 +samm2: o-incident-management|TODO +iso27001-2017: +- "8.1" +- "8.2" +id: InventoryOfRunningArtifacts +... diff --git a/data-new/Build and Deployment/Deployment/3/RollingUpdateOnDeployment.yaml b/data-new/Build and Deployment/Deployment/3/RollingUpdateOnDeployment.yaml new file mode 100755 index 000000000..d4721fc9b --- /dev/null +++ b/data-new/Build and Deployment/Deployment/3/RollingUpdateOnDeployment.yaml @@ -0,0 +1,19 @@ +--- +risk: While a deployment is performed, the application can not be reached. +measure: A deployment without downtime is performed*. +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 +usefulness: 2 +level: 3 +implementation: Docker, Webserver, rolling update +dependsOn: +- Defined deployment process +samm2: i-secure-deployment|A|1 +iso27001-2017: +- 12.5.1 +- 14.2.2 +- 17.2.1 +id: RollingUpdateOnDeployment +... diff --git a/data-new/Build and Deployment/Deployment/3/SameArtifactForEnvironments.yaml b/data-new/Build and Deployment/Deployment/3/SameArtifactForEnvironments.yaml new file mode 100755 index 000000000..10c3d19e0 --- /dev/null +++ b/data-new/Build and Deployment/Deployment/3/SameArtifactForEnvironments.yaml @@ -0,0 +1,22 @@ +--- +risk: Building of an artifact for different environments means that an untested artifact + might reach the production environment. +measure: Building an artifact once and deploying it to different environments means + that only tested artifacts are allowed to reach the production environment +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 +usefulness: 4 +level: 3 +implementation: Docker +dependsOn: +- Defined build process +samm: OE2-A +samm2: i-secure-deployment|A|2 +iso27001-2017: +- 14.3.1 +- 14.2.8 +- 12.1.4 +id: SameArtifactForEnvironments +... diff --git a/data-new/Build and Deployment/Deployment/3/UsageOfFeatureToggles.yaml b/data-new/Build and Deployment/Deployment/3/UsageOfFeatureToggles.yaml new file mode 100755 index 000000000..6c6621484 --- /dev/null +++ b/data-new/Build and Deployment/Deployment/3/UsageOfFeatureToggles.yaml @@ -0,0 +1,23 @@ +--- +risk: By using environment dependent configuration, some parameters will not be tested + correctly. i.e. 
if (host == 'production') {} else {}
+measure: Usage of environment independent configuration parameter, called feature + toggles, helps to enhance the test coverage. Only what has been tested, goes to + production. +difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 +usefulness: 2 +level: 3 +implementation: Docker +dependsOn: +- Same artifact for environments +samm: EG1-B +iso27001-2017: +- 14.3.1 +- 14.2.8 +- 14.2.9 +- 12.1.4 +id: UsageOfFeatureToggles +... diff --git a/data-new/Build and Deployment/Patch Management/1/APatchPolicyIsDefined.yaml b/data-new/Build and Deployment/Patch Management/1/APatchPolicyIsDefined.yaml new file mode 100755 index 000000000..0204f6071 --- /dev/null +++ b/data-new/Build and Deployment/Patch Management/1/APatchPolicyIsDefined.yaml @@ -0,0 +1,17 @@ +--- +risk: Vulnerabilities in running containers stay for long and might get exploited. +measure: A patch policy for all artifacts (e.g. in images) is defined. How often is + an image rebuilt? +difficultyOfImplementation: + knowledge: 3 + time: 1 + resources: 2 +usefulness: 4 +level: 1 +samm2: o-environment-management|B|1 +iso27001-2017: +- 12.6.1 +- 12.5.1 +- 14.2.5 +id: APatchPolicyIsDefined +... diff --git a/data-new/Build and Deployment/Patch Management/1/AutomatedPrsForPatches.yaml b/data-new/Build and Deployment/Patch Management/1/AutomatedPrsForPatches.yaml new file mode 100755 index 000000000..34c4fdfa2 --- /dev/null +++ b/data-new/Build and Deployment/Patch Management/1/AutomatedPrsForPatches.yaml @@ -0,0 +1,22 @@ +--- +risk: Known vulnerabilities components might stay for long and get exploited, even + when a patch is available. +measure: Fast patching of third party component is needed. The DevOps way is to have + an automated pull request for new components. This includes +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 +usefulness: 5 +level: 1 +samm2: o-environment-management|B|1 +iso27001-2017: +- 12.6.1 +- 14.2.5 +implementation: +- dependabot +- Jenkins +id: AutomatedPrsForPatches +... diff --git a/data-new/Build and Deployment/Patch Management/2/NightlyBuildOfImages.yaml b/data-new/Build and Deployment/Patch Management/2/NightlyBuildOfImages.yaml new file mode 100755 index 000000000..a453f1d41 --- /dev/null +++ b/data-new/Build and Deployment/Patch Management/2/NightlyBuildOfImages.yaml @@ -0,0 +1,14 @@ +--- +risk: Vulnerabilities in running containers stay for too long and might get exploited. +measure: Images are built at least nightly. +difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 2 +usefulness: 3 +level: 2 +samm2: o-environment-management|B|1 +iso27001-2017: +- 12.6.1 +id: NightlyBuildOfImages +... diff --git a/data-new/Build and Deployment/Patch Management/2/ReductionOfTheAttackSurface.yaml b/data-new/Build and Deployment/Patch Management/2/ReductionOfTheAttackSurface.yaml new file mode 100755 index 000000000..00e994945 --- /dev/null +++ b/data-new/Build and Deployment/Patch Management/2/ReductionOfTheAttackSurface.yaml @@ -0,0 +1,20 @@ +--- +risk: Components, dependencies, files or file access rights might have vulnerabilities, + but the they are not needed. +measure: Removal of unneeded components, dependencies, files or file access rights. + For container images the usage of distroless images is recommended. +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 +usefulness: 3 +level: 2 +samm2: o-environment-management|B|1 +iso27001-2017: +- hardening is missing in ISO 27001 +- 14.2.1 +implementation: +- Distroless +- Fedora CoreOS +id: ReductionOfTheAttackSurface +... diff --git a/data-new/Build and Deployment/Patch Management/2/UsageOfAMaximumLifetimeForImages.yaml b/data-new/Build and Deployment/Patch Management/2/UsageOfAMaximumLifetimeForImages.yaml new file mode 100755 index 000000000..d176e9ea6 --- /dev/null +++ b/data-new/Build and Deployment/Patch Management/2/UsageOfAMaximumLifetimeForImages.yaml @@ -0,0 +1,18 @@ +--- +risk: Vulnerabilities in images of running containers stay for too long and might + get exploited. Long running containers have potential memory leaks. A compromised + container might get killed by restarting the container (e.g. in case the attacker + has not reached the persistence layer). +measure: The periodically built images are deployed minimum every 30 days (better + hourly/daily/weekly). Meaning an image is not in production for longer than 30 days. +difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 2 +usefulness: 3 +level: 2 +samm2: o-environment-management|B|1 +iso27001-2017: +- 12.6.1 +id: UsageOfAMaximumLifetimeForImages +... diff --git a/data-new/Build and Deployment/Patch Management/4/UsageOfAShortMaximumLifetimeForImages.yaml b/data-new/Build and Deployment/Patch Management/4/UsageOfAShortMaximumLifetimeForImages.yaml new file mode 100755 index 000000000..ac6d7ba7b --- /dev/null +++ b/data-new/Build and Deployment/Patch Management/4/UsageOfAShortMaximumLifetimeForImages.yaml @@ -0,0 +1,25 @@ +--- +risk: Vulnerabilities in running containers stay for too long and might get exploited. +measure: Nightly built images are deployed at minimum every 1 day. +difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 2 +usefulness: 3 +level: 4 +samm2: o-environment-management|B|1 +iso27001-2017: +- 12.6.1 +implementation: +- Sample concept:
(1) each container has a set lifetime and is killed / replaced + with a new container multiple times a day where you have some form of a graceful + replacement to ensure no (short) service outage will occur to the end users.
(2) + twice a day a rebuild of images is done. The rebuilds are put into a automated testing + pipeline. If the testing has no blocking issues the new images will be released + for deployment during the next "restart" of a container. What has to be done, is + to ensure the new containers are deployed in some canary deployment manner, this + will ensure that if (and only if) something buggy has been introduced which breaks + functionality the canary deployment will make sure the "older version" is being + used and not the buggy newer one. +id: UsageOfAShortMaximumLifetimeForImages +... diff --git a/data-new/Culture and Organization/Design/0/InformationSecurityTargetsAreCommunicated.yaml b/data-new/Culture and Organization/Design/0/InformationSecurityTargetsAreCommunicated.yaml new file mode 100755 index 000000000..cc6797144 --- /dev/null +++ b/data-new/Culture and Organization/Design/0/InformationSecurityTargetsAreCommunicated.yaml @@ -0,0 +1,17 @@ +--- +risk: Employees don't known their organisation security targets. Therefore security + is not considered during development and administration as much as it should be. +measure: Transparent and timely communication of the security targets by senior management + is essential to ensure teams' buy-in and support. +difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 +usefulness: 4 +level: 0 +samm: SM1-B +iso27001-2017: +- 5.1.1 +- 7.2.1 +id: InformationSecurityTargetsAreCommunicated +... diff --git a/data-new/Culture and Organization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml b/data-new/Culture and Organization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml new file mode 100755 index 000000000..27db05320 --- /dev/null +++ b/data-new/Culture and Organization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml @@ -0,0 +1,56 @@ +--- +risk: Technical related threats are discovered too late in the development and deployment + process. +measure: Threat modelling of technical features is performed during the product sprint + planning. +difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 1 +usefulness: 3 +level: 1 +implementation: +- Threat modelling Playbook +md-description: |2 + + Once requirements are gathered and analysis is performed, implementation specifics need to be defined. The outcome of this stage is usually a diagram outlining data flows and a general system architecture. This presents an opportunity for both threat modeling and attaching security considerations to every ticket and epic that is the outcome of this stage. + + There is some great advice on threat modeling out there *e.g.* [this](https://arstechnica.com/information-technology/2017/07/how-i-learned-to-stop-worrying-mostly-and-love-my-threat-model/) article or [this](https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling) one. + + A bite sized primer by Adam Shostack himself can be found [here](https://adam.shostack.org/blog/2018/03/threat-modeling-panel-at-appsec-cali-2018/). + + OWASP includes a short [article](https://wiki.owasp.org/index.php/Category:Threat_Modeling) on Threat Modeling along with a relevant [Cheatsheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html). Moreover, if you're following OWASP SAMM, it has a short section on [Threat Assessment](https://owaspsamm.org/model/design/threat-assessment/). + + There's a few projects that can help with creating Threat Models at this stage, [PyTM](https://github.com/izar/pytm) is one, [ThreatSpec](https://github.com/threatspec/threatspec) is another. + + > Note: _A threat model can be as simple as a data flow diagram with attack vectors on every flow and asset and equivalent remediations. An example can be found below._ + + ![Threat Model](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/threat_model.png "Threat Model") + + Last, if the organisation maps Features to Epics, the Security Knowledge Framework (SKF) can be used to facilitate this process by leveraging it's questionnaire function. + + ![SKF](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/skf_qs.png "SKF") + + This practice has the side effect that it trains non-security specialists to think like attackers. + + The outcomes of this stage should help lay the foundation of secure design and considerations. + + **Example Low Maturity Scenario:** + + Following vague feature requirements the design includes caching data to a local unencrypted database with a hardcoded password. + + Remote data store access secrets are hardcoded in the configuration files. All communication between backend systems is plaintext. + + Frontend serves data over GraphQL as a thin layer between caching system and end user. + + GraphQL queries are dynamically translated to SQL, Elasticsearch and NoSQL queries. Access to data is protected with basic auth set to _1234:1234_ for development purposes. + + Source: OWASP Project Integration Project +samm: TA1-A +iso27001-2017: +- not explicitly covered by ISO 27001 +- may be part of risk assessment +- 8.2.1 +- 14.2.1 +id: ConductionOfSimpleThreatModellingOnTechnicalLevel +... diff --git a/data-new/Culture and Organization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml b/data-new/Culture and Organization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml new file mode 100755 index 000000000..ecc5b7f9e --- /dev/null +++ b/data-new/Culture and Organization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml @@ -0,0 +1,19 @@ +--- +risk: Business related threats are discovered too late in the development and deployment + process. +measure: Threat modelling of business functionality is performed during the product + backlog creation to facilitate early detection of security defects. +difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 1 +usefulness: 3 +level: 2 +samm: TA1-A +iso27001-2017: +- not explicitly covered by ISO 27001 +- may be part of risk assessment +- 8.2.1 +- 14.2.1 +id: ConductionOfSimpleThreatModellingOnBusinessLevel +... diff --git a/data-new/Culture and Organization/Design/2/CreationOfSimpleAbuseStories.yaml b/data-new/Culture and Organization/Design/2/CreationOfSimpleAbuseStories.yaml new file mode 100755 index 000000000..d8721cdb1 --- /dev/null +++ b/data-new/Culture and Organization/Design/2/CreationOfSimpleAbuseStories.yaml @@ -0,0 +1,22 @@ +--- +risk: User stories mostly don't consider security implications. Security flaws are + discovered too late in the development and deployment process. +measure: Abuse stories are created during the creation of user stories. +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 +usefulness: 4 +level: 2 +samm: TA2-A +iso27001-2017: +- not explicitly covered by ISO 27001 +- may be part of project management +- 6.1.5 +- may be part of risk assesment +- 8.1.2 +implementation: Don't + Forget EVIL User Stories and Practical + Security Stories and Security Tasks for Agile Development Environments +id: CreationOfSimpleAbuseStories +... diff --git a/data-new/Culture and Organization/Design/3/ConductionOfAdvancedThreatModelling.yaml b/data-new/Culture and Organization/Design/3/ConductionOfAdvancedThreatModelling.yaml new file mode 100755 index 000000000..8fb2bf6d9 --- /dev/null +++ b/data-new/Culture and Organization/Design/3/ConductionOfAdvancedThreatModelling.yaml @@ -0,0 +1,31 @@ +--- +risk: Inadequate identification of business and technical risks. +measure: Threat modelling is performed by using reviewing user stories and producing + security driven data flow diagrams. +difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 2 +usefulness: 3 +level: 3 +md-description: | + **Example High Maturity Scenario:** + + Based on a detailed threat model defined and updated through code, the team decides the following: + + * Local encrypted caches need to expire and auto-purged. + * Communication channels encrypted and authenticated. + * All secrets persisted in shared secrets store. + * Frontend designed with permissions model integration. + * Permissions matrix defined. + * Input is escaped output is encoded appropriately using well established libraries. + + Source: OWASP Project Integration Project +samm: TA2-B +iso27001-2017: +- not explicitly covered by ISO 27001 +- may be part of risk assessment +- 8.2.1 +- 14.2.1 +id: ConductionOfAdvancedThreatModelling +... diff --git a/data-new/Culture and Organization/Design/4/CreationOfAdvancedAbuseStories.yaml b/data-new/Culture and Organization/Design/4/CreationOfAdvancedAbuseStories.yaml new file mode 100755 index 000000000..baa9e6e12 --- /dev/null +++ b/data-new/Culture and Organization/Design/4/CreationOfAdvancedAbuseStories.yaml @@ -0,0 +1,25 @@ +--- +risk: Simple user stories are not going deep enough. Relevant security considerations + are performed. Security flaws are discovered too late in the development and deployment + process +measure: Advanced abuse stories are created as part of threat modelling activities. +difficultyOfImplementation: + knowledge: 4 + time: 2 + resources: 1 +usefulness: 4 +level: 4 +dependsOn: +- Creation of simple abuse stories +samm: TA2-A +iso27001-2017: +- not explicitly covered by ISO 27001 +- may be part of project management +- 6.1.5 +- may be part of risk assesment +- 8.1.2 +implementation: Don't + Forget EVIL User Stories and Practical + Security Stories and Security Tasks for Agile Development Environments +id: CreationOfAdvancedAbuseStories +... diff --git a/data-new/Culture and Organization/Education and Guidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml b/data-new/Culture and Organization/Education and Guidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml new file mode 100755 index 000000000..a2f6bdbc5 --- /dev/null +++ b/data-new/Culture and Organization/Education and Guidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml @@ -0,0 +1,19 @@ +--- +risk: Understanding security is hard and personnel needs to be trained on it. Otherwise, + flaws like an SQL Injection might be introduced into the software which might get + exploited. +measure: Provide security awareness training for all personnel involved in software + development Ad-Hoc. +difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 +usefulness: 3 +level: 1 +samm: EG1-A - In case you do not have the budget to hire an external security expert, + an option is to use the OWASP + Juice Shop on a "hacking Friday" - https://cheatsheetseries.owasp.org/ +iso27001-2017: +- 7.2.2 +id: Ad-HocSecurityTrainingsForSoftwareDevelopers +... diff --git a/data-new/Culture and Organization/Education and Guidance/1/SecurityConsultingOnRequest.yaml b/data-new/Culture and Organization/Education and Guidance/1/SecurityConsultingOnRequest.yaml new file mode 100755 index 000000000..eacc5e6c3 --- /dev/null +++ b/data-new/Culture and Organization/Education and Guidance/1/SecurityConsultingOnRequest.yaml @@ -0,0 +1,19 @@ +--- +risk: Not asking a security expert when questions regarding security appear might + lead to flaws. +measure: Security consulting to teams is given on request. The security consultants + can be internal or external. +difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 +usefulness: 3 +level: 1 +samm: EG2-B +iso27001-2017: +- security consulting is missing in ISO 27001 may be +- 6.1.1 +- 6.1.4 +- 6.1.5 +id: SecurityConsultingOnRequest +... diff --git a/data-new/Culture and Organization/Education and Guidance/2/EachTeamHasASecurityChampion.yaml b/data-new/Culture and Organization/Education and Guidance/2/EachTeamHasASecurityChampion.yaml new file mode 100755 index 000000000..3681ad4c4 --- /dev/null +++ b/data-new/Culture and Organization/Education and Guidance/2/EachTeamHasASecurityChampion.yaml @@ -0,0 +1,19 @@ +--- +risk: No one feels directly responsible for security and the security champion does + not have enough time to allocate to each team. +measure: Each team defines an individual to be responsible for security. These individuals + are often referred to as 'security champions' +difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 1 +usefulness: 3 +level: 2 +samm: EG2-B +iso27001-2017: +- security champions are missing in ISO 27001 most likely +- 7.2.1 +- 7.2.2 +implementation: https://www.owasp.org/index.php/Security_Champions_Playbook +id: EachTeamHasASecurityChampion +... diff --git a/data-new/Culture and Organization/Education and Guidance/2/RegularSecurityTrainingForAll.yaml b/data-new/Culture and Organization/Education and Guidance/2/RegularSecurityTrainingForAll.yaml new file mode 100755 index 000000000..9b22935e1 --- /dev/null +++ b/data-new/Culture and Organization/Education and Guidance/2/RegularSecurityTrainingForAll.yaml @@ -0,0 +1,20 @@ +--- +risk: Understanding security is hard. +measure: Provide security awareness training for all personnel involved in software + development on a regular basis like twice in a year for 1-3 days. +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 +usefulness: 3 +level: 2 +samm: EG1-A +iso27001-2017: +- 7.2.2 +implementation: +- In case you do not have the budget to hire an external security expert, an option + is to use the OWASP Juice Shop + on a "hacking Friday" +- https://cheatsheetseries.owasp.org/ +id: RegularSecurityTrainingForAll +... diff --git a/data-new/Culture and Organization/Education and Guidance/2/RegularSecurityTrainingOfSecurityChampions.yaml b/data-new/Culture and Organization/Education and Guidance/2/RegularSecurityTrainingOfSecurityChampions.yaml new file mode 100755 index 000000000..bc9caea3f --- /dev/null +++ b/data-new/Culture and Organization/Education and Guidance/2/RegularSecurityTrainingOfSecurityChampions.yaml @@ -0,0 +1,18 @@ +--- +risk: Understanding security is hard, even for security champions. +measure: Regular security training of security champions. +evidence: | + - Process Documentation: TODO + - Training Content: TOODO +difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 2 +usefulness: 3 +level: 2 +samm: EG2-B +iso27001-2017: +- security champions are missing in ISO 27001 +- 7.2.2 +id: RegularSecurityTrainingOfSecurityChampions +... diff --git a/data-new/Culture and Organization/Education and Guidance/2/RewardOfGoodCommunication.yaml b/data-new/Culture and Organization/Education and Guidance/2/RewardOfGoodCommunication.yaml new file mode 100755 index 000000000..3125e077f --- /dev/null +++ b/data-new/Culture and Organization/Education and Guidance/2/RewardOfGoodCommunication.yaml @@ -0,0 +1,21 @@ +--- +risk: Employees are not getting excited about security. +measure: Good communication and transparency encourages cross-organisational support. + Gamification of security is also known to help, examples include T-Shirts, mugs, + cups, giftcards and 'High-Fives'. +difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 1 +usefulness: 3 +level: 2 +iso27001-2017: +- not required by ISO 27001 +- interestingly enough A7.2.3 is requiring a process to handle misconduct but nothing + to promote good behavior. +implementation: +- Enhance motivation can be performed with the distribution of pins as a reward, see + OWASP Security Pins Project +- https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx +id: RewardOfGoodCommunication +... diff --git a/data-new/Culture and Organization/Education and Guidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml b/data-new/Culture and Organization/Education and Guidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml new file mode 100755 index 000000000..eb806156c --- /dev/null +++ b/data-new/Culture and Organization/Education and Guidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml @@ -0,0 +1,18 @@ +--- +risk: Understanding security is hard, even for security champions and the conduction + of security training often focuses on breaking a component instead of building a + component secure. +measure: The build-it, break-it, fix-it contest allows to train people with security + related roles like security champions the build, break and fix part of a secure + application. This increases the learning of building secure components. +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 +usefulness: 3 +level: 3 +iso27001-2017: +- 7.2.2 +implementation: https://builditbreakit.org/ +id: ConductionOfBuild-It,Break-It,Fix-ItContests +... diff --git a/data-new/Culture and Organization/Education and Guidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml b/data-new/Culture and Organization/Education and Guidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml new file mode 100755 index 000000000..6d741ff87 --- /dev/null +++ b/data-new/Culture and Organization/Education and Guidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml @@ -0,0 +1,20 @@ +--- +risk: Security checks by external companies do not increase the understanding of an + application/system for internal employees. +measure: Periodically security reviews of source code (SCA), in which security SME, + developers and operations are involved, are effective at increasing the robustness + of software and the security knowledge of the teams involved. +difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 1 +usefulness: 3 +level: 3 +samm: IR1-B +iso27001-2017: +- Mutual review of source code is not explicitly required in ISO 27001 may be +- 7.2.2 +- 12.6.1 +- 12.7.1 +id: ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators +... diff --git a/data-new/Culture and Organization/Education and Guidance/3/RegularSecurityTrainingForEveryone.yaml b/data-new/Culture and Organization/Education and Guidance/3/RegularSecurityTrainingForEveryone.yaml new file mode 100755 index 000000000..645083906 --- /dev/null +++ b/data-new/Culture and Organization/Education and Guidance/3/RegularSecurityTrainingForEveryone.yaml @@ -0,0 +1,17 @@ +--- +risk: Understanding security is hard, for internal as well as external employees. +measure: Regular security training for everyone. +difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 2 +usefulness: 3 +level: 3 +samm: EG2-B +iso27001-2017: +- 7.2.2 +implementation: Often, external employees are not invited for interal trainings. This + activity focuses on providing security trainings to internal as well as external + employees. It is conducted every two weeks for around one hour. +id: RegularSecurityTrainingForEveryone +... diff --git a/data-new/Culture and Organization/Education and Guidance/3/Security-Lessoned-Learned.yaml b/data-new/Culture and Organization/Education and Guidance/3/Security-Lessoned-Learned.yaml new file mode 100755 index 000000000..a39206e90 --- /dev/null +++ b/data-new/Culture and Organization/Education and Guidance/3/Security-Lessoned-Learned.yaml @@ -0,0 +1,16 @@ +--- +risk: After an incident, a similar incident might reoccur. +measure: Running a 'lessons learned' session after an incident helps drive continuous + improvement. Regular meetings with security champions are a good place to share + and discuss lessons learned. +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 +usefulness: 3 +level: 3 +samm: IM-3, ST-3, SR2-B +iso27001-2017: +- 16.1.6 +id: Security-Lessoned-Learned +... diff --git a/data-new/Culture and Organization/Education and Guidance/4/AligningSecurityInTeams.yaml b/data-new/Culture and Organization/Education and Guidance/4/AligningSecurityInTeams.yaml new file mode 100755 index 000000000..374906aae --- /dev/null +++ b/data-new/Culture and Organization/Education and Guidance/4/AligningSecurityInTeams.yaml @@ -0,0 +1,18 @@ +--- +risk: The concept of Security Champions might suggest that only he/she is responsible + for security. However, everyone in the project team should be responsible for security. +measure: By aligning security SME with project teams, a higher security standard can + be achieved. +difficultyOfImplementation: + knowledge: 4 + time: 5 + resources: 1 +implementation: Security SME are involved in discussion for requirements analysis, + software design and sprint planning to provide guidance and suggestions. +usefulness: 5 +level: 4 +samm: EG2-B +iso27001-2017: +- 7.1.1 +id: AligningSecurityInTeams +... diff --git a/data-new/Culture and Organization/Education and Guidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml b/data-new/Culture and Organization/Education and Guidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml new file mode 100755 index 000000000..af697f062 --- /dev/null +++ b/data-new/Culture and Organization/Education and Guidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml @@ -0,0 +1,16 @@ +--- +risk: Development teams limited insight over security practices. +measure: Mutual security testing the security of other teams's project enhances security + awareness and knowledge. +difficultyOfImplementation: + resources: 2 + knowledge: 4 + time: 4 +usefulness: 2 +level: 4 +samm: EG2-A +iso27001-2017: +- Mutual scurity testing is not explicitly required in ISO 27001 may be +- 7.2.2 +id: ConductionOfCollaborativeTeamSecurityChecks +... diff --git a/data-new/Culture and Organization/Education and Guidance/4/ConductionOfWarGames.yaml b/data-new/Culture and Organization/Education and Guidance/4/ConductionOfWarGames.yaml new file mode 100755 index 000000000..2738fc93e --- /dev/null +++ b/data-new/Culture and Organization/Education and Guidance/4/ConductionOfWarGames.yaml @@ -0,0 +1,18 @@ +--- +risk: Understanding incident response plans during an incident is hard and ineffective. +measure: War Games like activities help train for incidents. Security SMEs create + attack scenarios in a testing environment enabling the trainees to learn how to + react in case of an incident. +difficultyOfImplementation: + knowledge: 4 + time: 5 + resources: 5 +usefulness: 2 +level: 4 +iso27001-2017: +- ware games are not explicitly required in ISO 27001 may be +- 7.2.2 +- "16.1" +- 16.1.5 +id: ConductionOfWarGames +... diff --git a/data-new/Culture and Organization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml b/data-new/Culture and Organization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml new file mode 100755 index 000000000..69ad4d176 --- /dev/null +++ b/data-new/Culture and Organization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml @@ -0,0 +1,17 @@ +--- +risk: In case of an emergency, like a power outage, DR actions to perform are not + clear. This leads to reaction and remediation delays. +measure: By understanding and documenting a business continuity and disaster recovery + (BCDR) plan, the overall availability of systems and applications is increased. + Success factors like responsibilities, Service Level Agreements, Recovery Point + Objectives, Recovery Time Objectives or Failover must be fully documented and understood. +difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 2 +usefulness: 4 +level: 1 +iso27001-2017: +- 17.1.1 +id: DefinitionOfSimpleBcdrPracticesForCriticalComponents +... diff --git a/data-new/Culture and Organization/Process/3/ApprovalByReviewingAnyNewVersion.yaml b/data-new/Culture and Organization/Process/3/ApprovalByReviewingAnyNewVersion.yaml new file mode 100755 index 000000000..190e4cdc4 --- /dev/null +++ b/data-new/Culture and Organization/Process/3/ApprovalByReviewingAnyNewVersion.yaml @@ -0,0 +1,19 @@ +--- +risk: An individual might forget to implement security measures to protect source + code or infrastructure components. +measure: On each new version (e.g. Pull Request) of source code or infrastructure + components a security peer review of the changes is performed (two eyes principle) + and approval given by the reviewer. +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 +usefulness: 3 +level: 3 +samm: IR1-B +iso27001-2017: +- peer review - four eyes principle is not explicitly required by ISO 27001 +- 6.1.2 +- 14.2.1 +id: ApprovalByReviewingAnyNewVersion +... diff --git a/data-new/Culture and Organization/Process/3/DefinitionOfAChangeManagementProcess.yaml b/data-new/Culture and Organization/Process/3/DefinitionOfAChangeManagementProcess.yaml new file mode 100755 index 000000000..eb397d2ac --- /dev/null +++ b/data-new/Culture and Organization/Process/3/DefinitionOfAChangeManagementProcess.yaml @@ -0,0 +1,15 @@ +--- +risk: The impact of a change is not controlled because these are not recorded or documented. +measure: Each change of a system is automatically recorded and adequately logged. +difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 1 +usefulness: 3 +level: 3 +iso27001-2017: +- 14.2.2 +- 12.1.2 +- 12.4.1 +id: DefinitionOfAChangeManagementProcess +... diff --git a/data-new/Culture and Organization/Process/3/PreventionOfUnauthorizedInstallation.yaml b/data-new/Culture and Organization/Process/3/PreventionOfUnauthorizedInstallation.yaml new file mode 100755 index 000000000..9f7c56aef --- /dev/null +++ b/data-new/Culture and Organization/Process/3/PreventionOfUnauthorizedInstallation.yaml @@ -0,0 +1,19 @@ +--- +risk: Unapproved components are used. +measure: Components must be whitelisted. Regular scans on the docker infrastructure + (e.g. cluster) need to be performed, to verify that only standardized base images + are used. +difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 +usefulness: 3 +level: 3 +iso27001-2017: +- 12.5.1 +- 12.6.1 +implementation: 'Example: All docker images used by teams need to be based on standard + images.' +comment: By preventing teams from trying out new components, innovation might be hampered +id: PreventionOfUnauthorizedInstallation +... diff --git a/data-new/Implementation/Application Hardening/1/ApplicationHardeningLevel1.yaml b/data-new/Implementation/Application Hardening/1/ApplicationHardeningLevel1.yaml new file mode 100755 index 000000000..365d4fd25 --- /dev/null +++ b/data-new/Implementation/Application Hardening/1/ApplicationHardeningLevel1.yaml @@ -0,0 +1,44 @@ +--- +risk: Using an insecure application might lead to a compromised application. This + might lead to total data theft or data modification. +measure: | + Following frameworks like the + + + in all applications provides a good baseline. +difficultyOfImplementation: + knowledge: 4 + time: 4 + resources: 2 +usefulness: 4 +level: 1 +md-description: | + To tackle the security of code developed in-house, OWASP offers an extensive collection of [Cheatsheets](https://cheatsheetseries.owasp.org/) demonstrating how to implement features securely. Moreover, the Security Knowledge Framework[1] offers an extensive library of code patterns spanning several programming languages. These patterns can be used to not only jumpstart the development process, but also do so securely. + + [...] + + ### Planning aka Requirements Gathering & Analysis + The Requirements gathering process tries to answer the question: _"What is the system going to do?"_ At this stage, the [SAMM project](https://owaspsamm.org/model/) offers 3 distinct maturity levels covering both [in-house](https://owaspsamm.org/model/design/security-requirements/stream-a/) software development and [third party](https://owaspsamm.org/model/design/security-requirements/stream-b/) supplier security. + + ![SAMM Requirements](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/OWASP-in0.png) + + Organisations can use these to add solid security considerations at the start of the Software Development or Procurement process. + + These general security considerations can be audited by using a subsection of the ASVS controls in section V1 as a questionnaire. This process attempts to ensure that every feature has concrete security considerations. + + In case of internal development and if the organisation maps Features to Epics, the [Security Knowledge Framework](https://securityknowledgeframework.org/) can be used to facilitate this process by leveraging its questionnaire function, shown below. + + Source: [OWASP Project Integration](https://raw.githubusercontent.com/OWASP/www-project-integration-standards/master/writeups/owasp_in_sdlc/index.md) +implementation: +- OWASP + ASVS +- OWASP MASVS +samm2: software-requirements|A|1 +iso27001-2017: +- hardening is not explicitly covered by ISO 27001 - too specific +- 13.1.3 +id: ApplicationHardeningLevel1 +... diff --git a/data-new/Implementation/Application Hardening/2/App.HardeningLevel2.yaml b/data-new/Implementation/Application Hardening/2/App.HardeningLevel2.yaml new file mode 100755 index 000000000..ff0f2c8b4 --- /dev/null +++ b/data-new/Implementation/Application Hardening/2/App.HardeningLevel2.yaml @@ -0,0 +1,25 @@ +--- +risk: Using an insecure application might lead to a compromised application. This + might lead to total data theft or data modification. +measure: | + Following frameworks like the + +difficultyOfImplementation: + knowledge: 4 + time: 4 + resources: 2 +usefulness: 4 +level: 2 +implementation: +- OWASP + ASVS +- OWASP MASVS +samm2: software-requirements|A|2 +iso27001-2017: +- hardening is not explicitly covered by ISO 27001 - too specific +- 13.1.3 +id: App.HardeningLevel2 +... diff --git a/data-new/Implementation/Application Hardening/3/App.HardeningLevel3.yaml b/data-new/Implementation/Application Hardening/3/App.HardeningLevel3.yaml new file mode 100755 index 000000000..c6eee893c --- /dev/null +++ b/data-new/Implementation/Application Hardening/3/App.HardeningLevel3.yaml @@ -0,0 +1,26 @@ +--- +risk: Using an insecure application might lead to a compromised application. This + might lead to total data theft or data modification. +measure: | + Following frameworks like the + + and gain around 75% coverage of both. +difficultyOfImplementation: + knowledge: 4 + time: 4 + resources: 2 +usefulness: 4 +level: 3 +implementation: +- OWASP + ASVS +- OWASP MASVS +samm2: software-requirements|A|3 +iso27001-2017: +- hardening is not explicitly covered by ISO 27001 - too specific +- 13.1.3 +id: App.HardeningLevel3 +... diff --git a/data-new/Implementation/Application Hardening/4/FullCoverageOfApp.HardeningLevel3.yaml b/data-new/Implementation/Application Hardening/4/FullCoverageOfApp.HardeningLevel3.yaml new file mode 100755 index 000000000..b87bf3d1e --- /dev/null +++ b/data-new/Implementation/Application Hardening/4/FullCoverageOfApp.HardeningLevel3.yaml @@ -0,0 +1,26 @@ +--- +risk: Using an insecure application might lead to a compromised application. This + might lead to total data theft or data modification. +measure: | + Following frameworks like the + + and gain around 95% coverage of both. +difficultyOfImplementation: + knowledge: 4 + time: 4 + resources: 2 +usefulness: 4 +level: 4 +implementation: +- OWASP + ASVS +- OWASP MASVS +samm2: software-requirements|A|3 +iso27001-2017: +- hardening is not explicitly covered by ISO 27001 - too specific +- 13.1.3 +id: FullCoverageOfApp.HardeningLevel3 +... diff --git a/data-new/Implementation/Infrastructure Hardening/1/IsolatedNetworksForVirtualEnvironments.yaml b/data-new/Implementation/Infrastructure Hardening/1/IsolatedNetworksForVirtualEnvironments.yaml new file mode 100755 index 000000000..979d05f14 --- /dev/null +++ b/data-new/Implementation/Infrastructure Hardening/1/IsolatedNetworksForVirtualEnvironments.yaml @@ -0,0 +1,23 @@ +--- +risk: Virtual environments in default settings are able to access other virtual environments + on the network stack. By using virtual machines, it is often possible to connect + to other virtual machines. By using docker, one bridge is used by default so that + all containers on one host can communicate with each other. +measure: The communication between virtual environments is controlled and regulated. +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 +usefulness: 5 +level: 1 +dependsOn: [] +implementation: +- istio +- bridges +- firewalls +samm2: o-environment-management|A|1 +iso27001-2017: +- virtual environments are not explicitly covered by ISO 27001 - too specific +- 13.1.3 +id: IsolatedNetworksForVirtualEnvironments +... diff --git a/data-new/Implementation/Infrastructure Hardening/1/SimpleAccessControlForSystems.yaml b/data-new/Implementation/Infrastructure Hardening/1/SimpleAccessControlForSystems.yaml new file mode 100755 index 000000000..a9f60e024 --- /dev/null +++ b/data-new/Implementation/Infrastructure Hardening/1/SimpleAccessControlForSystems.yaml @@ -0,0 +1,18 @@ +--- +risk: Attackers a gaining access to internal systems and application interfaces +measure: All internal systems are using simple authentication +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 +usefulness: 5 +level: 1 +dependsOn: +- Defined deployment process +implementation: HTTP-Basic Authentication, TLS, VPN +samm: EH1-B +samm2: o-environment-management|A|1 +iso27001-2017: +- 9.4.1 +id: SimpleAccessControlForSystems +... diff --git a/data-new/Implementation/Infrastructure Hardening/1/UsageOfTestAndProductionEnvironments.yaml b/data-new/Implementation/Infrastructure Hardening/1/UsageOfTestAndProductionEnvironments.yaml new file mode 100755 index 000000000..e34936dca --- /dev/null +++ b/data-new/Implementation/Infrastructure Hardening/1/UsageOfTestAndProductionEnvironments.yaml @@ -0,0 +1,18 @@ +--- +risk: Security tests are not running regularly because test environments are missing +measure: A production and a production like envirnoment is used +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 +usefulness: 4 +level: 1 +dependsOn: +- Defined deployment process +samm2: o-environment-management|A|1 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- 12.1.4 +- 17.2.1 +id: UsageOfTestAndProductionEnvironments +... diff --git a/data-new/Implementation/Infrastructure Hardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml b/data-new/Implementation/Infrastructure Hardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml new file mode 100755 index 000000000..ebc15ec49 --- /dev/null +++ b/data-new/Implementation/Infrastructure Hardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml @@ -0,0 +1,16 @@ +--- +risk: Through a vulnerability in one service on a server, the attacker gains access + to other services running on the same server. +measure: Applications are running in a dedicated and isolated virtualized environments. +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 +usefulness: 3 +level: 2 +samm2: o-environment-management|A|1 +iso27001-2017: +- virtual environments are not explicitly covered by ISO 27001 - too specific +- 13.1.3 +id: ApplicationsAreRunningInVirtualizedEnvironments +... diff --git a/data-new/Implementation/Infrastructure Hardening/2/CheckingTheSourcesOfUsedLibraries.yaml b/data-new/Implementation/Infrastructure Hardening/2/CheckingTheSourcesOfUsedLibraries.yaml new file mode 100755 index 000000000..a15088c24 --- /dev/null +++ b/data-new/Implementation/Infrastructure Hardening/2/CheckingTheSourcesOfUsedLibraries.yaml @@ -0,0 +1,18 @@ +--- +risk: Application and system libraries can have implementation flaws or deployment + flaws. +measure: Each libraries source is checked to have a trusted source. +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 +usefulness: 3 +level: 2 +samm: SA1-A +samm2: o-environment-management|A|1 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- 14.2.1 +- 14.2.5 +id: CheckingTheSourcesOfUsedLibraries +... diff --git a/data-new/Implementation/Infrastructure Hardening/2/FilterOutgoingTraffic.yaml b/data-new/Implementation/Infrastructure Hardening/2/FilterOutgoingTraffic.yaml new file mode 100755 index 000000000..79000d7ff --- /dev/null +++ b/data-new/Implementation/Infrastructure Hardening/2/FilterOutgoingTraffic.yaml @@ -0,0 +1,20 @@ +--- +risk: A compromised infrastructure component might try to send out stolen data. +measure: Having a whitelist and explizitly allowing egress traffic provides the ability + to stop unauthorized data leackage. +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 +usefulness: 2 +level: 2 +dependsOn: [] +implementation: +- Open Policy Agent +- firewalls +samm2: o-environment-management|A|1 +iso27001-2017: +- virtual environments are not explicitly covered by ISO 27001 - too specific +- 13.1.3 +id: FilterOutgoingTraffic +... diff --git a/data-new/Implementation/Infrastructure Hardening/2/TheClusterIsHardened.yaml b/data-new/Implementation/Infrastructure Hardening/2/TheClusterIsHardened.yaml new file mode 100755 index 000000000..a10986197 --- /dev/null +++ b/data-new/Implementation/Infrastructure Hardening/2/TheClusterIsHardened.yaml @@ -0,0 +1,22 @@ +--- +risk: Using default configurations for a cluster environment leads to potential risks. +measure: Harden cluster environments according to best practices. Level 1 and partiually + level 2 from hardening practices like 'CIS Kubernetes Bench for Security' should + considered. +difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 2 +usefulness: 4 +level: 2 +implementation: +- CIS Kubernetes Bench for Security +- CIS Docker Bench for Security +- 'For example for Containers: Deny running containers as root, deny using advanced + privileges, deny mounting of the hole filesystem, ...' +samm2: o-environment-management|A|1 +iso27001-2017: +- system hardening is not explicitly covered by ISO 27001 - too specific +- 13.1.3 +id: TheClusterIsHardened +... diff --git a/data-new/Implementation/Infrastructure Hardening/2/UsageOfSecurityByDefaultForComponents.yaml b/data-new/Implementation/Infrastructure Hardening/2/UsageOfSecurityByDefaultForComponents.yaml new file mode 100755 index 000000000..6d328c630 --- /dev/null +++ b/data-new/Implementation/Infrastructure Hardening/2/UsageOfSecurityByDefaultForComponents.yaml @@ -0,0 +1,20 @@ +--- +risk: Components (images, libraries, applications) are not hardened. +measure: Hardening of components is important, specially for image on which other + teams base on. Hardening should be performed on the operation system and on the + services inside (e.g. Nginx or a Java-Application). +difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 1 +usefulness: 3 +level: 2 +implementation: 'For applications: Check default encoding, managing secrets, crypto, + authentication' +dependsOn: +- Defined build process +samm2: o-environment-management|A|1 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +id: UsageOfSecurityByDefaultForComponents +... diff --git a/data-new/Implementation/Infrastructure Hardening/2/VirtualEnvironmentsAreLimited.yaml b/data-new/Implementation/Infrastructure Hardening/2/VirtualEnvironmentsAreLimited.yaml new file mode 100755 index 000000000..6bd7946e2 --- /dev/null +++ b/data-new/Implementation/Infrastructure Hardening/2/VirtualEnvironmentsAreLimited.yaml @@ -0,0 +1,21 @@ +--- +risk: Denial of service (internally by an attacker or unintentionally by a bug) on + one service effects other services +measure: All virtual environments are using resource limits on hard disks, memory + and CPU +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 3 +usefulness: 3 +level: 2 +dependsOn: +- Applications are running in virtualized environments +samm2: o-environment-management|A|1 +iso27001-2017: +- virtual environments are not explicitly covered by ISO 27001 - too specific +- 12.1.3 +- 13.1.3 +- 17.2.1 +id: VirtualEnvironmentsAreLimited +... diff --git a/data-new/Implementation/Infrastructure Hardening/3/2Fa.yaml b/data-new/Implementation/Infrastructure Hardening/3/2Fa.yaml new file mode 100755 index 000000000..9b0b83e42 --- /dev/null +++ b/data-new/Implementation/Infrastructure Hardening/3/2Fa.yaml @@ -0,0 +1,19 @@ +--- +risk: One factor authentication is more vulnerable to brute force attacks and is considered + less secure. +measure: Two factor authentication for all privileged accounts on systems and applications +difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 3 +usefulness: 4 +level: 3 +implementation: Smartcard, YubiKey, SMS, TOTP +samm2: TODO +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- 9.1.1 +- 9.4.2 +- 14.2.5 +id: 2Fa +... diff --git a/data-new/Implementation/Infrastructure Hardening/3/ImmutableInfrastructure.yaml b/data-new/Implementation/Infrastructure Hardening/3/ImmutableInfrastructure.yaml new file mode 100755 index 000000000..cf891ada1 --- /dev/null +++ b/data-new/Implementation/Infrastructure Hardening/3/ImmutableInfrastructure.yaml @@ -0,0 +1,20 @@ +--- +risk: The availability of IT systems might be disturbed due to components failures +measure: Redundancies in the IT systems +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 +usefulness: 3 +level: 3 +dependsOn: +- Infrastructure as Code +- Usage of Semantic Versioning for components like + project images +implementation: Remove direct access to infrastructure +samm2: o-environment-management|A|1 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- 17.2.1 +id: ImmutableInfrastructure +... diff --git a/data-new/Implementation/Infrastructure Hardening/3/InfrastructureAsCode.yaml b/data-new/Implementation/Infrastructure Hardening/3/InfrastructureAsCode.yaml new file mode 100755 index 000000000..1db015fc4 --- /dev/null +++ b/data-new/Implementation/Infrastructure Hardening/3/InfrastructureAsCode.yaml @@ -0,0 +1,20 @@ +--- +risk: No tracking of changes in systems might lead to errors in the configuration. + In additions, it might lead to unauthorized changes. An examples is jenkins. +measure: Systems are setup by code. A full environment can be provisioned. In addition, + software like Jenkins 2 can be setup and configured in in code too. The code should + be stored in a version control system. +difficultyOfImplementation: + knowledge: 3 + time: 5 + resources: 4 +usefulness: 4 +level: 3 +implementation: GitOps, Ansible, Chef, Puppet, Jenkinsfile +samm2: o-environment-management|A|1 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- 12.1.1 +- 12.1.2 +id: InfrastructureAsCode +... diff --git a/data-new/Implementation/Infrastructure Hardening/3/RoleBasedAuthenticationAndAuthorization.yaml b/data-new/Implementation/Infrastructure Hardening/3/RoleBasedAuthenticationAndAuthorization.yaml new file mode 100755 index 000000000..210b4ee89 --- /dev/null +++ b/data-new/Implementation/Infrastructure Hardening/3/RoleBasedAuthenticationAndAuthorization.yaml @@ -0,0 +1,20 @@ +--- +risk: Everyone is able to get unauthorized access to information on systems or to + modify information unauthorized on systems. +measure: The usage of a (role based) access control helps to restrict system access + to authorized users. +difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 1 +usefulness: 3 +level: 3 +implementation: Directory Service, Plugins +dependsOn: +- Defined deployment process +- Defined build process +samm2: o-environment-management|A|1 +iso27001-2017: +- 9.4.1 +id: RoleBasedAuthenticationAndAuthorization +... diff --git a/data-new/Implementation/Infrastructure Hardening/3/Versioning.yaml b/data-new/Implementation/Infrastructure Hardening/3/Versioning.yaml new file mode 100755 index 000000000..bf00d47f6 --- /dev/null +++ b/data-new/Implementation/Infrastructure Hardening/3/Versioning.yaml @@ -0,0 +1,20 @@ +--- +risk: Changes to production systems can not be undone. +measure: versioning of artifacts related to production environments. For example Jenkins + configuration, docker images, system provisioning code. +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 +usefulness: 5 +level: 3 +dependsOn: +- Defined deployment process +samm2: o-environment-management|A|1 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- 12.1.1 +- 12.1.2 +- 14.2.2 +id: Versioning +... diff --git a/data-new/Implementation/Infrastructure Hardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml b/data-new/Implementation/Infrastructure Hardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml new file mode 100755 index 000000000..8dc68f24f --- /dev/null +++ b/data-new/Implementation/Infrastructure Hardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml @@ -0,0 +1,17 @@ +--- +risk: System calls in virtual environments like docker can lead to privilege escalation. +measure: System calls in virtual environments like docker are audited and limited. +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 +usefulness: 5 +level: 4 +dependsOn: +- Applications are running in virtualized environments +implementation: seccomp, strace +samm2: o-environment-management|A|1 +iso27001-2017: +- system hardenong is not explicitly covered by ISO 27001 - too specific +id: LimitationOfSystemCallsInVirtualEnvironments +... diff --git a/data-new/Implementation/Infrastructure Hardening/4/Microservice-Architecture.yaml b/data-new/Implementation/Infrastructure Hardening/4/Microservice-Architecture.yaml new file mode 100755 index 000000000..eb48cbc5c --- /dev/null +++ b/data-new/Implementation/Infrastructure Hardening/4/Microservice-Architecture.yaml @@ -0,0 +1,16 @@ +--- +risk: Monolithic applications are hard to test. +measure: A microservice-architecture helps to have small components, which are more + easy to test. +difficultyOfImplementation: + knowledge: 4 + time: 5 + resources: 5 +usefulness: 3 +level: 4 +samm: SA2 +samm2: o-environment-management|A|1 +iso27001-2017: +- not explicitly covered by ISO 27001 +id: Microservice-Architecture +... diff --git a/data-new/Implementation/Infrastructure Hardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml b/data-new/Implementation/Infrastructure Hardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml new file mode 100755 index 000000000..33a86bc71 --- /dev/null +++ b/data-new/Implementation/Infrastructure Hardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml @@ -0,0 +1,23 @@ +--- +risk: In case an errors occurs in production, the developer need to be able to create + a production near environment on a local development environment. +measure: Usage of infrastructure as code helps to create a production near environment. + The developer needs to be trained in order to setup a local development environment. + In addition, it should be possible to create production like test data. Often personal + identifiable information is anonymized in order to comply with data protection laws. +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 +usefulness: 4 +level: 4 +dependsOn: +- Defined deployment process +- Infrastructure as Code +samm: SA1 +samm2: o-environment-management|A|1 +iso27001-2017: +- 12.1.4 +- 17.2.1 +id: ProductionNearEnvironmentsAreUsedByDevelopers +... diff --git a/data-new/Implementation/Infrastructure Hardening/4/UsageOfAChaosMonkey.yaml b/data-new/Implementation/Infrastructure Hardening/4/UsageOfAChaosMonkey.yaml new file mode 100755 index 000000000..9cc978259 --- /dev/null +++ b/data-new/Implementation/Infrastructure Hardening/4/UsageOfAChaosMonkey.yaml @@ -0,0 +1,18 @@ +--- +risk: Due to manuel changes on a system, they are not replaceable anymore. In case + of a crash it might happen that a planned redundant system is unavailable. In addition, + it is hard to replay manual changes. +measure: A randomized periodically shutdown of systems makes sure, that nobody will + perform manual changes to a system. +difficultyOfImplementation: + knowledge: 3 + time: 5 + resources: 5 +usefulness: 3 +level: 4 +samm2: o-environment-management|A|1 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- 17.1.3 +id: UsageOfAChaosMonkey +... diff --git a/data-new/Information Gathering/Logging/1/CentralizedSystemLogging.yaml b/data-new/Information Gathering/Logging/1/CentralizedSystemLogging.yaml new file mode 100755 index 000000000..72a43f835 --- /dev/null +++ b/data-new/Information Gathering/Logging/1/CentralizedSystemLogging.yaml @@ -0,0 +1,18 @@ +--- +risk: Local stored system logs can be unauthorized manipulated by attackers or might + be corrupt after an incident. In addition, it is hard to perform a aggregation of + logs. +measure: By using centralized logging logs are protected against unauthorized modification. +difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 +usefulness: 2 +level: 1 +implementation: rsyslog, Logstash +samm2: o-incident-management|A|1 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- 12.4.1 +id: CentralizedSystemLogging +... diff --git a/data-new/Information Gathering/Logging/1/LoggingOfSecurityEvents.yaml b/data-new/Information Gathering/Logging/1/LoggingOfSecurityEvents.yaml new file mode 100755 index 000000000..f17599617 --- /dev/null +++ b/data-new/Information Gathering/Logging/1/LoggingOfSecurityEvents.yaml @@ -0,0 +1,18 @@ +--- +risk: No track of security-relevant events makes it harder to analyse an incident. +measure: Security-relevant events like login/logout or creation, change, deletion + of users should be logged. +difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 +usefulness: 4 +level: 1 +dependsOn: +- PII logging concept +implementation: rsyslog, logstash, fluentd, bash +samm2: o-incident-management|A|1 +iso27001-2017: +- 12.4.1 +id: LoggingOfSecurityEvents +... diff --git a/data-new/Information Gathering/Logging/1/PiiLoggingConcept.yaml b/data-new/Information Gathering/Logging/1/PiiLoggingConcept.yaml new file mode 100755 index 000000000..df834382f --- /dev/null +++ b/data-new/Information Gathering/Logging/1/PiiLoggingConcept.yaml @@ -0,0 +1,18 @@ +--- +risk: Personal identifiable information (PII) is logged and the law of GDPR is not + followed. +measure: A concept how to log PII is documented and applied. +difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 +usefulness: 1 +level: 1 +implementation: rsyslog, logstash, fluentd, bash +samm2: o-incident-management|A|1 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- 12.4.1 +- 18.1.1 +id: PiiLoggingConcept +... diff --git a/data-new/Information Gathering/Logging/2/VisualizedLogging.yaml b/data-new/Information Gathering/Logging/2/VisualizedLogging.yaml new file mode 100755 index 000000000..0d3ba4d5f --- /dev/null +++ b/data-new/Information Gathering/Logging/2/VisualizedLogging.yaml @@ -0,0 +1,22 @@ +--- +risk: System and application protocols are not visualized properly which leads to + no or very limited logging assessment. Specially developers might have difficulty + to read applications logs with unusually tools like the Linux tool 'cat' +measure: Protocols are visualized in a simple to use real time monitoring system. + The GUI gives the ability to search for special attributes in the protocol. +difficultyOfImplementation: + knowledge: 1 + time: 3 + resources: 3 +usefulness: 4 +level: 2 +dependsOn: +- Centralized system logging +- Centralized application logging +implementation: ELK-Stack +samm2: o-incident-management|A|1 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- 12.4.1 +id: VisualizedLogging +... diff --git a/data-new/Information Gathering/Logging/3/CentralizedApplicationLogging.yaml b/data-new/Information Gathering/Logging/3/CentralizedApplicationLogging.yaml new file mode 100755 index 000000000..276fd3cae --- /dev/null +++ b/data-new/Information Gathering/Logging/3/CentralizedApplicationLogging.yaml @@ -0,0 +1,22 @@ +--- +risk: Local stored logs can be unauthorized manipulated by attackers with system access + or might be corrupt after an incident. In addition, it is hard to perform an correlation + of logs. This leads attacks, which can be performed silently. +measure: A centralized logging system is used and applications logs (including application + exceptions) are shipped to it. +difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 +usefulness: 5 +level: 3 +dependsOn: +- Visualized logging +- Alerting +samm: SA2-B +samm2: o-incident-management|A|1 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- 12.4.1 +id: CentralizedApplicationLogging +... diff --git a/data-new/Information Gathering/Logging/4/CorrelationOfSecurityEvents.yaml b/data-new/Information Gathering/Logging/4/CorrelationOfSecurityEvents.yaml new file mode 100755 index 000000000..9bae7e283 --- /dev/null +++ b/data-new/Information Gathering/Logging/4/CorrelationOfSecurityEvents.yaml @@ -0,0 +1,20 @@ +--- +risk: Detection of security related events with hints on different systems/tools/metrics + is not possible. +measure: Events are correlated on one system. For example the correlation and visualisation + of failed login attempts combined with successful login attempts. +difficultyOfImplementation: + knowledge: 4 + time: 4 + resources: 4 +usefulness: 3 +level: 4 +dependsOn: +- Visualized logging +- Alerting +samm2: o-incident-management|A|2 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- 12.4.1 +id: CorrelationOfSecurityEvents +... diff --git a/data-new/Information Gathering/Monitoring/1/SimpleApplicationMetrics.yaml b/data-new/Information Gathering/Monitoring/1/SimpleApplicationMetrics.yaml new file mode 100755 index 000000000..4a4e282bb --- /dev/null +++ b/data-new/Information Gathering/Monitoring/1/SimpleApplicationMetrics.yaml @@ -0,0 +1,16 @@ +--- +risk: Attacks on an application are not recognized. +measure: Gathering of application metrics helps to identify incidents like brute force + attacks, login/logout. +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 +usefulness: 5 +level: 1 +implementation: Prometheus +samm2: o-incident-management|A|1 +iso27001-2017: +- 12.4.1 +id: SimpleApplicationMetrics +... diff --git a/data-new/Information Gathering/Monitoring/1/SimpleSystemMetrics.yaml b/data-new/Information Gathering/Monitoring/1/SimpleSystemMetrics.yaml new file mode 100755 index 000000000..aa5762912 --- /dev/null +++ b/data-new/Information Gathering/Monitoring/1/SimpleSystemMetrics.yaml @@ -0,0 +1,18 @@ +--- +risk: Without simple metrics analysis of incidents are hard. In case an application + uses a lot of CPU from time to time, it is hard for a developer to find out the + source with linux commands. +measure: Gathering of system metrics helps to identify incidents and specially bottlenecks + like in CPU usage, memory usage and hard disk usage. +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 +usefulness: 5 +level: 1 +implementation: collectd +samm2: o-incident-management|A|1 +iso27001-2017: +- 12.1.3 +id: SimpleSystemMetrics +... diff --git a/data-new/Information Gathering/Monitoring/2/Alerting.yaml b/data-new/Information Gathering/Monitoring/2/Alerting.yaml new file mode 100755 index 000000000..57242e799 --- /dev/null +++ b/data-new/Information Gathering/Monitoring/2/Alerting.yaml @@ -0,0 +1,20 @@ +--- +risk: Incidents are discovered after they happend. +measure: | + Thresholds for metrics are set. In case the thresholds are reached, alarms are send out. Which should get attention due to the critically. +difficultyOfImplementation: + knowledge: 2 + time: 5 + resources: 5 +usefulness: 5 +level: 2 +dependsOn: +- Visualized metrics +samm2: o-operational-management|B|3 +samm: OE1-B +iso27001-2017: +- 16.1.2 +- 16.1.4 +- 12.1.4 +id: Alerting +... diff --git a/data-new/Information Gathering/Monitoring/2/VisualizedMetrics.yaml b/data-new/Information Gathering/Monitoring/2/VisualizedMetrics.yaml new file mode 100755 index 000000000..c78acfacd --- /dev/null +++ b/data-new/Information Gathering/Monitoring/2/VisualizedMetrics.yaml @@ -0,0 +1,17 @@ +--- +risk: Not visualized metrics lead to restricted usage of metrics. +measure: Metrics are visualized in real time in a user friendly way. +difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 2 +usefulness: 3 +level: 2 +dependsOn: +- Simple application metrics +- Simple system metrics +samm2: o-incident-management|A|2 +iso27001-2017: +- 12.1.3 +id: VisualizedMetrics +... diff --git a/data-new/Information Gathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml b/data-new/Information Gathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml new file mode 100755 index 000000000..308598de7 --- /dev/null +++ b/data-new/Information Gathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml @@ -0,0 +1,18 @@ +--- +risk: Trends and advanced attacks are not detected. +measure: Advanced metrics are gathered in relation to availability and stability. + For example unplanned downtime's per year. +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 +usefulness: 4 +level: 3 +dependsOn: +- Simple application metrics +- Visualized metrics +samm2: o-incident-management|A|2 +iso27001-2017: +- 12.1.3 +id: AdvancedAvailablityAndStabilityMetrics +... diff --git a/data-new/Information Gathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml b/data-new/Information Gathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml new file mode 100755 index 000000000..ced25a5d2 --- /dev/null +++ b/data-new/Information Gathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml @@ -0,0 +1,18 @@ +--- +risk: People are not looking into tests results. Vulnerabilities not recolonized, + even they are detected by tools. +measure: All defects from the dimension Test- and Verification are instrumented. +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 +usefulness: 4 +level: 3 +dependsOn: +- Simple application metrics +- Visualized metrics +samm2: o-incident-management|A|2 +iso27001-2017: +- 12.6.1 +id: AdvancedWebapplicationMetrics +... diff --git a/data-new/Information Gathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml b/data-new/Information Gathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml new file mode 100755 index 000000000..682e9fe5f --- /dev/null +++ b/data-new/Information Gathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml @@ -0,0 +1,17 @@ +--- +risk: High resources are used while gathering unused metrics. +measure: Deactivation of unused metrics helps to free resources. +difficultyOfImplementation: + knowledge: 2 + time: 5 + resources: 5 +usefulness: 5 +level: 3 +dependsOn: +- Visualized metrics +samm2: o-incident-management|A|1 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- 12.1.3 +id: DeactivationOfUnusedMetrics +... diff --git a/data-new/Information Gathering/Monitoring/3/GroupingOfMetrics.yaml b/data-new/Information Gathering/Monitoring/3/GroupingOfMetrics.yaml new file mode 100755 index 000000000..39f84fcad --- /dev/null +++ b/data-new/Information Gathering/Monitoring/3/GroupingOfMetrics.yaml @@ -0,0 +1,15 @@ +--- +risk: The analysis of metrics takes long. +measure: Meaningful grouping of metrics helps to speed up analysis. +difficultyOfImplementation: + knowledge: 2 + time: 4 + resources: 2 +usefulness: 2 +level: 3 +samm2: o-incident-management|A|2 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- 12.1.3 +id: GroupingOfMetrics +... diff --git a/data-new/Information Gathering/Monitoring/3/TargetedAlerting.yaml b/data-new/Information Gathering/Monitoring/3/TargetedAlerting.yaml new file mode 100755 index 000000000..890ece8b4 --- /dev/null +++ b/data-new/Information Gathering/Monitoring/3/TargetedAlerting.yaml @@ -0,0 +1,20 @@ +--- +risk: People are bored (ignorant) of incident alarm messages, as they are not responsible + to react. +measure: By the definition of target groups for incidents people are only getting + alarms for incidents they are in charge for. +difficultyOfImplementation: + knowledge: 2 + time: 5 + resources: 5 +usefulness: 5 +level: 3 +dependsOn: +- Alerting +samm: OE1-B +samm2: o-operational-management|B|3 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- 16.1.5 +id: TargetedAlerting +... diff --git a/data-new/Information Gathering/Monitoring/4/CoverageAndControlMetrics.yaml b/data-new/Information Gathering/Monitoring/4/CoverageAndControlMetrics.yaml new file mode 100755 index 000000000..d897a877c --- /dev/null +++ b/data-new/Information Gathering/Monitoring/4/CoverageAndControlMetrics.yaml @@ -0,0 +1,22 @@ +--- +risk: The effectiveness of configuration, patch and vulnerability management is unknown. +measure: "Usage of Coverage- and control-metrics to show the effectiveness of the + security program. Coverage is the degree in \n which a specific security + control for a specific target group is applied with all resources.\n The + control degree shows the actual application of security standards and security-guidelines. + Examples are gathering information on anti-virus, anti-rootkits, patch management, + server configuration and vulnerability management." +difficultyOfImplementation: + knowledge: 3 + time: 5 + resources: 2 +usefulness: 4 +level: 4 +dependsOn: +- Visualized metrics +implementation: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf +samm2: o-incident-management|A|2 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +id: CoverageAndControlMetrics +... diff --git a/data-new/Information Gathering/Monitoring/4/DefenceMetrics.yaml b/data-new/Information Gathering/Monitoring/4/DefenceMetrics.yaml new file mode 100755 index 000000000..283fe6ef6 --- /dev/null +++ b/data-new/Information Gathering/Monitoring/4/DefenceMetrics.yaml @@ -0,0 +1,21 @@ +--- +risk: IDS/IPS systems like packet- or application-firewalls detect and prevent attacks. + It is not known how many attacks has been detected and blocked. +measure: | + Gathering of defence metrics like TCP/UDP sources enables to assume the geographic location of the request. + Assuming a Kubernetes cluster with an egress-traffic filter (e.g. IP/domain based), an alert might be send out in case of every violation. For ingress-traffic, alerting might not even be considered. +difficultyOfImplementation: + knowledge: 3 + time: 5 + resources: 2 +usefulness: 4 +level: 4 +dependsOn: +- Visualized metrics +- Filter outcoing traffic +samm2: o-incident-management|A|2 +iso27001-2017: +- 12.4.1 +- 13.1.1 +id: DefenceMetrics +... diff --git a/data-new/Information Gathering/Monitoring/4/MetricsAreCombinedWithTests.yaml b/data-new/Information Gathering/Monitoring/4/MetricsAreCombinedWithTests.yaml new file mode 100755 index 000000000..7c685553f --- /dev/null +++ b/data-new/Information Gathering/Monitoring/4/MetricsAreCombinedWithTests.yaml @@ -0,0 +1,16 @@ +--- +risk: Changes might cause high load due to programming errors. +measure: Metrics during tests helps to identify programming errors. +difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 2 +usefulness: 5 +level: 4 +dependsOn: +- Grouping of metrics +samm2: o-incident-management|A|2 +iso27001-2017: +- not explicitly covered by ISO 27001 +id: MetricsAreCombinedWithTests +... diff --git a/data-new/Information Gathering/Monitoring/4/ScreensWithMetricVisualization.yaml b/data-new/Information Gathering/Monitoring/4/ScreensWithMetricVisualization.yaml new file mode 100755 index 000000000..90ca5046d --- /dev/null +++ b/data-new/Information Gathering/Monitoring/4/ScreensWithMetricVisualization.yaml @@ -0,0 +1,18 @@ +--- +risk: Security related information is discovered too late during an incident. +measure: By having an internal accessible screen with a security related dashboards + helps to visualize incidents. +difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 +usefulness: 5 +level: 4 +dependsOn: +- Grouping of metrics +samm2: o-incident-management|A|2 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- 16.1.5 +id: ScreensWithMetricVisualization +... diff --git a/data-new/Test and Verification/Application tests/2/SecurityUnitTestsForImportantComponents.yaml b/data-new/Test and Verification/Application tests/2/SecurityUnitTestsForImportantComponents.yaml new file mode 100755 index 000000000..b982e0464 --- /dev/null +++ b/data-new/Test and Verification/Application tests/2/SecurityUnitTestsForImportantComponents.yaml @@ -0,0 +1,22 @@ +--- +risk: Vulnerabilities are rising due to code changes. +measure: Usage of unit tests to test important security related features like authentication + and authorization. +difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 2 +usefulness: 3 +level: 2 +comment: The integration of module tests takes place during development instead, it + highlights vulnerabilities in sub-routines, functions, modules, libraries etc. checked. +implementation: +- JUnit +- Karma +samm: ST2-B +samm2: v-security-testing|B|3 +iso27001-2017: +- 14.2.3 +- 14.2.8 +id: SecurityUnitTestsForImportantComponents +... diff --git a/data-new/Test and Verification/Application tests/3/SecurityIntegrationTestsForImportantComponents.yaml b/data-new/Test and Verification/Application tests/3/SecurityIntegrationTestsForImportantComponents.yaml new file mode 100755 index 000000000..aac136b49 --- /dev/null +++ b/data-new/Test and Verification/Application tests/3/SecurityIntegrationTestsForImportantComponents.yaml @@ -0,0 +1,18 @@ +--- +risk: Vulnerabilities are rising due to code changes in a complex microservice environment. +measure: Implementation of essential security related integration tests. For example + for authentication and authorization. +difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 2 +usefulness: 2 +level: 3 +implementation: HttpUnit +samm: ST2-B +samm2: v-security-testing|B|3 +iso27001-2017: +- 14.2.3 +- 14.2.8 +id: SecurityIntegrationTestsForImportantComponents +... diff --git a/data-new/Test and Verification/Application tests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml b/data-new/Test and Verification/Application tests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml new file mode 100755 index 000000000..6036ce5e1 --- /dev/null +++ b/data-new/Test and Verification/Application tests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml @@ -0,0 +1,18 @@ +--- +risk: Vulnerabilities are rising due to code changes in a complex microservice environment + in not important components. +measure: Implementation of security related tests via unit tests and integration tests. + Including the test of libraries, in case the are not tested already. +difficultyOfImplementation: + knowledge: 5 + time: 5 + resources: 3 +usefulness: 3 +level: 4 +samm: ST2-B +samm2: v-security-testing|B|3 +iso27001-2017: +- 14.2.3 +- 14.2.8 +id: HighCoverageOfSecurityRelatedModuleAndIntegrationTests +... diff --git a/data-new/Test and Verification/Application tests/4/SmokeTest.yaml b/data-new/Test and Verification/Application tests/4/SmokeTest.yaml new file mode 100755 index 000000000..f007ecda6 --- /dev/null +++ b/data-new/Test and Verification/Application tests/4/SmokeTest.yaml @@ -0,0 +1,21 @@ +--- +risk: During a deployment an error might happen which leads to non-availability of + the system, a part of the system or a feature. +measure: Integration tests are performed against the production environment after + each deployment. +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 +usefulness: 2 +level: 4 +implementation: "" +dependsOn: +- Defined deployment process +samm: ST2-B +samm2: v-security-testing|B|3 +iso27001-2017: +- 14.2.3 +- 14.2.8 +id: SmokeTest +... diff --git a/data-new/Test and Verification/Consolidation/1/DefinitionOfQualityGates.yaml b/data-new/Test and Verification/Consolidation/1/DefinitionOfQualityGates.yaml new file mode 100755 index 000000000..2385eeec6 --- /dev/null +++ b/data-new/Test and Verification/Consolidation/1/DefinitionOfQualityGates.yaml @@ -0,0 +1,20 @@ +--- +risk: Improper examination of vulnerabilities leads to no visibility at all. +measure: Quality gates for found vulnerabilities are defined. In the start it is important + to not overload the security analyst, therefore the recommendation is to start with + alerting of high cirital vulnerabilities. +difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 +usefulness: 4 +level: 1 +samm: IR2-A +samm2: i-defect-management|A|2 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- 12.6.1 +- 16.1.4 +implementation: See other actions, e.g. "Treatment of defects with severity high". +id: DefinitionOfQualityGates +... diff --git a/data-new/Test and Verification/Consolidation/1/SimpleFalsePositiveTreatment.yaml b/data-new/Test and Verification/Consolidation/1/SimpleFalsePositiveTreatment.yaml new file mode 100755 index 000000000..c0febd8e4 --- /dev/null +++ b/data-new/Test and Verification/Consolidation/1/SimpleFalsePositiveTreatment.yaml @@ -0,0 +1,21 @@ +--- +risk: As false positive occure during each test, all vulnerabilities might be ignored. +measure: False positives are suppressed so they will not show up on the next tests + again. Most security tools have the possibility to suppress false positives. A Vulnerability + Management System might be used. +difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 +usefulness: 4 +level: 1 +implementation: +- OWASP Defect Dojo +- Purify +samm: IR2-A +samm2: i-defect-management|A|2 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- 16.1.6 +id: SimpleFalsePositiveTreatment +... diff --git a/data-new/Test and Verification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml b/data-new/Test and Verification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml new file mode 100755 index 000000000..a7bee3cda --- /dev/null +++ b/data-new/Test and Verification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml @@ -0,0 +1,16 @@ +--- +risk: Vulnerabilities with severity high or higher are not visible. +measure: Vulnerabilities with severity high or higher are added to the quality gate. +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 +usefulness: 4 +level: 1 +comment: False positive analysis, specially for static analysis, is time consuming. +samm2: i-defect-management|B|2 +iso27001-2017: +- 16.1.4 +- 12.6.1 +id: TreatmentOfDefectsWithSeverityHighOrHigher +... diff --git a/data-new/Test and Verification/Consolidation/2/SimpleVisualizationOfDefects.yaml b/data-new/Test and Verification/Consolidation/2/SimpleVisualizationOfDefects.yaml new file mode 100755 index 000000000..84f5bc84c --- /dev/null +++ b/data-new/Test and Verification/Consolidation/2/SimpleVisualizationOfDefects.yaml @@ -0,0 +1,23 @@ +--- +risk: The security level of a component is not visible. Therefore, the motivation + to enhance the security is not give. +measure: Vulnerabilities are simple visualized. +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 +usefulness: 3 +level: 2 +implementation: +- OWASP Dependency Check Jenkins Plugin +- LogParser Jenkins Plugins +- OWASP Defect Dojo +- Purify +samm2: i-defect-management|B|1 +iso27001-2017: +- 16.1.4 +- 8.2.1 +- 8.2.2 +- 8.2.3 +id: SimpleVisualizationOfDefects +... diff --git a/data-new/Test and Verification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml b/data-new/Test and Verification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml new file mode 100755 index 000000000..97bda3e19 --- /dev/null +++ b/data-new/Test and Verification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml @@ -0,0 +1,23 @@ +--- +risk: To read console output of the build server to search for vulnerabilities might + be difficult. Also, to check a vulnerability management system might not be a daily + task for a developer. +measure: Vulnerabilities are tracked in the teams issue system (e.g. jira). +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 +usefulness: 2 +level: 3 +implementation: 'At SAST (Static Application Security Testing): Server-side / client-side + teams can easily be recorded. With microservice architecture, individual microservices + can be used usually Teams. At DAST (Dynamic Application Security Testing): vulnerabilities + are classified and can be assigned to server-side and client-side teams.' +samm2: i-defect-management|B|2 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- 16.1.4 +- 16.1.5 +- 16.1.6 +id: IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess +... diff --git a/data-new/Test and Verification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml b/data-new/Test and Verification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml new file mode 100755 index 000000000..5fc960135 --- /dev/null +++ b/data-new/Test and Verification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml @@ -0,0 +1,16 @@ +--- +risk: Vulnerabilities with severity middle are not visible. +measure: Vulnerabilities with severity middle are added to the quality gate. +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 +usefulness: 3 +level: 3 +comment: False positive analysis, specially for static analysis, is time consuming. +samm2: i-defect-management|B|2 +iso27001-2017: +- 16.1.4 +- 12.6.1 +id: TreatmentOfDefectsWithSeverityMiddle +... diff --git a/data-new/Test and Verification/Consolidation/4/AdvancedVisualizationOfDefects.yaml b/data-new/Test and Verification/Consolidation/4/AdvancedVisualizationOfDefects.yaml new file mode 100755 index 000000000..e0fb1f2b2 --- /dev/null +++ b/data-new/Test and Verification/Consolidation/4/AdvancedVisualizationOfDefects.yaml @@ -0,0 +1,21 @@ +--- +risk: Correlation of the vulnerabilities of different tools to have an overview of + the the overall security level per component/project/team is not given. +measure: Findings are visualized per component/project/team. +difficultyOfImplementation: + knowledge: 2 + time: 4 + resources: 1 +usefulness: 2 +level: 4 +implementation: +- OWASP Defect Dojo +- Purify +samm2: defect-management|B|1 +iso27001-2017: +- 16.1.4 +- 8.2.1 +- 8.2.2 +- 8.2.3 +id: AdvancedVisualizationOfDefects +... diff --git a/data-new/Test and Verification/Consolidation/4/ReproducibleDefectTickets.yaml b/data-new/Test and Verification/Consolidation/4/ReproducibleDefectTickets.yaml new file mode 100755 index 000000000..162995aac --- /dev/null +++ b/data-new/Test and Verification/Consolidation/4/ReproducibleDefectTickets.yaml @@ -0,0 +1,21 @@ +--- +risk: Vulnerability descriptions are hard to understand by staff from operations and + development. +measure: Vulnerabilities include the test procedure to give the staff from operations + and development the ability to reproduce vulnerabilities. This enhances the understanding + of vulnerabilities and therefore the fix have a higher quality. +difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 2 +usefulness: 2 +level: 4 +implementation: Mozilla Zest +samm2: i-defect-management|B|2 +iso27001-2017: +- 16.1.4 +- 8.2.1 +- 8.2.2 +- 8.2.3 +id: ReproducibleDefectTickets +... diff --git a/data-new/Test and Verification/Consolidation/4/TreatmentOfAllDefects.yaml b/data-new/Test and Verification/Consolidation/4/TreatmentOfAllDefects.yaml new file mode 100755 index 000000000..2c36c7625 --- /dev/null +++ b/data-new/Test and Verification/Consolidation/4/TreatmentOfAllDefects.yaml @@ -0,0 +1,15 @@ +--- +risk: Vulnerabilities with severity low are not visible. +measure: All vulnerabilities are added to the quality gate. +difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 1 +usefulness: 2 +level: 4 +samm2: i-defect-management|B|2 +iso27001-2017: +- 16.1.4 +- 12.6.1 +id: TreatmentOfAllDefects +... diff --git a/data-new/Test and Verification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml b/data-new/Test and Verification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml new file mode 100755 index 000000000..199106878 --- /dev/null +++ b/data-new/Test and Verification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml @@ -0,0 +1,23 @@ +--- +risk: Maintenance of false positives in each tool enforces a high workload. In addition + a correlation of the same finding from different tools is not possible. +measure: Aggregation of vulnerabilities in one tool reduce the workload to mark false + positives. +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 +usefulness: 2 +level: 4 +implementation: +- OWASP Defect Dojo +- Purify +samm2: i-defect-management|B|1 +iso27001-2017: +- 12.6.1 +- 16.1.3 +- 16.1.4 +- 16.1.5 +- 16.1.6 +id: UsageOfAVulnerabilityManagementSystem +... diff --git a/data-new/Test and Verification/Dynamic depth for applications/1/SimpleScan.yaml b/data-new/Test and Verification/Dynamic depth for applications/1/SimpleScan.yaml new file mode 100755 index 000000000..34f29432f --- /dev/null +++ b/data-new/Test and Verification/Dynamic depth for applications/1/SimpleScan.yaml @@ -0,0 +1,24 @@ +--- +risk: Deficient security tests are performed. Simple vulnerabilities are not detected + and missing security configurations (e.g. headers) are not set. Fast feedback is + not given. +measure: A simple scan is performed to get a security baseline. In case the test is + done in under 10 minutes, it should be part of the build and deployment process. +difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 1 +usefulness: 2 +level: 1 +dependsOn: +- Defined build process +samm: ST2 +implementation: +- OWASP Zap +- Arachni +samm2: v-security-testing|A|1 +iso27001-2017: +- 14.2.3 +- 14.2.8 +id: SimpleScan +... diff --git a/data-new/Test and Verification/Dynamic depth for applications/2/CoverageOfClientSideDynamicComponents.yaml b/data-new/Test and Verification/Dynamic depth for applications/2/CoverageOfClientSideDynamicComponents.yaml new file mode 100755 index 000000000..2c522ae0f --- /dev/null +++ b/data-new/Test and Verification/Dynamic depth for applications/2/CoverageOfClientSideDynamicComponents.yaml @@ -0,0 +1,21 @@ +--- +risk: Parts of the service are not covered during the scan, because JavaScript is + not getting executed. Therefore, the co +measure: Usage of a spider which executes dynamic content like JavaScript, e.g. via + Selenium. +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 +usefulness: 4 +level: 2 +dependsOn: +- Usage of different roles +samm: ST-2 +samm2: v-security-testing|A|2 +iso27001-2017: +- 14.2.3 +- 14.2.8 +implementation: Ajax Spider +id: CoverageOfClientSideDynamicComponents +... diff --git a/data-new/Test and Verification/Dynamic depth for applications/2/UsageOfDifferentRoles.yaml b/data-new/Test and Verification/Dynamic depth for applications/2/UsageOfDifferentRoles.yaml new file mode 100755 index 000000000..a696db0be --- /dev/null +++ b/data-new/Test and Verification/Dynamic depth for applications/2/UsageOfDifferentRoles.yaml @@ -0,0 +1,19 @@ +--- +risk: Parts of the service are not covered during the scan, because a login is not + performed. +measure: Integration of authentication with all roles used in the service. +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 +usefulness: 2 +level: 2 +dependsOn: +- Simple Scan +samm2: v-security-testing|A|2 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- 14.2.3 +- 14.2.8 +id: UsageOfDifferentRoles +... diff --git a/data-new/Test and Verification/Dynamic depth for applications/3/CoverageOfHiddenEndpoints.yaml b/data-new/Test and Verification/Dynamic depth for applications/3/CoverageOfHiddenEndpoints.yaml new file mode 100755 index 000000000..14a67e116 --- /dev/null +++ b/data-new/Test and Verification/Dynamic depth for applications/3/CoverageOfHiddenEndpoints.yaml @@ -0,0 +1,17 @@ +--- +risk: Hidden endpoints of the service are not getting tracked. +measure: Hidden endpoints are getting detected and included in the vulnerability scan. +difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 1 +usefulness: 5 +level: 3 +implementation: cURL, OpenAPI +dependsOn: +- Usage of different roles +samm2: v-security-testing|A|2 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +id: CoverageOfHiddenEndpoints +... diff --git a/data-new/Test and Verification/Dynamic depth for applications/3/CoverageOfMoreInputVectors.yaml b/data-new/Test and Verification/Dynamic depth for applications/3/CoverageOfMoreInputVectors.yaml new file mode 100755 index 000000000..65ee4bc46 --- /dev/null +++ b/data-new/Test and Verification/Dynamic depth for applications/3/CoverageOfMoreInputVectors.yaml @@ -0,0 +1,19 @@ +--- +risk: Parts of the service are not covered. For example specially formatted or coded + parameters are not getting detected as parameter (e.g. parameters in REST-like URLs, + parameters in JSON-Format or base64-coded parameters). +measure: Special parameter and special encodings are defined, so that they get fuzzed + by the used vulnerability scanners. +difficultyOfImplementation: + knowledge: 5 + time: 5 + resources: 1 +usefulness: 4 +level: 3 +dependsOn: +- Usage of different roles +samm2: v-security-testing|A|2 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +id: CoverageOfMoreInputVectors +... diff --git a/data-new/Test and Verification/Dynamic depth for applications/3/CoverageOfSequentialOperations.yaml b/data-new/Test and Verification/Dynamic depth for applications/3/CoverageOfSequentialOperations.yaml new file mode 100755 index 000000000..c938b4d3b --- /dev/null +++ b/data-new/Test and Verification/Dynamic depth for applications/3/CoverageOfSequentialOperations.yaml @@ -0,0 +1,19 @@ +--- +risk: Sequential operations like workflows (e.g. login -> put products in the basket +measure: Sequential operations are defined and checked by the vulnerability scanner + in the defined order. +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 +usefulness: 5 +level: 3 +implementation: cURL +dependsOn: +- Usage of different roles +samm2: v-security-testing|A|2 +iso27001-2017: +- 14.2.8 +- 14.2.3 +id: CoverageOfSequentialOperations +... diff --git a/data-new/Test and Verification/Dynamic depth for applications/3/UsageOfMultipleScanners.yaml b/data-new/Test and Verification/Dynamic depth for applications/3/UsageOfMultipleScanners.yaml new file mode 100755 index 000000000..34459f5bd --- /dev/null +++ b/data-new/Test and Verification/Dynamic depth for applications/3/UsageOfMultipleScanners.yaml @@ -0,0 +1,19 @@ +--- +risk: Each vulnerability scanner has different opportunities. By using just one scanner, + some vulnerabilities might not be found. +measure: Usage of multiple spiders and scanner enhance the coverage and the vulnerabilities. +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 +usefulness: 1 +level: 3 +dependsOn: +- Usage of different roles +implementation: SecureCodeBox +samm2: v-security-testing|A|2 +iso27001-2017: +- 12.6.1 +- 14.2.5 +id: UsageOfMultipleScanners +... diff --git a/data-new/Test and Verification/Dynamic depth for applications/4/CoverageAnalysis.yaml b/data-new/Test and Verification/Dynamic depth for applications/4/CoverageAnalysis.yaml new file mode 100755 index 000000000..544f5d111 --- /dev/null +++ b/data-new/Test and Verification/Dynamic depth for applications/4/CoverageAnalysis.yaml @@ -0,0 +1,16 @@ +--- +risk: Parts of the service are not still covered. +measure: Check that there are no missing paths in the application with coverage-tools. +difficultyOfImplementation: + knowledge: 4 + time: 5 + resources: 3 +usefulness: 4 +level: 4 +implementation: OWASP Code Pulse +samm2: v-security-testing|A|2 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- part of periodic review, PDCA +id: CoverageAnalysis +... diff --git a/data-new/Test and Verification/Dynamic depth for applications/4/CoverageOfServiceToServiceCommunication.yaml b/data-new/Test and Verification/Dynamic depth for applications/4/CoverageOfServiceToServiceCommunication.yaml new file mode 100755 index 000000000..80ff595e5 --- /dev/null +++ b/data-new/Test and Verification/Dynamic depth for applications/4/CoverageOfServiceToServiceCommunication.yaml @@ -0,0 +1,17 @@ +--- +risk: Service to service communication is not covered. +measure: Service to service communication is dumped and checked. +difficultyOfImplementation: + knowledge: 4 + time: 5 + resources: 2 +usefulness: 3 +level: 4 +dependsOn: +- Simple Scan +samm2: v-security-testing|A|2 +iso27001-2017: +- 14.2.3 +- 14.2.8 +id: CoverageOfServiceToServiceCommunication +... diff --git a/data-new/Test and Verification/Dynamic depth for infrastructure/1/TestForExposedServices.yaml b/data-new/Test and Verification/Dynamic depth for infrastructure/1/TestForExposedServices.yaml new file mode 100755 index 000000000..8b3f7d196 --- /dev/null +++ b/data-new/Test and Verification/Dynamic depth for infrastructure/1/TestForExposedServices.yaml @@ -0,0 +1,23 @@ +--- +risk: Standard network segmentation and firewalling has not been performed, leading + to world open cluster management ports. +measure: With the help of tools the network configuration of unintenonal exposed cluster(s) + are tested. To identify clusters, all subdomains might need to be identified with + a tool like OWASP Amass to perform portscans based o the result. +difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 +usefulness: 3 +level: 1 +implementation: +- nmap +- OWASP Amass +samm: EH2-B +samm2: v-security-testing|A|1 +iso27001-2017: +- 13.1.3 +- 14.2.3 +- 14.2.8 +id: TestForExposedServices +... diff --git a/data-new/Test and Verification/Dynamic depth for infrastructure/2/TestNetworkSegmentation.yaml b/data-new/Test and Verification/Dynamic depth for infrastructure/2/TestNetworkSegmentation.yaml new file mode 100755 index 000000000..0ea0e625a --- /dev/null +++ b/data-new/Test and Verification/Dynamic depth for infrastructure/2/TestNetworkSegmentation.yaml @@ -0,0 +1,20 @@ +--- +risk: Wrong or no network segmentation of pods makes it easyer for an attacker to + access a database and extract or modify data. +measure: Cluster interal test needs to be performed. Integration of fine granulated + network segmenation (also between pods in the same namespace). +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 +usefulness: 3 +level: 2 +implementation: netassert +dependendsOn: Segmented networks for virtual environments +samm2: v-security-testing|A|2 +iso27001-2017: +- 13.1.3 +- 14.2.3 +- 14.2.8 +id: TestNetworkSegmentation +... diff --git a/data-new/Test and Verification/Dynamic depth for infrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml b/data-new/Test and Verification/Dynamic depth for infrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml new file mode 100755 index 000000000..70f09cc80 --- /dev/null +++ b/data-new/Test and Verification/Dynamic depth for infrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml @@ -0,0 +1,21 @@ +--- +risk: Standard hardening practices for cloud environments are not performed leading + to vulnerabilities. +measure: With the help of tools the configuration of virtual environments are tested. +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 +usefulness: 4 +level: 2 +implementation: +- kube-hunter +- openVAS +samm: EH2-B +iso27001-2017: +- system hardening is not explicitly covered by ISO 27001 - too specific +- 12.6.1 +- 14.2.3 +- 14.2.8 +id: TestOfTheConfigurationOfCloudEnvironments +... diff --git a/data-new/Test and Verification/Dynamic depth for infrastructure/3/WeakPasswordTest.yaml b/data-new/Test and Verification/Dynamic depth for infrastructure/3/WeakPasswordTest.yaml new file mode 100755 index 000000000..bb532e24d --- /dev/null +++ b/data-new/Test and Verification/Dynamic depth for infrastructure/3/WeakPasswordTest.yaml @@ -0,0 +1,17 @@ +--- +risk: Weak passwords in components like applications or systems, specially for privileged + accounts, lead to take over of that account. +measure: Automatic brute force attacks are performed. Specially the usage of standard + accounts like 'admin' and employee user-ids is recommended. +difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 +usefulness: 1 +level: 3 +implementation: HTC Hydra +samm2: v-security-testing|A|2 +iso27001-2017: +- 9.4.3 +id: WeakPasswordTest +... diff --git a/data-new/Test and Verification/Dynamic depth for infrastructure/4/LoadTests.yaml b/data-new/Test and Verification/Dynamic depth for infrastructure/4/LoadTests.yaml new file mode 100755 index 000000000..b7d6020ee --- /dev/null +++ b/data-new/Test and Verification/Dynamic depth for infrastructure/4/LoadTests.yaml @@ -0,0 +1,17 @@ +--- +risk: As it is unknown how many requests the systems and applications can serve, due + to an unexpected load the availability is disturbed. +measure: Load test against the production system or a production near system is performed. +difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 5 +usefulness: 3 +level: 4 +samm2: v-security-testing|A|1 +iso27001-2017: +- 12.1.3 +- 14.2.3 +- 14.2.8 +id: LoadTests +... diff --git a/data-new/Test and Verification/Static depth for applications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml b/data-new/Test and Verification/Static depth for applications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml new file mode 100755 index 000000000..22c17f527 --- /dev/null +++ b/data-new/Test and Verification/Static depth for applications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml @@ -0,0 +1,19 @@ +--- +risk: Server side components might have vulnerabilities. +measure: Tests for known vulnerabilities in server side components (e.g. backend/middleware) + are performed. +difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 +usefulness: 5 +level: 1 +dependsOn: +- Defined build process +implementation: OWASP Dependency Check +samm: SA +samm2: v-security-testing|A|2 +iso27001-2017: +- 12.6.1 +id: TestOfServerSideComponentsWithKnownVulnerabilities +... diff --git a/data-new/Test and Verification/Static depth for applications/2/StaticAnalysisForImportantServerSideComponents.yaml b/data-new/Test and Verification/Static depth for applications/2/StaticAnalysisForImportantServerSideComponents.yaml new file mode 100755 index 000000000..5e1a7bba7 --- /dev/null +++ b/data-new/Test and Verification/Static depth for applications/2/StaticAnalysisForImportantServerSideComponents.yaml @@ -0,0 +1,19 @@ +--- +risk: Important parts in the source code of the middleware have vulnerabilities. +measure: Usage of static analysis tools for important parts of the middleware are + used. Static analysis uses for example string matching algorithms and/or dataflow + analysis. +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 +usefulness: 4 +level: 2 +implementation: eslint, FindSecurityBugs, jsprime +dependsOn: +- Defined build process +samm2: v-security-testing|A|2 +iso27001-2017: +- 12.6.1 +id: StaticAnalysisForImportantServerSideComponents +... diff --git a/data-new/Test and Verification/Static depth for applications/3/StaticAnalysisForImportantClientSideComponents.yaml b/data-new/Test and Verification/Static depth for applications/3/StaticAnalysisForImportantClientSideComponents.yaml new file mode 100755 index 000000000..2837b3644 --- /dev/null +++ b/data-new/Test and Verification/Static depth for applications/3/StaticAnalysisForImportantClientSideComponents.yaml @@ -0,0 +1,22 @@ +--- +risk: Important parts in the source code of the frontend have vulnerabilities. +measure: Usage of static analysis tools for important parts of the frontend are used. + Static analysis uses for example string matching algorithms and/or dataflow analysis. +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 +usefulness: 3 +level: 3 +implementation: +- eslint +- FindSecurityBugs +- jsprime +- bdd-mobile-security-automation-framework +samm2: v-security-testing|A|2 +iso27001-2017: +- 12.6.1 +dependsOn: +- Defined build process +id: StaticAnalysisForImportantClientSideComponents +... diff --git a/data-new/Test and Verification/Static depth for applications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml b/data-new/Test and Verification/Static depth for applications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml new file mode 100755 index 000000000..6cbfcd377 --- /dev/null +++ b/data-new/Test and Verification/Static depth for applications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml @@ -0,0 +1,19 @@ +--- +risk: Client side components might have vulnerabilities. +measure: Tests for known vulnerabilities in components of the frontend are performed. +difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 +usefulness: 2 +level: 3 +dependsOn: +- Defined build process +implementation: +- retire.js +- npm audit +samm2: v-security-testing|A|2 +iso27001-2017: +- 12.6.1 +id: TestOfClientSideComponentsWithKnownVulnerabilities +... diff --git a/data-new/Test and Verification/Static depth for applications/4/ExclusionOfSourceCodeDuplicates.yaml b/data-new/Test and Verification/Static depth for applications/4/ExclusionOfSourceCodeDuplicates.yaml new file mode 100755 index 000000000..83d20da46 --- /dev/null +++ b/data-new/Test and Verification/Static depth for applications/4/ExclusionOfSourceCodeDuplicates.yaml @@ -0,0 +1,19 @@ +--- +risk: Duplicates in source code might influence the stability of the application. +measure: Automatic Detection and manual removal of duplicates in source code. +difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 +usefulness: 1 +level: 4 +implementation: PMD +dependsOn: +- Defined build process +samm2: v-security-testing|A|2 +iso27001-2017: +- not explicitly covered by ISO 27001 - too specific +- 14.2.1 +- 14.2.5 +id: ExclusionOfSourceCodeDuplicates +... diff --git a/data-new/Test and Verification/Static depth for applications/4/StaticAnalysisForAllSelfWrittenComponents.yaml b/data-new/Test and Verification/Static depth for applications/4/StaticAnalysisForAllSelfWrittenComponents.yaml new file mode 100755 index 000000000..b66ea8726 --- /dev/null +++ b/data-new/Test and Verification/Static depth for applications/4/StaticAnalysisForAllSelfWrittenComponents.yaml @@ -0,0 +1,19 @@ +--- +risk: Parts in the source code of the frontend or middleware have vulnerabilities. +measure: Usage of static analysis tools for all parts of the middleware and frontend. + Static analysis uses for example string matching algorithms and/or dataflow analysis. +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 +usefulness: 4 +level: 4 +implementation: eslint, FindSecurityBugs, jsprime +dependsOn: +- Static analysis for important client side components +- Static analysis for important server side components +samm2: v-security-testing|A|2 +iso27001-2017: +- 12.6.1 +id: StaticAnalysisForAllSelfWrittenComponents +... diff --git a/data-new/Test and Verification/Static depth for applications/4/StylisticAnalysis.yaml b/data-new/Test and Verification/Static depth for applications/4/StylisticAnalysis.yaml new file mode 100755 index 000000000..425490182 --- /dev/null +++ b/data-new/Test and Verification/Static depth for applications/4/StylisticAnalysis.yaml @@ -0,0 +1,18 @@ +--- +risk: False source code indenting might lead to vulnerabilities. +measure: Analysis of compliance to style guides of the source code ensures that source + code indenting rules are met. +difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 +usefulness: 1 +level: 4 +implementation: PMD +samm2: v-security-testing|A|2 +iso27001-2017: +- 12.6.1 +- 14.2.1 +- 14.2.5 +id: StylisticAnalysis +... diff --git a/data-new/Test and Verification/Static depth for applications/4/UsageOfMultipleAnalysers.yaml b/data-new/Test and Verification/Static depth for applications/4/UsageOfMultipleAnalysers.yaml new file mode 100755 index 000000000..f218a3dc2 --- /dev/null +++ b/data-new/Test and Verification/Static depth for applications/4/UsageOfMultipleAnalysers.yaml @@ -0,0 +1,21 @@ +--- +risk: Each vulnerability analyser has different opportunities. By using just one analyser, + some vulnerabilities might not be found. +measure: Usage of multiple static tools to find more vulnerabilities. +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 +usefulness: 1 +level: 4 +samm2: v-security-testing|A|3 +iso27001-2017: +- 12.6.1 +- 14.2.1 +- 14.2.5 +dependsOn: +- Test of server side components with known vulnerabilities +- Test of client side components with known vulnerabilities +- Static analysis for all self written components +id: UsageOfMultipleAnalysers +... diff --git a/data-new/Test and Verification/Static depth for infrastructure/1/StoredSecrets.yaml b/data-new/Test and Verification/Static depth for infrastructure/1/StoredSecrets.yaml new file mode 100755 index 000000000..9e4b1dae3 --- /dev/null +++ b/data-new/Test and Verification/Static depth for infrastructure/1/StoredSecrets.yaml @@ -0,0 +1,20 @@ +--- +risk: Stored secrets in git history, in container images or directly in code shouldn't + exists because they might be read unauthorized. +measure: Test for secrets in code, container images and history +difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 +usefulness: 2 +level: 1 +implementation: +- truffleHog +- go-pillage-registries +samm2: v-security-testing|A|1 +iso27001-2017: +- vcs usage is not explicitly covered by ISO 27001 - too specific +- 9.4.3 +- 10.1.2 +id: StoredSecrets +... diff --git a/data-new/Test and Verification/Static depth for infrastructure/2/TestClusterDeploymentResources.yaml b/data-new/Test and Verification/Static depth for infrastructure/2/TestClusterDeploymentResources.yaml new file mode 100755 index 000000000..31952dc7d --- /dev/null +++ b/data-new/Test and Verification/Static depth for infrastructure/2/TestClusterDeploymentResources.yaml @@ -0,0 +1,21 @@ +--- +risk: The deployment configuration (e.g. kubernetes deployment resources) might contain + unsecured configurations. +measure: Test the deployment configuration for virtualized environments for unsecured + configurations. +difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 +usefulness: 3 +level: 2 +implementation: +- kubesec +samm2: v-security-testing|A|1 +iso27001-2017: +- system hardening is not explicitly covered by ISO 27001 - too specific +- 12.6.1 +- 14.2.3 +- 14.2.8 +id: TestClusterDeploymentResources +... diff --git a/data-new/Test and Verification/Static depth for infrastructure/2/TestOfVirtualizedEnvironments.yaml b/data-new/Test and Verification/Static depth for infrastructure/2/TestOfVirtualizedEnvironments.yaml new file mode 100755 index 000000000..69bf4281e --- /dev/null +++ b/data-new/Test and Verification/Static depth for infrastructure/2/TestOfVirtualizedEnvironments.yaml @@ -0,0 +1,16 @@ +--- +risk: Virtualized environments (e.g. via Container Images) might contains unsecure + configurations. +measure: Test virtualized environments for unsecured configurations. +difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 +usefulness: 3 +level: 2 +implementation: +- Dive to inspect a container images +- Cluster Scanner (will be open sourced soon) to check different aspects +samm2: v-security-testing|A|1 +id: TestOfVirtualizedEnvironments +... diff --git a/data-new/Test and Verification/Static depth for infrastructure/2/TestTheClouldConfiguration.yaml b/data-new/Test and Verification/Static depth for infrastructure/2/TestTheClouldConfiguration.yaml new file mode 100755 index 000000000..05850106b --- /dev/null +++ b/data-new/Test and Verification/Static depth for infrastructure/2/TestTheClouldConfiguration.yaml @@ -0,0 +1,21 @@ +--- +risk: Standard hardening practices for cloud environments are not performed leading + to vulnerabilities. +measure: With the help of tools the configuration of virtual environments are tested. +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 +usefulness: 4 +level: 2 +implementation: +- kube-bench +samm: EH2-B +samm2: v-security-testing|A|1 +iso27001-2017: +- system hardening is not explicitly covered by ISO 27001 - too specific +- 12.6.1 +- 14.2.3 +- 14.2.8 +id: TestTheClouldConfiguration +... diff --git a/data-new/Test and Verification/Static depth for infrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml b/data-new/Test and Verification/Static depth for infrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml new file mode 100755 index 000000000..9f6886d61 --- /dev/null +++ b/data-new/Test and Verification/Static depth for infrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml @@ -0,0 +1,23 @@ +--- +risk: The definition of virtualized environments (e.g. via Dockerfile) might + contains unsecure configurations. +measure: Test the definition of virtualized environments for unsecured configurations. +difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 +usefulness: 3 +level: 2 +implementation: +- Dockerfile with hadolint +- Deployment with kube-score +samm2: v-security-testing|A|1 +iso27001-2017: +- system hardening, virtual environments are not explicitly covered by ISO 27001 - + too specific +- 12.6.1 +- 14.2.3 +- 14.2.8 +- 14.2.1 +id: TestTheDefinitionOfVirtualizedEnvironments +... diff --git a/data-new/Test and Verification/Static depth for infrastructure/3/CheckForImageLifetime.yaml b/data-new/Test and Verification/Static depth for infrastructure/3/CheckForImageLifetime.yaml new file mode 100755 index 000000000..d5d91db4a --- /dev/null +++ b/data-new/Test and Verification/Static depth for infrastructure/3/CheckForImageLifetime.yaml @@ -0,0 +1,17 @@ +--- +risk: Old container images in production indicate that patch management is not performed + and therefore vulnerabilities might exists. +measure: Check the image age of containers in production. +difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 +usefulness: 2 +level: 3 +implementation: ~ +samm2: v-security-testing|A|1 +iso27001-2017: +- 12.6.1 +- 14.2.5 +id: CheckForImageLifetime +... diff --git a/data-new/Test and Verification/Static depth for infrastructure/3/CheckForMalware.yaml b/data-new/Test and Verification/Static depth for infrastructure/3/CheckForMalware.yaml new file mode 100755 index 000000000..60e215448 --- /dev/null +++ b/data-new/Test and Verification/Static depth for infrastructure/3/CheckForMalware.yaml @@ -0,0 +1,18 @@ +--- +risk: Third party might include malware. Ether due to the maintainer (e.g. typo squatting + of an image name and using the wrong image) or by an attacker on behalf of the maintainer + with stolen credentials. +measure: Check for malware in components (e.g. container images, VM baseline images, + libaries). +difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 +usefulness: 3 +level: 3 +implementation: ~ +samm2: v-security-testing|A|2 +iso27001-2017: +- 12.2.1 +id: CheckForMalware +... diff --git a/data-new/Test and Verification/Static depth for infrastructure/3/CheckForNewImageVersion.yaml b/data-new/Test and Verification/Static depth for infrastructure/3/CheckForNewImageVersion.yaml new file mode 100755 index 000000000..36e16a8ed --- /dev/null +++ b/data-new/Test and Verification/Static depth for infrastructure/3/CheckForNewImageVersion.yaml @@ -0,0 +1,17 @@ +--- +risk: When a new version of an image is available, it might fixes security vulnerabilities. +measure: Check for new images of containers in production. +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 +usefulness: 2 +level: 3 +implementation: ~ +samm2: v-security-testing|A|2 +iso27001-2017: +- 12.6.1 +- 14.2.5 +- 12.2.1 +id: CheckForNewImageVersion +... diff --git a/data-new/Test and Verification/Static depth for infrastructure/4/CheckForKnownVulnerabilities.yaml b/data-new/Test and Verification/Static depth for infrastructure/4/CheckForKnownVulnerabilities.yaml new file mode 100755 index 000000000..d8a742c2b --- /dev/null +++ b/data-new/Test and Verification/Static depth for infrastructure/4/CheckForKnownVulnerabilities.yaml @@ -0,0 +1,19 @@ +--- +risk: Known vulnerabilities in infrastructure components like container images might + get exploited. +measure: Check for known vulnerabilities +difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 +usefulness: 4 +level: 4 +implementation: +- https://github.com/aquasecurity/trivy +- Registries like quay, dockerhub provide (commercial) offerings, often not suiteable + for distroless images +samm2: v-security-testing|A|2 +iso27001-2017: +- 12.6.1 +id: CheckForKnownVulnerabilities +... diff --git a/data-new/Test and Verification/Static depth for infrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml b/data-new/Test and Verification/Static depth for infrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml new file mode 100755 index 000000000..2a6ab7f21 --- /dev/null +++ b/data-new/Test and Verification/Static depth for infrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml @@ -0,0 +1,22 @@ +--- +risk: TODO. +measure: TODO +difficultyOfImplementation: + knowledge: 2 + time: 5 + resources: 4 +usefulness: 1 +level: 4 +dependsOn: +- Usage of a maximum lifetime for images +implementation: +- Anchore.io +- Clair +- OpenSCAP +- Vuls +samm2: v-security-testing|A|1 +iso27001-2017: +- 12.6.1 +- 14.2.1 +id: CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions +... diff --git a/data-new/Test and Verification/Static depth for infrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml b/data-new/Test and Verification/Static depth for infrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml new file mode 100755 index 000000000..6304cb80b --- /dev/null +++ b/data-new/Test and Verification/Static depth for infrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml @@ -0,0 +1,25 @@ +--- +risk: Infrastructure components might have vulnerabilities. +measure: Test for known vulnerabilities in infrastructure components. Often, the only + way to respond to known vulnerabilities in operating system packages is to accept + the risk and wait for a patch. As the patch needs to be applied fast when it is + available, this activity depends on 'Usage of a maximum life for images'. +difficultyOfImplementation: + knowledge: 2 + time: 5 + resources: 2 +usefulness: 1 +level: 4 +dependsOn: +- Usage of a maximum lifetime for images +implementation: +- Anchore.io +- Clair +- OpenSCAP +- Vuls +samm2: v-security-testing|A|1 +iso27001-2017: +- 12.6.1 +- 14.2.1 +id: TestOfInfrastructureComponentsForKnownVulnerabilities +... diff --git a/data-new/Test and Verification/Test-Intensity/1/DefaultSettingsForIntensity.yaml b/data-new/Test and Verification/Test-Intensity/1/DefaultSettingsForIntensity.yaml new file mode 100755 index 000000000..4ed6f8608 --- /dev/null +++ b/data-new/Test and Verification/Test-Intensity/1/DefaultSettingsForIntensity.yaml @@ -0,0 +1,16 @@ +--- +risk: Time pressure and ignorance might lead to false predictions for the test intensity. +measure: The intensity of the used tools are not modified to safe time. +difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 +usefulness: 1 +level: 1 +samm2: v-security-testing|A|1 +iso27001-2017: +- 12.6.1 +- 14.2.1 +- 14.2.5 +id: DefaultSettingsForIntensity +... diff --git a/data-new/Test and Verification/Test-Intensity/1/HighTestIntensity.yaml b/data-new/Test and Verification/Test-Intensity/1/HighTestIntensity.yaml new file mode 100755 index 000000000..5523c5991 --- /dev/null +++ b/data-new/Test and Verification/Test-Intensity/1/HighTestIntensity.yaml @@ -0,0 +1,16 @@ +--- +risk: A too small intensity or a too high confidence might lead to not visible vulnerabilities. +measure: A deep scan with high test intensity and a low confidence threshold is performed. +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 +usefulness: 3 +level: 1 +samm2: v-security-testing|A|2 +iso27001-2017: +- 12.6.1 +- 14.2.1 +- 14.2.5 +id: HighTestIntensity +... diff --git a/data-new/Test and Verification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml b/data-new/Test and Verification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml new file mode 100755 index 000000000..31c8a09be --- /dev/null +++ b/data-new/Test and Verification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml @@ -0,0 +1,20 @@ +--- +risk: As tools cover a wide range of different vulnerability tests, they might not + match the used components. Therefore, they need more time and resources as they + need and the feedback loops takes too much time. +measure: Unneeded tests are deactivated. For example in case the service is using + a Mongo database and no mysql database, the dynamic scan doesn't need to test for + sql injections. +difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 1 +usefulness: 1 +level: 2 +samm2: v-security-testing|A|2 +iso27001-2017: +- 12.6.1 +- 14.2.1 +- 14.2.5 +id: DeactivatingOfUnneededTests +... diff --git a/data-new/Test and Verification/Test-Intensity/2/RegularTests.yaml b/data-new/Test and Verification/Test-Intensity/2/RegularTests.yaml new file mode 100755 index 000000000..bddf8484d --- /dev/null +++ b/data-new/Test and Verification/Test-Intensity/2/RegularTests.yaml @@ -0,0 +1,18 @@ +--- +risk: After pushing source code to the version control system, any delay in receiving + feedback on defects makes them harder for the developer to remediate. +measure: On each push and/or at given intervals automatic security tests are performed. +difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 +usefulness: 2 +level: 2 +implementation: "" +samm2: i-secure-build|A|3 +iso27001-2017: +- 14.2.3 +- 14.2.8 +- 14.2.9 +id: RegularTests +... diff --git a/data-new/Test and Verification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml b/data-new/Test and Verification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml new file mode 100755 index 000000000..f146d77c6 --- /dev/null +++ b/data-new/Test and Verification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml @@ -0,0 +1,21 @@ +--- +risk: Scans might use a too small or too high test intensity. +measure: A testing concept considering the amount of time per scan/intensity is created + and applied. A dynamic analysis needs more time than a static analysis. The dynamic + scan, depending on the test intensity might be performed on every commit, every + night, every week or once in a month. +difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 +usefulness: 2 +level: 3 +samm2: v-security-testing|A|2 +iso27001-2017: +- 14.2.2 +- 14.2.3 +- 14.2.1 +- 14.2.5 +- 12.6.1 +id: CreationAndApplicationOfATestingConcept +... diff --git a/data.php b/data.php index 8c02eebd9..1dd4248ca 100644 --- a/data.php +++ b/data.php @@ -2,7 +2,7 @@ $dimensions = array(); $files = scandir("data"); - +$Extra = new ParsedownExtra(); function readYaml($file) { return yaml_parse( @@ -11,7 +11,6 @@ function readYaml($file) } $dimensions = array( - "Application" => readYaml("data/Application.yml"), "Culture and Org." => readYaml("data/CultureandOrg.yml"), "Build and Deployment" => readYaml("data/BuildandDeployment.yml"), "Information Gathering" => readYaml("data/Informationgathering.yml"), @@ -142,6 +141,7 @@ function getElementContentAndCheckExistence($parent, $name) function getElementContent($element) { + $Extra = new ParsedownExtra(); $contentString = ""; if (is_array($element)) { if (isAssoc($element)) { @@ -152,14 +152,14 @@ function getElementContent($element) if (is_array($elementContent)) { $contentString .= getElementContent($elementContent); } else - $contentString .= "
  • " . str_replace("\"", "'", $elementContent) . "
    • "; + $contentString .= "
  • " . $Extra->text($elementContent) . "
    • "; $contentString .= ""; } } else { $contentString .= ""; } diff --git a/data/CultureandOrg.yml b/data/CultureandOrg.yml index ce885718b..57ee534bb 100755 --- a/data/CultureandOrg.yml +++ b/data/CultureandOrg.yml @@ -47,7 +47,7 @@ Education and Guidance: Regular security training of security champions: risk: Understanding security is hard, even for security champions. measure: Regular security training of security champions. - evidence: + evidence: | - Process Documentation: TODO - Training Content: TOODO difficultyOfImplementation: diff --git a/detail.php b/detail.php index efcaa81e0..c842dcc33 100644 --- a/detail.php +++ b/detail.php @@ -65,8 +65,7 @@ function printDetail($dimension, $subdimension, $activityName, $dimensions, $rep if (array_key_exists("md-description", $element) && !empty($element['md-description'])) { echo "
    text($element['md-description']); + echo $element['md-description']; echo "
    "; } if (array_key_exists("implementation", $element) && !empty($element['implementation'])) { diff --git a/newFolder.php b/newFolder.php new file mode 100644 index 000000000..d9bac2218 --- /dev/null +++ b/newFolder.php @@ -0,0 +1,43 @@ + readYaml("data/CultureandOrg.yml"), + "Build and Deployment" => readYaml("data/BuildandDeployment.yml"), + "Information Gathering" => readYaml("data/Informationgathering.yml"), + "Implementation" => readYaml("data/Implementation.yml"), + "Test and Verification" => readYaml("data/TestandVerification.yml") +); + +foreach ($dimensions as $dimensionName => $subDimension) { + foreach ($subDimension as $subDimensionName => $elements) { + + $newElements = $elements; + ksort($newElements); + $dimensions[$dimensionName][$subDimensionName] = $newElements; + foreach($elements as $elementName => $element) { + $folder = "data-new/$dimensionName/$subDimensionName/" . $element['level'] . "/"; + //echo $folder; + mkdir($folder, 755, true); + + $idWithSpace=mb_convert_case($elementName, MB_CASE_TITLE); + $id = str_replace(" ", "", $idWithSpace); + $filePath = $folder . "/" . $id . ".yaml"; + $element['id'] = $id; + $yamlContent = yaml_emit ( $element ); + + file_put_contents($filePath, $yamlContent); + + } + + } +} + diff --git a/selectedData.csv b/selectedData.csv new file mode 100755 index 000000000..9c8a1ebed --- /dev/null +++ b/selectedData.csv @@ -0,0 +1,12 @@ +"element" +"Building and testing of artifacts in virtual environments" +"Blue/Green Deployment" +"Centralized system logging" +"Centralized application logging" +"Approval by reviewing any new version" +"Usage of test and production environments" +"Applications are running in virtualized environments" +"Virtual environments are limited" +"Load tests" +"Smoke Test" +"Stylistic analysis" diff --git a/vendor/autoload.php b/vendor/autoload.php new file mode 100644 index 000000000..45bdcba99 --- /dev/null +++ b/vendor/autoload.php @@ -0,0 +1,7 @@ + + * Jordi Boggiano + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +namespace Composer\Autoload; + +/** + * ClassLoader implements a PSR-0, PSR-4 and classmap class loader. + * + * $loader = new \Composer\Autoload\ClassLoader(); + * + * // register classes with namespaces + * $loader->add('Symfony\Component', __DIR__.'/component'); + * $loader->add('Symfony', __DIR__.'/framework'); + * + * // activate the autoloader + * $loader->register(); + * + * // to enable searching the include path (eg. for PEAR packages) + * $loader->setUseIncludePath(true); + * + * In this example, if you try to use a class in the Symfony\Component + * namespace or one of its children (Symfony\Component\Console for instance), + * the autoloader will first look for the class under the component/ + * directory, and it will then fallback to the framework/ directory if not + * found before giving up. + * + * This class is loosely based on the Symfony UniversalClassLoader. + * + * @author Fabien Potencier + * @author Jordi Boggiano + * @see http://www.php-fig.org/psr/psr-0/ + * @see http://www.php-fig.org/psr/psr-4/ + */ +class ClassLoader +{ + // PSR-4 + private $prefixLengthsPsr4 = array(); + private $prefixDirsPsr4 = array(); + private $fallbackDirsPsr4 = array(); + + // PSR-0 + private $prefixesPsr0 = array(); + private $fallbackDirsPsr0 = array(); + + private $useIncludePath = false; + private $classMap = array(); + private $classMapAuthoritative = false; + private $missingClasses = array(); + private $apcuPrefix; + + public function getPrefixes() + { + if (!empty($this->prefixesPsr0)) { + return call_user_func_array('array_merge', $this->prefixesPsr0); + } + + return array(); + } + + public function getPrefixesPsr4() + { + return $this->prefixDirsPsr4; + } + + public function getFallbackDirs() + { + return $this->fallbackDirsPsr0; + } + + public function getFallbackDirsPsr4() + { + return $this->fallbackDirsPsr4; + } + + public function getClassMap() + { + return $this->classMap; + } + + /** + * @param array $classMap Class to filename map + */ + public function addClassMap(array $classMap) + { + if ($this->classMap) { + $this->classMap = array_merge($this->classMap, $classMap); + } else { + $this->classMap = $classMap; + } + } + + /** + * Registers a set of PSR-0 directories for a given prefix, either + * appending or prepending to the ones previously set for this prefix. + * + * @param string $prefix The prefix + * @param array|string $paths The PSR-0 root directories + * @param bool $prepend Whether to prepend the directories + */ + public function add($prefix, $paths, $prepend = false) + { + if (!$prefix) { + if ($prepend) { + $this->fallbackDirsPsr0 = array_merge( + (array) $paths, + $this->fallbackDirsPsr0 + ); + } else { + $this->fallbackDirsPsr0 = array_merge( + $this->fallbackDirsPsr0, + (array) $paths + ); + } + + return; + } + + $first = $prefix[0]; + if (!isset($this->prefixesPsr0[$first][$prefix])) { + $this->prefixesPsr0[$first][$prefix] = (array) $paths; + + return; + } + if ($prepend) { + $this->prefixesPsr0[$first][$prefix] = array_merge( + (array) $paths, + $this->prefixesPsr0[$first][$prefix] + ); + } else { + $this->prefixesPsr0[$first][$prefix] = array_merge( + $this->prefixesPsr0[$first][$prefix], + (array) $paths + ); + } + } + + /** + * Registers a set of PSR-4 directories for a given namespace, either + * appending or prepending to the ones previously set for this namespace. + * + * @param string $prefix The prefix/namespace, with trailing '\\' + * @param array|string $paths The PSR-4 base directories + * @param bool $prepend Whether to prepend the directories + * + * @throws \InvalidArgumentException + */ + public function addPsr4($prefix, $paths, $prepend = false) + { + if (!$prefix) { + // Register directories for the root namespace. + if ($prepend) { + $this->fallbackDirsPsr4 = array_merge( + (array) $paths, + $this->fallbackDirsPsr4 + ); + } else { + $this->fallbackDirsPsr4 = array_merge( + $this->fallbackDirsPsr4, + (array) $paths + ); + } + } elseif (!isset($this->prefixDirsPsr4[$prefix])) { + // Register directories for a new namespace. + $length = strlen($prefix); + if ('\\' !== $prefix[$length - 1]) { + throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator."); + } + $this->prefixLengthsPsr4[$prefix[0]][$prefix] = $length; + $this->prefixDirsPsr4[$prefix] = (array) $paths; + } elseif ($prepend) { + // Prepend directories for an already registered namespace. + $this->prefixDirsPsr4[$prefix] = array_merge( + (array) $paths, + $this->prefixDirsPsr4[$prefix] + ); + } else { + // Append directories for an already registered namespace. + $this->prefixDirsPsr4[$prefix] = array_merge( + $this->prefixDirsPsr4[$prefix], + (array) $paths + ); + } + } + + /** + * Registers a set of PSR-0 directories for a given prefix, + * replacing any others previously set for this prefix. + * + * @param string $prefix The prefix + * @param array|string $paths The PSR-0 base directories + */ + public function set($prefix, $paths) + { + if (!$prefix) { + $this->fallbackDirsPsr0 = (array) $paths; + } else { + $this->prefixesPsr0[$prefix[0]][$prefix] = (array) $paths; + } + } + + /** + * Registers a set of PSR-4 directories for a given namespace, + * replacing any others previously set for this namespace. + * + * @param string $prefix The prefix/namespace, with trailing '\\' + * @param array|string $paths The PSR-4 base directories + * + * @throws \InvalidArgumentException + */ + public function setPsr4($prefix, $paths) + { + if (!$prefix) { + $this->fallbackDirsPsr4 = (array) $paths; + } else { + $length = strlen($prefix); + if ('\\' !== $prefix[$length - 1]) { + throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator."); + } + $this->prefixLengthsPsr4[$prefix[0]][$prefix] = $length; + $this->prefixDirsPsr4[$prefix] = (array) $paths; + } + } + + /** + * Turns on searching the include path for class files. + * + * @param bool $useIncludePath + */ + public function setUseIncludePath($useIncludePath) + { + $this->useIncludePath = $useIncludePath; + } + + /** + * Can be used to check if the autoloader uses the include path to check + * for classes. + * + * @return bool + */ + public function getUseIncludePath() + { + return $this->useIncludePath; + } + + /** + * Turns off searching the prefix and fallback directories for classes + * that have not been registered with the class map. + * + * @param bool $classMapAuthoritative + */ + public function setClassMapAuthoritative($classMapAuthoritative) + { + $this->classMapAuthoritative = $classMapAuthoritative; + } + + /** + * Should class lookup fail if not found in the current class map? + * + * @return bool + */ + public function isClassMapAuthoritative() + { + return $this->classMapAuthoritative; + } + + /** + * APCu prefix to use to cache found/not-found classes, if the extension is enabled. + * + * @param string|null $apcuPrefix + */ + public function setApcuPrefix($apcuPrefix) + { + $this->apcuPrefix = function_exists('apcu_fetch') && filter_var(ini_get('apc.enabled'), FILTER_VALIDATE_BOOLEAN) ? $apcuPrefix : null; + } + + /** + * The APCu prefix in use, or null if APCu caching is not enabled. + * + * @return string|null + */ + public function getApcuPrefix() + { + return $this->apcuPrefix; + } + + /** + * Registers this instance as an autoloader. + * + * @param bool $prepend Whether to prepend the autoloader or not + */ + public function register($prepend = false) + { + spl_autoload_register(array($this, 'loadClass'), true, $prepend); + } + + /** + * Unregisters this instance as an autoloader. + */ + public function unregister() + { + spl_autoload_unregister(array($this, 'loadClass')); + } + + /** + * Loads the given class or interface. + * + * @param string $class The name of the class + * @return bool|null True if loaded, null otherwise + */ + public function loadClass($class) + { + if ($file = $this->findFile($class)) { + includeFile($file); + + return true; + } + } + + /** + * Finds the path to the file where the class is defined. + * + * @param string $class The name of the class + * + * @return string|false The path if found, false otherwise + */ + public function findFile($class) + { + // class map lookup + if (isset($this->classMap[$class])) { + return $this->classMap[$class]; + } + if ($this->classMapAuthoritative || isset($this->missingClasses[$class])) { + return false; + } + if (null !== $this->apcuPrefix) { + $file = apcu_fetch($this->apcuPrefix.$class, $hit); + if ($hit) { + return $file; + } + } + + $file = $this->findFileWithExtension($class, '.php'); + + // Search for Hack files if we are running on HHVM + if (false === $file && defined('HHVM_VERSION')) { + $file = $this->findFileWithExtension($class, '.hh'); + } + + if (null !== $this->apcuPrefix) { + apcu_add($this->apcuPrefix.$class, $file); + } + + if (false === $file) { + // Remember that this class does not exist. + $this->missingClasses[$class] = true; + } + + return $file; + } + + private function findFileWithExtension($class, $ext) + { + // PSR-4 lookup + $logicalPathPsr4 = strtr($class, '\\', DIRECTORY_SEPARATOR) . $ext; + + $first = $class[0]; + if (isset($this->prefixLengthsPsr4[$first])) { + $subPath = $class; + while (false !== $lastPos = strrpos($subPath, '\\')) { + $subPath = substr($subPath, 0, $lastPos); + $search = $subPath . '\\'; + if (isset($this->prefixDirsPsr4[$search])) { + $pathEnd = DIRECTORY_SEPARATOR . substr($logicalPathPsr4, $lastPos + 1); + foreach ($this->prefixDirsPsr4[$search] as $dir) { + if (file_exists($file = $dir . $pathEnd)) { + return $file; + } + } + } + } + } + + // PSR-4 fallback dirs + foreach ($this->fallbackDirsPsr4 as $dir) { + if (file_exists($file = $dir . DIRECTORY_SEPARATOR . $logicalPathPsr4)) { + return $file; + } + } + + // PSR-0 lookup + if (false !== $pos = strrpos($class, '\\')) { + // namespaced class name + $logicalPathPsr0 = substr($logicalPathPsr4, 0, $pos + 1) + . strtr(substr($logicalPathPsr4, $pos + 1), '_', DIRECTORY_SEPARATOR); + } else { + // PEAR-like class name + $logicalPathPsr0 = strtr($class, '_', DIRECTORY_SEPARATOR) . $ext; + } + + if (isset($this->prefixesPsr0[$first])) { + foreach ($this->prefixesPsr0[$first] as $prefix => $dirs) { + if (0 === strpos($class, $prefix)) { + foreach ($dirs as $dir) { + if (file_exists($file = $dir . DIRECTORY_SEPARATOR . $logicalPathPsr0)) { + return $file; + } + } + } + } + } + + // PSR-0 fallback dirs + foreach ($this->fallbackDirsPsr0 as $dir) { + if (file_exists($file = $dir . DIRECTORY_SEPARATOR . $logicalPathPsr0)) { + return $file; + } + } + + // PSR-0 include paths. + if ($this->useIncludePath && $file = stream_resolve_include_path($logicalPathPsr0)) { + return $file; + } + + return false; + } +} + +/** + * Scope isolated include. + * + * Prevents access to $this/self from included files. + */ +function includeFile($file) +{ + include $file; +} diff --git a/vendor/composer/LICENSE b/vendor/composer/LICENSE new file mode 100644 index 000000000..62ecfd8d0 --- /dev/null +++ b/vendor/composer/LICENSE @@ -0,0 +1,19 @@ +Copyright (c) Nils Adermann, Jordi Boggiano + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is furnished +to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/vendor/composer/autoload_classmap.php b/vendor/composer/autoload_classmap.php new file mode 100644 index 000000000..7a91153b0 --- /dev/null +++ b/vendor/composer/autoload_classmap.php @@ -0,0 +1,9 @@ + $vendorDir . '/symfony/deprecation-contracts/function.php', + '320cde22f66dd4f5d3fd621d3e88b98f' => $vendorDir . '/symfony/polyfill-ctype/bootstrap.php', +); diff --git a/vendor/composer/autoload_namespaces.php b/vendor/composer/autoload_namespaces.php new file mode 100644 index 000000000..67a4ae415 --- /dev/null +++ b/vendor/composer/autoload_namespaces.php @@ -0,0 +1,11 @@ + array($vendorDir . '/erusev/parsedown-extra'), + 'Parsedown' => array($vendorDir . '/erusev/parsedown'), +); diff --git a/vendor/composer/autoload_psr4.php b/vendor/composer/autoload_psr4.php new file mode 100644 index 000000000..65ce31d9f --- /dev/null +++ b/vendor/composer/autoload_psr4.php @@ -0,0 +1,12 @@ + array($vendorDir . '/symfony/polyfill-ctype'), + 'Symfony\\Component\\Yaml\\' => array($vendorDir . '/symfony/yaml'), + 'Mni\\FrontYAML\\' => array($vendorDir . '/mnapoli/front-yaml/src'), +); diff --git a/vendor/composer/autoload_real.php b/vendor/composer/autoload_real.php new file mode 100644 index 000000000..b907d34d9 --- /dev/null +++ b/vendor/composer/autoload_real.php @@ -0,0 +1,73 @@ += 50600 && !defined('HHVM_VERSION') && (!function_exists('zend_loader_file_encoded') || !zend_loader_file_encoded()); + if ($useStaticLoader) { + require_once __DIR__ . '/autoload_static.php'; + + call_user_func(\Composer\Autoload\ComposerStaticInit27b4a40ab3e3fe0b78d1d3bc398ce110::getInitializer($loader)); + } else { + $map = require __DIR__ . '/autoload_namespaces.php'; + foreach ($map as $namespace => $path) { + $loader->set($namespace, $path); + } + + $map = require __DIR__ . '/autoload_psr4.php'; + foreach ($map as $namespace => $path) { + $loader->setPsr4($namespace, $path); + } + + $classMap = require __DIR__ . '/autoload_classmap.php'; + if ($classMap) { + $loader->addClassMap($classMap); + } + } + + $loader->register(true); + + if ($useStaticLoader) { + $includeFiles = Composer\Autoload\ComposerStaticInit27b4a40ab3e3fe0b78d1d3bc398ce110::$files; + } else { + $includeFiles = require __DIR__ . '/autoload_files.php'; + } + foreach ($includeFiles as $fileIdentifier => $file) { + composerRequire27b4a40ab3e3fe0b78d1d3bc398ce110($fileIdentifier, $file); + } + + return $loader; + } +} + +function composerRequire27b4a40ab3e3fe0b78d1d3bc398ce110($fileIdentifier, $file) +{ + if (empty($GLOBALS['__composer_autoload_files'][$fileIdentifier])) { + require $file; + + $GLOBALS['__composer_autoload_files'][$fileIdentifier] = true; + } +} diff --git a/vendor/composer/autoload_static.php b/vendor/composer/autoload_static.php new file mode 100644 index 000000000..a685ec6f1 --- /dev/null +++ b/vendor/composer/autoload_static.php @@ -0,0 +1,64 @@ + __DIR__ . '/..' . '/symfony/deprecation-contracts/function.php', + '320cde22f66dd4f5d3fd621d3e88b98f' => __DIR__ . '/..' . '/symfony/polyfill-ctype/bootstrap.php', + ); + + public static $prefixLengthsPsr4 = array ( + 'S' => + array ( + 'Symfony\\Polyfill\\Ctype\\' => 23, + 'Symfony\\Component\\Yaml\\' => 23, + ), + 'M' => + array ( + 'Mni\\FrontYAML\\' => 14, + ), + ); + + public static $prefixDirsPsr4 = array ( + 'Symfony\\Polyfill\\Ctype\\' => + array ( + 0 => __DIR__ . '/..' . '/symfony/polyfill-ctype', + ), + 'Symfony\\Component\\Yaml\\' => + array ( + 0 => __DIR__ . '/..' . '/symfony/yaml', + ), + 'Mni\\FrontYAML\\' => + array ( + 0 => __DIR__ . '/..' . '/mnapoli/front-yaml/src', + ), + ); + + public static $prefixesPsr0 = array ( + 'P' => + array ( + 'ParsedownExtra' => + array ( + 0 => __DIR__ . '/..' . '/erusev/parsedown-extra', + ), + 'Parsedown' => + array ( + 0 => __DIR__ . '/..' . '/erusev/parsedown', + ), + ), + ); + + public static function getInitializer(ClassLoader $loader) + { + return \Closure::bind(function () use ($loader) { + $loader->prefixLengthsPsr4 = ComposerStaticInit27b4a40ab3e3fe0b78d1d3bc398ce110::$prefixLengthsPsr4; + $loader->prefixDirsPsr4 = ComposerStaticInit27b4a40ab3e3fe0b78d1d3bc398ce110::$prefixDirsPsr4; + $loader->prefixesPsr0 = ComposerStaticInit27b4a40ab3e3fe0b78d1d3bc398ce110::$prefixesPsr0; + + }, null, ClassLoader::class); + } +} diff --git a/vendor/composer/installed.json b/vendor/composer/installed.json new file mode 100644 index 000000000..61c0e35b3 --- /dev/null +++ b/vendor/composer/installed.json @@ -0,0 +1,354 @@ +[ + { + "name": "erusev/parsedown", + "version": "1.7.4", + "version_normalized": "1.7.4.0", + "source": { + "type": "git", + "url": "https://github.com/erusev/parsedown.git", + "reference": "cb17b6477dfff935958ba01325f2e8a2bfa6dab3" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/erusev/parsedown/zipball/cb17b6477dfff935958ba01325f2e8a2bfa6dab3", + "reference": "cb17b6477dfff935958ba01325f2e8a2bfa6dab3", + "shasum": "" + }, + "require": { + "ext-mbstring": "*", + "php": ">=5.3.0" + }, + "require-dev": { + "phpunit/phpunit": "^4.8.35" + }, + "time": "2019-12-30T22:54:17+00:00", + "type": "library", + "installation-source": "dist", + "autoload": { + "psr-0": { + "Parsedown": "" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Emanuil Rusev", + "email": "hello@erusev.com", + "homepage": "http://erusev.com" + } + ], + "description": "Parser for Markdown.", + "homepage": "http://parsedown.org", + "keywords": [ + "markdown", + "parser" + ] + }, + { + "name": "erusev/parsedown-extra", + "version": "0.8.1", + "version_normalized": "0.8.1.0", + "source": { + "type": "git", + "url": "https://github.com/erusev/parsedown-extra.git", + "reference": "91ac3ff98f0cea243bdccc688df43810f044dcef" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/erusev/parsedown-extra/zipball/91ac3ff98f0cea243bdccc688df43810f044dcef", + "reference": "91ac3ff98f0cea243bdccc688df43810f044dcef", + "shasum": "" + }, + "require": { + "erusev/parsedown": "^1.7.4" + }, + "require-dev": { + "phpunit/phpunit": "^4.8.35" + }, + "time": "2019-12-30T23:20:37+00:00", + "type": "library", + "installation-source": "dist", + "autoload": { + "psr-0": { + "ParsedownExtra": "" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Emanuil Rusev", + "email": "hello@erusev.com", + "homepage": "http://erusev.com" + } + ], + "description": "An extension of Parsedown that adds support for Markdown Extra.", + "homepage": "https://github.com/erusev/parsedown-extra", + "keywords": [ + "markdown", + "markdown extra", + "parsedown", + "parser" + ] + }, + { + "name": "mnapoli/front-yaml", + "version": "1.8.0", + "version_normalized": "1.8.0.0", + "source": { + "type": "git", + "url": "https://github.com/mnapoli/FrontYAML.git", + "reference": "76baa8ca538e111bfe53ac49c6a512ec5ea2bf54" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/mnapoli/FrontYAML/zipball/76baa8ca538e111bfe53ac49c6a512ec5ea2bf54", + "reference": "76baa8ca538e111bfe53ac49c6a512ec5ea2bf54", + "shasum": "" + }, + "require": { + "erusev/parsedown": "~1.0", + "php": ">=7.3", + "symfony/yaml": "~2.1|^3.0|^4.0|^5.0" + }, + "require-dev": { + "league/commonmark": "~1.4", + "phpunit/phpunit": "^9.4" + }, + "time": "2020-12-04T10:52:19+00:00", + "type": "library", + "installation-source": "dist", + "autoload": { + "psr-4": { + "Mni\\FrontYAML\\": "src/" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ] + }, + { + "name": "symfony/deprecation-contracts", + "version": "v2.2.0", + "version_normalized": "2.2.0.0", + "source": { + "type": "git", + "url": "https://github.com/symfony/deprecation-contracts.git", + "reference": "5fa56b4074d1ae755beb55617ddafe6f5d78f665" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/symfony/deprecation-contracts/zipball/5fa56b4074d1ae755beb55617ddafe6f5d78f665", + "reference": "5fa56b4074d1ae755beb55617ddafe6f5d78f665", + "shasum": "" + }, + "require": { + "php": ">=7.1" + }, + "time": "2020-09-07T11:33:47+00:00", + "type": "library", + "extra": { + "branch-alias": { + "dev-master": "2.2-dev" + }, + "thanks": { + "name": "symfony/contracts", + "url": "https://github.com/symfony/contracts" + } + }, + "installation-source": "dist", + "autoload": { + "files": [ + "function.php" + ] + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Nicolas Grekas", + "email": "p@tchwork.com" + }, + { + "name": "Symfony Community", + "homepage": "https://symfony.com/contributors" + } + ], + "description": "A generic function and convention to trigger deprecation notices", + "homepage": "https://symfony.com", + "funding": [ + { + "url": "https://symfony.com/sponsor", + "type": "custom" + }, + { + "url": "https://github.com/fabpot", + "type": "github" + }, + { + "url": "https://tidelift.com/funding/github/packagist/symfony/symfony", + "type": "tidelift" + } + ] + }, + { + "name": "symfony/polyfill-ctype", + "version": "v1.22.0", + "version_normalized": "1.22.0.0", + "source": { + "type": "git", + "url": "https://github.com/symfony/polyfill-ctype.git", + "reference": "c6c942b1ac76c82448322025e084cadc56048b4e" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/symfony/polyfill-ctype/zipball/c6c942b1ac76c82448322025e084cadc56048b4e", + "reference": "c6c942b1ac76c82448322025e084cadc56048b4e", + "shasum": "" + }, + "require": { + "php": ">=7.1" + }, + "suggest": { + "ext-ctype": "For best performance" + }, + "time": "2021-01-07T16:49:33+00:00", + "type": "library", + "extra": { + "branch-alias": { + "dev-main": "1.22-dev" + }, + "thanks": { + "name": "symfony/polyfill", + "url": "https://github.com/symfony/polyfill" + } + }, + "installation-source": "dist", + "autoload": { + "psr-4": { + "Symfony\\Polyfill\\Ctype\\": "" + }, + "files": [ + "bootstrap.php" + ] + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Gert de Pagter", + "email": "BackEndTea@gmail.com" + }, + { + "name": "Symfony Community", + "homepage": "https://symfony.com/contributors" + } + ], + "description": "Symfony polyfill for ctype functions", + "homepage": "https://symfony.com", + "keywords": [ + "compatibility", + "ctype", + "polyfill", + "portable" + ], + "funding": [ + { + "url": "https://symfony.com/sponsor", + "type": "custom" + }, + { + "url": "https://github.com/fabpot", + "type": "github" + }, + { + "url": "https://tidelift.com/funding/github/packagist/symfony/symfony", + "type": "tidelift" + } + ] + }, + { + "name": "symfony/yaml", + "version": "v5.2.3", + "version_normalized": "5.2.3.0", + "source": { + "type": "git", + "url": "https://github.com/symfony/yaml.git", + "reference": "338cddc6d74929f6adf19ca5682ac4b8e109cdb0" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/symfony/yaml/zipball/338cddc6d74929f6adf19ca5682ac4b8e109cdb0", + "reference": "338cddc6d74929f6adf19ca5682ac4b8e109cdb0", + "shasum": "" + }, + "require": { + "php": ">=7.2.5", + "symfony/deprecation-contracts": "^2.1", + "symfony/polyfill-ctype": "~1.8" + }, + "conflict": { + "symfony/console": "<4.4" + }, + "require-dev": { + "symfony/console": "^4.4|^5.0" + }, + "suggest": { + "symfony/console": "For validating YAML files using the lint command" + }, + "time": "2021-02-03T04:42:09+00:00", + "bin": [ + "Resources/bin/yaml-lint" + ], + "type": "library", + "installation-source": "dist", + "autoload": { + "psr-4": { + "Symfony\\Component\\Yaml\\": "" + }, + "exclude-from-classmap": [ + "/Tests/" + ] + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Fabien Potencier", + "email": "fabien@symfony.com" + }, + { + "name": "Symfony Community", + "homepage": "https://symfony.com/contributors" + } + ], + "description": "Loads and dumps YAML files", + "homepage": "https://symfony.com", + "funding": [ + { + "url": "https://symfony.com/sponsor", + "type": "custom" + }, + { + "url": "https://github.com/fabpot", + "type": "github" + }, + { + "url": "https://tidelift.com/funding/github/packagist/symfony/symfony", + "type": "tidelift" + } + ] + } +] diff --git a/vendor/erusev/parsedown-extra/.travis.yml b/vendor/erusev/parsedown-extra/.travis.yml new file mode 100644 index 000000000..d0b48f88f --- /dev/null +++ b/vendor/erusev/parsedown-extra/.travis.yml @@ -0,0 +1,30 @@ +language: php + +dist: trusty +sudo: false + +matrix: + include: + - php: 5.3 + dist: precise + - php: 5.4 + - php: 5.5 + - php: 5.6 + - php: 7.0 + - php: 7.1 + - php: 7.2 + - php: 7.3 + - php: 7.4 + - php: nightly + fast_finish: true + allow_failures: + - php: nightly + - php: hhvm-nightly + +install: + - composer install --prefer-source + +script: + - vendor/bin/phpunit + - vendor/bin/phpunit vendor/erusev/parsedown/test/CommonMarkTestWeak.php || true + - '[ -z "$TRAVIS_TAG" ] || [ "$TRAVIS_TAG" == "$(php -r "require(\"ParsedownExtra.php\"); echo ParsedownExtra::version;")" ]' diff --git a/vendor/erusev/parsedown-extra/LICENSE.txt b/vendor/erusev/parsedown-extra/LICENSE.txt new file mode 100644 index 000000000..baca86f5b --- /dev/null +++ b/vendor/erusev/parsedown-extra/LICENSE.txt @@ -0,0 +1,20 @@ +The MIT License (MIT) + +Copyright (c) 2013 Emanuil Rusev, erusev.com + +Permission is hereby granted, free of charge, to any person obtaining a copy of +this software and associated documentation files (the "Software"), to deal in +the Software without restriction, including without limitation the rights to +use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of +the Software, and to permit persons to whom the Software is furnished to do so, +subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER +IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/ParsedownExtra.php b/vendor/erusev/parsedown-extra/ParsedownExtra.php new file mode 100644 index 000000000..632ba84f6 --- /dev/null +++ b/vendor/erusev/parsedown-extra/ParsedownExtra.php @@ -0,0 +1,538 @@ +BlockTypes[':'] []= 'DefinitionList'; + $this->BlockTypes['*'] []= 'Abbreviation'; + + # identify footnote definitions before reference definitions + array_unshift($this->BlockTypes['['], 'Footnote'); + + # identify footnote markers before before links + array_unshift($this->InlineTypes['['], 'FootnoteMarker'); + } + + # + # ~ + + function text($text) + { + $markup = parent::text($text); + + # merge consecutive dl elements + + $markup = preg_replace('/<\/dl>\s+
    \s+/', '', $markup); + + # add footnotes + + if (isset($this->DefinitionData['Footnote'])) + { + $Element = $this->buildFootnoteElement(); + + $markup .= "\n" . $this->element($Element); + } + + return $markup; + } + + # + # Blocks + # + + # + # Abbreviation + + protected function blockAbbreviation($Line) + { + if (preg_match('/^\*\[(.+?)\]:[ ]*(.+?)[ ]*$/', $Line['text'], $matches)) + { + $this->DefinitionData['Abbreviation'][$matches[1]] = $matches[2]; + + $Block = array( + 'hidden' => true, + ); + + return $Block; + } + } + + # + # Footnote + + protected function blockFootnote($Line) + { + if (preg_match('/^\[\^(.+?)\]:[ ]?(.*)$/', $Line['text'], $matches)) + { + $Block = array( + 'label' => $matches[1], + 'text' => $matches[2], + 'hidden' => true, + ); + + return $Block; + } + } + + protected function blockFootnoteContinue($Line, $Block) + { + if ($Line['text'][0] === '[' and preg_match('/^\[\^(.+?)\]:/', $Line['text'])) + { + return; + } + + if (isset($Block['interrupted'])) + { + if ($Line['indent'] >= 4) + { + $Block['text'] .= "\n\n" . $Line['text']; + + return $Block; + } + } + else + { + $Block['text'] .= "\n" . $Line['text']; + + return $Block; + } + } + + protected function blockFootnoteComplete($Block) + { + $this->DefinitionData['Footnote'][$Block['label']] = array( + 'text' => $Block['text'], + 'count' => null, + 'number' => null, + ); + + return $Block; + } + + # + # Definition List + + protected function blockDefinitionList($Line, $Block) + { + if ( ! isset($Block) or isset($Block['type'])) + { + return; + } + + $Element = array( + 'name' => 'dl', + 'handler' => 'elements', + 'text' => array(), + ); + + $terms = explode("\n", $Block['element']['text']); + + foreach ($terms as $term) + { + $Element['text'] []= array( + 'name' => 'dt', + 'handler' => 'line', + 'text' => $term, + ); + } + + $Block['element'] = $Element; + + $Block = $this->addDdElement($Line, $Block); + + return $Block; + } + + protected function blockDefinitionListContinue($Line, array $Block) + { + if ($Line['text'][0] === ':') + { + $Block = $this->addDdElement($Line, $Block); + + return $Block; + } + else + { + if (isset($Block['interrupted']) and $Line['indent'] === 0) + { + return; + } + + if (isset($Block['interrupted'])) + { + $Block['dd']['handler'] = 'text'; + $Block['dd']['text'] .= "\n\n"; + + unset($Block['interrupted']); + } + + $text = substr($Line['body'], min($Line['indent'], 4)); + + $Block['dd']['text'] .= "\n" . $text; + + return $Block; + } + } + + # + # Header + + protected function blockHeader($Line) + { + $Block = parent::blockHeader($Line); + + if (! isset($Block)) { + return null; + } + + if (preg_match('/[ #]*{('.$this->regexAttribute.'+)}[ ]*$/', $Block['element']['text'], $matches, PREG_OFFSET_CAPTURE)) + { + $attributeString = $matches[1][0]; + + $Block['element']['attributes'] = $this->parseAttributeData($attributeString); + + $Block['element']['text'] = substr($Block['element']['text'], 0, $matches[0][1]); + } + + return $Block; + } + + # + # Markup + + protected function blockMarkupComplete($Block) + { + if ( ! isset($Block['void'])) + { + $Block['markup'] = $this->processTag($Block['markup']); + } + + return $Block; + } + + # + # Setext + + protected function blockSetextHeader($Line, array $Block = null) + { + $Block = parent::blockSetextHeader($Line, $Block); + + if (! isset($Block)) { + return null; + } + + if (preg_match('/[ ]*{('.$this->regexAttribute.'+)}[ ]*$/', $Block['element']['text'], $matches, PREG_OFFSET_CAPTURE)) + { + $attributeString = $matches[1][0]; + + $Block['element']['attributes'] = $this->parseAttributeData($attributeString); + + $Block['element']['text'] = substr($Block['element']['text'], 0, $matches[0][1]); + } + + return $Block; + } + + # + # Inline Elements + # + + # + # Footnote Marker + + protected function inlineFootnoteMarker($Excerpt) + { + if (preg_match('/^\[\^(.+?)\]/', $Excerpt['text'], $matches)) + { + $name = $matches[1]; + + if ( ! isset($this->DefinitionData['Footnote'][$name])) + { + return; + } + + $this->DefinitionData['Footnote'][$name]['count'] ++; + + if ( ! isset($this->DefinitionData['Footnote'][$name]['number'])) + { + $this->DefinitionData['Footnote'][$name]['number'] = ++ $this->footnoteCount; # » & + } + + $Element = array( + 'name' => 'sup', + 'attributes' => array('id' => 'fnref'.$this->DefinitionData['Footnote'][$name]['count'].':'.$name), + 'handler' => 'element', + 'text' => array( + 'name' => 'a', + 'attributes' => array('href' => '#fn:'.$name, 'class' => 'footnote-ref'), + 'text' => $this->DefinitionData['Footnote'][$name]['number'], + ), + ); + + return array( + 'extent' => strlen($matches[0]), + 'element' => $Element, + ); + } + } + + private $footnoteCount = 0; + + # + # Link + + protected function inlineLink($Excerpt) + { + $Link = parent::inlineLink($Excerpt); + + if (! isset($Link)) { + return null; + } + + $remainder = substr($Excerpt['text'], $Link['extent']); + + if (preg_match('/^[ ]*{('.$this->regexAttribute.'+)}/', $remainder, $matches)) + { + $Link['element']['attributes'] += $this->parseAttributeData($matches[1]); + + $Link['extent'] += strlen($matches[0]); + } + + return $Link; + } + + # + # ~ + # + + protected function unmarkedText($text) + { + $text = parent::unmarkedText($text); + + if (isset($this->DefinitionData['Abbreviation'])) + { + foreach ($this->DefinitionData['Abbreviation'] as $abbreviation => $meaning) + { + $pattern = '/\b'.preg_quote($abbreviation, '/').'\b/'; + + $text = preg_replace($pattern, ''.$abbreviation.'', $text); + } + } + + return $text; + } + + # + # Util Methods + # + + protected function addDdElement(array $Line, array $Block) + { + $text = substr($Line['text'], 1); + $text = trim($text); + + unset($Block['dd']); + + $Block['dd'] = array( + 'name' => 'dd', + 'handler' => 'line', + 'text' => $text, + ); + + if (isset($Block['interrupted'])) + { + $Block['dd']['handler'] = 'text'; + + unset($Block['interrupted']); + } + + $Block['element']['text'] []= & $Block['dd']; + + return $Block; + } + + protected function buildFootnoteElement() + { + $Element = array( + 'name' => 'div', + 'attributes' => array('class' => 'footnotes'), + 'handler' => 'elements', + 'text' => array( + array( + 'name' => 'hr', + ), + array( + 'name' => 'ol', + 'handler' => 'elements', + 'text' => array(), + ), + ), + ); + + uasort($this->DefinitionData['Footnote'], 'self::sortFootnotes'); + + foreach ($this->DefinitionData['Footnote'] as $definitionId => $DefinitionData) + { + if ( ! isset($DefinitionData['number'])) + { + continue; + } + + $text = $DefinitionData['text']; + + $text = parent::text($text); + + $numbers = range(1, $DefinitionData['count']); + + $backLinksMarkup = ''; + + foreach ($numbers as $number) + { + $backLinksMarkup .= ' ↩'; + } + + $backLinksMarkup = substr($backLinksMarkup, 1); + + if (substr($text, - 4) === '

    ') + { + $backLinksMarkup = ' '.$backLinksMarkup; + + $text = substr_replace($text, $backLinksMarkup.'

    ', - 4); + } + else + { + $text .= "\n".'

    '.$backLinksMarkup.'

    '; + } + + $Element['text'][1]['text'] []= array( + 'name' => 'li', + 'attributes' => array('id' => 'fn:'.$definitionId), + 'rawHtml' => "\n".$text."\n", + ); + } + + return $Element; + } + + # ~ + + protected function parseAttributeData($attributeString) + { + $Data = array(); + + $attributes = preg_split('/[ ]+/', $attributeString, - 1, PREG_SPLIT_NO_EMPTY); + + foreach ($attributes as $attribute) + { + if ($attribute[0] === '#') + { + $Data['id'] = substr($attribute, 1); + } + else # "." + { + $classes []= substr($attribute, 1); + } + } + + if (isset($classes)) + { + $Data['class'] = implode(' ', $classes); + } + + return $Data; + } + + # ~ + + protected function processTag($elementMarkup) # recursive + { + # http://stackoverflow.com/q/1148928/200145 + libxml_use_internal_errors(true); + + $DOMDocument = new DOMDocument; + + # http://stackoverflow.com/q/11309194/200145 + $elementMarkup = mb_convert_encoding($elementMarkup, 'HTML-ENTITIES', 'UTF-8'); + + # http://stackoverflow.com/q/4879946/200145 + $DOMDocument->loadHTML($elementMarkup); + $DOMDocument->removeChild($DOMDocument->doctype); + $DOMDocument->replaceChild($DOMDocument->firstChild->firstChild->firstChild, $DOMDocument->firstChild); + + $elementText = ''; + + if ($DOMDocument->documentElement->getAttribute('markdown') === '1') + { + foreach ($DOMDocument->documentElement->childNodes as $Node) + { + $elementText .= $DOMDocument->saveHTML($Node); + } + + $DOMDocument->documentElement->removeAttribute('markdown'); + + $elementText = "\n".$this->text($elementText)."\n"; + } + else + { + foreach ($DOMDocument->documentElement->childNodes as $Node) + { + $nodeMarkup = $DOMDocument->saveHTML($Node); + + if ($Node instanceof DOMElement and ! in_array($Node->nodeName, $this->textLevelElements)) + { + $elementText .= $this->processTag($nodeMarkup); + } + else + { + $elementText .= $nodeMarkup; + } + } + } + + # because we don't want for markup to get encoded + $DOMDocument->documentElement->nodeValue = 'placeholder\x1A'; + + $markup = $DOMDocument->saveHTML($DOMDocument->documentElement); + $markup = str_replace('placeholder\x1A', $elementText, $markup); + + return $markup; + } + + # ~ + + protected function sortFootnotes($A, $B) # callback + { + return $A['number'] - $B['number']; + } + + # + # Fields + # + + protected $regexAttribute = '(?:[#.][-\w]+[ ]*)'; +} diff --git a/vendor/erusev/parsedown-extra/README.md b/vendor/erusev/parsedown-extra/README.md new file mode 100644 index 000000000..cee4b5430 --- /dev/null +++ b/vendor/erusev/parsedown-extra/README.md @@ -0,0 +1,31 @@ +> You might also like [Caret](http://caret.io?ref=parsedown) - our Markdown editor for the Desktop. + +## Parsedown Extra + +[![Build Status](https://img.shields.io/travis/erusev/parsedown-extra/master.svg?style=flat-square)](https://travis-ci.org/erusev/parsedown-extra) + +An extension of [Parsedown](http://parsedown.org) that adds support for [Markdown Extra](https://michelf.ca/projects/php-markdown/extra/). + +[See Demo](http://parsedown.org/extra/) + +### Installation + +Include both `Parsedown.php` and `ParsedownExtra.php` or install [the composer package](https://packagist.org/packages/erusev/parsedown-extra). + +### Example + +``` php +$Extra = new ParsedownExtra(); + +echo $Extra->text('# Header {.sth}'); # prints:

    Header

    +``` + +### Questions + +**Who uses Parsedown Extra?** + +[October CMS](http://octobercms.com/), [Bolt CMS](http://bolt.cm/), [Kirby CMS](http://getkirby.com/), [Grav CMS](http://getgrav.org/), [Statamic CMS](http://www.statamic.com/) and [more](https://www.versioneye.com/php/erusev:parsedown-extra/references). + +**How can I help?** + +Use it, star it, share it and in case you feel generous, [donate some money](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=528P3NZQMP8N2). diff --git a/vendor/erusev/parsedown-extra/composer.json b/vendor/erusev/parsedown-extra/composer.json new file mode 100644 index 000000000..317d14729 --- /dev/null +++ b/vendor/erusev/parsedown-extra/composer.json @@ -0,0 +1,33 @@ +{ + "name": "erusev/parsedown-extra", + "description": "An extension of Parsedown that adds support for Markdown Extra.", + "keywords": ["markdown", "markdown extra", "parser", "parsedown"], + "homepage": "https://github.com/erusev/parsedown-extra", + "type": "library", + "license": "MIT", + "authors": [ + { + "name": "Emanuil Rusev", + "email": "hello@erusev.com", + "homepage": "http://erusev.com" + } + ], + "require": { + "erusev/parsedown": "^1.7.4" + }, + "require-dev": { + "phpunit/phpunit": "^4.8.35" + }, + "autoload": { + "psr-0": {"ParsedownExtra": ""} + }, + "autoload-dev": { + "psr-0": { + "TestParsedown": "test/", + "ParsedownExtraTest": "test/", + "ParsedownTest": "vendor/erusev/parsedown/test/", + "CommonMarkTest": "vendor/erusev/parsedown/test/", + "CommonMarkTestWeak": "vendor/erusev/parsedown/test/" + } + } +} diff --git a/vendor/erusev/parsedown-extra/phpunit.xml.dist b/vendor/erusev/parsedown-extra/phpunit.xml.dist new file mode 100644 index 000000000..29880b567 --- /dev/null +++ b/vendor/erusev/parsedown-extra/phpunit.xml.dist @@ -0,0 +1,8 @@ + + + + + test/ParsedownExtraTest.php + + + diff --git a/vendor/erusev/parsedown-extra/test/ParsedownExtraTest.php b/vendor/erusev/parsedown-extra/test/ParsedownExtraTest.php new file mode 100644 index 000000000..d2a6d23cc --- /dev/null +++ b/vendor/erusev/parsedown-extra/test/ParsedownExtraTest.php @@ -0,0 +1,11 @@ +textLevelElements; + } +} diff --git a/vendor/erusev/parsedown-extra/test/data/abbreviation.html b/vendor/erusev/parsedown-extra/test/data/abbreviation.html new file mode 100644 index 000000000..9b3a45c40 --- /dev/null +++ b/vendor/erusev/parsedown-extra/test/data/abbreviation.html @@ -0,0 +1,3 @@ +

    The HTML specification +is maintained by the W3C. +The abbreviation ML is contained in the abbreviation HTML.

    \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/abbreviation.md b/vendor/erusev/parsedown-extra/test/data/abbreviation.md new file mode 100644 index 000000000..4ac8f8842 --- /dev/null +++ b/vendor/erusev/parsedown-extra/test/data/abbreviation.md @@ -0,0 +1,7 @@ +The HTML specification +is maintained by the W3C. +The abbreviation ML is contained in the abbreviation HTML. + +*[HTML]: Hyper Text Markup Language +*[W3C]: World Wide Web Consortium +*[ML]: Markup Language \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/compound_footnote.html b/vendor/erusev/parsedown-extra/test/data/compound_footnote.html new file mode 100644 index 000000000..1a3848fd0 --- /dev/null +++ b/vendor/erusev/parsedown-extra/test/data/compound_footnote.html @@ -0,0 +1,18 @@ +

    footnote 1 and another one 2

    +
    +
    +
      +
    1. +

      line 1 +line 2

      +
      +

      quote

      +
      +

      another paragraph ↩

      +
      2. +
    2. +

      paragraph

      +

      another paragraph ↩

      +
      3. +
    +
    \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/compound_footnote.md b/vendor/erusev/parsedown-extra/test/data/compound_footnote.md new file mode 100644 index 000000000..5bca3c788 --- /dev/null +++ b/vendor/erusev/parsedown-extra/test/data/compound_footnote.md @@ -0,0 +1,14 @@ +footnote [^1] and another one [^2] + +[^1]: line 1 + line 2 + + > quote + + another paragraph + +[^2]: + paragraph + + another paragraph + \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/definition_list.html b/vendor/erusev/parsedown-extra/test/data/definition_list.html new file mode 100644 index 000000000..2567dc1c4 --- /dev/null +++ b/vendor/erusev/parsedown-extra/test/data/definition_list.html @@ -0,0 +1,17 @@ +
    +
    Term 1
    +
    one
    +
    two +extra line
    +
    Term 2
    +

    lazy +line

    +

    multiple

    +

    paragraphs

    +

    nested

    +
    code block
    +
    +

    quote +block

    +
    +
    \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/definition_list.md b/vendor/erusev/parsedown-extra/test/data/definition_list.md new file mode 100644 index 000000000..ec0ee03f3 --- /dev/null +++ b/vendor/erusev/parsedown-extra/test/data/definition_list.md @@ -0,0 +1,20 @@ +Term 1 +: one +: two + extra line + +Term 2 + +: lazy +line + +: multiple + + paragraphs + +: nested + + code block + + > quote + > block \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/footnote.html b/vendor/erusev/parsedown-extra/test/data/footnote.html new file mode 100644 index 000000000..d0ba76ce9 --- /dev/null +++ b/vendor/erusev/parsedown-extra/test/data/footnote.html @@ -0,0 +1,20 @@ +

    first 1 second 2.

    +

    first 3 second 4.

    +

    second time 1

    +
    +
    +
      +
    1. +

      one ↩ ↩

      +
      2. +
    2. +

      two ↩

      +
      3. +
    3. +

      one ↩

      +
      4. +
    4. +

      two ↩

      +
      5. +
    +
    \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/footnote.md b/vendor/erusev/parsedown-extra/test/data/footnote.md new file mode 100644 index 000000000..07d70103f --- /dev/null +++ b/vendor/erusev/parsedown-extra/test/data/footnote.md @@ -0,0 +1,11 @@ +first [^1] second [^2]. + +[^1]: one +[^2]: two + +first [^a] second [^b]. + +[^a]: one +[^b]: two + +second time [^1] \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/markdown_inside_markup.html b/vendor/erusev/parsedown-extra/test/data/markdown_inside_markup.html new file mode 100644 index 000000000..27da259f5 --- /dev/null +++ b/vendor/erusev/parsedown-extra/test/data/markdown_inside_markup.html @@ -0,0 +1,25 @@ +
    +

    markdown

    +

    This is another paragraph. It contains inline markup.

    +
    +_no markdown_ +
    +
    +
    +
    +

    markdown

    +
    +

    markdown

    +
    +
    +
    +
    +_no markdown_ +
    +

    markdown

    +
    +
    +
    +
    +_no markdown_ +
    \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/markdown_inside_markup.md b/vendor/erusev/parsedown-extra/test/data/markdown_inside_markup.md new file mode 100644 index 000000000..dbb85d66f --- /dev/null +++ b/vendor/erusev/parsedown-extra/test/data/markdown_inside_markup.md @@ -0,0 +1,32 @@ +
    +_markdown_ + +This is another paragraph. It contains inline markup. +
    +_no markdown_ +
    +
    + +--- + +
    +_markdown_ +
    +_markdown_ +
    +
    + +--- + +
    +_no markdown_ +
    +_markdown_ +
    +
    + +--- + +
    +_no markdown_ +
    \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/special_attributes.html b/vendor/erusev/parsedown-extra/test/data/special_attributes.html new file mode 100644 index 000000000..cafa31109 --- /dev/null +++ b/vendor/erusev/parsedown-extra/test/data/special_attributes.html @@ -0,0 +1,6 @@ +

    Header 1

    +

    Header 2

    +

    The Site

    +

    The Site

    +

    link

    +

    \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/special_attributes.md b/vendor/erusev/parsedown-extra/test/data/special_attributes.md new file mode 100644 index 000000000..01f29fc97 --- /dev/null +++ b/vendor/erusev/parsedown-extra/test/data/special_attributes.md @@ -0,0 +1,12 @@ +Header 1 {#header1} +======== + +## Header 2 ## {#header2} + +## The Site ## {.main} + +## The Site ## {.main .shine #the-site} + +[link](http://parsedown.org) {.primary #link .upper-case} + +![logo](/md.png) {#logo .big} \ No newline at end of file diff --git a/bib/parsedown/LICENSE.txt b/vendor/erusev/parsedown/LICENSE.txt old mode 100755 new mode 100644 similarity index 100% rename from bib/parsedown/LICENSE.txt rename to vendor/erusev/parsedown/LICENSE.txt diff --git a/bib/parsedown/Parsedown.php b/vendor/erusev/parsedown/Parsedown.php old mode 100755 new mode 100644 similarity index 100% rename from bib/parsedown/Parsedown.php rename to vendor/erusev/parsedown/Parsedown.php diff --git a/bib/parsedown/README.md b/vendor/erusev/parsedown/README.md old mode 100755 new mode 100644 similarity index 100% rename from bib/parsedown/README.md rename to vendor/erusev/parsedown/README.md diff --git a/bib/parsedown/composer.json b/vendor/erusev/parsedown/composer.json old mode 100755 new mode 100644 similarity index 100% rename from bib/parsedown/composer.json rename to vendor/erusev/parsedown/composer.json diff --git a/vendor/mnapoli/front-yaml/.gitattributes b/vendor/mnapoli/front-yaml/.gitattributes new file mode 100644 index 000000000..a50492955 --- /dev/null +++ b/vendor/mnapoli/front-yaml/.gitattributes @@ -0,0 +1,5 @@ +# Auto detect text files and perform LF normalization +* text=auto + +tests/ export-ignore +.travis.yml export-ignore diff --git a/vendor/mnapoli/front-yaml/.gitignore b/vendor/mnapoli/front-yaml/.gitignore new file mode 100644 index 000000000..051d91512 --- /dev/null +++ b/vendor/mnapoli/front-yaml/.gitignore @@ -0,0 +1,5 @@ +vendor/* +composer.phar +composer.lock + +.phpunit.result.cache \ No newline at end of file diff --git a/vendor/mnapoli/front-yaml/LICENSE b/vendor/mnapoli/front-yaml/LICENSE new file mode 100644 index 000000000..472effa5a --- /dev/null +++ b/vendor/mnapoli/front-yaml/LICENSE @@ -0,0 +1,18 @@ +FrontYAML + +Copyright (C) 2014 Matthieu Napoli + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and +associated documentation files (the "Software"), to deal in the Software without restriction, +including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, +and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, +subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial +portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT +NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, +WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE +SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/vendor/mnapoli/front-yaml/README.md b/vendor/mnapoli/front-yaml/README.md new file mode 100644 index 000000000..aaee30788 --- /dev/null +++ b/vendor/mnapoli/front-yaml/README.md @@ -0,0 +1,86 @@ +# FrontYAML + +An implementation of YAML Front matter for PHP. Can parse the YAML *and* the Markdown. + +[![Build Status](https://travis-ci.org/mnapoli/FrontYAML.png?branch=master)](https://travis-ci.org/mnapoli/FrontYAML) +[![Total Downloads](https://poser.pugx.org/mnapoli/front-yaml/downloads.svg)](https://packagist.org/packages/mnapoli/front-yaml) + +## Installation + +Require the project with Composer: + +``` +composer require mnapoli/front-yaml +``` + +## Usage + +```php +$parser = new Mni\FrontYAML\Parser(); + +$document = $parser->parse($str); + +$yaml = $document->getYAML(); +$html = $document->getContent(); +``` + +If you don't want the Markdown to be parsed (maybe because it is not Markdown): + +```php +$document = $parser->parse($str, false); +``` + +## Example + +The following file: + +```markdown +--- +foo: bar +--- +This is **strong**. +``` + +Will give: + +```php +var_export($document->getYAML()); +// array("foo" => "bar") + +var_export($document->getContent()); +// "

    This is strong

    " +``` + +## YAML and Markdown parsers + +```php +$parser = new Mni\FrontYAML\Parser($yamlParser, $markdownParser); +``` + +This library uses dependency injection and abstraction to allow you to provide your own YAML or Markdown parser. + +```php +interface YAMLParser +{ + public function parse($yaml); +} +``` + +FrontYAML uses by default [Symfony's YAML parser](http://symfony.com/doc/current/components/yaml/introduction.html). + +```php +interface MarkdownParser +{ + public function parse($markdown); +} +``` + +FrontYAML uses by default [Parsedown Markdown parser](http://parsedown.org/). + +An adapter to [League CommonMark](https://github.com/thephpleague/commonmark) is also included (you need to require the `league/commonmark` though): + +```php +use \Mni\FrontYAML\Bridge\CommonMark\CommonMarkParser; + +$parser = new Mni\FrontYAML\Parser(null, new CommonMarkParser()); +``` diff --git a/vendor/mnapoli/front-yaml/composer.json b/vendor/mnapoli/front-yaml/composer.json new file mode 100644 index 000000000..05fa5de82 --- /dev/null +++ b/vendor/mnapoli/front-yaml/composer.json @@ -0,0 +1,23 @@ +{ + "name": "mnapoli/front-yaml", + "license": "MIT", + "autoload": { + "psr-4": { + "Mni\\FrontYAML\\": "src/" + } + }, + "autoload-dev": { + "psr-4": { + "Mni\\FrontYAML\\Test\\": "tests/" + } + }, + "require": { + "php": ">=7.3", + "symfony/yaml": "~2.1|^3.0|^4.0|^5.0", + "erusev/parsedown": "~1.0" + }, + "require-dev": { + "phpunit/phpunit": "^9.4", + "league/commonmark": "~1.4" + } +} diff --git a/vendor/mnapoli/front-yaml/phpunit.xml.dist b/vendor/mnapoli/front-yaml/phpunit.xml.dist new file mode 100644 index 000000000..93a96e8a0 --- /dev/null +++ b/vendor/mnapoli/front-yaml/phpunit.xml.dist @@ -0,0 +1,21 @@ + + + + + + + ./tests/ + + + + diff --git a/vendor/mnapoli/front-yaml/src/Bridge/CommonMark/CommonMarkParser.php b/vendor/mnapoli/front-yaml/src/Bridge/CommonMark/CommonMarkParser.php new file mode 100644 index 000000000..b4c7c3c76 --- /dev/null +++ b/vendor/mnapoli/front-yaml/src/Bridge/CommonMark/CommonMarkParser.php @@ -0,0 +1,33 @@ + + */ +class CommonMarkParser implements MarkdownParser +{ + public function __construct(CommonMarkConverter $commonMarkConverter = null) + { + $this->parser = $commonMarkConverter ?: new CommonMarkConverter(); + } + + /** + * {@inheritdoc} + */ + public function parse($markdown) + { + return $this->parser->convertToHtml($markdown); + } +} diff --git a/vendor/mnapoli/front-yaml/src/Bridge/Parsedown/ParsedownParser.php b/vendor/mnapoli/front-yaml/src/Bridge/Parsedown/ParsedownParser.php new file mode 100644 index 000000000..9f9ff2d3c --- /dev/null +++ b/vendor/mnapoli/front-yaml/src/Bridge/Parsedown/ParsedownParser.php @@ -0,0 +1,33 @@ + + */ +class ParsedownParser implements MarkdownParser +{ + public function __construct(Parsedown $parsedown = null) + { + $this->parser = $parsedown ?: new Parsedown(); + } + + /** + * {@inheritdoc} + */ + public function parse($markdown) + { + return $this->parser->parse($markdown); + } +} diff --git a/vendor/mnapoli/front-yaml/src/Bridge/Symfony/SymfonyYAMLParser.php b/vendor/mnapoli/front-yaml/src/Bridge/Symfony/SymfonyYAMLParser.php new file mode 100644 index 000000000..ce1c7268d --- /dev/null +++ b/vendor/mnapoli/front-yaml/src/Bridge/Symfony/SymfonyYAMLParser.php @@ -0,0 +1,38 @@ + + */ +class SymfonyYAMLParser implements YAMLParser +{ + /** + * @var Parser + */ + private $parser; + + public function __construct() + { + $this->parser = new Parser(); + } + + /** + * {@inheritdoc} + */ + public function parse($yaml) + { + return $this->parser->parse($yaml); + } +} diff --git a/vendor/mnapoli/front-yaml/src/Document.php b/vendor/mnapoli/front-yaml/src/Document.php new file mode 100644 index 000000000..9fdf5a0c3 --- /dev/null +++ b/vendor/mnapoli/front-yaml/src/Document.php @@ -0,0 +1,53 @@ + + */ +class Document +{ + /** + * @var mixed + */ + private $yaml; + + /** + * @var string + */ + private $content; + + /** + * @param mixed $yaml YAML content. + * @param string $content Content of the document. + */ + public function __construct($yaml, $content) + { + $this->yaml = $yaml; + $this->content = $content; + } + + /** + * @return mixed YAML content. + */ + public function getYAML() + { + return $this->yaml; + } + + /** + * @return string Content of the document. + */ + public function getContent() + { + return $this->content; + } +} diff --git a/vendor/mnapoli/front-yaml/src/Markdown/MarkdownParser.php b/vendor/mnapoli/front-yaml/src/Markdown/MarkdownParser.php new file mode 100644 index 000000000..1e3c1c2d0 --- /dev/null +++ b/vendor/mnapoli/front-yaml/src/Markdown/MarkdownParser.php @@ -0,0 +1,26 @@ + + */ +interface MarkdownParser +{ + /** + * Parses a Markdown string to HTML. + * + * @param string $markdown Markdown document. + * + * @return string HTML document. + */ + public function parse($markdown); +} diff --git a/vendor/mnapoli/front-yaml/src/Parser.php b/vendor/mnapoli/front-yaml/src/Parser.php new file mode 100644 index 000000000..3a2c6738a --- /dev/null +++ b/vendor/mnapoli/front-yaml/src/Parser.php @@ -0,0 +1,84 @@ + + */ +class Parser +{ + /** + * @var YAMLParser + */ + private $yamlParser; + + /** + * @var MarkdownParser + */ + private $markdownParser; + + /** + * @var array + */ + private $startSep; + + /** + * @var array + */ + private $endSep; + + public function __construct( + YAMLParser $yamlParser = null, + MarkdownParser $markdownParser = null, + $startSep = '---', + $endSep = '---' + ) { + $this->yamlParser = $yamlParser ?: new SymfonyYAMLParser(); + $this->markdownParser = $markdownParser ?: new ParsedownParser(); + $this->startSep = array_filter((array) $startSep, 'is_string') ?: array('---'); + $this->endSep = array_filter((array) $endSep, 'is_string') ?: array('---'); + } + + /** + * Parse a string containing the YAML front matter and the markdown. + * + * @param string $str + * @param bool $parseMarkdown Should the Markdown be turned into HTML? + * + * @return Document + */ + public function parse($str, $parseMarkdown = true) + { + $yaml = null; + + $quote = function ($str) { + return preg_quote($str, "~"); + }; + + $regex = '~^(' + .implode('|', array_map($quote, $this->startSep)) # $matches[1] start separator + ."){1}[\r\n|\n]*(.*?)[\r\n|\n]+(" # $matches[2] between separators + .implode('|', array_map($quote, $this->endSep)) # $matches[3] end separator + ."){1}[\r\n|\n]*(.*)$~s"; # $matches[4] document content + + if (preg_match($regex, $str, $matches) === 1) { // There is a Front matter + $yaml = trim($matches[2]) !== '' ? $this->yamlParser->parse(trim($matches[2])) : null; + $str = ltrim($matches[4]); + } + + return new Document($yaml, $parseMarkdown ? $this->markdownParser->parse($str) : $str); + } +} diff --git a/vendor/mnapoli/front-yaml/src/YAML/YAMLParser.php b/vendor/mnapoli/front-yaml/src/YAML/YAMLParser.php new file mode 100644 index 000000000..49df86b66 --- /dev/null +++ b/vendor/mnapoli/front-yaml/src/YAML/YAMLParser.php @@ -0,0 +1,26 @@ + + */ +interface YAMLParser +{ + /** + * Parses a YAML string. + * + * @param string $yaml + * + * @return mixed + */ + public function parse($yaml); +} diff --git a/vendor/symfony/deprecation-contracts/.gitignore b/vendor/symfony/deprecation-contracts/.gitignore new file mode 100644 index 000000000..c49a5d8df --- /dev/null +++ b/vendor/symfony/deprecation-contracts/.gitignore @@ -0,0 +1,3 @@ +vendor/ +composer.lock +phpunit.xml diff --git a/vendor/symfony/deprecation-contracts/CHANGELOG.md b/vendor/symfony/deprecation-contracts/CHANGELOG.md new file mode 100644 index 000000000..e9847779b --- /dev/null +++ b/vendor/symfony/deprecation-contracts/CHANGELOG.md @@ -0,0 +1,5 @@ +CHANGELOG +========= + +The changelog is maintained for all Symfony contracts at the following URL: +https://github.com/symfony/contracts/blob/master/CHANGELOG.md diff --git a/vendor/symfony/deprecation-contracts/LICENSE b/vendor/symfony/deprecation-contracts/LICENSE new file mode 100644 index 000000000..5593b1d84 --- /dev/null +++ b/vendor/symfony/deprecation-contracts/LICENSE @@ -0,0 +1,19 @@ +Copyright (c) 2020 Fabien Potencier + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is furnished +to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/vendor/symfony/deprecation-contracts/README.md b/vendor/symfony/deprecation-contracts/README.md new file mode 100644 index 000000000..4957933a6 --- /dev/null +++ b/vendor/symfony/deprecation-contracts/README.md @@ -0,0 +1,26 @@ +Symfony Deprecation Contracts +============================= + +A generic function and convention to trigger deprecation notices. + +This package provides a single global function named `trigger_deprecation()` that triggers silenced deprecation notices. + +By using a custom PHP error handler such as the one provided by the Symfony ErrorHandler component, +the triggered deprecations can be caught and logged for later discovery, both on dev and prod environments. + +The function requires at least 3 arguments: + - the name of the Composer package that is triggering the deprecation + - the version of the package that introduced the deprecation + - the message of the deprecation + - more arguments can be provided: they will be inserted in the message using `printf()` formatting + +Example: +```php +trigger_deprecation('symfony/blockchain', '8.9', 'Using "%s" is deprecated, use "%s" instead.', 'bitcoin', 'fabcoin'); +``` + +This will generate the following message: +`Since symfony/blockchain 8.9: Using "bitcoin" is deprecated, use "fabcoin" instead.` + +While not necessarily recommended, the deprecation notices can be completely ignored by declaring an empty +`function trigger_deprecation() {}` in your application. diff --git a/vendor/symfony/deprecation-contracts/composer.json b/vendor/symfony/deprecation-contracts/composer.json new file mode 100644 index 000000000..052541cce --- /dev/null +++ b/vendor/symfony/deprecation-contracts/composer.json @@ -0,0 +1,35 @@ +{ + "name": "symfony/deprecation-contracts", + "type": "library", + "description": "A generic function and convention to trigger deprecation notices", + "homepage": "https://symfony.com", + "license": "MIT", + "authors": [ + { + "name": "Nicolas Grekas", + "email": "p@tchwork.com" + }, + { + "name": "Symfony Community", + "homepage": "https://symfony.com/contributors" + } + ], + "require": { + "php": ">=7.1" + }, + "autoload": { + "files": [ + "function.php" + ] + }, + "minimum-stability": "dev", + "extra": { + "branch-alias": { + "dev-master": "2.2-dev" + }, + "thanks": { + "name": "symfony/contracts", + "url": "https://github.com/symfony/contracts" + } + } +} diff --git a/vendor/symfony/deprecation-contracts/function.php b/vendor/symfony/deprecation-contracts/function.php new file mode 100644 index 000000000..d4371504a --- /dev/null +++ b/vendor/symfony/deprecation-contracts/function.php @@ -0,0 +1,27 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +if (!function_exists('trigger_deprecation')) { + /** + * Triggers a silenced deprecation notice. + * + * @param string $package The name of the Composer package that is triggering the deprecation + * @param string $version The version of the package that introduced the deprecation + * @param string $message The message of the deprecation + * @param mixed ...$args Values to insert in the message using printf() formatting + * + * @author Nicolas Grekas + */ + function trigger_deprecation(string $package, string $version, string $message, ...$args): void + { + @trigger_error(($package || $version ? "Since $package $version: " : '').($args ? vsprintf($message, $args) : $message), \E_USER_DEPRECATED); + } +} diff --git a/vendor/symfony/polyfill-ctype/Ctype.php b/vendor/symfony/polyfill-ctype/Ctype.php new file mode 100644 index 000000000..58414dc73 --- /dev/null +++ b/vendor/symfony/polyfill-ctype/Ctype.php @@ -0,0 +1,227 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +namespace Symfony\Polyfill\Ctype; + +/** + * Ctype implementation through regex. + * + * @internal + * + * @author Gert de Pagter + */ +final class Ctype +{ + /** + * Returns TRUE if every character in text is either a letter or a digit, FALSE otherwise. + * + * @see https://php.net/ctype-alnum + * + * @param string|int $text + * + * @return bool + */ + public static function ctype_alnum($text) + { + $text = self::convert_int_to_char_for_ctype($text); + + return \is_string($text) && '' !== $text && !preg_match('/[^A-Za-z0-9]/', $text); + } + + /** + * Returns TRUE if every character in text is a letter, FALSE otherwise. + * + * @see https://php.net/ctype-alpha + * + * @param string|int $text + * + * @return bool + */ + public static function ctype_alpha($text) + { + $text = self::convert_int_to_char_for_ctype($text); + + return \is_string($text) && '' !== $text && !preg_match('/[^A-Za-z]/', $text); + } + + /** + * Returns TRUE if every character in text is a control character from the current locale, FALSE otherwise. + * + * @see https://php.net/ctype-cntrl + * + * @param string|int $text + * + * @return bool + */ + public static function ctype_cntrl($text) + { + $text = self::convert_int_to_char_for_ctype($text); + + return \is_string($text) && '' !== $text && !preg_match('/[^\x00-\x1f\x7f]/', $text); + } + + /** + * Returns TRUE if every character in the string text is a decimal digit, FALSE otherwise. + * + * @see https://php.net/ctype-digit + * + * @param string|int $text + * + * @return bool + */ + public static function ctype_digit($text) + { + $text = self::convert_int_to_char_for_ctype($text); + + return \is_string($text) && '' !== $text && !preg_match('/[^0-9]/', $text); + } + + /** + * Returns TRUE if every character in text is printable and actually creates visible output (no white space), FALSE otherwise. + * + * @see https://php.net/ctype-graph + * + * @param string|int $text + * + * @return bool + */ + public static function ctype_graph($text) + { + $text = self::convert_int_to_char_for_ctype($text); + + return \is_string($text) && '' !== $text && !preg_match('/[^!-~]/', $text); + } + + /** + * Returns TRUE if every character in text is a lowercase letter. + * + * @see https://php.net/ctype-lower + * + * @param string|int $text + * + * @return bool + */ + public static function ctype_lower($text) + { + $text = self::convert_int_to_char_for_ctype($text); + + return \is_string($text) && '' !== $text && !preg_match('/[^a-z]/', $text); + } + + /** + * Returns TRUE if every character in text will actually create output (including blanks). Returns FALSE if text contains control characters or characters that do not have any output or control function at all. + * + * @see https://php.net/ctype-print + * + * @param string|int $text + * + * @return bool + */ + public static function ctype_print($text) + { + $text = self::convert_int_to_char_for_ctype($text); + + return \is_string($text) && '' !== $text && !preg_match('/[^ -~]/', $text); + } + + /** + * Returns TRUE if every character in text is printable, but neither letter, digit or blank, FALSE otherwise. + * + * @see https://php.net/ctype-punct + * + * @param string|int $text + * + * @return bool + */ + public static function ctype_punct($text) + { + $text = self::convert_int_to_char_for_ctype($text); + + return \is_string($text) && '' !== $text && !preg_match('/[^!-\/\:-@\[-`\{-~]/', $text); + } + + /** + * Returns TRUE if every character in text creates some sort of white space, FALSE otherwise. Besides the blank character this also includes tab, vertical tab, line feed, carriage return and form feed characters. + * + * @see https://php.net/ctype-space + * + * @param string|int $text + * + * @return bool + */ + public static function ctype_space($text) + { + $text = self::convert_int_to_char_for_ctype($text); + + return \is_string($text) && '' !== $text && !preg_match('/[^\s]/', $text); + } + + /** + * Returns TRUE if every character in text is an uppercase letter. + * + * @see https://php.net/ctype-upper + * + * @param string|int $text + * + * @return bool + */ + public static function ctype_upper($text) + { + $text = self::convert_int_to_char_for_ctype($text); + + return \is_string($text) && '' !== $text && !preg_match('/[^A-Z]/', $text); + } + + /** + * Returns TRUE if every character in text is a hexadecimal 'digit', that is a decimal digit or a character from [A-Fa-f] , FALSE otherwise. + * + * @see https://php.net/ctype-xdigit + * + * @param string|int $text + * + * @return bool + */ + public static function ctype_xdigit($text) + { + $text = self::convert_int_to_char_for_ctype($text); + + return \is_string($text) && '' !== $text && !preg_match('/[^A-Fa-f0-9]/', $text); + } + + /** + * Converts integers to their char versions according to normal ctype behaviour, if needed. + * + * If an integer between -128 and 255 inclusive is provided, + * it is interpreted as the ASCII value of a single character + * (negative values have 256 added in order to allow characters in the Extended ASCII range). + * Any other integer is interpreted as a string containing the decimal digits of the integer. + * + * @param string|int $int + * + * @return mixed + */ + private static function convert_int_to_char_for_ctype($int) + { + if (!\is_int($int)) { + return $int; + } + + if ($int < -128 || $int > 255) { + return (string) $int; + } + + if ($int < 0) { + $int += 256; + } + + return \chr($int); + } +} diff --git a/vendor/symfony/polyfill-ctype/LICENSE b/vendor/symfony/polyfill-ctype/LICENSE new file mode 100644 index 000000000..3f853aaf3 --- /dev/null +++ b/vendor/symfony/polyfill-ctype/LICENSE @@ -0,0 +1,19 @@ +Copyright (c) 2018-2019 Fabien Potencier + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is furnished +to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/vendor/symfony/polyfill-ctype/README.md b/vendor/symfony/polyfill-ctype/README.md new file mode 100644 index 000000000..8add1ab00 --- /dev/null +++ b/vendor/symfony/polyfill-ctype/README.md @@ -0,0 +1,12 @@ +Symfony Polyfill / Ctype +======================== + +This component provides `ctype_*` functions to users who run php versions without the ctype extension. + +More information can be found in the +[main Polyfill README](https://github.com/symfony/polyfill/blob/master/README.md). + +License +======= + +This library is released under the [MIT license](LICENSE). diff --git a/vendor/symfony/polyfill-ctype/bootstrap.php b/vendor/symfony/polyfill-ctype/bootstrap.php new file mode 100644 index 000000000..d54524b31 --- /dev/null +++ b/vendor/symfony/polyfill-ctype/bootstrap.php @@ -0,0 +1,50 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +use Symfony\Polyfill\Ctype as p; + +if (\PHP_VERSION_ID >= 80000) { + return require __DIR__.'/bootstrap80.php'; +} + +if (!function_exists('ctype_alnum')) { + function ctype_alnum($text) { return p\Ctype::ctype_alnum($text); } +} +if (!function_exists('ctype_alpha')) { + function ctype_alpha($text) { return p\Ctype::ctype_alpha($text); } +} +if (!function_exists('ctype_cntrl')) { + function ctype_cntrl($text) { return p\Ctype::ctype_cntrl($text); } +} +if (!function_exists('ctype_digit')) { + function ctype_digit($text) { return p\Ctype::ctype_digit($text); } +} +if (!function_exists('ctype_graph')) { + function ctype_graph($text) { return p\Ctype::ctype_graph($text); } +} +if (!function_exists('ctype_lower')) { + function ctype_lower($text) { return p\Ctype::ctype_lower($text); } +} +if (!function_exists('ctype_print')) { + function ctype_print($text) { return p\Ctype::ctype_print($text); } +} +if (!function_exists('ctype_punct')) { + function ctype_punct($text) { return p\Ctype::ctype_punct($text); } +} +if (!function_exists('ctype_space')) { + function ctype_space($text) { return p\Ctype::ctype_space($text); } +} +if (!function_exists('ctype_upper')) { + function ctype_upper($text) { return p\Ctype::ctype_upper($text); } +} +if (!function_exists('ctype_xdigit')) { + function ctype_xdigit($text) { return p\Ctype::ctype_xdigit($text); } +} diff --git a/vendor/symfony/polyfill-ctype/bootstrap80.php b/vendor/symfony/polyfill-ctype/bootstrap80.php new file mode 100644 index 000000000..ab2f8611d --- /dev/null +++ b/vendor/symfony/polyfill-ctype/bootstrap80.php @@ -0,0 +1,46 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +use Symfony\Polyfill\Ctype as p; + +if (!function_exists('ctype_alnum')) { + function ctype_alnum(mixed $text): bool { return p\Ctype::ctype_alnum($text); } +} +if (!function_exists('ctype_alpha')) { + function ctype_alpha(mixed $text): bool { return p\Ctype::ctype_alpha($text); } +} +if (!function_exists('ctype_cntrl')) { + function ctype_cntrl(mixed $text): bool { return p\Ctype::ctype_cntrl($text); } +} +if (!function_exists('ctype_digit')) { + function ctype_digit(mixed $text): bool { return p\Ctype::ctype_digit($text); } +} +if (!function_exists('ctype_graph')) { + function ctype_graph(mixed $text): bool { return p\Ctype::ctype_graph($text); } +} +if (!function_exists('ctype_lower')) { + function ctype_lower(mixed $text): bool { return p\Ctype::ctype_lower($text); } +} +if (!function_exists('ctype_print')) { + function ctype_print(mixed $text): bool { return p\Ctype::ctype_print($text); } +} +if (!function_exists('ctype_punct')) { + function ctype_punct(mixed $text): bool { return p\Ctype::ctype_punct($text); } +} +if (!function_exists('ctype_space')) { + function ctype_space(mixed $text): bool { return p\Ctype::ctype_space($text); } +} +if (!function_exists('ctype_upper')) { + function ctype_upper(mixed $text): bool { return p\Ctype::ctype_upper($text); } +} +if (!function_exists('ctype_xdigit')) { + function ctype_xdigit(mixed $text): bool { return p\Ctype::ctype_xdigit($text); } +} diff --git a/vendor/symfony/polyfill-ctype/composer.json b/vendor/symfony/polyfill-ctype/composer.json new file mode 100644 index 000000000..995978c0a --- /dev/null +++ b/vendor/symfony/polyfill-ctype/composer.json @@ -0,0 +1,38 @@ +{ + "name": "symfony/polyfill-ctype", + "type": "library", + "description": "Symfony polyfill for ctype functions", + "keywords": ["polyfill", "compatibility", "portable", "ctype"], + "homepage": "https://symfony.com", + "license": "MIT", + "authors": [ + { + "name": "Gert de Pagter", + "email": "BackEndTea@gmail.com" + }, + { + "name": "Symfony Community", + "homepage": "https://symfony.com/contributors" + } + ], + "require": { + "php": ">=7.1" + }, + "autoload": { + "psr-4": { "Symfony\\Polyfill\\Ctype\\": "" }, + "files": [ "bootstrap.php" ] + }, + "suggest": { + "ext-ctype": "For best performance" + }, + "minimum-stability": "dev", + "extra": { + "branch-alias": { + "dev-main": "1.22-dev" + }, + "thanks": { + "name": "symfony/polyfill", + "url": "https://github.com/symfony/polyfill" + } + } +} diff --git a/vendor/symfony/yaml/CHANGELOG.md b/vendor/symfony/yaml/CHANGELOG.md new file mode 100644 index 000000000..d4f2b5d78 --- /dev/null +++ b/vendor/symfony/yaml/CHANGELOG.md @@ -0,0 +1,224 @@ +CHANGELOG +========= + +5.1.0 +----- + + * Added support for parsing numbers prefixed with `0o` as octal numbers. + * Deprecated support for parsing numbers starting with `0` as octal numbers. They will be parsed as strings as of Symfony 6.0. Prefix numbers with `0o` + so that they are parsed as octal numbers. + + Before: + + ```yaml + Yaml::parse('072'); + ``` + + After: + + ```yaml + Yaml::parse('0o72'); + ``` + + * Added `yaml-lint` binary. + * Deprecated using the `!php/object` and `!php/const` tags without a value. + +5.0.0 +----- + + * Removed support for mappings inside multi-line strings. + * removed support for implicit STDIN usage in the `lint:yaml` command, use `lint:yaml -` (append a dash) instead to make it explicit. + +4.4.0 +----- + + * Added support for parsing the inline notation spanning multiple lines. + * Added support to dump `null` as `~` by using the `Yaml::DUMP_NULL_AS_TILDE` flag. + * deprecated accepting STDIN implicitly when using the `lint:yaml` command, use `lint:yaml -` (append a dash) instead to make it explicit. + +4.3.0 +----- + + * Using a mapping inside a multi-line string is deprecated and will throw a `ParseException` in 5.0. + +4.2.0 +----- + + * added support for multiple files or directories in `LintCommand` + +4.0.0 +----- + + * The behavior of the non-specific tag `!` is changed and now forces + non-evaluating your values. + * complex mappings will throw a `ParseException` + * support for the comma as a group separator for floats has been dropped, use + the underscore instead + * support for the `!!php/object` tag has been dropped, use the `!php/object` + tag instead + * duplicate mapping keys throw a `ParseException` + * non-string mapping keys throw a `ParseException`, use the `Yaml::PARSE_KEYS_AS_STRINGS` + flag to cast them to strings + * `%` at the beginning of an unquoted string throw a `ParseException` + * mappings with a colon (`:`) that is not followed by a whitespace throw a + `ParseException` + * the `Dumper::setIndentation()` method has been removed + * being able to pass boolean options to the `Yaml::parse()`, `Yaml::dump()`, + `Parser::parse()`, and `Dumper::dump()` methods to configure the behavior of + the parser and dumper is no longer supported, pass bitmask flags instead + * the constructor arguments of the `Parser` class have been removed + * the `Inline` class is internal and no longer part of the BC promise + * removed support for the `!str` tag, use the `!!str` tag instead + * added support for tagged scalars. + + ```yml + Yaml::parse('!foo bar', Yaml::PARSE_CUSTOM_TAGS); + // returns TaggedValue('foo', 'bar'); + ``` + +3.4.0 +----- + + * added support for parsing YAML files using the `Yaml::parseFile()` or `Parser::parseFile()` method + + * the `Dumper`, `Parser`, and `Yaml` classes are marked as final + + * Deprecated the `!php/object:` tag which will be replaced by the + `!php/object` tag (without the colon) in 4.0. + + * Deprecated the `!php/const:` tag which will be replaced by the + `!php/const` tag (without the colon) in 4.0. + + * Support for the `!str` tag is deprecated, use the `!!str` tag instead. + + * Deprecated using the non-specific tag `!` as its behavior will change in 4.0. + It will force non-evaluating your values in 4.0. Use plain integers or `!!float` instead. + +3.3.0 +----- + + * Starting an unquoted string with a question mark followed by a space is + deprecated and will throw a `ParseException` in Symfony 4.0. + + * Deprecated support for implicitly parsing non-string mapping keys as strings. + Mapping keys that are no strings will lead to a `ParseException` in Symfony + 4.0. Use quotes to opt-in for keys to be parsed as strings. + + Before: + + ```php + $yaml = << new A(), 'bar' => 1], 0, 0, Yaml::DUMP_EXCEPTION_ON_INVALID_TYPE | Yaml::DUMP_OBJECT); + ``` + +3.0.0 +----- + + * Yaml::parse() now throws an exception when a blackslash is not escaped + in double-quoted strings + +2.8.0 +----- + + * Deprecated usage of a colon in an unquoted mapping value + * Deprecated usage of @, \`, | and > at the beginning of an unquoted string + * When surrounding strings with double-quotes, you must now escape `\` characters. Not + escaping those characters (when surrounded by double-quotes) is deprecated. + + Before: + + ```yml + class: "Foo\Var" + ``` + + After: + + ```yml + class: "Foo\\Var" + ``` + +2.1.0 +----- + + * Yaml::parse() does not evaluate loaded files as PHP files by default + anymore (call Yaml::enablePhpParsing() to get back the old behavior) diff --git a/vendor/symfony/yaml/Command/LintCommand.php b/vendor/symfony/yaml/Command/LintCommand.php new file mode 100644 index 000000000..83f36a938 --- /dev/null +++ b/vendor/symfony/yaml/Command/LintCommand.php @@ -0,0 +1,248 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +namespace Symfony\Component\Yaml\Command; + +use Symfony\Component\Console\Command\Command; +use Symfony\Component\Console\Exception\InvalidArgumentException; +use Symfony\Component\Console\Exception\RuntimeException; +use Symfony\Component\Console\Input\InputArgument; +use Symfony\Component\Console\Input\InputInterface; +use Symfony\Component\Console\Input\InputOption; +use Symfony\Component\Console\Output\OutputInterface; +use Symfony\Component\Console\Style\SymfonyStyle; +use Symfony\Component\Yaml\Exception\ParseException; +use Symfony\Component\Yaml\Parser; +use Symfony\Component\Yaml\Yaml; + +/** + * Validates YAML files syntax and outputs encountered errors. + * + * @author Grégoire Pineau + * @author Robin Chalas + */ +class LintCommand extends Command +{ + protected static $defaultName = 'lint:yaml'; + + private $parser; + private $format; + private $displayCorrectFiles; + private $directoryIteratorProvider; + private $isReadableProvider; + + public function __construct(string $name = null, callable $directoryIteratorProvider = null, callable $isReadableProvider = null) + { + parent::__construct($name); + + $this->directoryIteratorProvider = $directoryIteratorProvider; + $this->isReadableProvider = $isReadableProvider; + } + + /** + * {@inheritdoc} + */ + protected function configure() + { + $this + ->setDescription('Lints a file and outputs encountered errors') + ->addArgument('filename', InputArgument::IS_ARRAY, 'A file, a directory or "-" for reading from STDIN') + ->addOption('format', null, InputOption::VALUE_REQUIRED, 'The output format', 'txt') + ->addOption('parse-tags', null, InputOption::VALUE_NONE, 'Parse custom tags') + ->setHelp(<<%command.name% command lints a YAML file and outputs to STDOUT +the first encountered syntax error. + +You can validates YAML contents passed from STDIN: + + cat filename | php %command.full_name% - + +You can also validate the syntax of a file: + + php %command.full_name% filename + +Or of a whole directory: + + php %command.full_name% dirname + php %command.full_name% dirname --format=json + +EOF + ) + ; + } + + protected function execute(InputInterface $input, OutputInterface $output) + { + $io = new SymfonyStyle($input, $output); + $filenames = (array) $input->getArgument('filename'); + $this->format = $input->getOption('format'); + $this->displayCorrectFiles = $output->isVerbose(); + $flags = $input->getOption('parse-tags') ? Yaml::PARSE_CUSTOM_TAGS : 0; + + if (['-'] === $filenames) { + return $this->display($io, [$this->validate(file_get_contents('php://stdin'), $flags)]); + } + + if (!$filenames) { + throw new RuntimeException('Please provide a filename or pipe file content to STDIN.'); + } + + $filesInfo = []; + foreach ($filenames as $filename) { + if (!$this->isReadable($filename)) { + throw new RuntimeException(sprintf('File or directory "%s" is not readable.', $filename)); + } + + foreach ($this->getFiles($filename) as $file) { + $filesInfo[] = $this->validate(file_get_contents($file), $flags, $file); + } + } + + return $this->display($io, $filesInfo); + } + + private function validate(string $content, int $flags, string $file = null) + { + $prevErrorHandler = set_error_handler(function ($level, $message, $file, $line) use (&$prevErrorHandler) { + if (\E_USER_DEPRECATED === $level) { + throw new ParseException($message, $this->getParser()->getRealCurrentLineNb() + 1); + } + + return $prevErrorHandler ? $prevErrorHandler($level, $message, $file, $line) : false; + }); + + try { + $this->getParser()->parse($content, Yaml::PARSE_CONSTANT | $flags); + } catch (ParseException $e) { + return ['file' => $file, 'line' => $e->getParsedLine(), 'valid' => false, 'message' => $e->getMessage()]; + } finally { + restore_error_handler(); + } + + return ['file' => $file, 'valid' => true]; + } + + private function display(SymfonyStyle $io, array $files): int + { + switch ($this->format) { + case 'txt': + return $this->displayTxt($io, $files); + case 'json': + return $this->displayJson($io, $files); + default: + throw new InvalidArgumentException(sprintf('The format "%s" is not supported.', $this->format)); + } + } + + private function displayTxt(SymfonyStyle $io, array $filesInfo): int + { + $countFiles = \count($filesInfo); + $erroredFiles = 0; + $suggestTagOption = false; + + foreach ($filesInfo as $info) { + if ($info['valid'] && $this->displayCorrectFiles) { + $io->comment('OK'.($info['file'] ? sprintf(' in %s', $info['file']) : '')); + } elseif (!$info['valid']) { + ++$erroredFiles; + $io->text(' ERROR '.($info['file'] ? sprintf(' in %s', $info['file']) : '')); + $io->text(sprintf(' >> %s', $info['message'])); + + if (false !== strpos($info['message'], 'PARSE_CUSTOM_TAGS')) { + $suggestTagOption = true; + } + } + } + + if (0 === $erroredFiles) { + $io->success(sprintf('All %d YAML files contain valid syntax.', $countFiles)); + } else { + $io->warning(sprintf('%d YAML files have valid syntax and %d contain errors.%s', $countFiles - $erroredFiles, $erroredFiles, $suggestTagOption ? ' Use the --parse-tags option if you want parse custom tags.' : '')); + } + + return min($erroredFiles, 1); + } + + private function displayJson(SymfonyStyle $io, array $filesInfo): int + { + $errors = 0; + + array_walk($filesInfo, function (&$v) use (&$errors) { + $v['file'] = (string) $v['file']; + if (!$v['valid']) { + ++$errors; + } + + if (isset($v['message']) && false !== strpos($v['message'], 'PARSE_CUSTOM_TAGS')) { + $v['message'] .= ' Use the --parse-tags option if you want parse custom tags.'; + } + }); + + $io->writeln(json_encode($filesInfo, \JSON_PRETTY_PRINT | \JSON_UNESCAPED_SLASHES)); + + return min($errors, 1); + } + + private function getFiles(string $fileOrDirectory): iterable + { + if (is_file($fileOrDirectory)) { + yield new \SplFileInfo($fileOrDirectory); + + return; + } + + foreach ($this->getDirectoryIterator($fileOrDirectory) as $file) { + if (!\in_array($file->getExtension(), ['yml', 'yaml'])) { + continue; + } + + yield $file; + } + } + + private function getParser(): Parser + { + if (!$this->parser) { + $this->parser = new Parser(); + } + + return $this->parser; + } + + private function getDirectoryIterator(string $directory): iterable + { + $default = function ($directory) { + return new \RecursiveIteratorIterator( + new \RecursiveDirectoryIterator($directory, \FilesystemIterator::SKIP_DOTS | \FilesystemIterator::FOLLOW_SYMLINKS), + \RecursiveIteratorIterator::LEAVES_ONLY + ); + }; + + if (null !== $this->directoryIteratorProvider) { + return ($this->directoryIteratorProvider)($directory, $default); + } + + return $default($directory); + } + + private function isReadable(string $fileOrDirectory): bool + { + $default = function ($fileOrDirectory) { + return is_readable($fileOrDirectory); + }; + + if (null !== $this->isReadableProvider) { + return ($this->isReadableProvider)($fileOrDirectory, $default); + } + + return $default($fileOrDirectory); + } +} diff --git a/vendor/symfony/yaml/Dumper.php b/vendor/symfony/yaml/Dumper.php new file mode 100644 index 000000000..dcb104ccf --- /dev/null +++ b/vendor/symfony/yaml/Dumper.php @@ -0,0 +1,142 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +namespace Symfony\Component\Yaml; + +use Symfony\Component\Yaml\Tag\TaggedValue; + +/** + * Dumper dumps PHP variables to YAML strings. + * + * @author Fabien Potencier + * + * @final + */ +class Dumper +{ + /** + * The amount of spaces to use for indentation of nested nodes. + * + * @var int + */ + protected $indentation; + + public function __construct(int $indentation = 4) + { + if ($indentation < 1) { + throw new \InvalidArgumentException('The indentation must be greater than zero.'); + } + + $this->indentation = $indentation; + } + + /** + * Dumps a PHP value to YAML. + * + * @param mixed $input The PHP value + * @param int $inline The level where you switch to inline YAML + * @param int $indent The level of indentation (used internally) + * @param int $flags A bit field of Yaml::DUMP_* constants to customize the dumped YAML string + * + * @return string The YAML representation of the PHP value + */ + public function dump($input, int $inline = 0, int $indent = 0, int $flags = 0): string + { + $output = ''; + $prefix = $indent ? str_repeat(' ', $indent) : ''; + $dumpObjectAsInlineMap = true; + + if (Yaml::DUMP_OBJECT_AS_MAP & $flags && ($input instanceof \ArrayObject || $input instanceof \stdClass)) { + $dumpObjectAsInlineMap = empty((array) $input); + } + + if ($inline <= 0 || (!\is_array($input) && !$input instanceof TaggedValue && $dumpObjectAsInlineMap) || empty($input)) { + $output .= $prefix.Inline::dump($input, $flags); + } else { + $dumpAsMap = Inline::isHash($input); + + foreach ($input as $key => $value) { + if ('' !== $output && "\n" !== $output[-1]) { + $output .= "\n"; + } + + if (Yaml::DUMP_MULTI_LINE_LITERAL_BLOCK & $flags && \is_string($value) && false !== strpos($value, "\n") && false === strpos($value, "\r")) { + // If the first line starts with a space character, the spec requires a blockIndicationIndicator + // http://www.yaml.org/spec/1.2/spec.html#id2793979 + $blockIndentationIndicator = (' ' === substr($value, 0, 1)) ? (string) $this->indentation : ''; + + if (isset($value[-2]) && "\n" === $value[-2] && "\n" === $value[-1]) { + $blockChompingIndicator = '+'; + } elseif ("\n" === $value[-1]) { + $blockChompingIndicator = ''; + } else { + $blockChompingIndicator = '-'; + } + + $output .= sprintf('%s%s%s |%s%s', $prefix, $dumpAsMap ? Inline::dump($key, $flags).':' : '-', '', $blockIndentationIndicator, $blockChompingIndicator); + + foreach (explode("\n", $value) as $row) { + if ('' === $row) { + $output .= "\n"; + } else { + $output .= sprintf("\n%s%s%s", $prefix, str_repeat(' ', $this->indentation), $row); + } + } + + continue; + } + + if ($value instanceof TaggedValue) { + $output .= sprintf('%s%s !%s', $prefix, $dumpAsMap ? Inline::dump($key, $flags).':' : '-', $value->getTag()); + + if (Yaml::DUMP_MULTI_LINE_LITERAL_BLOCK & $flags && \is_string($value->getValue()) && false !== strpos($value->getValue(), "\n") && false === strpos($value->getValue(), "\r\n")) { + // If the first line starts with a space character, the spec requires a blockIndicationIndicator + // http://www.yaml.org/spec/1.2/spec.html#id2793979 + $blockIndentationIndicator = (' ' === substr($value->getValue(), 0, 1)) ? (string) $this->indentation : ''; + $output .= sprintf(' |%s', $blockIndentationIndicator); + + foreach (explode("\n", $value->getValue()) as $row) { + $output .= sprintf("\n%s%s%s", $prefix, str_repeat(' ', $this->indentation), $row); + } + + continue; + } + + if ($inline - 1 <= 0 || null === $value->getValue() || is_scalar($value->getValue())) { + $output .= ' '.$this->dump($value->getValue(), $inline - 1, 0, $flags)."\n"; + } else { + $output .= "\n"; + $output .= $this->dump($value->getValue(), $inline - 1, $dumpAsMap ? $indent + $this->indentation : $indent + 2, $flags); + } + + continue; + } + + $dumpObjectAsInlineMap = true; + + if (Yaml::DUMP_OBJECT_AS_MAP & $flags && ($value instanceof \ArrayObject || $value instanceof \stdClass)) { + $dumpObjectAsInlineMap = empty((array) $value); + } + + $willBeInlined = $inline - 1 <= 0 || !\is_array($value) && $dumpObjectAsInlineMap || empty($value); + + $output .= sprintf('%s%s%s%s', + $prefix, + $dumpAsMap ? Inline::dump($key, $flags).':' : '-', + $willBeInlined ? ' ' : "\n", + $this->dump($value, $inline - 1, $willBeInlined ? 0 : $indent + $this->indentation, $flags) + ).($willBeInlined ? "\n" : ''); + } + } + + return $output; + } +} diff --git a/vendor/symfony/yaml/Escaper.php b/vendor/symfony/yaml/Escaper.php new file mode 100644 index 000000000..9b809df87 --- /dev/null +++ b/vendor/symfony/yaml/Escaper.php @@ -0,0 +1,103 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +namespace Symfony\Component\Yaml; + +/** + * Escaper encapsulates escaping rules for single and double-quoted + * YAML strings. + * + * @author Matthew Lewinski + * + * @internal + */ +class Escaper +{ + // Characters that would cause a dumped string to require double quoting. + public const REGEX_CHARACTER_TO_ESCAPE = "[\\x00-\\x1f]|\x7f|\xc2\x85|\xc2\xa0|\xe2\x80\xa8|\xe2\x80\xa9"; + + // Mapping arrays for escaping a double quoted string. The backslash is + // first to ensure proper escaping because str_replace operates iteratively + // on the input arrays. This ordering of the characters avoids the use of strtr, + // which performs more slowly. + private const ESCAPEES = ['\\', '\\\\', '\\"', '"', + "\x00", "\x01", "\x02", "\x03", "\x04", "\x05", "\x06", "\x07", + "\x08", "\x09", "\x0a", "\x0b", "\x0c", "\x0d", "\x0e", "\x0f", + "\x10", "\x11", "\x12", "\x13", "\x14", "\x15", "\x16", "\x17", + "\x18", "\x19", "\x1a", "\x1b", "\x1c", "\x1d", "\x1e", "\x1f", + "\x7f", + "\xc2\x85", "\xc2\xa0", "\xe2\x80\xa8", "\xe2\x80\xa9", + ]; + private const ESCAPED = ['\\\\', '\\"', '\\\\', '\\"', + '\\0', '\\x01', '\\x02', '\\x03', '\\x04', '\\x05', '\\x06', '\\a', + '\\b', '\\t', '\\n', '\\v', '\\f', '\\r', '\\x0e', '\\x0f', + '\\x10', '\\x11', '\\x12', '\\x13', '\\x14', '\\x15', '\\x16', '\\x17', + '\\x18', '\\x19', '\\x1a', '\\e', '\\x1c', '\\x1d', '\\x1e', '\\x1f', + '\\x7f', + '\\N', '\\_', '\\L', '\\P', + ]; + + /** + * Determines if a PHP value would require double quoting in YAML. + * + * @param string $value A PHP value + * + * @return bool True if the value would require double quotes + */ + public static function requiresDoubleQuoting(string $value): bool + { + return 0 < preg_match('/'.self::REGEX_CHARACTER_TO_ESCAPE.'/u', $value); + } + + /** + * Escapes and surrounds a PHP value with double quotes. + * + * @param string $value A PHP value + * + * @return string The quoted, escaped string + */ + public static function escapeWithDoubleQuotes(string $value): string + { + return sprintf('"%s"', str_replace(self::ESCAPEES, self::ESCAPED, $value)); + } + + /** + * Determines if a PHP value would require single quoting in YAML. + * + * @param string $value A PHP value + * + * @return bool True if the value would require single quotes + */ + public static function requiresSingleQuoting(string $value): bool + { + // Determines if a PHP value is entirely composed of a value that would + // require single quoting in YAML. + if (\in_array(strtolower($value), ['null', '~', 'true', 'false', 'y', 'n', 'yes', 'no', 'on', 'off'])) { + return true; + } + + // Determines if the PHP value contains any single characters that would + // cause it to require single quoting in YAML. + return 0 < preg_match('/[ \s \' " \: \{ \} \[ \] , & \* \# \?] | \A[ \- ? | < > = ! % @ ` \p{Zs}]/xu', $value); + } + + /** + * Escapes and surrounds a PHP value with single quotes. + * + * @param string $value A PHP value + * + * @return string The quoted, escaped string + */ + public static function escapeWithSingleQuotes(string $value): string + { + return sprintf("'%s'", str_replace('\'', '\'\'', $value)); + } +} diff --git a/vendor/symfony/yaml/Exception/DumpException.php b/vendor/symfony/yaml/Exception/DumpException.php new file mode 100644 index 000000000..cce972f24 --- /dev/null +++ b/vendor/symfony/yaml/Exception/DumpException.php @@ -0,0 +1,21 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +namespace Symfony\Component\Yaml\Exception; + +/** + * Exception class thrown when an error occurs during dumping. + * + * @author Fabien Potencier + */ +class DumpException extends RuntimeException +{ +} diff --git a/vendor/symfony/yaml/Exception/ExceptionInterface.php b/vendor/symfony/yaml/Exception/ExceptionInterface.php new file mode 100644 index 000000000..909131684 --- /dev/null +++ b/vendor/symfony/yaml/Exception/ExceptionInterface.php @@ -0,0 +1,21 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +namespace Symfony\Component\Yaml\Exception; + +/** + * Exception interface for all exceptions thrown by the component. + * + * @author Fabien Potencier + */ +interface ExceptionInterface extends \Throwable +{ +} diff --git a/vendor/symfony/yaml/Exception/ParseException.php b/vendor/symfony/yaml/Exception/ParseException.php new file mode 100644 index 000000000..20b918929 --- /dev/null +++ b/vendor/symfony/yaml/Exception/ParseException.php @@ -0,0 +1,133 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +namespace Symfony\Component\Yaml\Exception; + +/** + * Exception class thrown when an error occurs during parsing. + * + * @author Fabien Potencier + */ +class ParseException extends RuntimeException +{ + private $parsedFile; + private $parsedLine; + private $snippet; + private $rawMessage; + + /** + * @param string $message The error message + * @param int $parsedLine The line where the error occurred + * @param string|null $snippet The snippet of code near the problem + * @param string|null $parsedFile The file name where the error occurred + * @param \Exception|null $previous The previous exception + */ + public function __construct(string $message, int $parsedLine = -1, string $snippet = null, string $parsedFile = null, \Throwable $previous = null) + { + $this->parsedFile = $parsedFile; + $this->parsedLine = $parsedLine; + $this->snippet = $snippet; + $this->rawMessage = $message; + + $this->updateRepr(); + + parent::__construct($this->message, 0, $previous); + } + + /** + * Gets the snippet of code near the error. + * + * @return string The snippet of code + */ + public function getSnippet() + { + return $this->snippet; + } + + /** + * Sets the snippet of code near the error. + */ + public function setSnippet(string $snippet) + { + $this->snippet = $snippet; + + $this->updateRepr(); + } + + /** + * Gets the filename where the error occurred. + * + * This method returns null if a string is parsed. + * + * @return string The filename + */ + public function getParsedFile() + { + return $this->parsedFile; + } + + /** + * Sets the filename where the error occurred. + */ + public function setParsedFile(string $parsedFile) + { + $this->parsedFile = $parsedFile; + + $this->updateRepr(); + } + + /** + * Gets the line where the error occurred. + * + * @return int The file line + */ + public function getParsedLine() + { + return $this->parsedLine; + } + + /** + * Sets the line where the error occurred. + */ + public function setParsedLine(int $parsedLine) + { + $this->parsedLine = $parsedLine; + + $this->updateRepr(); + } + + private function updateRepr() + { + $this->message = $this->rawMessage; + + $dot = false; + if ('.' === substr($this->message, -1)) { + $this->message = substr($this->message, 0, -1); + $dot = true; + } + + if (null !== $this->parsedFile) { + $this->message .= sprintf(' in %s', json_encode($this->parsedFile, \JSON_UNESCAPED_SLASHES | \JSON_UNESCAPED_UNICODE)); + } + + if ($this->parsedLine >= 0) { + $this->message .= sprintf(' at line %d', $this->parsedLine); + } + + if ($this->snippet) { + $this->message .= sprintf(' (near "%s")', $this->snippet); + } + + if ($dot) { + $this->message .= '.'; + } + } +} diff --git a/vendor/symfony/yaml/Exception/RuntimeException.php b/vendor/symfony/yaml/Exception/RuntimeException.php new file mode 100644 index 000000000..3f36b73be --- /dev/null +++ b/vendor/symfony/yaml/Exception/RuntimeException.php @@ -0,0 +1,21 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +namespace Symfony\Component\Yaml\Exception; + +/** + * Exception class thrown when an error occurs during parsing. + * + * @author Romain Neutron + */ +class RuntimeException extends \RuntimeException implements ExceptionInterface +{ +} diff --git a/vendor/symfony/yaml/Inline.php b/vendor/symfony/yaml/Inline.php new file mode 100644 index 000000000..fe1028787 --- /dev/null +++ b/vendor/symfony/yaml/Inline.php @@ -0,0 +1,794 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +namespace Symfony\Component\Yaml; + +use Symfony\Component\Yaml\Exception\DumpException; +use Symfony\Component\Yaml\Exception\ParseException; +use Symfony\Component\Yaml\Tag\TaggedValue; + +/** + * Inline implements a YAML parser/dumper for the YAML inline syntax. + * + * @author Fabien Potencier + * + * @internal + */ +class Inline +{ + public const REGEX_QUOTED_STRING = '(?:"([^"\\\\]*+(?:\\\\.[^"\\\\]*+)*+)"|\'([^\']*+(?:\'\'[^\']*+)*+)\')'; + + public static $parsedLineNumber = -1; + public static $parsedFilename; + + private static $exceptionOnInvalidType = false; + private static $objectSupport = false; + private static $objectForMap = false; + private static $constantSupport = false; + + public static function initialize(int $flags, int $parsedLineNumber = null, string $parsedFilename = null) + { + self::$exceptionOnInvalidType = (bool) (Yaml::PARSE_EXCEPTION_ON_INVALID_TYPE & $flags); + self::$objectSupport = (bool) (Yaml::PARSE_OBJECT & $flags); + self::$objectForMap = (bool) (Yaml::PARSE_OBJECT_FOR_MAP & $flags); + self::$constantSupport = (bool) (Yaml::PARSE_CONSTANT & $flags); + self::$parsedFilename = $parsedFilename; + + if (null !== $parsedLineNumber) { + self::$parsedLineNumber = $parsedLineNumber; + } + } + + /** + * Converts a YAML string to a PHP value. + * + * @param string $value A YAML string + * @param int $flags A bit field of PARSE_* constants to customize the YAML parser behavior + * @param array $references Mapping of variable names to values + * + * @return mixed A PHP value + * + * @throws ParseException + */ + public static function parse(string $value = null, int $flags = 0, array $references = []) + { + self::initialize($flags); + + $value = trim($value); + + if ('' === $value) { + return ''; + } + + if (2 /* MB_OVERLOAD_STRING */ & (int) ini_get('mbstring.func_overload')) { + $mbEncoding = mb_internal_encoding(); + mb_internal_encoding('ASCII'); + } + + try { + $i = 0; + $tag = self::parseTag($value, $i, $flags); + switch ($value[$i]) { + case '[': + $result = self::parseSequence($value, $flags, $i, $references); + ++$i; + break; + case '{': + $result = self::parseMapping($value, $flags, $i, $references); + ++$i; + break; + default: + $result = self::parseScalar($value, $flags, null, $i, null === $tag, $references); + } + + // some comments are allowed at the end + if (preg_replace('/\s*#.*$/A', '', substr($value, $i))) { + throw new ParseException(sprintf('Unexpected characters near "%s".', substr($value, $i)), self::$parsedLineNumber + 1, $value, self::$parsedFilename); + } + + if (null !== $tag && '' !== $tag) { + return new TaggedValue($tag, $result); + } + + return $result; + } finally { + if (isset($mbEncoding)) { + mb_internal_encoding($mbEncoding); + } + } + } + + /** + * Dumps a given PHP variable to a YAML string. + * + * @param mixed $value The PHP variable to convert + * @param int $flags A bit field of Yaml::DUMP_* constants to customize the dumped YAML string + * + * @return string The YAML string representing the PHP value + * + * @throws DumpException When trying to dump PHP resource + */ + public static function dump($value, int $flags = 0): string + { + switch (true) { + case \is_resource($value): + if (Yaml::DUMP_EXCEPTION_ON_INVALID_TYPE & $flags) { + throw new DumpException(sprintf('Unable to dump PHP resources in a YAML file ("%s").', get_resource_type($value))); + } + + return self::dumpNull($flags); + case $value instanceof \DateTimeInterface: + return $value->format('c'); + case \is_object($value): + if ($value instanceof TaggedValue) { + return '!'.$value->getTag().' '.self::dump($value->getValue(), $flags); + } + + if (Yaml::DUMP_OBJECT & $flags) { + return '!php/object '.self::dump(serialize($value)); + } + + if (Yaml::DUMP_OBJECT_AS_MAP & $flags && ($value instanceof \stdClass || $value instanceof \ArrayObject)) { + $output = []; + + foreach ($value as $key => $val) { + $output[] = sprintf('%s: %s', self::dump($key, $flags), self::dump($val, $flags)); + } + + return sprintf('{ %s }', implode(', ', $output)); + } + + if (Yaml::DUMP_EXCEPTION_ON_INVALID_TYPE & $flags) { + throw new DumpException('Object support when dumping a YAML file has been disabled.'); + } + + return self::dumpNull($flags); + case \is_array($value): + return self::dumpArray($value, $flags); + case null === $value: + return self::dumpNull($flags); + case true === $value: + return 'true'; + case false === $value: + return 'false'; + case ctype_digit($value): + return \is_string($value) ? "'$value'" : (int) $value; + case is_numeric($value) && false === strpos($value, "\f") && false === strpos($value, "\n") && false === strpos($value, "\r") && false === strpos($value, "\t") && false === strpos($value, "\v"): + $locale = setlocale(\LC_NUMERIC, 0); + if (false !== $locale) { + setlocale(\LC_NUMERIC, 'C'); + } + if (\is_float($value)) { + $repr = (string) $value; + if (is_infinite($value)) { + $repr = str_ireplace('INF', '.Inf', $repr); + } elseif (floor($value) == $value && $repr == $value) { + // Preserve float data type since storing a whole number will result in integer value. + $repr = '!!float '.$repr; + } + } else { + $repr = \is_string($value) ? "'$value'" : (string) $value; + } + if (false !== $locale) { + setlocale(\LC_NUMERIC, $locale); + } + + return $repr; + case '' == $value: + return "''"; + case self::isBinaryString($value): + return '!!binary '.base64_encode($value); + case Escaper::requiresDoubleQuoting($value): + return Escaper::escapeWithDoubleQuotes($value); + case Escaper::requiresSingleQuoting($value): + case Parser::preg_match('{^[0-9]+[_0-9]*$}', $value): + case Parser::preg_match(self::getHexRegex(), $value): + case Parser::preg_match(self::getTimestampRegex(), $value): + return Escaper::escapeWithSingleQuotes($value); + default: + return $value; + } + } + + /** + * Check if given array is hash or just normal indexed array. + * + * @param array|\ArrayObject|\stdClass $value The PHP array or array-like object to check + * + * @return bool true if value is hash array, false otherwise + */ + public static function isHash($value): bool + { + if ($value instanceof \stdClass || $value instanceof \ArrayObject) { + return true; + } + + $expectedKey = 0; + + foreach ($value as $key => $val) { + if ($key !== $expectedKey++) { + return true; + } + } + + return false; + } + + /** + * Dumps a PHP array to a YAML string. + * + * @param array $value The PHP array to dump + * @param int $flags A bit field of Yaml::DUMP_* constants to customize the dumped YAML string + * + * @return string The YAML string representing the PHP array + */ + private static function dumpArray(array $value, int $flags): string + { + // array + if (($value || Yaml::DUMP_EMPTY_ARRAY_AS_SEQUENCE & $flags) && !self::isHash($value)) { + $output = []; + foreach ($value as $val) { + $output[] = self::dump($val, $flags); + } + + return sprintf('[%s]', implode(', ', $output)); + } + + // hash + $output = []; + foreach ($value as $key => $val) { + $output[] = sprintf('%s: %s', self::dump($key, $flags), self::dump($val, $flags)); + } + + return sprintf('{ %s }', implode(', ', $output)); + } + + private static function dumpNull(int $flags): string + { + if (Yaml::DUMP_NULL_AS_TILDE & $flags) { + return '~'; + } + + return 'null'; + } + + /** + * Parses a YAML scalar. + * + * @return mixed + * + * @throws ParseException When malformed inline YAML string is parsed + */ + public static function parseScalar(string $scalar, int $flags = 0, array $delimiters = null, int &$i = 0, bool $evaluate = true, array $references = []) + { + if (\in_array($scalar[$i], ['"', "'"], true)) { + // quoted scalar + $output = self::parseQuotedScalar($scalar, $i); + + if (null !== $delimiters) { + $tmp = ltrim(substr($scalar, $i), " \n"); + if ('' === $tmp) { + throw new ParseException(sprintf('Unexpected end of line, expected one of "%s".', implode('', $delimiters)), self::$parsedLineNumber + 1, $scalar, self::$parsedFilename); + } + if (!\in_array($tmp[0], $delimiters)) { + throw new ParseException(sprintf('Unexpected characters (%s).', substr($scalar, $i)), self::$parsedLineNumber + 1, $scalar, self::$parsedFilename); + } + } + } else { + // "normal" string + if (!$delimiters) { + $output = substr($scalar, $i); + $i += \strlen($output); + + // remove comments + if (Parser::preg_match('/[ \t]+#/', $output, $match, \PREG_OFFSET_CAPTURE)) { + $output = substr($output, 0, $match[0][1]); + } + } elseif (Parser::preg_match('/^(.*?)('.implode('|', $delimiters).')/', substr($scalar, $i), $match)) { + $output = $match[1]; + $i += \strlen($output); + $output = trim($output); + } else { + throw new ParseException(sprintf('Malformed inline YAML string: "%s".', $scalar), self::$parsedLineNumber + 1, null, self::$parsedFilename); + } + + // a non-quoted string cannot start with @ or ` (reserved) nor with a scalar indicator (| or >) + if ($output && ('@' === $output[0] || '`' === $output[0] || '|' === $output[0] || '>' === $output[0] || '%' === $output[0])) { + throw new ParseException(sprintf('The reserved indicator "%s" cannot start a plain scalar; you need to quote the scalar.', $output[0]), self::$parsedLineNumber + 1, $output, self::$parsedFilename); + } + + if ($evaluate) { + $output = self::evaluateScalar($output, $flags, $references); + } + } + + return $output; + } + + /** + * Parses a YAML quoted scalar. + * + * @throws ParseException When malformed inline YAML string is parsed + */ + private static function parseQuotedScalar(string $scalar, int &$i): string + { + if (!Parser::preg_match('/'.self::REGEX_QUOTED_STRING.'/Au', substr($scalar, $i), $match)) { + throw new ParseException(sprintf('Malformed inline YAML string: "%s".', substr($scalar, $i)), self::$parsedLineNumber + 1, $scalar, self::$parsedFilename); + } + + $output = substr($match[0], 1, -1); + + $unescaper = new Unescaper(); + if ('"' == $scalar[$i]) { + $output = $unescaper->unescapeDoubleQuotedString($output); + } else { + $output = $unescaper->unescapeSingleQuotedString($output); + } + + $i += \strlen($match[0]); + + return $output; + } + + /** + * Parses a YAML sequence. + * + * @throws ParseException When malformed inline YAML string is parsed + */ + private static function parseSequence(string $sequence, int $flags, int &$i = 0, array $references = []): array + { + $output = []; + $len = \strlen($sequence); + ++$i; + + // [foo, bar, ...] + while ($i < $len) { + if (']' === $sequence[$i]) { + return $output; + } + if (',' === $sequence[$i] || ' ' === $sequence[$i]) { + ++$i; + + continue; + } + + $tag = self::parseTag($sequence, $i, $flags); + switch ($sequence[$i]) { + case '[': + // nested sequence + $value = self::parseSequence($sequence, $flags, $i, $references); + break; + case '{': + // nested mapping + $value = self::parseMapping($sequence, $flags, $i, $references); + break; + default: + $isQuoted = \in_array($sequence[$i], ['"', "'"], true); + $value = self::parseScalar($sequence, $flags, [',', ']'], $i, null === $tag, $references); + + // the value can be an array if a reference has been resolved to an array var + if (\is_string($value) && !$isQuoted && false !== strpos($value, ': ')) { + // embedded mapping? + try { + $pos = 0; + $value = self::parseMapping('{'.$value.'}', $flags, $pos, $references); + } catch (\InvalidArgumentException $e) { + // no, it's not + } + } + + --$i; + } + + if (null !== $tag && '' !== $tag) { + $value = new TaggedValue($tag, $value); + } + + $output[] = $value; + + ++$i; + } + + throw new ParseException(sprintf('Malformed inline YAML string: "%s".', $sequence), self::$parsedLineNumber + 1, null, self::$parsedFilename); + } + + /** + * Parses a YAML mapping. + * + * @return array|\stdClass + * + * @throws ParseException When malformed inline YAML string is parsed + */ + private static function parseMapping(string $mapping, int $flags, int &$i = 0, array $references = []) + { + $output = []; + $len = \strlen($mapping); + ++$i; + $allowOverwrite = false; + + // {foo: bar, bar:foo, ...} + while ($i < $len) { + switch ($mapping[$i]) { + case ' ': + case ',': + case "\n": + ++$i; + continue 2; + case '}': + if (self::$objectForMap) { + return (object) $output; + } + + return $output; + } + + // key + $offsetBeforeKeyParsing = $i; + $isKeyQuoted = \in_array($mapping[$i], ['"', "'"], true); + $key = self::parseScalar($mapping, $flags, [':', ' '], $i, false, []); + + if ($offsetBeforeKeyParsing === $i) { + throw new ParseException('Missing mapping key.', self::$parsedLineNumber + 1, $mapping); + } + + if ('!php/const' === $key) { + $key .= ' '.self::parseScalar($mapping, $flags, [':'], $i, false, []); + $key = self::evaluateScalar($key, $flags); + } + + if (false === $i = strpos($mapping, ':', $i)) { + break; + } + + if (!$isKeyQuoted) { + $evaluatedKey = self::evaluateScalar($key, $flags, $references); + + if ('' !== $key && $evaluatedKey !== $key && !\is_string($evaluatedKey) && !\is_int($evaluatedKey)) { + throw new ParseException('Implicit casting of incompatible mapping keys to strings is not supported. Quote your evaluable mapping keys instead.', self::$parsedLineNumber + 1, $mapping); + } + } + + if (!$isKeyQuoted && (!isset($mapping[$i + 1]) || !\in_array($mapping[$i + 1], [' ', ',', '[', ']', '{', '}', "\n"], true))) { + throw new ParseException('Colons must be followed by a space or an indication character (i.e. " ", ",", "[", "]", "{", "}").', self::$parsedLineNumber + 1, $mapping); + } + + if ('<<' === $key) { + $allowOverwrite = true; + } + + while ($i < $len) { + if (':' === $mapping[$i] || ' ' === $mapping[$i] || "\n" === $mapping[$i]) { + ++$i; + + continue; + } + + $tag = self::parseTag($mapping, $i, $flags); + switch ($mapping[$i]) { + case '[': + // nested sequence + $value = self::parseSequence($mapping, $flags, $i, $references); + // Spec: Keys MUST be unique; first one wins. + // Parser cannot abort this mapping earlier, since lines + // are processed sequentially. + // But overwriting is allowed when a merge node is used in current block. + if ('<<' === $key) { + foreach ($value as $parsedValue) { + $output += $parsedValue; + } + } elseif ($allowOverwrite || !isset($output[$key])) { + if (null !== $tag) { + $output[$key] = new TaggedValue($tag, $value); + } else { + $output[$key] = $value; + } + } elseif (isset($output[$key])) { + throw new ParseException(sprintf('Duplicate key "%s" detected.', $key), self::$parsedLineNumber + 1, $mapping); + } + break; + case '{': + // nested mapping + $value = self::parseMapping($mapping, $flags, $i, $references); + // Spec: Keys MUST be unique; first one wins. + // Parser cannot abort this mapping earlier, since lines + // are processed sequentially. + // But overwriting is allowed when a merge node is used in current block. + if ('<<' === $key) { + $output += $value; + } elseif ($allowOverwrite || !isset($output[$key])) { + if (null !== $tag) { + $output[$key] = new TaggedValue($tag, $value); + } else { + $output[$key] = $value; + } + } elseif (isset($output[$key])) { + throw new ParseException(sprintf('Duplicate key "%s" detected.', $key), self::$parsedLineNumber + 1, $mapping); + } + break; + default: + $value = self::parseScalar($mapping, $flags, [',', '}', "\n"], $i, null === $tag, $references); + // Spec: Keys MUST be unique; first one wins. + // Parser cannot abort this mapping earlier, since lines + // are processed sequentially. + // But overwriting is allowed when a merge node is used in current block. + if ('<<' === $key) { + $output += $value; + } elseif ($allowOverwrite || !isset($output[$key])) { + if (null !== $tag) { + $output[$key] = new TaggedValue($tag, $value); + } else { + $output[$key] = $value; + } + } elseif (isset($output[$key])) { + throw new ParseException(sprintf('Duplicate key "%s" detected.', $key), self::$parsedLineNumber + 1, $mapping); + } + --$i; + } + ++$i; + + continue 2; + } + } + + throw new ParseException(sprintf('Malformed inline YAML string: "%s".', $mapping), self::$parsedLineNumber + 1, null, self::$parsedFilename); + } + + /** + * Evaluates scalars and replaces magic values. + * + * @return mixed The evaluated YAML string + * + * @throws ParseException when object parsing support was disabled and the parser detected a PHP object or when a reference could not be resolved + */ + private static function evaluateScalar(string $scalar, int $flags, array $references = []) + { + $scalar = trim($scalar); + + if ('*' === ($scalar[0] ?? '')) { + if (false !== $pos = strpos($scalar, '#')) { + $value = substr($scalar, 1, $pos - 2); + } else { + $value = substr($scalar, 1); + } + + // an unquoted * + if (false === $value || '' === $value) { + throw new ParseException('A reference must contain at least one character.', self::$parsedLineNumber + 1, $value, self::$parsedFilename); + } + + if (!\array_key_exists($value, $references)) { + throw new ParseException(sprintf('Reference "%s" does not exist.', $value), self::$parsedLineNumber + 1, $value, self::$parsedFilename); + } + + return $references[$value]; + } + + $scalarLower = strtolower($scalar); + + switch (true) { + case 'null' === $scalarLower: + case '' === $scalar: + case '~' === $scalar: + return null; + case 'true' === $scalarLower: + return true; + case 'false' === $scalarLower: + return false; + case '!' === $scalar[0]: + switch (true) { + case 0 === strncmp($scalar, '!!str ', 6): + return (string) substr($scalar, 6); + case 0 === strncmp($scalar, '! ', 2): + return substr($scalar, 2); + case 0 === strncmp($scalar, '!php/object', 11): + if (self::$objectSupport) { + if (!isset($scalar[12])) { + trigger_deprecation('symfony/yaml', '5.1', 'Using the !php/object tag without a value is deprecated.'); + + return false; + } + + return unserialize(self::parseScalar(substr($scalar, 12))); + } + + if (self::$exceptionOnInvalidType) { + throw new ParseException('Object support when parsing a YAML file has been disabled.', self::$parsedLineNumber + 1, $scalar, self::$parsedFilename); + } + + return null; + case 0 === strncmp($scalar, '!php/const', 10): + if (self::$constantSupport) { + if (!isset($scalar[11])) { + trigger_deprecation('symfony/yaml', '5.1', 'Using the !php/const tag without a value is deprecated.'); + + return ''; + } + + $i = 0; + if (\defined($const = self::parseScalar(substr($scalar, 11), 0, null, $i, false))) { + return \constant($const); + } + + throw new ParseException(sprintf('The constant "%s" is not defined.', $const), self::$parsedLineNumber + 1, $scalar, self::$parsedFilename); + } + if (self::$exceptionOnInvalidType) { + throw new ParseException(sprintf('The string "%s" could not be parsed as a constant. Did you forget to pass the "Yaml::PARSE_CONSTANT" flag to the parser?', $scalar), self::$parsedLineNumber + 1, $scalar, self::$parsedFilename); + } + + return null; + case 0 === strncmp($scalar, '!!float ', 8): + return (float) substr($scalar, 8); + case 0 === strncmp($scalar, '!!binary ', 9): + return self::evaluateBinaryScalar(substr($scalar, 9)); + default: + throw new ParseException(sprintf('The string "%s" could not be parsed as it uses an unsupported built-in tag.', $scalar), self::$parsedLineNumber, $scalar, self::$parsedFilename); + } + // no break + case preg_match('/^(?:\+|-)?0o(?P[0-7_]++)$/', $scalar, $matches): + $value = str_replace('_', '', $matches['value']); + + if ('-' === $scalar[0]) { + return -octdec($value); + } else { + return octdec($value); + } + + // Optimize for returning strings. + // no break + case \in_array($scalar[0], ['+', '-', '.'], true) || is_numeric($scalar[0]): + if (Parser::preg_match('{^[+-]?[0-9][0-9_]*$}', $scalar)) { + $scalar = str_replace('_', '', (string) $scalar); + } + + switch (true) { + case ctype_digit($scalar): + if (preg_match('/^0[0-7]+$/', $scalar)) { + trigger_deprecation('symfony/yaml', '5.1', 'Support for parsing numbers prefixed with 0 as octal numbers. They will be parsed as strings as of 6.0.'); + + return octdec($scalar); + } + + $cast = (int) $scalar; + + return ($scalar === (string) $cast) ? $cast : $scalar; + case '-' === $scalar[0] && ctype_digit(substr($scalar, 1)): + if (preg_match('/^-0[0-7]+$/', $scalar)) { + trigger_deprecation('symfony/yaml', '5.1', 'Support for parsing numbers prefixed with 0 as octal numbers. They will be parsed as strings as of 6.0.'); + + return -octdec(substr($scalar, 1)); + } + + $cast = (int) $scalar; + + return ($scalar === (string) $cast) ? $cast : $scalar; + case is_numeric($scalar): + case Parser::preg_match(self::getHexRegex(), $scalar): + $scalar = str_replace('_', '', $scalar); + + return '0x' === $scalar[0].$scalar[1] ? hexdec($scalar) : (float) $scalar; + case '.inf' === $scalarLower: + case '.nan' === $scalarLower: + return -log(0); + case '-.inf' === $scalarLower: + return log(0); + case Parser::preg_match('/^(-|\+)?[0-9][0-9_]*(\.[0-9_]+)?$/', $scalar): + return (float) str_replace('_', '', $scalar); + case Parser::preg_match(self::getTimestampRegex(), $scalar): + if (Yaml::PARSE_DATETIME & $flags) { + // When no timezone is provided in the parsed date, YAML spec says we must assume UTC. + return new \DateTime($scalar, new \DateTimeZone('UTC')); + } + + $timeZone = date_default_timezone_get(); + date_default_timezone_set('UTC'); + $time = strtotime($scalar); + date_default_timezone_set($timeZone); + + return $time; + } + } + + return (string) $scalar; + } + + private static function parseTag(string $value, int &$i, int $flags): ?string + { + if ('!' !== $value[$i]) { + return null; + } + + $tagLength = strcspn($value, " \t\n[]{},", $i + 1); + $tag = substr($value, $i + 1, $tagLength); + + $nextOffset = $i + $tagLength + 1; + $nextOffset += strspn($value, ' ', $nextOffset); + + if ('' === $tag && (!isset($value[$nextOffset]) || \in_array($value[$nextOffset], [']', '}', ','], true))) { + throw new ParseException(sprintf('Using the unquoted scalar value "!" is not supported. You must quote it.', $value), self::$parsedLineNumber + 1, $value, self::$parsedFilename); + } + + // Is followed by a scalar and is a built-in tag + if ('' !== $tag && (!isset($value[$nextOffset]) || !\in_array($value[$nextOffset], ['[', '{'], true)) && ('!' === $tag[0] || 'str' === $tag || 'php/const' === $tag || 'php/object' === $tag)) { + // Manage in {@link self::evaluateScalar()} + return null; + } + + $i = $nextOffset; + + // Built-in tags + if ('' !== $tag && '!' === $tag[0]) { + throw new ParseException(sprintf('The built-in tag "!%s" is not implemented.', $tag), self::$parsedLineNumber + 1, $value, self::$parsedFilename); + } + + if ('' !== $tag && !isset($value[$i])) { + throw new ParseException(sprintf('Missing value for tag "%s".', $tag), self::$parsedLineNumber + 1, $value, self::$parsedFilename); + } + + if ('' === $tag || Yaml::PARSE_CUSTOM_TAGS & $flags) { + return $tag; + } + + throw new ParseException(sprintf('Tags support is not enabled. Enable the "Yaml::PARSE_CUSTOM_TAGS" flag to use "!%s".', $tag), self::$parsedLineNumber + 1, $value, self::$parsedFilename); + } + + public static function evaluateBinaryScalar(string $scalar): string + { + $parsedBinaryData = self::parseScalar(preg_replace('/\s/', '', $scalar)); + + if (0 !== (\strlen($parsedBinaryData) % 4)) { + throw new ParseException(sprintf('The normalized base64 encoded data (data without whitespace characters) length must be a multiple of four (%d bytes given).', \strlen($parsedBinaryData)), self::$parsedLineNumber + 1, $scalar, self::$parsedFilename); + } + + if (!Parser::preg_match('#^[A-Z0-9+/]+={0,2}$#i', $parsedBinaryData)) { + throw new ParseException(sprintf('The base64 encoded data (%s) contains invalid characters.', $parsedBinaryData), self::$parsedLineNumber + 1, $scalar, self::$parsedFilename); + } + + return base64_decode($parsedBinaryData, true); + } + + private static function isBinaryString(string $value): bool + { + return !preg_match('//u', $value) || preg_match('/[^\x00\x07-\x0d\x1B\x20-\xff]/', $value); + } + + /** + * Gets a regex that matches a YAML date. + * + * @return string The regular expression + * + * @see http://www.yaml.org/spec/1.2/spec.html#id2761573 + */ + private static function getTimestampRegex(): string + { + return <<[0-9][0-9][0-9][0-9]) + -(?P[0-9][0-9]?) + -(?P[0-9][0-9]?) + (?:(?:[Tt]|[ \t]+) + (?P[0-9][0-9]?) + :(?P[0-9][0-9]) + :(?P[0-9][0-9]) + (?:\.(?P[0-9]*))? + (?:[ \t]*(?PZ|(?P[-+])(?P[0-9][0-9]?) + (?::(?P[0-9][0-9]))?))?)? + $~x +EOF; + } + + /** + * Gets a regex that matches a YAML number in hexadecimal notation. + */ + private static function getHexRegex(): string + { + return '~^0x[0-9a-f_]++$~i'; + } +} diff --git a/vendor/symfony/yaml/LICENSE b/vendor/symfony/yaml/LICENSE new file mode 100644 index 000000000..9ff2d0d63 --- /dev/null +++ b/vendor/symfony/yaml/LICENSE @@ -0,0 +1,19 @@ +Copyright (c) 2004-2021 Fabien Potencier + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is furnished +to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/vendor/symfony/yaml/Parser.php b/vendor/symfony/yaml/Parser.php new file mode 100644 index 000000000..8a76b4880 --- /dev/null +++ b/vendor/symfony/yaml/Parser.php @@ -0,0 +1,1308 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +namespace Symfony\Component\Yaml; + +use Symfony\Component\Yaml\Exception\ParseException; +use Symfony\Component\Yaml\Tag\TaggedValue; + +/** + * Parser parses YAML strings to convert them to PHP arrays. + * + * @author Fabien Potencier + * + * @final + */ +class Parser +{ + public const TAG_PATTERN = '(?P![\w!.\/:-]+)'; + public const BLOCK_SCALAR_HEADER_PATTERN = '(?P\||>)(?P\+|\-|\d+|\+\d+|\-\d+|\d+\+|\d+\-)?(?P +#.*)?'; + + private $filename; + private $offset = 0; + private $numberOfParsedLines = 0; + private $totalNumberOfLines; + private $lines = []; + private $currentLineNb = -1; + private $currentLine = ''; + private $refs = []; + private $skippedLineNumbers = []; + private $locallySkippedLineNumbers = []; + private $refsBeingParsed = []; + + /** + * Parses a YAML file into a PHP value. + * + * @param string $filename The path to the YAML file to be parsed + * @param int $flags A bit field of PARSE_* constants to customize the YAML parser behavior + * + * @return mixed The YAML converted to a PHP value + * + * @throws ParseException If the file could not be read or the YAML is not valid + */ + public function parseFile(string $filename, int $flags = 0) + { + if (!is_file($filename)) { + throw new ParseException(sprintf('File "%s" does not exist.', $filename)); + } + + if (!is_readable($filename)) { + throw new ParseException(sprintf('File "%s" cannot be read.', $filename)); + } + + $this->filename = $filename; + + try { + return $this->parse(file_get_contents($filename), $flags); + } finally { + $this->filename = null; + } + } + + /** + * Parses a YAML string to a PHP value. + * + * @param string $value A YAML string + * @param int $flags A bit field of PARSE_* constants to customize the YAML parser behavior + * + * @return mixed A PHP value + * + * @throws ParseException If the YAML is not valid + */ + public function parse(string $value, int $flags = 0) + { + if (false === preg_match('//u', $value)) { + throw new ParseException('The YAML value does not appear to be valid UTF-8.', -1, null, $this->filename); + } + + $this->refs = []; + + $mbEncoding = null; + + if (2 /* MB_OVERLOAD_STRING */ & (int) ini_get('mbstring.func_overload')) { + $mbEncoding = mb_internal_encoding(); + mb_internal_encoding('UTF-8'); + } + + try { + $data = $this->doParse($value, $flags); + } finally { + if (null !== $mbEncoding) { + mb_internal_encoding($mbEncoding); + } + $this->lines = []; + $this->currentLine = ''; + $this->numberOfParsedLines = 0; + $this->refs = []; + $this->skippedLineNumbers = []; + $this->locallySkippedLineNumbers = []; + $this->totalNumberOfLines = null; + } + + return $data; + } + + private function doParse(string $value, int $flags) + { + $this->currentLineNb = -1; + $this->currentLine = ''; + $value = $this->cleanup($value); + $this->lines = explode("\n", $value); + $this->numberOfParsedLines = \count($this->lines); + $this->locallySkippedLineNumbers = []; + + if (null === $this->totalNumberOfLines) { + $this->totalNumberOfLines = $this->numberOfParsedLines; + } + + if (!$this->moveToNextLine()) { + return null; + } + + $data = []; + $context = null; + $allowOverwrite = false; + + while ($this->isCurrentLineEmpty()) { + if (!$this->moveToNextLine()) { + return null; + } + } + + // Resolves the tag and returns if end of the document + if (null !== ($tag = $this->getLineTag($this->currentLine, $flags, false)) && !$this->moveToNextLine()) { + return new TaggedValue($tag, ''); + } + + do { + if ($this->isCurrentLineEmpty()) { + continue; + } + + // tab? + if ("\t" === $this->currentLine[0]) { + throw new ParseException('A YAML file cannot contain tabs as indentation.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); + } + + Inline::initialize($flags, $this->getRealCurrentLineNb(), $this->filename); + + $isRef = $mergeNode = false; + if ('-' === $this->currentLine[0] && self::preg_match('#^\-((?P\s+)(?P.+))?$#u', rtrim($this->currentLine), $values)) { + if ($context && 'mapping' == $context) { + throw new ParseException('You cannot define a sequence item when in a mapping.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); + } + $context = 'sequence'; + + if (isset($values['value']) && '&' === $values['value'][0] && self::preg_match('#^&(?P[^ ]+) *(?P.*)#u', $values['value'], $matches)) { + $isRef = $matches['ref']; + $this->refsBeingParsed[] = $isRef; + $values['value'] = $matches['value']; + } + + if (isset($values['value'][1]) && '?' === $values['value'][0] && ' ' === $values['value'][1]) { + throw new ParseException('Complex mappings are not supported.', $this->getRealCurrentLineNb() + 1, $this->currentLine); + } + + // array + if (!isset($values['value']) || '' == trim($values['value'], ' ') || 0 === strpos(ltrim($values['value'], ' '), '#')) { + $data[] = $this->parseBlock($this->getRealCurrentLineNb() + 1, $this->getNextEmbedBlock(null, true) ?? '', $flags); + } elseif (null !== $subTag = $this->getLineTag(ltrim($values['value'], ' '), $flags)) { + $data[] = new TaggedValue( + $subTag, + $this->parseBlock($this->getRealCurrentLineNb() + 1, $this->getNextEmbedBlock(null, true), $flags) + ); + } else { + if ( + isset($values['leadspaces']) + && ( + '!' === $values['value'][0] + || self::preg_match('#^(?P'.Inline::REGEX_QUOTED_STRING.'|[^ \'"\{\[].*?) *\:(\s+(?P.+?))?\s*$#u', $this->trimTag($values['value']), $matches) + ) + ) { + // this is a compact notation element, add to next block and parse + $block = $values['value']; + if ($this->isNextLineIndented()) { + $block .= "\n".$this->getNextEmbedBlock($this->getCurrentLineIndentation() + \strlen($values['leadspaces']) + 1); + } + + $data[] = $this->parseBlock($this->getRealCurrentLineNb(), $block, $flags); + } else { + $data[] = $this->parseValue($values['value'], $flags, $context); + } + } + if ($isRef) { + $this->refs[$isRef] = end($data); + array_pop($this->refsBeingParsed); + } + } elseif ( + self::preg_match('#^(?P(?:![^\s]++\s++)?(?:'.Inline::REGEX_QUOTED_STRING.'|(?:!?!php/const:)?[^ \'"\[\{!].*?)) *\:( ++(?P.+))?$#u', rtrim($this->currentLine), $values) + && (false === strpos($values['key'], ' #') || \in_array($values['key'][0], ['"', "'"])) + ) { + if ($context && 'sequence' == $context) { + throw new ParseException('You cannot define a mapping item when in a sequence.', $this->currentLineNb + 1, $this->currentLine, $this->filename); + } + $context = 'mapping'; + + try { + $key = Inline::parseScalar($values['key']); + } catch (ParseException $e) { + $e->setParsedLine($this->getRealCurrentLineNb() + 1); + $e->setSnippet($this->currentLine); + + throw $e; + } + + if (!\is_string($key) && !\is_int($key)) { + throw new ParseException(sprintf('%s keys are not supported. Quote your evaluable mapping keys instead.', is_numeric($key) ? 'Numeric' : 'Non-string'), $this->getRealCurrentLineNb() + 1, $this->currentLine); + } + + // Convert float keys to strings, to avoid being converted to integers by PHP + if (\is_float($key)) { + $key = (string) $key; + } + + if ('<<' === $key && (!isset($values['value']) || '&' !== $values['value'][0] || !self::preg_match('#^&(?P[^ ]+)#u', $values['value'], $refMatches))) { + $mergeNode = true; + $allowOverwrite = true; + if (isset($values['value'][0]) && '*' === $values['value'][0]) { + $refName = substr(rtrim($values['value']), 1); + if (!\array_key_exists($refName, $this->refs)) { + if (false !== $pos = array_search($refName, $this->refsBeingParsed, true)) { + throw new ParseException(sprintf('Circular reference [%s, %s] detected for reference "%s".', implode(', ', \array_slice($this->refsBeingParsed, $pos)), $refName, $refName), $this->currentLineNb + 1, $this->currentLine, $this->filename); + } + + throw new ParseException(sprintf('Reference "%s" does not exist.', $refName), $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); + } + + $refValue = $this->refs[$refName]; + + if (Yaml::PARSE_OBJECT_FOR_MAP & $flags && $refValue instanceof \stdClass) { + $refValue = (array) $refValue; + } + + if (!\is_array($refValue)) { + throw new ParseException('YAML merge keys used with a scalar value instead of an array.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); + } + + $data += $refValue; // array union + } else { + if (isset($values['value']) && '' !== $values['value']) { + $value = $values['value']; + } else { + $value = $this->getNextEmbedBlock(); + } + $parsed = $this->parseBlock($this->getRealCurrentLineNb() + 1, $value, $flags); + + if (Yaml::PARSE_OBJECT_FOR_MAP & $flags && $parsed instanceof \stdClass) { + $parsed = (array) $parsed; + } + + if (!\is_array($parsed)) { + throw new ParseException('YAML merge keys used with a scalar value instead of an array.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); + } + + if (isset($parsed[0])) { + // If the value associated with the merge key is a sequence, then this sequence is expected to contain mapping nodes + // and each of these nodes is merged in turn according to its order in the sequence. Keys in mapping nodes earlier + // in the sequence override keys specified in later mapping nodes. + foreach ($parsed as $parsedItem) { + if (Yaml::PARSE_OBJECT_FOR_MAP & $flags && $parsedItem instanceof \stdClass) { + $parsedItem = (array) $parsedItem; + } + + if (!\is_array($parsedItem)) { + throw new ParseException('Merge items must be arrays.', $this->getRealCurrentLineNb() + 1, $parsedItem, $this->filename); + } + + $data += $parsedItem; // array union + } + } else { + // If the value associated with the key is a single mapping node, each of its key/value pairs is inserted into the + // current mapping, unless the key already exists in it. + $data += $parsed; // array union + } + } + } elseif ('<<' !== $key && isset($values['value']) && '&' === $values['value'][0] && self::preg_match('#^&(?P[^ ]++) *+(?P.*)#u', $values['value'], $matches)) { + $isRef = $matches['ref']; + $this->refsBeingParsed[] = $isRef; + $values['value'] = $matches['value']; + } + + $subTag = null; + if ($mergeNode) { + // Merge keys + } elseif (!isset($values['value']) || '' === $values['value'] || '#' === ($values['value'][0] ?? '') || (null !== $subTag = $this->getLineTag($values['value'], $flags)) || '<<' === $key) { + // hash + // if next line is less indented or equal, then it means that the current value is null + if (!$this->isNextLineIndented() && !$this->isNextLineUnIndentedCollection()) { + // Spec: Keys MUST be unique; first one wins. + // But overwriting is allowed when a merge node is used in current block. + if ($allowOverwrite || !isset($data[$key])) { + if (null !== $subTag) { + $data[$key] = new TaggedValue($subTag, ''); + } else { + $data[$key] = null; + } + } else { + throw new ParseException(sprintf('Duplicate key "%s" detected.', $key), $this->getRealCurrentLineNb() + 1, $this->currentLine); + } + } else { + // remember the parsed line number here in case we need it to provide some contexts in error messages below + $realCurrentLineNbKey = $this->getRealCurrentLineNb(); + $value = $this->parseBlock($this->getRealCurrentLineNb() + 1, $this->getNextEmbedBlock(), $flags); + if ('<<' === $key) { + $this->refs[$refMatches['ref']] = $value; + + if (Yaml::PARSE_OBJECT_FOR_MAP & $flags && $value instanceof \stdClass) { + $value = (array) $value; + } + + $data += $value; + } elseif ($allowOverwrite || !isset($data[$key])) { + // Spec: Keys MUST be unique; first one wins. + // But overwriting is allowed when a merge node is used in current block. + if (null !== $subTag) { + $data[$key] = new TaggedValue($subTag, $value); + } else { + $data[$key] = $value; + } + } else { + throw new ParseException(sprintf('Duplicate key "%s" detected.', $key), $realCurrentLineNbKey + 1, $this->currentLine); + } + } + } else { + $value = $this->parseValue(rtrim($values['value']), $flags, $context); + // Spec: Keys MUST be unique; first one wins. + // But overwriting is allowed when a merge node is used in current block. + if ($allowOverwrite || !isset($data[$key])) { + $data[$key] = $value; + } else { + throw new ParseException(sprintf('Duplicate key "%s" detected.', $key), $this->getRealCurrentLineNb() + 1, $this->currentLine); + } + } + if ($isRef) { + $this->refs[$isRef] = $data[$key]; + array_pop($this->refsBeingParsed); + } + } elseif ('"' === $this->currentLine[0] || "'" === $this->currentLine[0]) { + if (null !== $context) { + throw new ParseException('Unable to parse.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); + } + + try { + return Inline::parse($this->lexInlineQuotedString(), $flags, $this->refs); + } catch (ParseException $e) { + $e->setParsedLine($this->getRealCurrentLineNb() + 1); + $e->setSnippet($this->currentLine); + + throw $e; + } + } elseif ('{' === $this->currentLine[0]) { + if (null !== $context) { + throw new ParseException('Unable to parse.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); + } + + try { + $parsedMapping = Inline::parse($this->lexInlineMapping(), $flags, $this->refs); + + while ($this->moveToNextLine()) { + if (!$this->isCurrentLineEmpty()) { + throw new ParseException('Unable to parse.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); + } + } + + return $parsedMapping; + } catch (ParseException $e) { + $e->setParsedLine($this->getRealCurrentLineNb() + 1); + $e->setSnippet($this->currentLine); + + throw $e; + } + } elseif ('[' === $this->currentLine[0]) { + if (null !== $context) { + throw new ParseException('Unable to parse.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); + } + + try { + $parsedSequence = Inline::parse($this->lexInlineSequence(), $flags, $this->refs); + + while ($this->moveToNextLine()) { + if (!$this->isCurrentLineEmpty()) { + throw new ParseException('Unable to parse.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); + } + } + + return $parsedSequence; + } catch (ParseException $e) { + $e->setParsedLine($this->getRealCurrentLineNb() + 1); + $e->setSnippet($this->currentLine); + + throw $e; + } + } else { + // multiple documents are not supported + if ('---' === $this->currentLine) { + throw new ParseException('Multiple documents are not supported.', $this->currentLineNb + 1, $this->currentLine, $this->filename); + } + + if ($deprecatedUsage = (isset($this->currentLine[1]) && '?' === $this->currentLine[0] && ' ' === $this->currentLine[1])) { + throw new ParseException('Complex mappings are not supported.', $this->getRealCurrentLineNb() + 1, $this->currentLine); + } + + // 1-liner optionally followed by newline(s) + if (\is_string($value) && $this->lines[0] === trim($value)) { + try { + $value = Inline::parse($this->lines[0], $flags, $this->refs); + } catch (ParseException $e) { + $e->setParsedLine($this->getRealCurrentLineNb() + 1); + $e->setSnippet($this->currentLine); + + throw $e; + } + + return $value; + } + + // try to parse the value as a multi-line string as a last resort + if (0 === $this->currentLineNb) { + $previousLineWasNewline = false; + $previousLineWasTerminatedWithBackslash = false; + $value = ''; + + foreach ($this->lines as $line) { + $trimmedLine = trim($line); + if ('#' === ($trimmedLine[0] ?? '')) { + continue; + } + // If the indentation is not consistent at offset 0, it is to be considered as a ParseError + if (0 === $this->offset && !$deprecatedUsage && isset($line[0]) && ' ' === $line[0]) { + throw new ParseException('Unable to parse.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); + } + + if (false !== strpos($line, ': ')) { + throw new ParseException('Mapping values are not allowed in multi-line blocks.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); + } + + if ('' === $trimmedLine) { + $value .= "\n"; + } elseif (!$previousLineWasNewline && !$previousLineWasTerminatedWithBackslash) { + $value .= ' '; + } + + if ('' !== $trimmedLine && '\\' === $line[-1]) { + $value .= ltrim(substr($line, 0, -1)); + } elseif ('' !== $trimmedLine) { + $value .= $trimmedLine; + } + + if ('' === $trimmedLine) { + $previousLineWasNewline = true; + $previousLineWasTerminatedWithBackslash = false; + } elseif ('\\' === $line[-1]) { + $previousLineWasNewline = false; + $previousLineWasTerminatedWithBackslash = true; + } else { + $previousLineWasNewline = false; + $previousLineWasTerminatedWithBackslash = false; + } + } + + try { + return Inline::parse(trim($value)); + } catch (ParseException $e) { + // fall-through to the ParseException thrown below + } + } + + throw new ParseException('Unable to parse.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); + } + } while ($this->moveToNextLine()); + + if (null !== $tag) { + $data = new TaggedValue($tag, $data); + } + + if (Yaml::PARSE_OBJECT_FOR_MAP & $flags && 'mapping' === $context && !\is_object($data)) { + $object = new \stdClass(); + + foreach ($data as $key => $value) { + $object->$key = $value; + } + + $data = $object; + } + + return empty($data) ? null : $data; + } + + private function parseBlock(int $offset, string $yaml, int $flags) + { + $skippedLineNumbers = $this->skippedLineNumbers; + + foreach ($this->locallySkippedLineNumbers as $lineNumber) { + if ($lineNumber < $offset) { + continue; + } + + $skippedLineNumbers[] = $lineNumber; + } + + $parser = new self(); + $parser->offset = $offset; + $parser->totalNumberOfLines = $this->totalNumberOfLines; + $parser->skippedLineNumbers = $skippedLineNumbers; + $parser->refs = &$this->refs; + $parser->refsBeingParsed = $this->refsBeingParsed; + + return $parser->doParse($yaml, $flags); + } + + /** + * Returns the current line number (takes the offset into account). + * + * @internal + * + * @return int The current line number + */ + public function getRealCurrentLineNb(): int + { + $realCurrentLineNumber = $this->currentLineNb + $this->offset; + + foreach ($this->skippedLineNumbers as $skippedLineNumber) { + if ($skippedLineNumber > $realCurrentLineNumber) { + break; + } + + ++$realCurrentLineNumber; + } + + return $realCurrentLineNumber; + } + + /** + * Returns the current line indentation. + * + * @return int The current line indentation + */ + private function getCurrentLineIndentation(): int + { + if (' ' !== ($this->currentLine[0] ?? '')) { + return 0; + } + + return \strlen($this->currentLine) - \strlen(ltrim($this->currentLine, ' ')); + } + + /** + * Returns the next embed block of YAML. + * + * @param int|null $indentation The indent level at which the block is to be read, or null for default + * @param bool $inSequence True if the enclosing data structure is a sequence + * + * @return string A YAML string + * + * @throws ParseException When indentation problem are detected + */ + private function getNextEmbedBlock(int $indentation = null, bool $inSequence = false): string + { + $oldLineIndentation = $this->getCurrentLineIndentation(); + + if (!$this->moveToNextLine()) { + return ''; + } + + if (null === $indentation) { + $newIndent = null; + $movements = 0; + + do { + $EOF = false; + + // empty and comment-like lines do not influence the indentation depth + if ($this->isCurrentLineEmpty() || $this->isCurrentLineComment()) { + $EOF = !$this->moveToNextLine(); + + if (!$EOF) { + ++$movements; + } + } else { + $newIndent = $this->getCurrentLineIndentation(); + } + } while (!$EOF && null === $newIndent); + + for ($i = 0; $i < $movements; ++$i) { + $this->moveToPreviousLine(); + } + + $unindentedEmbedBlock = $this->isStringUnIndentedCollectionItem(); + + if (!$this->isCurrentLineEmpty() && 0 === $newIndent && !$unindentedEmbedBlock) { + throw new ParseException('Indentation problem.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); + } + } else { + $newIndent = $indentation; + } + + $data = []; + if ($this->getCurrentLineIndentation() >= $newIndent) { + $data[] = substr($this->currentLine, $newIndent); + } elseif ($this->isCurrentLineEmpty() || $this->isCurrentLineComment()) { + $data[] = $this->currentLine; + } else { + $this->moveToPreviousLine(); + + return ''; + } + + if ($inSequence && $oldLineIndentation === $newIndent && isset($data[0][0]) && '-' === $data[0][0]) { + // the previous line contained a dash but no item content, this line is a sequence item with the same indentation + // and therefore no nested list or mapping + $this->moveToPreviousLine(); + + return ''; + } + + $isItUnindentedCollection = $this->isStringUnIndentedCollectionItem(); + $isItComment = $this->isCurrentLineComment(); + + while ($this->moveToNextLine()) { + if ($isItComment && !$isItUnindentedCollection) { + $isItUnindentedCollection = $this->isStringUnIndentedCollectionItem(); + $isItComment = $this->isCurrentLineComment(); + } + + $indent = $this->getCurrentLineIndentation(); + + if ($isItUnindentedCollection && !$this->isCurrentLineEmpty() && !$this->isStringUnIndentedCollectionItem() && $newIndent === $indent) { + $this->moveToPreviousLine(); + break; + } + + if ($this->isCurrentLineBlank()) { + $data[] = substr($this->currentLine, $newIndent); + continue; + } + + if ($indent >= $newIndent) { + $data[] = substr($this->currentLine, $newIndent); + } elseif ($this->isCurrentLineComment()) { + $data[] = $this->currentLine; + } elseif (0 == $indent) { + $this->moveToPreviousLine(); + + break; + } else { + throw new ParseException('Indentation problem.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); + } + } + + return implode("\n", $data); + } + + private function hasMoreLines(): bool + { + return (\count($this->lines) - 1) > $this->currentLineNb; + } + + /** + * Moves the parser to the next line. + */ + private function moveToNextLine(): bool + { + if ($this->currentLineNb >= $this->numberOfParsedLines - 1) { + return false; + } + + $this->currentLine = $this->lines[++$this->currentLineNb]; + + return true; + } + + /** + * Moves the parser to the previous line. + */ + private function moveToPreviousLine(): bool + { + if ($this->currentLineNb < 1) { + return false; + } + + $this->currentLine = $this->lines[--$this->currentLineNb]; + + return true; + } + + /** + * Parses a YAML value. + * + * @param string $value A YAML value + * @param int $flags A bit field of PARSE_* constants to customize the YAML parser behavior + * @param string $context The parser context (either sequence or mapping) + * + * @return mixed A PHP value + * + * @throws ParseException When reference does not exist + */ + private function parseValue(string $value, int $flags, string $context) + { + if ('*' === ($value[0] ?? '')) { + if (false !== $pos = strpos($value, '#')) { + $value = substr($value, 1, $pos - 2); + } else { + $value = substr($value, 1); + } + + if (!\array_key_exists($value, $this->refs)) { + if (false !== $pos = array_search($value, $this->refsBeingParsed, true)) { + throw new ParseException(sprintf('Circular reference [%s, %s] detected for reference "%s".', implode(', ', \array_slice($this->refsBeingParsed, $pos)), $value, $value), $this->currentLineNb + 1, $this->currentLine, $this->filename); + } + + throw new ParseException(sprintf('Reference "%s" does not exist.', $value), $this->currentLineNb + 1, $this->currentLine, $this->filename); + } + + return $this->refs[$value]; + } + + if (\in_array($value[0], ['!', '|', '>'], true) && self::preg_match('/^(?:'.self::TAG_PATTERN.' +)?'.self::BLOCK_SCALAR_HEADER_PATTERN.'$/', $value, $matches)) { + $modifiers = $matches['modifiers'] ?? ''; + + $data = $this->parseBlockScalar($matches['separator'], preg_replace('#\d+#', '', $modifiers), abs((int) $modifiers)); + + if ('' !== $matches['tag'] && '!' !== $matches['tag']) { + if ('!!binary' === $matches['tag']) { + return Inline::evaluateBinaryScalar($data); + } + + return new TaggedValue(substr($matches['tag'], 1), $data); + } + + return $data; + } + + try { + if ('' !== $value && '{' === $value[0]) { + $cursor = \strlen(rtrim($this->currentLine)) - \strlen(rtrim($value)); + + return Inline::parse($this->lexInlineMapping($cursor), $flags, $this->refs); + } elseif ('' !== $value && '[' === $value[0]) { + $cursor = \strlen(rtrim($this->currentLine)) - \strlen(rtrim($value)); + + return Inline::parse($this->lexInlineSequence($cursor), $flags, $this->refs); + } + + switch ($value[0] ?? '') { + case '"': + case "'": + $cursor = \strlen(rtrim($this->currentLine)) - \strlen(rtrim($value)); + $parsedValue = Inline::parse($this->lexInlineQuotedString($cursor), $flags, $this->refs); + + if (isset($this->currentLine[$cursor]) && preg_replace('/\s*(#.*)?$/A', '', substr($this->currentLine, $cursor))) { + throw new ParseException(sprintf('Unexpected characters near "%s".', substr($this->currentLine, $cursor))); + } + + return $parsedValue; + default: + $lines = []; + + while ($this->moveToNextLine()) { + // unquoted strings end before the first unindented line + if (0 === $this->getCurrentLineIndentation()) { + $this->moveToPreviousLine(); + + break; + } + + $lines[] = trim($this->currentLine); + } + + for ($i = 0, $linesCount = \count($lines), $previousLineBlank = false; $i < $linesCount; ++$i) { + if ('' === $lines[$i]) { + $value .= "\n"; + $previousLineBlank = true; + } elseif ($previousLineBlank) { + $value .= $lines[$i]; + $previousLineBlank = false; + } else { + $value .= ' '.$lines[$i]; + $previousLineBlank = false; + } + } + + Inline::$parsedLineNumber = $this->getRealCurrentLineNb(); + + $parsedValue = Inline::parse($value, $flags, $this->refs); + + if ('mapping' === $context && \is_string($parsedValue) && '"' !== $value[0] && "'" !== $value[0] && '[' !== $value[0] && '{' !== $value[0] && '!' !== $value[0] && false !== strpos($parsedValue, ': ')) { + throw new ParseException('A colon cannot be used in an unquoted mapping value.', $this->getRealCurrentLineNb() + 1, $value, $this->filename); + } + + return $parsedValue; + } + } catch (ParseException $e) { + $e->setParsedLine($this->getRealCurrentLineNb() + 1); + $e->setSnippet($this->currentLine); + + throw $e; + } + } + + /** + * Parses a block scalar. + * + * @param string $style The style indicator that was used to begin this block scalar (| or >) + * @param string $chomping The chomping indicator that was used to begin this block scalar (+ or -) + * @param int $indentation The indentation indicator that was used to begin this block scalar + */ + private function parseBlockScalar(string $style, string $chomping = '', int $indentation = 0): string + { + $notEOF = $this->moveToNextLine(); + if (!$notEOF) { + return ''; + } + + $isCurrentLineBlank = $this->isCurrentLineBlank(); + $blockLines = []; + + // leading blank lines are consumed before determining indentation + while ($notEOF && $isCurrentLineBlank) { + // newline only if not EOF + if ($notEOF = $this->moveToNextLine()) { + $blockLines[] = ''; + $isCurrentLineBlank = $this->isCurrentLineBlank(); + } + } + + // determine indentation if not specified + if (0 === $indentation) { + $currentLineLength = \strlen($this->currentLine); + + for ($i = 0; $i < $currentLineLength && ' ' === $this->currentLine[$i]; ++$i) { + ++$indentation; + } + } + + if ($indentation > 0) { + $pattern = sprintf('/^ {%d}(.*)$/', $indentation); + + while ( + $notEOF && ( + $isCurrentLineBlank || + self::preg_match($pattern, $this->currentLine, $matches) + ) + ) { + if ($isCurrentLineBlank && \strlen($this->currentLine) > $indentation) { + $blockLines[] = substr($this->currentLine, $indentation); + } elseif ($isCurrentLineBlank) { + $blockLines[] = ''; + } else { + $blockLines[] = $matches[1]; + } + + // newline only if not EOF + if ($notEOF = $this->moveToNextLine()) { + $isCurrentLineBlank = $this->isCurrentLineBlank(); + } + } + } elseif ($notEOF) { + $blockLines[] = ''; + } + + if ($notEOF) { + $blockLines[] = ''; + $this->moveToPreviousLine(); + } elseif (!$notEOF && !$this->isCurrentLineLastLineInDocument()) { + $blockLines[] = ''; + } + + // folded style + if ('>' === $style) { + $text = ''; + $previousLineIndented = false; + $previousLineBlank = false; + + for ($i = 0, $blockLinesCount = \count($blockLines); $i < $blockLinesCount; ++$i) { + if ('' === $blockLines[$i]) { + $text .= "\n"; + $previousLineIndented = false; + $previousLineBlank = true; + } elseif (' ' === $blockLines[$i][0]) { + $text .= "\n".$blockLines[$i]; + $previousLineIndented = true; + $previousLineBlank = false; + } elseif ($previousLineIndented) { + $text .= "\n".$blockLines[$i]; + $previousLineIndented = false; + $previousLineBlank = false; + } elseif ($previousLineBlank || 0 === $i) { + $text .= $blockLines[$i]; + $previousLineIndented = false; + $previousLineBlank = false; + } else { + $text .= ' '.$blockLines[$i]; + $previousLineIndented = false; + $previousLineBlank = false; + } + } + } else { + $text = implode("\n", $blockLines); + } + + // deal with trailing newlines + if ('' === $chomping) { + $text = preg_replace('/\n+$/', "\n", $text); + } elseif ('-' === $chomping) { + $text = preg_replace('/\n+$/', '', $text); + } + + return $text; + } + + /** + * Returns true if the next line is indented. + * + * @return bool Returns true if the next line is indented, false otherwise + */ + private function isNextLineIndented(): bool + { + $currentIndentation = $this->getCurrentLineIndentation(); + $movements = 0; + + do { + $EOF = !$this->moveToNextLine(); + + if (!$EOF) { + ++$movements; + } + } while (!$EOF && ($this->isCurrentLineEmpty() || $this->isCurrentLineComment())); + + if ($EOF) { + return false; + } + + $ret = $this->getCurrentLineIndentation() > $currentIndentation; + + for ($i = 0; $i < $movements; ++$i) { + $this->moveToPreviousLine(); + } + + return $ret; + } + + /** + * Returns true if the current line is blank or if it is a comment line. + * + * @return bool Returns true if the current line is empty or if it is a comment line, false otherwise + */ + private function isCurrentLineEmpty(): bool + { + return $this->isCurrentLineBlank() || $this->isCurrentLineComment(); + } + + /** + * Returns true if the current line is blank. + * + * @return bool Returns true if the current line is blank, false otherwise + */ + private function isCurrentLineBlank(): bool + { + return '' === $this->currentLine || '' === trim($this->currentLine, ' '); + } + + /** + * Returns true if the current line is a comment line. + * + * @return bool Returns true if the current line is a comment line, false otherwise + */ + private function isCurrentLineComment(): bool + { + //checking explicitly the first char of the trim is faster than loops or strpos + $ltrimmedLine = '' !== $this->currentLine && ' ' === $this->currentLine[0] ? ltrim($this->currentLine, ' ') : $this->currentLine; + + return '' !== $ltrimmedLine && '#' === $ltrimmedLine[0]; + } + + private function isCurrentLineLastLineInDocument(): bool + { + return ($this->offset + $this->currentLineNb) >= ($this->totalNumberOfLines - 1); + } + + /** + * Cleanups a YAML string to be parsed. + * + * @param string $value The input YAML string + * + * @return string A cleaned up YAML string + */ + private function cleanup(string $value): string + { + $value = str_replace(["\r\n", "\r"], "\n", $value); + + // strip YAML header + $count = 0; + $value = preg_replace('#^\%YAML[: ][\d\.]+.*\n#u', '', $value, -1, $count); + $this->offset += $count; + + // remove leading comments + $trimmedValue = preg_replace('#^(\#.*?\n)+#s', '', $value, -1, $count); + if (1 === $count) { + // items have been removed, update the offset + $this->offset += substr_count($value, "\n") - substr_count($trimmedValue, "\n"); + $value = $trimmedValue; + } + + // remove start of the document marker (---) + $trimmedValue = preg_replace('#^\-\-\-.*?\n#s', '', $value, -1, $count); + if (1 === $count) { + // items have been removed, update the offset + $this->offset += substr_count($value, "\n") - substr_count($trimmedValue, "\n"); + $value = $trimmedValue; + + // remove end of the document marker (...) + $value = preg_replace('#\.\.\.\s*$#', '', $value); + } + + return $value; + } + + /** + * Returns true if the next line starts unindented collection. + * + * @return bool Returns true if the next line starts unindented collection, false otherwise + */ + private function isNextLineUnIndentedCollection(): bool + { + $currentIndentation = $this->getCurrentLineIndentation(); + $movements = 0; + + do { + $EOF = !$this->moveToNextLine(); + + if (!$EOF) { + ++$movements; + } + } while (!$EOF && ($this->isCurrentLineEmpty() || $this->isCurrentLineComment())); + + if ($EOF) { + return false; + } + + $ret = $this->getCurrentLineIndentation() === $currentIndentation && $this->isStringUnIndentedCollectionItem(); + + for ($i = 0; $i < $movements; ++$i) { + $this->moveToPreviousLine(); + } + + return $ret; + } + + /** + * Returns true if the string is un-indented collection item. + * + * @return bool Returns true if the string is un-indented collection item, false otherwise + */ + private function isStringUnIndentedCollectionItem(): bool + { + return 0 === strncmp($this->currentLine, '- ', 2) || '-' === rtrim($this->currentLine); + } + + /** + * A local wrapper for "preg_match" which will throw a ParseException if there + * is an internal error in the PCRE engine. + * + * This avoids us needing to check for "false" every time PCRE is used + * in the YAML engine + * + * @throws ParseException on a PCRE internal error + * + * @see preg_last_error() + * + * @internal + */ + public static function preg_match(string $pattern, string $subject, array &$matches = null, int $flags = 0, int $offset = 0): int + { + if (false === $ret = preg_match($pattern, $subject, $matches, $flags, $offset)) { + switch (preg_last_error()) { + case \PREG_INTERNAL_ERROR: + $error = 'Internal PCRE error.'; + break; + case \PREG_BACKTRACK_LIMIT_ERROR: + $error = 'pcre.backtrack_limit reached.'; + break; + case \PREG_RECURSION_LIMIT_ERROR: + $error = 'pcre.recursion_limit reached.'; + break; + case \PREG_BAD_UTF8_ERROR: + $error = 'Malformed UTF-8 data.'; + break; + case \PREG_BAD_UTF8_OFFSET_ERROR: + $error = 'Offset doesn\'t correspond to the begin of a valid UTF-8 code point.'; + break; + default: + $error = 'Error.'; + } + + throw new ParseException($error); + } + + return $ret; + } + + /** + * Trim the tag on top of the value. + * + * Prevent values such as "!foo {quz: bar}" to be considered as + * a mapping block. + */ + private function trimTag(string $value): string + { + if ('!' === $value[0]) { + return ltrim(substr($value, 1, strcspn($value, " \r\n", 1)), ' '); + } + + return $value; + } + + private function getLineTag(string $value, int $flags, bool $nextLineCheck = true): ?string + { + if ('' === $value || '!' !== $value[0] || 1 !== self::preg_match('/^'.self::TAG_PATTERN.' *( +#.*)?$/', $value, $matches)) { + return null; + } + + if ($nextLineCheck && !$this->isNextLineIndented()) { + return null; + } + + $tag = substr($matches['tag'], 1); + + // Built-in tags + if ($tag && '!' === $tag[0]) { + throw new ParseException(sprintf('The built-in tag "!%s" is not implemented.', $tag), $this->getRealCurrentLineNb() + 1, $value, $this->filename); + } + + if (Yaml::PARSE_CUSTOM_TAGS & $flags) { + return $tag; + } + + throw new ParseException(sprintf('Tags support is not enabled. You must use the flag "Yaml::PARSE_CUSTOM_TAGS" to use "%s".', $matches['tag']), $this->getRealCurrentLineNb() + 1, $value, $this->filename); + } + + private function lexInlineQuotedString(int &$cursor = 0): string + { + $quotation = $this->currentLine[$cursor]; + $value = $quotation; + ++$cursor; + + $previousLineWasNewline = true; + $previousLineWasTerminatedWithBackslash = false; + $lineNumber = 0; + + do { + if (++$lineNumber > 1) { + $cursor += strspn($this->currentLine, ' ', $cursor); + } + + if ($this->isCurrentLineBlank()) { + $value .= "\n"; + } elseif (!$previousLineWasNewline && !$previousLineWasTerminatedWithBackslash) { + $value .= ' '; + } + + for (; \strlen($this->currentLine) > $cursor; ++$cursor) { + switch ($this->currentLine[$cursor]) { + case '\\': + if ("'" === $quotation) { + $value .= '\\'; + } elseif (isset($this->currentLine[++$cursor])) { + $value .= '\\'.$this->currentLine[$cursor]; + } + + break; + case $quotation: + ++$cursor; + + if ("'" === $quotation && isset($this->currentLine[$cursor]) && "'" === $this->currentLine[$cursor]) { + $value .= "''"; + break; + } + + return $value.$quotation; + default: + $value .= $this->currentLine[$cursor]; + } + } + + if ($this->isCurrentLineBlank()) { + $previousLineWasNewline = true; + $previousLineWasTerminatedWithBackslash = false; + } elseif ('\\' === $this->currentLine[-1]) { + $previousLineWasNewline = false; + $previousLineWasTerminatedWithBackslash = true; + } else { + $previousLineWasNewline = false; + $previousLineWasTerminatedWithBackslash = false; + } + + if ($this->hasMoreLines()) { + $cursor = 0; + } + } while ($this->moveToNextLine()); + + throw new ParseException('Malformed inline YAML string'); + } + + private function lexUnquotedString(int &$cursor): string + { + $offset = $cursor; + $cursor += strcspn($this->currentLine, '[]{},: ', $cursor); + + return substr($this->currentLine, $offset, $cursor - $offset); + } + + private function lexInlineMapping(int &$cursor = 0): string + { + return $this->lexInlineStructure($cursor, '}'); + } + + private function lexInlineSequence(int &$cursor = 0): string + { + return $this->lexInlineStructure($cursor, ']'); + } + + private function lexInlineStructure(int &$cursor, string $closingTag): string + { + $value = $this->currentLine[$cursor]; + ++$cursor; + + do { + $this->consumeWhitespaces($cursor); + + while (isset($this->currentLine[$cursor])) { + switch ($this->currentLine[$cursor]) { + case '"': + case "'": + $value .= $this->lexInlineQuotedString($cursor); + break; + case ':': + case ',': + $value .= $this->currentLine[$cursor]; + ++$cursor; + break; + case '{': + $value .= $this->lexInlineMapping($cursor); + break; + case '[': + $value .= $this->lexInlineSequence($cursor); + break; + case $closingTag: + $value .= $this->currentLine[$cursor]; + ++$cursor; + + return $value; + case '#': + break 2; + default: + $value .= $this->lexUnquotedString($cursor); + } + + if ($this->consumeWhitespaces($cursor)) { + $value .= ' '; + } + } + + if ($this->hasMoreLines()) { + $cursor = 0; + } + } while ($this->moveToNextLine()); + + throw new ParseException('Malformed inline YAML string'); + } + + private function consumeWhitespaces(int &$cursor): bool + { + $whitespacesConsumed = 0; + + do { + $whitespaceOnlyTokenLength = strspn($this->currentLine, ' ', $cursor); + $whitespacesConsumed += $whitespaceOnlyTokenLength; + $cursor += $whitespaceOnlyTokenLength; + + if (isset($this->currentLine[$cursor])) { + return 0 < $whitespacesConsumed; + } + + if ($this->hasMoreLines()) { + $cursor = 0; + } + } while ($this->moveToNextLine()); + + return 0 < $whitespacesConsumed; + } +} diff --git a/vendor/symfony/yaml/README.md b/vendor/symfony/yaml/README.md new file mode 100644 index 000000000..b914e7836 --- /dev/null +++ b/vendor/symfony/yaml/README.md @@ -0,0 +1,13 @@ +Yaml Component +============== + +The Yaml component loads and dumps YAML files. + +Resources +--------- + + * [Documentation](https://symfony.com/doc/current/components/yaml.html) + * [Contributing](https://symfony.com/doc/current/contributing/index.html) + * [Report issues](https://github.com/symfony/symfony/issues) and + [send Pull Requests](https://github.com/symfony/symfony/pulls) + in the [main Symfony repository](https://github.com/symfony/symfony) diff --git a/vendor/symfony/yaml/Resources/bin/yaml-lint b/vendor/symfony/yaml/Resources/bin/yaml-lint new file mode 100755 index 000000000..0ad73d714 --- /dev/null +++ b/vendor/symfony/yaml/Resources/bin/yaml-lint @@ -0,0 +1,45 @@ +#!/usr/bin/env php + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +/** + * Runs the Yaml lint command. + * + * @author Jan Schädlich + */ + +use Symfony\Component\Console\Application; +use Symfony\Component\Yaml\Command\LintCommand; + +function includeIfExists(string $file): bool +{ + return file_exists($file) && include $file; +} + +if ( + !includeIfExists(__DIR__ . '/../../../../autoload.php') && + !includeIfExists(__DIR__ . '/../../vendor/autoload.php') && + !includeIfExists(__DIR__ . '/../../../../../../vendor/autoload.php') +) { + fwrite(STDERR, 'Install dependencies using Composer.'.PHP_EOL); + exit(1); +} + +if (!class_exists(Application::class)) { + fwrite(STDERR, 'You need the "symfony/console" component in order to run the Yaml linter.'.PHP_EOL); + exit(1); +} + +(new Application())->add($command = new LintCommand()) + ->getApplication() + ->setDefaultCommand($command->getName(), true) + ->run() +; diff --git a/vendor/symfony/yaml/Tag/TaggedValue.php b/vendor/symfony/yaml/Tag/TaggedValue.php new file mode 100644 index 000000000..4ea340613 --- /dev/null +++ b/vendor/symfony/yaml/Tag/TaggedValue.php @@ -0,0 +1,38 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +namespace Symfony\Component\Yaml\Tag; + +/** + * @author Nicolas Grekas + * @author Guilhem N. + */ +final class TaggedValue +{ + private $tag; + private $value; + + public function __construct(string $tag, $value) + { + $this->tag = $tag; + $this->value = $value; + } + + public function getTag(): string + { + return $this->tag; + } + + public function getValue() + { + return $this->value; + } +} diff --git a/vendor/symfony/yaml/Unescaper.php b/vendor/symfony/yaml/Unescaper.php new file mode 100644 index 000000000..6bdf216ae --- /dev/null +++ b/vendor/symfony/yaml/Unescaper.php @@ -0,0 +1,138 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +namespace Symfony\Component\Yaml; + +use Symfony\Component\Yaml\Exception\ParseException; + +/** + * Unescaper encapsulates unescaping rules for single and double-quoted + * YAML strings. + * + * @author Matthew Lewinski + * + * @internal + */ +class Unescaper +{ + /** + * Regex fragment that matches an escaped character in a double quoted string. + */ + public const REGEX_ESCAPED_CHARACTER = '\\\\(x[0-9a-fA-F]{2}|u[0-9a-fA-F]{4}|U[0-9a-fA-F]{8}|.)'; + + /** + * Unescapes a single quoted string. + * + * @param string $value A single quoted string + * + * @return string The unescaped string + */ + public function unescapeSingleQuotedString(string $value): string + { + return str_replace('\'\'', '\'', $value); + } + + /** + * Unescapes a double quoted string. + * + * @param string $value A double quoted string + * + * @return string The unescaped string + */ + public function unescapeDoubleQuotedString(string $value): string + { + $callback = function ($match) { + return $this->unescapeCharacter($match[0]); + }; + + // evaluate the string + return preg_replace_callback('/'.self::REGEX_ESCAPED_CHARACTER.'/u', $callback, $value); + } + + /** + * Unescapes a character that was found in a double-quoted string. + * + * @param string $value An escaped character + * + * @return string The unescaped character + */ + private function unescapeCharacter(string $value): string + { + switch ($value[1]) { + case '0': + return "\x0"; + case 'a': + return "\x7"; + case 'b': + return "\x8"; + case 't': + return "\t"; + case "\t": + return "\t"; + case 'n': + return "\n"; + case 'v': + return "\xB"; + case 'f': + return "\xC"; + case 'r': + return "\r"; + case 'e': + return "\x1B"; + case ' ': + return ' '; + case '"': + return '"'; + case '/': + return '/'; + case '\\': + return '\\'; + case 'N': + // U+0085 NEXT LINE + return "\xC2\x85"; + case '_': + // U+00A0 NO-BREAK SPACE + return "\xC2\xA0"; + case 'L': + // U+2028 LINE SEPARATOR + return "\xE2\x80\xA8"; + case 'P': + // U+2029 PARAGRAPH SEPARATOR + return "\xE2\x80\xA9"; + case 'x': + return self::utf8chr(hexdec(substr($value, 2, 2))); + case 'u': + return self::utf8chr(hexdec(substr($value, 2, 4))); + case 'U': + return self::utf8chr(hexdec(substr($value, 2, 8))); + default: + throw new ParseException(sprintf('Found unknown escape character "%s".', $value)); + } + } + + /** + * Get the UTF-8 character for the given code point. + */ + private static function utf8chr(int $c): string + { + if (0x80 > $c %= 0x200000) { + return \chr($c); + } + if (0x800 > $c) { + return \chr(0xC0 | $c >> 6).\chr(0x80 | $c & 0x3F); + } + if (0x10000 > $c) { + return \chr(0xE0 | $c >> 12).\chr(0x80 | $c >> 6 & 0x3F).\chr(0x80 | $c & 0x3F); + } + + return \chr(0xF0 | $c >> 18).\chr(0x80 | $c >> 12 & 0x3F).\chr(0x80 | $c >> 6 & 0x3F).\chr(0x80 | $c & 0x3F); + } +} diff --git a/vendor/symfony/yaml/Yaml.php b/vendor/symfony/yaml/Yaml.php new file mode 100644 index 000000000..4fea47f9a --- /dev/null +++ b/vendor/symfony/yaml/Yaml.php @@ -0,0 +1,102 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +namespace Symfony\Component\Yaml; + +use Symfony\Component\Yaml\Exception\ParseException; + +/** + * Yaml offers convenience methods to load and dump YAML. + * + * @author Fabien Potencier + * + * @final + */ +class Yaml +{ + public const DUMP_OBJECT = 1; + public const PARSE_EXCEPTION_ON_INVALID_TYPE = 2; + public const PARSE_OBJECT = 4; + public const PARSE_OBJECT_FOR_MAP = 8; + public const DUMP_EXCEPTION_ON_INVALID_TYPE = 16; + public const PARSE_DATETIME = 32; + public const DUMP_OBJECT_AS_MAP = 64; + public const DUMP_MULTI_LINE_LITERAL_BLOCK = 128; + public const PARSE_CONSTANT = 256; + public const PARSE_CUSTOM_TAGS = 512; + public const DUMP_EMPTY_ARRAY_AS_SEQUENCE = 1024; + public const DUMP_NULL_AS_TILDE = 2048; + + /** + * Parses a YAML file into a PHP value. + * + * Usage: + * + * $array = Yaml::parseFile('config.yml'); + * print_r($array); + * + * @param string $filename The path to the YAML file to be parsed + * @param int $flags A bit field of PARSE_* constants to customize the YAML parser behavior + * + * @return mixed The YAML converted to a PHP value + * + * @throws ParseException If the file could not be read or the YAML is not valid + */ + public static function parseFile(string $filename, int $flags = 0) + { + $yaml = new Parser(); + + return $yaml->parseFile($filename, $flags); + } + + /** + * Parses YAML into a PHP value. + * + * Usage: + * + * $array = Yaml::parse(file_get_contents('config.yml')); + * print_r($array); + * + * + * @param string $input A string containing YAML + * @param int $flags A bit field of PARSE_* constants to customize the YAML parser behavior + * + * @return mixed The YAML converted to a PHP value + * + * @throws ParseException If the YAML is not valid + */ + public static function parse(string $input, int $flags = 0) + { + $yaml = new Parser(); + + return $yaml->parse($input, $flags); + } + + /** + * Dumps a PHP value to a YAML string. + * + * The dump method, when supplied with an array, will do its best + * to convert the array into friendly YAML. + * + * @param mixed $input The PHP value + * @param int $inline The level where you switch to inline YAML + * @param int $indent The amount of spaces to use for indentation of nested nodes + * @param int $flags A bit field of DUMP_* constants to customize the dumped YAML string + * + * @return string A YAML string representing the original PHP value + */ + public static function dump($input, int $inline = 2, int $indent = 4, int $flags = 0): string + { + $yaml = new Dumper($indent); + + return $yaml->dump($input, $inline, 0, $flags); + } +} diff --git a/vendor/symfony/yaml/composer.json b/vendor/symfony/yaml/composer.json new file mode 100644 index 000000000..4aca5c85b --- /dev/null +++ b/vendor/symfony/yaml/composer.json @@ -0,0 +1,42 @@ +{ + "name": "symfony/yaml", + "type": "library", + "description": "Loads and dumps YAML files", + "keywords": [], + "homepage": "https://symfony.com", + "license": "MIT", + "authors": [ + { + "name": "Fabien Potencier", + "email": "fabien@symfony.com" + }, + { + "name": "Symfony Community", + "homepage": "https://symfony.com/contributors" + } + ], + "require": { + "php": ">=7.2.5", + "symfony/deprecation-contracts": "^2.1", + "symfony/polyfill-ctype": "~1.8" + }, + "require-dev": { + "symfony/console": "^4.4|^5.0" + }, + "conflict": { + "symfony/console": "<4.4" + }, + "suggest": { + "symfony/console": "For validating YAML files using the lint command" + }, + "autoload": { + "psr-4": { "Symfony\\Component\\Yaml\\": "" }, + "exclude-from-classmap": [ + "/Tests/" + ] + }, + "bin": [ + "Resources/bin/yaml-lint" + ], + "minimum-stability": "dev" +} diff --git a/yaml2md.php b/yaml2md.php deleted file mode 100644 index a67fc2008..000000000 --- a/yaml2md.php +++ /dev/null @@ -1,16 +0,0 @@ - - -Matrix"; -echo getTable($dimensions); - -echo "

    Activtities per Dimension

    "; -echo '
    '.getInfos($dimensions) . '
    '; -?> - From 7c682eee0a9bc6799224b87e4be76ef17b9dc343 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 9 Feb 2021 20:59:33 +0100 Subject: [PATCH 2/6] Sanitized/CamelCase Filenames --- .../Build/1/DefinedBuildProcess.yaml | 1 - ...stingOfArtifactsInVirtualEnvironments.yaml | 1 - .../Build/3/SigningOfArtifacts.yaml | 1 - .../Build/3/SigningOfCode.yaml | 1 - .../1/DefinedDeploymentProcess.yaml | 1 - .../Deployment/2/BackupBeforeDeployment.yaml | 1 - ...nmentDependingConfigurationParameters.yaml | 1 - .../Deployment/2/UsageOfTrustedImages.yaml | 1 - .../3/HandoverOfConfidentialParameters.yaml | 1 - .../3/InventoryOfRunningArtifacts.yaml | 1 - .../3/RollingUpdateOnDeployment.yaml | 1 - .../3/SameArtifactForEnvironments.yaml | 1 - .../Deployment/3/UsageOfFeatureToggles.yaml | 1 - .../Deployment/4/BlueOrgreenDeployment.yaml | 24 +++++++++++++++++++ .../1/APatchPolicyIsDefined.yaml | 1 - .../1/AutomatedPrsForPatches.yaml | 1 - .../2/NightlyBuildOfImages.yaml | 1 - .../2/ReductionOfTheAttackSurface.yaml | 1 - .../2/UsageOfAMaximumLifetimeForImages.yaml | 1 - ...UsageOfAShortMaximumLifetimeForImages.yaml | 1 - ...rmationSecurityTargetsAreCommunicated.yaml | 1 - ...SimpleThreatModellingOnTechnicalLevel.yaml | 1 - ...fSimpleThreatModellingOnBusinessLevel.yaml | 1 - .../2/CreationOfSimpleAbuseStories.yaml | 1 - .../ConductionOfAdvancedThreatModelling.yaml | 1 - .../4/CreationOfAdvancedAbuseStories.yaml | 1 - ...ecurityTrainingsForSoftwareDevelopers.yaml | 1 - .../1/SecurityConsultingOnRequest.yaml | 1 - .../2/EachTeamHasASecurityChampion.yaml | 1 - .../2/RegularSecurityTrainingForAll.yaml | 1 - ...arSecurityTrainingOfSecurityChampions.yaml | 1 - .../2/RewardOfGoodCommunication.yaml | 1 - ...ionOfBuild-It,Break-It,Fix-ItContests.yaml | 1 - ...WithDevelopersAndSystemAdministrators.yaml | 1 - .../3/RegularSecurityTrainingForEveryone.yaml | 1 - .../3/Security-Lessoned-Learned.yaml | 1 - .../4/AligningSecurityInTeams.yaml | 1 - ...tionOfCollaborativeTeamSecurityChecks.yaml | 1 - .../4/ConductionOfWarGames.yaml | 1 - ...pleBcdrPracticesForCriticalComponents.yaml | 1 - .../3/ApprovalByReviewingAnyNewVersion.yaml | 1 - .../DefinitionOfAChangeManagementProcess.yaml | 1 - .../PreventionOfUnauthorizedInstallation.yaml | 1 - .../1/ApplicationHardeningLevel1.yaml | 1 - .../2/App.HardeningLevel2.yaml | 1 - .../3/App.HardeningLevel3.yaml | 1 - .../4/FullCoverageOfApp.HardeningLevel3.yaml | 1 - ...solatedNetworksForVirtualEnvironments.yaml | 1 - .../1/SimpleAccessControlForSystems.yaml | 1 - .../UsageOfTestAndProductionEnvironments.yaml | 1 - ...nsAreRunningInVirtualizedEnvironments.yaml | 1 - .../2/CheckingTheSourcesOfUsedLibraries.yaml | 1 - .../2/FilterOutgoingTraffic.yaml | 1 - .../2/TheClusterIsHardened.yaml | 1 - ...UsageOfSecurityByDefaultForComponents.yaml | 1 - .../2/VirtualEnvironmentsAreLimited.yaml | 1 - .../3/2Fa.yaml | 1 - .../3/ImmutableInfrastructure.yaml | 1 - .../3/InfrastructureAsCode.yaml | 1 - ...leBasedAuthenticationAndAuthorization.yaml | 1 - .../3/Versioning.yaml | 1 - ...ionOfSystemCallsInVirtualEnvironments.yaml | 1 - .../4/Microservice-Architecture.yaml | 1 - ...onNearEnvironmentsAreUsedByDevelopers.yaml | 1 - .../4/UsageOfAChaosMonkey.yaml | 1 - .../Logging/1/CentralizedSystemLogging.yaml | 1 - .../Logging/1/LoggingOfSecurityEvents.yaml | 1 - .../Logging/1/PiiLoggingConcept.yaml | 1 - .../Logging/2/VisualizedLogging.yaml | 1 - .../3/CentralizedApplicationLogging.yaml | 1 - .../4/CorrelationOfSecurityEvents.yaml | 1 - .../1/SimpleApplicationMetrics.yaml | 1 - .../Monitoring/1/SimpleSystemMetrics.yaml | 1 - .../Monitoring/2/Alerting.yaml | 1 - .../Monitoring/2/VisualizedMetrics.yaml | 1 - ...dvancedAvailablityAndStabilityMetrics.yaml | 1 - .../3/AdvancedWebapplicationMetrics.yaml | 1 - .../3/DeactivationOfUnusedMetrics.yaml | 1 - .../Monitoring/3/GroupingOfMetrics.yaml | 1 - .../Monitoring/3/TargetedAlerting.yaml | 1 - .../4/CoverageAndControlMetrics.yaml | 1 - .../Monitoring/4/DefenceMetrics.yaml | 1 - .../4/MetricsAreCombinedWithTests.yaml | 1 - .../4/ScreensWithMetricVisualization.yaml | 1 - ...curityUnitTestsForImportantComponents.yaml | 1 - ...ntegrationTestsForImportantComponents.yaml | 1 - ...urityRelatedModuleAndIntegrationTests.yaml | 1 - .../ApplicationTests}/4/SmokeTest.yaml | 1 - .../1/DefinitionOfQualityGates.yaml | 1 - .../1/SimpleFalsePositiveTreatment.yaml | 1 - ...mentOfDefectsWithSeverityHighOrHigher.yaml | 1 - .../2/SimpleVisualizationOfDefects.yaml | 1 - ...bilityIssuesIntoTheDevelopmentProcess.yaml | 1 - .../TreatmentOfDefectsWithSeverityMiddle.yaml | 1 - .../4/AdvancedVisualizationOfDefects.yaml | 1 - .../4/ReproducibleDefectTickets.yaml | 1 - .../4/TreatmentOfAllDefects.yaml | 1 - ...UsageOfAVulnerabilityManagementSystem.yaml | 1 - .../1/SimpleScan.yaml | 1 - ...CoverageOfClientSideDynamicComponents.yaml | 1 - .../2/UsageOfDifferentRoles.yaml | 1 - .../3/CoverageOfHiddenEndpoints.yaml | 1 - .../3/CoverageOfMoreInputVectors.yaml | 1 - .../3/CoverageOfSequentialOperations.yaml | 1 - .../3/UsageOfMultipleScanners.yaml | 1 - .../4/CoverageAnalysis.yaml | 1 - ...verageOfServiceToServiceCommunication.yaml | 1 - .../1/TestForExposedServices.yaml | 1 - .../2/TestNetworkSegmentation.yaml | 1 - ...OfTheConfigurationOfCloudEnvironments.yaml | 1 - .../3/WeakPasswordTest.yaml | 1 - .../4/LoadTests.yaml | 1 - ...ideComponentsWithKnownVulnerabilities.yaml | 1 - ...lysisForImportantServerSideComponents.yaml | 1 - ...lysisForImportantClientSideComponents.yaml | 1 - ...ideComponentsWithKnownVulnerabilities.yaml | 1 - .../4/ExclusionOfSourceCodeDuplicates.yaml | 1 - ...icAnalysisForAllComponentsOrlibraries.yaml | 16 +++++++++++++ ...icAnalysisForAllSelfWrittenComponents.yaml | 1 - .../4/StylisticAnalysis.yaml | 1 - .../4/UsageOfMultipleAnalysers.yaml | 1 - .../1/StoredSecrets.yaml | 1 - .../2/TestClusterDeploymentResources.yaml | 1 - .../2/TestOfVirtualizedEnvironments.yaml | 1 - .../2/TestTheClouldConfiguration.yaml | 1 - ...heDefinitionOfVirtualizedEnvironments.yaml | 1 - .../3/CheckForImageLifetime.yaml | 1 - .../3/CheckForMalware.yaml | 1 - .../3/CheckForNewImageVersion.yaml | 1 - .../4/CheckForKnownVulnerabilities.yaml | 1 - ...sInInfrastructureWithNewImageVersions.yaml | 1 - ...tureComponentsForKnownVulnerabilities.yaml | 1 - .../1/DefaultSettingsForIntensity.yaml | 1 - .../Test-Intensity/1/HighTestIntensity.yaml | 1 - .../2/DeactivatingOfUnneededTests.yaml | 1 - .../Test-Intensity/2/RegularTests.yaml | 1 - ...eationAndApplicationOfATestingConcept.yaml | 1 - newFolder.php => newFolder-Migration-2021.php | 12 ++++++---- 138 files changed, 48 insertions(+), 139 deletions(-) rename data-new/{Build and Deployment => BuildAndDeployment}/Build/1/DefinedBuildProcess.yaml (98%) rename data-new/{Build and Deployment => BuildAndDeployment}/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml (99%) rename data-new/{Build and Deployment => BuildAndDeployment}/Build/3/SigningOfArtifacts.yaml (98%) rename data-new/{Build and Deployment => BuildAndDeployment}/Build/3/SigningOfCode.yaml (97%) rename data-new/{Build and Deployment => BuildAndDeployment}/Deployment/1/DefinedDeploymentProcess.yaml (98%) rename data-new/{Build and Deployment => BuildAndDeployment}/Deployment/2/BackupBeforeDeployment.yaml (98%) rename data-new/{Build and Deployment => BuildAndDeployment}/Deployment/2/EnvironmentDependingConfigurationParameters.yaml (97%) rename data-new/{Build and Deployment => BuildAndDeployment}/Deployment/2/UsageOfTrustedImages.yaml (98%) rename data-new/{Build and Deployment => BuildAndDeployment}/Deployment/3/HandoverOfConfidentialParameters.yaml (98%) rename data-new/{Build and Deployment => BuildAndDeployment}/Deployment/3/InventoryOfRunningArtifacts.yaml (98%) rename data-new/{Build and Deployment => BuildAndDeployment}/Deployment/3/RollingUpdateOnDeployment.yaml (97%) rename data-new/{Build and Deployment => BuildAndDeployment}/Deployment/3/SameArtifactForEnvironments.yaml (98%) rename data-new/{Build and Deployment => BuildAndDeployment}/Deployment/3/UsageOfFeatureToggles.yaml (98%) create mode 100755 data-new/BuildAndDeployment/Deployment/4/BlueOrgreenDeployment.yaml rename data-new/{Build and Deployment/Patch Management => BuildAndDeployment/PatchManagement}/1/APatchPolicyIsDefined.yaml (97%) rename data-new/{Build and Deployment/Patch Management => BuildAndDeployment/PatchManagement}/1/AutomatedPrsForPatches.yaml (98%) rename data-new/{Build and Deployment/Patch Management => BuildAndDeployment/PatchManagement}/2/NightlyBuildOfImages.yaml (97%) rename data-new/{Build and Deployment/Patch Management => BuildAndDeployment/PatchManagement}/2/ReductionOfTheAttackSurface.yaml (98%) rename data-new/{Build and Deployment/Patch Management => BuildAndDeployment/PatchManagement}/2/UsageOfAMaximumLifetimeForImages.yaml (98%) rename data-new/{Build and Deployment/Patch Management => BuildAndDeployment/PatchManagement}/4/UsageOfAShortMaximumLifetimeForImages.yaml (99%) rename data-new/{Culture and Organization => CultureAndOrganization}/Design/0/InformationSecurityTargetsAreCommunicated.yaml (98%) rename data-new/{Culture and Organization => CultureAndOrganization}/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml (99%) rename data-new/{Culture and Organization => CultureAndOrganization}/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml (98%) rename data-new/{Culture and Organization => CultureAndOrganization}/Design/2/CreationOfSimpleAbuseStories.yaml (98%) rename data-new/{Culture and Organization => CultureAndOrganization}/Design/3/ConductionOfAdvancedThreatModelling.yaml (99%) rename data-new/{Culture and Organization => CultureAndOrganization}/Design/4/CreationOfAdvancedAbuseStories.yaml (99%) rename data-new/{Culture and Organization/Education and Guidance => CultureAndOrganization/EducationAndGuidance}/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml (98%) rename data-new/{Culture and Organization/Education and Guidance => CultureAndOrganization/EducationAndGuidance}/1/SecurityConsultingOnRequest.yaml (97%) rename data-new/{Culture and Organization/Education and Guidance => CultureAndOrganization/EducationAndGuidance}/2/EachTeamHasASecurityChampion.yaml (98%) rename data-new/{Culture and Organization/Education and Guidance => CultureAndOrganization/EducationAndGuidance}/2/RegularSecurityTrainingForAll.yaml (98%) rename data-new/{Culture and Organization/Education and Guidance => CultureAndOrganization/EducationAndGuidance}/2/RegularSecurityTrainingOfSecurityChampions.yaml (97%) rename data-new/{Culture and Organization/Education and Guidance => CultureAndOrganization/EducationAndGuidance}/2/RewardOfGoodCommunication.yaml (98%) rename data-new/{Culture and Organization/Education and Guidance => CultureAndOrganization/EducationAndGuidance}/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml (98%) rename data-new/{Culture and Organization/Education and Guidance => CultureAndOrganization/EducationAndGuidance}/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml (98%) rename data-new/{Culture and Organization/Education and Guidance => CultureAndOrganization/EducationAndGuidance}/3/RegularSecurityTrainingForEveryone.yaml (98%) rename data-new/{Culture and Organization/Education and Guidance => CultureAndOrganization/EducationAndGuidance}/3/Security-Lessoned-Learned.yaml (97%) rename data-new/{Culture and Organization/Education and Guidance => CultureAndOrganization/EducationAndGuidance}/4/AligningSecurityInTeams.yaml (98%) rename data-new/{Culture and Organization/Education and Guidance => CultureAndOrganization/EducationAndGuidance}/4/ConductionOfCollaborativeTeamSecurityChecks.yaml (97%) rename data-new/{Culture and Organization/Education and Guidance => CultureAndOrganization/EducationAndGuidance}/4/ConductionOfWarGames.yaml (98%) rename data-new/{Culture and Organization => CultureAndOrganization}/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml (98%) rename data-new/{Culture and Organization => CultureAndOrganization}/Process/3/ApprovalByReviewingAnyNewVersion.yaml (98%) rename data-new/{Culture and Organization => CultureAndOrganization}/Process/3/DefinitionOfAChangeManagementProcess.yaml (97%) rename data-new/{Culture and Organization => CultureAndOrganization}/Process/3/PreventionOfUnauthorizedInstallation.yaml (98%) rename data-new/Implementation/{Application Hardening => ApplicationHardening}/1/ApplicationHardeningLevel1.yaml (99%) rename data-new/Implementation/{Application Hardening => ApplicationHardening}/2/App.HardeningLevel2.yaml (98%) rename data-new/Implementation/{Application Hardening => ApplicationHardening}/3/App.HardeningLevel3.yaml (98%) rename data-new/Implementation/{Application Hardening => ApplicationHardening}/4/FullCoverageOfApp.HardeningLevel3.yaml (98%) rename data-new/Implementation/{Infrastructure Hardening => InfrastructureHardening}/1/IsolatedNetworksForVirtualEnvironments.yaml (98%) rename data-new/Implementation/{Infrastructure Hardening => InfrastructureHardening}/1/SimpleAccessControlForSystems.yaml (97%) rename data-new/Implementation/{Infrastructure Hardening => InfrastructureHardening}/1/UsageOfTestAndProductionEnvironments.yaml (98%) rename data-new/Implementation/{Infrastructure Hardening => InfrastructureHardening}/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml (98%) rename data-new/Implementation/{Infrastructure Hardening => InfrastructureHardening}/2/CheckingTheSourcesOfUsedLibraries.yaml (97%) rename data-new/Implementation/{Infrastructure Hardening => InfrastructureHardening}/2/FilterOutgoingTraffic.yaml (98%) rename data-new/Implementation/{Infrastructure Hardening => InfrastructureHardening}/2/TheClusterIsHardened.yaml (98%) rename data-new/Implementation/{Infrastructure Hardening => InfrastructureHardening}/2/UsageOfSecurityByDefaultForComponents.yaml (98%) rename data-new/Implementation/{Infrastructure Hardening => InfrastructureHardening}/2/VirtualEnvironmentsAreLimited.yaml (98%) rename data-new/Implementation/{Infrastructure Hardening => InfrastructureHardening}/3/2Fa.yaml (98%) rename data-new/Implementation/{Infrastructure Hardening => InfrastructureHardening}/3/ImmutableInfrastructure.yaml (98%) rename data-new/Implementation/{Infrastructure Hardening => InfrastructureHardening}/3/InfrastructureAsCode.yaml (98%) rename data-new/Implementation/{Infrastructure Hardening => InfrastructureHardening}/3/RoleBasedAuthenticationAndAuthorization.yaml (98%) rename data-new/Implementation/{Infrastructure Hardening => InfrastructureHardening}/3/Versioning.yaml (98%) rename data-new/Implementation/{Infrastructure Hardening => InfrastructureHardening}/4/LimitationOfSystemCallsInVirtualEnvironments.yaml (98%) rename data-new/Implementation/{Infrastructure Hardening => InfrastructureHardening}/4/Microservice-Architecture.yaml (97%) rename data-new/Implementation/{Infrastructure Hardening => InfrastructureHardening}/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml (98%) rename data-new/Implementation/{Infrastructure Hardening => InfrastructureHardening}/4/UsageOfAChaosMonkey.yaml (98%) rename data-new/{Information Gathering => InformationGathering}/Logging/1/CentralizedSystemLogging.yaml (98%) rename data-new/{Information Gathering => InformationGathering}/Logging/1/LoggingOfSecurityEvents.yaml (98%) rename data-new/{Information Gathering => InformationGathering}/Logging/1/PiiLoggingConcept.yaml (97%) rename data-new/{Information Gathering => InformationGathering}/Logging/2/VisualizedLogging.yaml (98%) rename data-new/{Information Gathering => InformationGathering}/Logging/3/CentralizedApplicationLogging.yaml (98%) rename data-new/{Information Gathering => InformationGathering}/Logging/4/CorrelationOfSecurityEvents.yaml (98%) rename data-new/{Information Gathering => InformationGathering}/Monitoring/1/SimpleApplicationMetrics.yaml (97%) rename data-new/{Information Gathering => InformationGathering}/Monitoring/1/SimpleSystemMetrics.yaml (98%) rename data-new/{Information Gathering => InformationGathering}/Monitoring/2/Alerting.yaml (97%) rename data-new/{Information Gathering => InformationGathering}/Monitoring/2/VisualizedMetrics.yaml (97%) rename data-new/{Information Gathering => InformationGathering}/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml (97%) rename data-new/{Information Gathering => InformationGathering}/Monitoring/3/AdvancedWebapplicationMetrics.yaml (97%) rename data-new/{Information Gathering => InformationGathering}/Monitoring/3/DeactivationOfUnusedMetrics.yaml (97%) rename data-new/{Information Gathering => InformationGathering}/Monitoring/3/GroupingOfMetrics.yaml (97%) rename data-new/{Information Gathering => InformationGathering}/Monitoring/3/TargetedAlerting.yaml (98%) rename data-new/{Information Gathering => InformationGathering}/Monitoring/4/CoverageAndControlMetrics.yaml (99%) rename data-new/{Information Gathering => InformationGathering}/Monitoring/4/DefenceMetrics.yaml (98%) rename data-new/{Information Gathering => InformationGathering}/Monitoring/4/MetricsAreCombinedWithTests.yaml (97%) rename data-new/{Information Gathering => InformationGathering}/Monitoring/4/ScreensWithMetricVisualization.yaml (98%) rename data-new/{Test and Verification/Application tests => TestAndVerification/ApplicationTests}/2/SecurityUnitTestsForImportantComponents.yaml (98%) rename data-new/{Test and Verification/Application tests => TestAndVerification/ApplicationTests}/3/SecurityIntegrationTestsForImportantComponents.yaml (98%) rename data-new/{Test and Verification/Application tests => TestAndVerification/ApplicationTests}/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml (98%) rename data-new/{Test and Verification/Application tests => TestAndVerification/ApplicationTests}/4/SmokeTest.yaml (98%) rename data-new/{Test and Verification => TestAndVerification}/Consolidation/1/DefinitionOfQualityGates.yaml (98%) rename data-new/{Test and Verification => TestAndVerification}/Consolidation/1/SimpleFalsePositiveTreatment.yaml (98%) rename data-new/{Test and Verification => TestAndVerification}/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml (97%) rename data-new/{Test and Verification => TestAndVerification}/Consolidation/2/SimpleVisualizationOfDefects.yaml (98%) rename data-new/{Test and Verification => TestAndVerification}/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml (99%) rename data-new/{Test and Verification => TestAndVerification}/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml (97%) rename data-new/{Test and Verification => TestAndVerification}/Consolidation/4/AdvancedVisualizationOfDefects.yaml (98%) rename data-new/{Test and Verification => TestAndVerification}/Consolidation/4/ReproducibleDefectTickets.yaml (98%) rename data-new/{Test and Verification => TestAndVerification}/Consolidation/4/TreatmentOfAllDefects.yaml (97%) rename data-new/{Test and Verification => TestAndVerification}/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml (98%) rename data-new/{Test and Verification/Dynamic depth for applications => TestAndVerification/DynamicDepthForApplications}/1/SimpleScan.yaml (98%) rename data-new/{Test and Verification/Dynamic depth for applications => TestAndVerification/DynamicDepthForApplications}/2/CoverageOfClientSideDynamicComponents.yaml (98%) rename data-new/{Test and Verification/Dynamic depth for applications => TestAndVerification/DynamicDepthForApplications}/2/UsageOfDifferentRoles.yaml (97%) rename data-new/{Test and Verification/Dynamic depth for applications => TestAndVerification/DynamicDepthForApplications}/3/CoverageOfHiddenEndpoints.yaml (97%) rename data-new/{Test and Verification/Dynamic depth for applications => TestAndVerification/DynamicDepthForApplications}/3/CoverageOfMoreInputVectors.yaml (98%) rename data-new/{Test and Verification/Dynamic depth for applications => TestAndVerification/DynamicDepthForApplications}/3/CoverageOfSequentialOperations.yaml (97%) rename data-new/{Test and Verification/Dynamic depth for applications => TestAndVerification/DynamicDepthForApplications}/3/UsageOfMultipleScanners.yaml (98%) rename data-new/{Test and Verification/Dynamic depth for applications => TestAndVerification/DynamicDepthForApplications}/4/CoverageAnalysis.yaml (97%) rename data-new/{Test and Verification/Dynamic depth for applications => TestAndVerification/DynamicDepthForApplications}/4/CoverageOfServiceToServiceCommunication.yaml (97%) rename data-new/{Test and Verification/Dynamic depth for infrastructure => TestAndVerification/DynamicDepthForInfrastructure}/1/TestForExposedServices.yaml (98%) rename data-new/{Test and Verification/Dynamic depth for infrastructure => TestAndVerification/DynamicDepthForInfrastructure}/2/TestNetworkSegmentation.yaml (98%) rename data-new/{Test and Verification/Dynamic depth for infrastructure => TestAndVerification/DynamicDepthForInfrastructure}/2/TestOfTheConfigurationOfCloudEnvironments.yaml (98%) rename data-new/{Test and Verification/Dynamic depth for infrastructure => TestAndVerification/DynamicDepthForInfrastructure}/3/WeakPasswordTest.yaml (98%) rename data-new/{Test and Verification/Dynamic depth for infrastructure => TestAndVerification/DynamicDepthForInfrastructure}/4/LoadTests.yaml (97%) rename data-new/{Test and Verification/Static depth for applications => TestAndVerification/StaticDepthForApplications}/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml (98%) rename data-new/{Test and Verification/Static depth for applications => TestAndVerification/StaticDepthForApplications}/2/StaticAnalysisForImportantServerSideComponents.yaml (98%) rename data-new/{Test and Verification/Static depth for applications => TestAndVerification/StaticDepthForApplications}/3/StaticAnalysisForImportantClientSideComponents.yaml (98%) rename data-new/{Test and Verification/Static depth for applications => TestAndVerification/StaticDepthForApplications}/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml (98%) rename data-new/{Test and Verification/Static depth for applications => TestAndVerification/StaticDepthForApplications}/4/ExclusionOfSourceCodeDuplicates.yaml (98%) create mode 100755 data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllComponentsOrlibraries.yaml rename data-new/{Test and Verification/Static depth for applications => TestAndVerification/StaticDepthForApplications}/4/StaticAnalysisForAllSelfWrittenComponents.yaml (98%) rename data-new/{Test and Verification/Static depth for applications => TestAndVerification/StaticDepthForApplications}/4/StylisticAnalysis.yaml (97%) rename data-new/{Test and Verification/Static depth for applications => TestAndVerification/StaticDepthForApplications}/4/UsageOfMultipleAnalysers.yaml (98%) rename data-new/{Test and Verification/Static depth for infrastructure => TestAndVerification/StaticDepthForInfrastructure}/1/StoredSecrets.yaml (98%) rename data-new/{Test and Verification/Static depth for infrastructure => TestAndVerification/StaticDepthForInfrastructure}/2/TestClusterDeploymentResources.yaml (98%) rename data-new/{Test and Verification/Static depth for infrastructure => TestAndVerification/StaticDepthForInfrastructure}/2/TestOfVirtualizedEnvironments.yaml (98%) rename data-new/{Test and Verification/Static depth for infrastructure => TestAndVerification/StaticDepthForInfrastructure}/2/TestTheClouldConfiguration.yaml (98%) rename data-new/{Test and Verification/Static depth for infrastructure => TestAndVerification/StaticDepthForInfrastructure}/2/TestTheDefinitionOfVirtualizedEnvironments.yaml (98%) rename data-new/{Test and Verification/Static depth for infrastructure => TestAndVerification/StaticDepthForInfrastructure}/3/CheckForImageLifetime.yaml (97%) rename data-new/{Test and Verification/Static depth for infrastructure => TestAndVerification/StaticDepthForInfrastructure}/3/CheckForMalware.yaml (98%) rename data-new/{Test and Verification/Static depth for infrastructure => TestAndVerification/StaticDepthForInfrastructure}/3/CheckForNewImageVersion.yaml (97%) rename data-new/{Test and Verification/Static depth for infrastructure => TestAndVerification/StaticDepthForInfrastructure}/4/CheckForKnownVulnerabilities.yaml (98%) rename data-new/{Test and Verification/Static depth for infrastructure => TestAndVerification/StaticDepthForInfrastructure}/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml (97%) rename data-new/{Test and Verification/Static depth for infrastructure => TestAndVerification/StaticDepthForInfrastructure}/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml (98%) rename data-new/{Test and Verification => TestAndVerification}/Test-Intensity/1/DefaultSettingsForIntensity.yaml (97%) rename data-new/{Test and Verification => TestAndVerification}/Test-Intensity/1/HighTestIntensity.yaml (97%) rename data-new/{Test and Verification => TestAndVerification}/Test-Intensity/2/DeactivatingOfUnneededTests.yaml (98%) rename data-new/{Test and Verification => TestAndVerification}/Test-Intensity/2/RegularTests.yaml (97%) rename data-new/{Test and Verification => TestAndVerification}/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml (98%) rename newFolder.php => newFolder-Migration-2021.php (65%) diff --git a/data-new/Build and Deployment/Build/1/DefinedBuildProcess.yaml b/data-new/BuildAndDeployment/Build/1/DefinedBuildProcess.yaml similarity index 98% rename from data-new/Build and Deployment/Build/1/DefinedBuildProcess.yaml rename to data-new/BuildAndDeployment/Build/1/DefinedBuildProcess.yaml index cefc8663b..61fc29551 100755 --- a/data-new/Build and Deployment/Build/1/DefinedBuildProcess.yaml +++ b/data-new/BuildAndDeployment/Build/1/DefinedBuildProcess.yaml @@ -11,7 +11,6 @@ difficultyOfImplementation: time: 3 resources: 2 usefulness: 4 -level: 1 implementation: - CI/CD Tools, e.g. Jenkins - Container technologies and orchestration like Docker, Kubernetes diff --git a/data-new/Build and Deployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml b/data-new/BuildAndDeployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml similarity index 99% rename from data-new/Build and Deployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml rename to data-new/BuildAndDeployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml index 8b60def28..ae69f2f12 100755 --- a/data-new/Build and Deployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml +++ b/data-new/BuildAndDeployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml @@ -16,7 +16,6 @@ usefulness: 2 implementation: - Container technologies and orchestration like Docker, Kubernetes - CI/CD Tools, e.g. Jenkins -level: 2 samm2: i-secure-build|A|2 iso27001-2017: - 14.2.6 diff --git a/data-new/Build and Deployment/Build/3/SigningOfArtifacts.yaml b/data-new/BuildAndDeployment/Build/3/SigningOfArtifacts.yaml similarity index 98% rename from data-new/Build and Deployment/Build/3/SigningOfArtifacts.yaml rename to data-new/BuildAndDeployment/Build/3/SigningOfArtifacts.yaml index 271d04573..439494fb7 100755 --- a/data-new/Build and Deployment/Build/3/SigningOfArtifacts.yaml +++ b/data-new/BuildAndDeployment/Build/3/SigningOfArtifacts.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 2 resources: 2 usefulness: 4 -level: 3 implementation: - Docker Content Trust - in-toto diff --git a/data-new/Build and Deployment/Build/3/SigningOfCode.yaml b/data-new/BuildAndDeployment/Build/3/SigningOfCode.yaml similarity index 97% rename from data-new/Build and Deployment/Build/3/SigningOfCode.yaml rename to data-new/BuildAndDeployment/Build/3/SigningOfCode.yaml index 3581acf0c..9560d1958 100755 --- a/data-new/Build and Deployment/Build/3/SigningOfCode.yaml +++ b/data-new/BuildAndDeployment/Build/3/SigningOfCode.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 2 resources: 2 usefulness: 3 -level: 3 implementation: ~ dependsOn: - Defined build process diff --git a/data-new/Build and Deployment/Deployment/1/DefinedDeploymentProcess.yaml b/data-new/BuildAndDeployment/Deployment/1/DefinedDeploymentProcess.yaml similarity index 98% rename from data-new/Build and Deployment/Deployment/1/DefinedDeploymentProcess.yaml rename to data-new/BuildAndDeployment/Deployment/1/DefinedDeploymentProcess.yaml index 59c98d5bc..7aea8a7b8 100755 --- a/data-new/Build and Deployment/Deployment/1/DefinedDeploymentProcess.yaml +++ b/data-new/BuildAndDeployment/Deployment/1/DefinedDeploymentProcess.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 4 -level: 1 implementation: Jenkins, Docker samm2: i-secure-deployment|A|1 iso27001-2017: diff --git a/data-new/Build and Deployment/Deployment/2/BackupBeforeDeployment.yaml b/data-new/BuildAndDeployment/Deployment/2/BackupBeforeDeployment.yaml similarity index 98% rename from data-new/Build and Deployment/Deployment/2/BackupBeforeDeployment.yaml rename to data-new/BuildAndDeployment/Deployment/2/BackupBeforeDeployment.yaml index 1b34926fb..0c8ce5edd 100755 --- a/data-new/Build and Deployment/Deployment/2/BackupBeforeDeployment.yaml +++ b/data-new/BuildAndDeployment/Deployment/2/BackupBeforeDeployment.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 4 -level: 2 implementation: A complete database backup might be performed*. For large and complex environments, a Point in Time Recovery for databases should be implemented. dependsOn: diff --git a/data-new/Build and Deployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml b/data-new/BuildAndDeployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml similarity index 97% rename from data-new/Build and Deployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml rename to data-new/BuildAndDeployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml index 8423b8712..8b67ddd30 100755 --- a/data-new/Build and Deployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml +++ b/data-new/BuildAndDeployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 4 -level: 2 implementation: "" samm: SA2-A samm2: i-secure-deployment|B|1 diff --git a/data-new/Build and Deployment/Deployment/2/UsageOfTrustedImages.yaml b/data-new/BuildAndDeployment/Deployment/2/UsageOfTrustedImages.yaml similarity index 98% rename from data-new/Build and Deployment/Deployment/2/UsageOfTrustedImages.yaml rename to data-new/BuildAndDeployment/Deployment/2/UsageOfTrustedImages.yaml index 79fc48227..9ed3ab781 100755 --- a/data-new/Build and Deployment/Deployment/2/UsageOfTrustedImages.yaml +++ b/data-new/BuildAndDeployment/Deployment/2/UsageOfTrustedImages.yaml @@ -10,7 +10,6 @@ difficultyOfImplementation: time: 1 resources: 1 usefulness: 3 -level: 2 samm2: i-secure-deployment|A|2 iso27001-2017: - 15.1.1 diff --git a/data-new/Build and Deployment/Deployment/3/HandoverOfConfidentialParameters.yaml b/data-new/BuildAndDeployment/Deployment/3/HandoverOfConfidentialParameters.yaml similarity index 98% rename from data-new/Build and Deployment/Deployment/3/HandoverOfConfidentialParameters.yaml rename to data-new/BuildAndDeployment/Deployment/3/HandoverOfConfidentialParameters.yaml index e5f97c8f0..e9ed103c9 100755 --- a/data-new/Build and Deployment/Deployment/3/HandoverOfConfidentialParameters.yaml +++ b/data-new/BuildAndDeployment/Deployment/3/HandoverOfConfidentialParameters.yaml @@ -10,7 +10,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 4 -level: 3 implementation: "" dependsOn: - Environment depending configuration parameters diff --git a/data-new/Build and Deployment/Deployment/3/InventoryOfRunningArtifacts.yaml b/data-new/BuildAndDeployment/Deployment/3/InventoryOfRunningArtifacts.yaml similarity index 98% rename from data-new/Build and Deployment/Deployment/3/InventoryOfRunningArtifacts.yaml rename to data-new/BuildAndDeployment/Deployment/3/InventoryOfRunningArtifacts.yaml index 361374ef1..63eb72f97 100755 --- a/data-new/Build and Deployment/Deployment/3/InventoryOfRunningArtifacts.yaml +++ b/data-new/BuildAndDeployment/Deployment/3/InventoryOfRunningArtifacts.yaml @@ -10,7 +10,6 @@ difficultyOfImplementation: time: 2 resources: 3 usefulness: 3 -level: 3 samm2: o-incident-management|TODO iso27001-2017: - "8.1" diff --git a/data-new/Build and Deployment/Deployment/3/RollingUpdateOnDeployment.yaml b/data-new/BuildAndDeployment/Deployment/3/RollingUpdateOnDeployment.yaml similarity index 97% rename from data-new/Build and Deployment/Deployment/3/RollingUpdateOnDeployment.yaml rename to data-new/BuildAndDeployment/Deployment/3/RollingUpdateOnDeployment.yaml index d4721fc9b..5e46dfa9a 100755 --- a/data-new/Build and Deployment/Deployment/3/RollingUpdateOnDeployment.yaml +++ b/data-new/BuildAndDeployment/Deployment/3/RollingUpdateOnDeployment.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 2 resources: 2 usefulness: 2 -level: 3 implementation: Docker, Webserver, rolling update dependsOn: - Defined deployment process diff --git a/data-new/Build and Deployment/Deployment/3/SameArtifactForEnvironments.yaml b/data-new/BuildAndDeployment/Deployment/3/SameArtifactForEnvironments.yaml similarity index 98% rename from data-new/Build and Deployment/Deployment/3/SameArtifactForEnvironments.yaml rename to data-new/BuildAndDeployment/Deployment/3/SameArtifactForEnvironments.yaml index 10c3d19e0..075ee154b 100755 --- a/data-new/Build and Deployment/Deployment/3/SameArtifactForEnvironments.yaml +++ b/data-new/BuildAndDeployment/Deployment/3/SameArtifactForEnvironments.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 4 -level: 3 implementation: Docker dependsOn: - Defined build process diff --git a/data-new/Build and Deployment/Deployment/3/UsageOfFeatureToggles.yaml b/data-new/BuildAndDeployment/Deployment/3/UsageOfFeatureToggles.yaml similarity index 98% rename from data-new/Build and Deployment/Deployment/3/UsageOfFeatureToggles.yaml rename to data-new/BuildAndDeployment/Deployment/3/UsageOfFeatureToggles.yaml index 6c6621484..f1dfb99db 100755 --- a/data-new/Build and Deployment/Deployment/3/UsageOfFeatureToggles.yaml +++ b/data-new/BuildAndDeployment/Deployment/3/UsageOfFeatureToggles.yaml @@ -9,7 +9,6 @@ difficultyOfImplementation: time: 1 resources: 1 usefulness: 2 -level: 3 implementation: Docker dependsOn: - Same artifact for environments diff --git a/data-new/BuildAndDeployment/Deployment/4/BlueOrgreenDeployment.yaml b/data-new/BuildAndDeployment/Deployment/4/BlueOrgreenDeployment.yaml new file mode 100755 index 000000000..d1b50df75 --- /dev/null +++ b/data-new/BuildAndDeployment/Deployment/4/BlueOrgreenDeployment.yaml @@ -0,0 +1,24 @@ +--- +risk: A new artifacts version can have unknown defects. +measure: By having multiple production environments, a deployment can be performant + on the first environment to spot possible defects before it is deployment in the + production environment(s) +difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 +usefulness: 2 +implementation: Blue/Green + Deployments +dependsOn: +- Smoke Test +samm2: TODO +iso27001-2017: +- 17.2.1 +- 12.1.1 +- 12.1.2 +- 12.1.4 +- 12.5.1 +- 14.2.9 +id: BlueOrgreenDeployment +... diff --git a/data-new/Build and Deployment/Patch Management/1/APatchPolicyIsDefined.yaml b/data-new/BuildAndDeployment/PatchManagement/1/APatchPolicyIsDefined.yaml similarity index 97% rename from data-new/Build and Deployment/Patch Management/1/APatchPolicyIsDefined.yaml rename to data-new/BuildAndDeployment/PatchManagement/1/APatchPolicyIsDefined.yaml index 0204f6071..36ce4dd90 100755 --- a/data-new/Build and Deployment/Patch Management/1/APatchPolicyIsDefined.yaml +++ b/data-new/BuildAndDeployment/PatchManagement/1/APatchPolicyIsDefined.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 1 resources: 2 usefulness: 4 -level: 1 samm2: o-environment-management|B|1 iso27001-2017: - 12.6.1 diff --git a/data-new/Build and Deployment/Patch Management/1/AutomatedPrsForPatches.yaml b/data-new/BuildAndDeployment/PatchManagement/1/AutomatedPrsForPatches.yaml similarity index 98% rename from data-new/Build and Deployment/Patch Management/1/AutomatedPrsForPatches.yaml rename to data-new/BuildAndDeployment/PatchManagement/1/AutomatedPrsForPatches.yaml index 34c4fdfa2..93f52bec8 100755 --- a/data-new/Build and Deployment/Patch Management/1/AutomatedPrsForPatches.yaml +++ b/data-new/BuildAndDeployment/PatchManagement/1/AutomatedPrsForPatches.yaml @@ -10,7 +10,6 @@ difficultyOfImplementation: time: 2 resources: 2 usefulness: 5 -level: 1 samm2: o-environment-management|B|1 iso27001-2017: - 12.6.1 diff --git a/data-new/Build and Deployment/Patch Management/2/NightlyBuildOfImages.yaml b/data-new/BuildAndDeployment/PatchManagement/2/NightlyBuildOfImages.yaml similarity index 97% rename from data-new/Build and Deployment/Patch Management/2/NightlyBuildOfImages.yaml rename to data-new/BuildAndDeployment/PatchManagement/2/NightlyBuildOfImages.yaml index a453f1d41..8c576b214 100755 --- a/data-new/Build and Deployment/Patch Management/2/NightlyBuildOfImages.yaml +++ b/data-new/BuildAndDeployment/PatchManagement/2/NightlyBuildOfImages.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 2 resources: 2 usefulness: 3 -level: 2 samm2: o-environment-management|B|1 iso27001-2017: - 12.6.1 diff --git a/data-new/Build and Deployment/Patch Management/2/ReductionOfTheAttackSurface.yaml b/data-new/BuildAndDeployment/PatchManagement/2/ReductionOfTheAttackSurface.yaml similarity index 98% rename from data-new/Build and Deployment/Patch Management/2/ReductionOfTheAttackSurface.yaml rename to data-new/BuildAndDeployment/PatchManagement/2/ReductionOfTheAttackSurface.yaml index 00e994945..3a23a74c1 100755 --- a/data-new/Build and Deployment/Patch Management/2/ReductionOfTheAttackSurface.yaml +++ b/data-new/BuildAndDeployment/PatchManagement/2/ReductionOfTheAttackSurface.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 3 resources: 2 usefulness: 3 -level: 2 samm2: o-environment-management|B|1 iso27001-2017: - hardening is missing in ISO 27001 diff --git a/data-new/Build and Deployment/Patch Management/2/UsageOfAMaximumLifetimeForImages.yaml b/data-new/BuildAndDeployment/PatchManagement/2/UsageOfAMaximumLifetimeForImages.yaml similarity index 98% rename from data-new/Build and Deployment/Patch Management/2/UsageOfAMaximumLifetimeForImages.yaml rename to data-new/BuildAndDeployment/PatchManagement/2/UsageOfAMaximumLifetimeForImages.yaml index d176e9ea6..7ce947d1b 100755 --- a/data-new/Build and Deployment/Patch Management/2/UsageOfAMaximumLifetimeForImages.yaml +++ b/data-new/BuildAndDeployment/PatchManagement/2/UsageOfAMaximumLifetimeForImages.yaml @@ -10,7 +10,6 @@ difficultyOfImplementation: time: 4 resources: 2 usefulness: 3 -level: 2 samm2: o-environment-management|B|1 iso27001-2017: - 12.6.1 diff --git a/data-new/Build and Deployment/Patch Management/4/UsageOfAShortMaximumLifetimeForImages.yaml b/data-new/BuildAndDeployment/PatchManagement/4/UsageOfAShortMaximumLifetimeForImages.yaml similarity index 99% rename from data-new/Build and Deployment/Patch Management/4/UsageOfAShortMaximumLifetimeForImages.yaml rename to data-new/BuildAndDeployment/PatchManagement/4/UsageOfAShortMaximumLifetimeForImages.yaml index ac6d7ba7b..890406b0e 100755 --- a/data-new/Build and Deployment/Patch Management/4/UsageOfAShortMaximumLifetimeForImages.yaml +++ b/data-new/BuildAndDeployment/PatchManagement/4/UsageOfAShortMaximumLifetimeForImages.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 4 resources: 2 usefulness: 3 -level: 4 samm2: o-environment-management|B|1 iso27001-2017: - 12.6.1 diff --git a/data-new/Culture and Organization/Design/0/InformationSecurityTargetsAreCommunicated.yaml b/data-new/CultureAndOrganization/Design/0/InformationSecurityTargetsAreCommunicated.yaml similarity index 98% rename from data-new/Culture and Organization/Design/0/InformationSecurityTargetsAreCommunicated.yaml rename to data-new/CultureAndOrganization/Design/0/InformationSecurityTargetsAreCommunicated.yaml index cc6797144..4233c2a3e 100755 --- a/data-new/Culture and Organization/Design/0/InformationSecurityTargetsAreCommunicated.yaml +++ b/data-new/CultureAndOrganization/Design/0/InformationSecurityTargetsAreCommunicated.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 1 resources: 1 usefulness: 4 -level: 0 samm: SM1-B iso27001-2017: - 5.1.1 diff --git a/data-new/Culture and Organization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml b/data-new/CultureAndOrganization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml similarity index 99% rename from data-new/Culture and Organization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml rename to data-new/CultureAndOrganization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml index 27db05320..601f16c8d 100755 --- a/data-new/Culture and Organization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml +++ b/data-new/CultureAndOrganization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 3 resources: 1 usefulness: 3 -level: 1 implementation: - Threat modelling Playbook md-description: |2 diff --git a/data-new/Culture and Organization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml b/data-new/CultureAndOrganization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml similarity index 98% rename from data-new/Culture and Organization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml rename to data-new/CultureAndOrganization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml index ecc5b7f9e..dde02bae5 100755 --- a/data-new/Culture and Organization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml +++ b/data-new/CultureAndOrganization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 3 resources: 1 usefulness: 3 -level: 2 samm: TA1-A iso27001-2017: - not explicitly covered by ISO 27001 diff --git a/data-new/Culture and Organization/Design/2/CreationOfSimpleAbuseStories.yaml b/data-new/CultureAndOrganization/Design/2/CreationOfSimpleAbuseStories.yaml similarity index 98% rename from data-new/Culture and Organization/Design/2/CreationOfSimpleAbuseStories.yaml rename to data-new/CultureAndOrganization/Design/2/CreationOfSimpleAbuseStories.yaml index d8721cdb1..b3cf67a6f 100755 --- a/data-new/Culture and Organization/Design/2/CreationOfSimpleAbuseStories.yaml +++ b/data-new/CultureAndOrganization/Design/2/CreationOfSimpleAbuseStories.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 4 -level: 2 samm: TA2-A iso27001-2017: - not explicitly covered by ISO 27001 diff --git a/data-new/Culture and Organization/Design/3/ConductionOfAdvancedThreatModelling.yaml b/data-new/CultureAndOrganization/Design/3/ConductionOfAdvancedThreatModelling.yaml similarity index 99% rename from data-new/Culture and Organization/Design/3/ConductionOfAdvancedThreatModelling.yaml rename to data-new/CultureAndOrganization/Design/3/ConductionOfAdvancedThreatModelling.yaml index 8fb2bf6d9..fc9f22b39 100755 --- a/data-new/Culture and Organization/Design/3/ConductionOfAdvancedThreatModelling.yaml +++ b/data-new/CultureAndOrganization/Design/3/ConductionOfAdvancedThreatModelling.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 3 resources: 2 usefulness: 3 -level: 3 md-description: | **Example High Maturity Scenario:** diff --git a/data-new/Culture and Organization/Design/4/CreationOfAdvancedAbuseStories.yaml b/data-new/CultureAndOrganization/Design/4/CreationOfAdvancedAbuseStories.yaml similarity index 99% rename from data-new/Culture and Organization/Design/4/CreationOfAdvancedAbuseStories.yaml rename to data-new/CultureAndOrganization/Design/4/CreationOfAdvancedAbuseStories.yaml index baa9e6e12..fc51356ad 100755 --- a/data-new/Culture and Organization/Design/4/CreationOfAdvancedAbuseStories.yaml +++ b/data-new/CultureAndOrganization/Design/4/CreationOfAdvancedAbuseStories.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 4 -level: 4 dependsOn: - Creation of simple abuse stories samm: TA2-A diff --git a/data-new/Culture and Organization/Education and Guidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml similarity index 98% rename from data-new/Culture and Organization/Education and Guidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml rename to data-new/CultureAndOrganization/EducationAndGuidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml index a2f6bdbc5..eea684d96 100755 --- a/data-new/Culture and Organization/Education and Guidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml @@ -9,7 +9,6 @@ difficultyOfImplementation: time: 1 resources: 1 usefulness: 3 -level: 1 samm: EG1-A - In case you do not have the budget to hire an external security expert, an option is to use the OWASP Juice Shop on a "hacking Friday" - https://cheatsheetseries.owasp.org/ diff --git a/data-new/Culture and Organization/Education and Guidance/1/SecurityConsultingOnRequest.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/1/SecurityConsultingOnRequest.yaml similarity index 97% rename from data-new/Culture and Organization/Education and Guidance/1/SecurityConsultingOnRequest.yaml rename to data-new/CultureAndOrganization/EducationAndGuidance/1/SecurityConsultingOnRequest.yaml index eacc5e6c3..78160ba6c 100755 --- a/data-new/Culture and Organization/Education and Guidance/1/SecurityConsultingOnRequest.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/1/SecurityConsultingOnRequest.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 1 resources: 1 usefulness: 3 -level: 1 samm: EG2-B iso27001-2017: - security consulting is missing in ISO 27001 may be diff --git a/data-new/Culture and Organization/Education and Guidance/2/EachTeamHasASecurityChampion.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/2/EachTeamHasASecurityChampion.yaml similarity index 98% rename from data-new/Culture and Organization/Education and Guidance/2/EachTeamHasASecurityChampion.yaml rename to data-new/CultureAndOrganization/EducationAndGuidance/2/EachTeamHasASecurityChampion.yaml index 3681ad4c4..cf2215007 100755 --- a/data-new/Culture and Organization/Education and Guidance/2/EachTeamHasASecurityChampion.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/2/EachTeamHasASecurityChampion.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 3 -level: 2 samm: EG2-B iso27001-2017: - security champions are missing in ISO 27001 most likely diff --git a/data-new/Culture and Organization/Education and Guidance/2/RegularSecurityTrainingForAll.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingForAll.yaml similarity index 98% rename from data-new/Culture and Organization/Education and Guidance/2/RegularSecurityTrainingForAll.yaml rename to data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingForAll.yaml index 9b22935e1..15337a502 100755 --- a/data-new/Culture and Organization/Education and Guidance/2/RegularSecurityTrainingForAll.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingForAll.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 3 -level: 2 samm: EG1-A iso27001-2017: - 7.2.2 diff --git a/data-new/Culture and Organization/Education and Guidance/2/RegularSecurityTrainingOfSecurityChampions.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingOfSecurityChampions.yaml similarity index 97% rename from data-new/Culture and Organization/Education and Guidance/2/RegularSecurityTrainingOfSecurityChampions.yaml rename to data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingOfSecurityChampions.yaml index bc9caea3f..7b5c76d3e 100755 --- a/data-new/Culture and Organization/Education and Guidance/2/RegularSecurityTrainingOfSecurityChampions.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingOfSecurityChampions.yaml @@ -9,7 +9,6 @@ difficultyOfImplementation: time: 2 resources: 2 usefulness: 3 -level: 2 samm: EG2-B iso27001-2017: - security champions are missing in ISO 27001 diff --git a/data-new/Culture and Organization/Education and Guidance/2/RewardOfGoodCommunication.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/2/RewardOfGoodCommunication.yaml similarity index 98% rename from data-new/Culture and Organization/Education and Guidance/2/RewardOfGoodCommunication.yaml rename to data-new/CultureAndOrganization/EducationAndGuidance/2/RewardOfGoodCommunication.yaml index 3125e077f..aa6a276e9 100755 --- a/data-new/Culture and Organization/Education and Guidance/2/RewardOfGoodCommunication.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/2/RewardOfGoodCommunication.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 3 -level: 2 iso27001-2017: - not required by ISO 27001 - interestingly enough A7.2.3 is requiring a process to handle misconduct but nothing diff --git a/data-new/Culture and Organization/Education and Guidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml similarity index 98% rename from data-new/Culture and Organization/Education and Guidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml rename to data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml index eb806156c..3bcd217e7 100755 --- a/data-new/Culture and Organization/Education and Guidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml @@ -10,7 +10,6 @@ difficultyOfImplementation: time: 3 resources: 1 usefulness: 3 -level: 3 iso27001-2017: - 7.2.2 implementation: https://builditbreakit.org/ diff --git a/data-new/Culture and Organization/Education and Guidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml similarity index 98% rename from data-new/Culture and Organization/Education and Guidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml rename to data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml index 6d741ff87..1a9b2171e 100755 --- a/data-new/Culture and Organization/Education and Guidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml @@ -9,7 +9,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 3 -level: 3 samm: IR1-B iso27001-2017: - Mutual review of source code is not explicitly required in ISO 27001 may be diff --git a/data-new/Culture and Organization/Education and Guidance/3/RegularSecurityTrainingForEveryone.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/3/RegularSecurityTrainingForEveryone.yaml similarity index 98% rename from data-new/Culture and Organization/Education and Guidance/3/RegularSecurityTrainingForEveryone.yaml rename to data-new/CultureAndOrganization/EducationAndGuidance/3/RegularSecurityTrainingForEveryone.yaml index 645083906..ad02b01e0 100755 --- a/data-new/Culture and Organization/Education and Guidance/3/RegularSecurityTrainingForEveryone.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/3/RegularSecurityTrainingForEveryone.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 2 resources: 2 usefulness: 3 -level: 3 samm: EG2-B iso27001-2017: - 7.2.2 diff --git a/data-new/Culture and Organization/Education and Guidance/3/Security-Lessoned-Learned.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/3/Security-Lessoned-Learned.yaml similarity index 97% rename from data-new/Culture and Organization/Education and Guidance/3/Security-Lessoned-Learned.yaml rename to data-new/CultureAndOrganization/EducationAndGuidance/3/Security-Lessoned-Learned.yaml index a39206e90..107eac7b2 100755 --- a/data-new/Culture and Organization/Education and Guidance/3/Security-Lessoned-Learned.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/3/Security-Lessoned-Learned.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 3 resources: 1 usefulness: 3 -level: 3 samm: IM-3, ST-3, SR2-B iso27001-2017: - 16.1.6 diff --git a/data-new/Culture and Organization/Education and Guidance/4/AligningSecurityInTeams.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/4/AligningSecurityInTeams.yaml similarity index 98% rename from data-new/Culture and Organization/Education and Guidance/4/AligningSecurityInTeams.yaml rename to data-new/CultureAndOrganization/EducationAndGuidance/4/AligningSecurityInTeams.yaml index 374906aae..5a8c47708 100755 --- a/data-new/Culture and Organization/Education and Guidance/4/AligningSecurityInTeams.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/4/AligningSecurityInTeams.yaml @@ -10,7 +10,6 @@ difficultyOfImplementation: implementation: Security SME are involved in discussion for requirements analysis, software design and sprint planning to provide guidance and suggestions. usefulness: 5 -level: 4 samm: EG2-B iso27001-2017: - 7.1.1 diff --git a/data-new/Culture and Organization/Education and Guidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml similarity index 97% rename from data-new/Culture and Organization/Education and Guidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml rename to data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml index af697f062..9a800187c 100755 --- a/data-new/Culture and Organization/Education and Guidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: knowledge: 4 time: 4 usefulness: 2 -level: 4 samm: EG2-A iso27001-2017: - Mutual scurity testing is not explicitly required in ISO 27001 may be diff --git a/data-new/Culture and Organization/Education and Guidance/4/ConductionOfWarGames.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfWarGames.yaml similarity index 98% rename from data-new/Culture and Organization/Education and Guidance/4/ConductionOfWarGames.yaml rename to data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfWarGames.yaml index 2738fc93e..b001ba639 100755 --- a/data-new/Culture and Organization/Education and Guidance/4/ConductionOfWarGames.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfWarGames.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 5 resources: 5 usefulness: 2 -level: 4 iso27001-2017: - ware games are not explicitly required in ISO 27001 may be - 7.2.2 diff --git a/data-new/Culture and Organization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml b/data-new/CultureAndOrganization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml similarity index 98% rename from data-new/Culture and Organization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml rename to data-new/CultureAndOrganization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml index 69ad4d176..6d0f52826 100755 --- a/data-new/Culture and Organization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml +++ b/data-new/CultureAndOrganization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml @@ -10,7 +10,6 @@ difficultyOfImplementation: time: 3 resources: 2 usefulness: 4 -level: 1 iso27001-2017: - 17.1.1 id: DefinitionOfSimpleBcdrPracticesForCriticalComponents diff --git a/data-new/Culture and Organization/Process/3/ApprovalByReviewingAnyNewVersion.yaml b/data-new/CultureAndOrganization/Process/3/ApprovalByReviewingAnyNewVersion.yaml similarity index 98% rename from data-new/Culture and Organization/Process/3/ApprovalByReviewingAnyNewVersion.yaml rename to data-new/CultureAndOrganization/Process/3/ApprovalByReviewingAnyNewVersion.yaml index 190e4cdc4..781454150 100755 --- a/data-new/Culture and Organization/Process/3/ApprovalByReviewingAnyNewVersion.yaml +++ b/data-new/CultureAndOrganization/Process/3/ApprovalByReviewingAnyNewVersion.yaml @@ -9,7 +9,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 3 -level: 3 samm: IR1-B iso27001-2017: - peer review - four eyes principle is not explicitly required by ISO 27001 diff --git a/data-new/Culture and Organization/Process/3/DefinitionOfAChangeManagementProcess.yaml b/data-new/CultureAndOrganization/Process/3/DefinitionOfAChangeManagementProcess.yaml similarity index 97% rename from data-new/Culture and Organization/Process/3/DefinitionOfAChangeManagementProcess.yaml rename to data-new/CultureAndOrganization/Process/3/DefinitionOfAChangeManagementProcess.yaml index eb397d2ac..3208fdeef 100755 --- a/data-new/Culture and Organization/Process/3/DefinitionOfAChangeManagementProcess.yaml +++ b/data-new/CultureAndOrganization/Process/3/DefinitionOfAChangeManagementProcess.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 3 resources: 1 usefulness: 3 -level: 3 iso27001-2017: - 14.2.2 - 12.1.2 diff --git a/data-new/Culture and Organization/Process/3/PreventionOfUnauthorizedInstallation.yaml b/data-new/CultureAndOrganization/Process/3/PreventionOfUnauthorizedInstallation.yaml similarity index 98% rename from data-new/Culture and Organization/Process/3/PreventionOfUnauthorizedInstallation.yaml rename to data-new/CultureAndOrganization/Process/3/PreventionOfUnauthorizedInstallation.yaml index 9f7c56aef..945dcab35 100755 --- a/data-new/Culture and Organization/Process/3/PreventionOfUnauthorizedInstallation.yaml +++ b/data-new/CultureAndOrganization/Process/3/PreventionOfUnauthorizedInstallation.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 1 resources: 1 usefulness: 3 -level: 3 iso27001-2017: - 12.5.1 - 12.6.1 diff --git a/data-new/Implementation/Application Hardening/1/ApplicationHardeningLevel1.yaml b/data-new/Implementation/ApplicationHardening/1/ApplicationHardeningLevel1.yaml similarity index 99% rename from data-new/Implementation/Application Hardening/1/ApplicationHardeningLevel1.yaml rename to data-new/Implementation/ApplicationHardening/1/ApplicationHardeningLevel1.yaml index 365d4fd25..b2e4302aa 100755 --- a/data-new/Implementation/Application Hardening/1/ApplicationHardeningLevel1.yaml +++ b/data-new/Implementation/ApplicationHardening/1/ApplicationHardeningLevel1.yaml @@ -14,7 +14,6 @@ difficultyOfImplementation: time: 4 resources: 2 usefulness: 4 -level: 1 md-description: | To tackle the security of code developed in-house, OWASP offers an extensive collection of [Cheatsheets](https://cheatsheetseries.owasp.org/) demonstrating how to implement features securely. Moreover, the Security Knowledge Framework[1] offers an extensive library of code patterns spanning several programming languages. These patterns can be used to not only jumpstart the development process, but also do so securely. diff --git a/data-new/Implementation/Application Hardening/2/App.HardeningLevel2.yaml b/data-new/Implementation/ApplicationHardening/2/App.HardeningLevel2.yaml similarity index 98% rename from data-new/Implementation/Application Hardening/2/App.HardeningLevel2.yaml rename to data-new/Implementation/ApplicationHardening/2/App.HardeningLevel2.yaml index ff0f2c8b4..ca02d4b11 100755 --- a/data-new/Implementation/Application Hardening/2/App.HardeningLevel2.yaml +++ b/data-new/Implementation/ApplicationHardening/2/App.HardeningLevel2.yaml @@ -12,7 +12,6 @@ difficultyOfImplementation: time: 4 resources: 2 usefulness: 4 -level: 2 implementation: - OWASP ASVS diff --git a/data-new/Implementation/Application Hardening/3/App.HardeningLevel3.yaml b/data-new/Implementation/ApplicationHardening/3/App.HardeningLevel3.yaml similarity index 98% rename from data-new/Implementation/Application Hardening/3/App.HardeningLevel3.yaml rename to data-new/Implementation/ApplicationHardening/3/App.HardeningLevel3.yaml index c6eee893c..48fe0042e 100755 --- a/data-new/Implementation/Application Hardening/3/App.HardeningLevel3.yaml +++ b/data-new/Implementation/ApplicationHardening/3/App.HardeningLevel3.yaml @@ -13,7 +13,6 @@ difficultyOfImplementation: time: 4 resources: 2 usefulness: 4 -level: 3 implementation: - OWASP ASVS diff --git a/data-new/Implementation/Application Hardening/4/FullCoverageOfApp.HardeningLevel3.yaml b/data-new/Implementation/ApplicationHardening/4/FullCoverageOfApp.HardeningLevel3.yaml similarity index 98% rename from data-new/Implementation/Application Hardening/4/FullCoverageOfApp.HardeningLevel3.yaml rename to data-new/Implementation/ApplicationHardening/4/FullCoverageOfApp.HardeningLevel3.yaml index b87bf3d1e..a56ed72e4 100755 --- a/data-new/Implementation/Application Hardening/4/FullCoverageOfApp.HardeningLevel3.yaml +++ b/data-new/Implementation/ApplicationHardening/4/FullCoverageOfApp.HardeningLevel3.yaml @@ -13,7 +13,6 @@ difficultyOfImplementation: time: 4 resources: 2 usefulness: 4 -level: 4 implementation: - OWASP ASVS diff --git a/data-new/Implementation/Infrastructure Hardening/1/IsolatedNetworksForVirtualEnvironments.yaml b/data-new/Implementation/InfrastructureHardening/1/IsolatedNetworksForVirtualEnvironments.yaml similarity index 98% rename from data-new/Implementation/Infrastructure Hardening/1/IsolatedNetworksForVirtualEnvironments.yaml rename to data-new/Implementation/InfrastructureHardening/1/IsolatedNetworksForVirtualEnvironments.yaml index 979d05f14..6d949b7ff 100755 --- a/data-new/Implementation/Infrastructure Hardening/1/IsolatedNetworksForVirtualEnvironments.yaml +++ b/data-new/Implementation/InfrastructureHardening/1/IsolatedNetworksForVirtualEnvironments.yaml @@ -9,7 +9,6 @@ difficultyOfImplementation: time: 3 resources: 3 usefulness: 5 -level: 1 dependsOn: [] implementation: - istio diff --git a/data-new/Implementation/Infrastructure Hardening/1/SimpleAccessControlForSystems.yaml b/data-new/Implementation/InfrastructureHardening/1/SimpleAccessControlForSystems.yaml similarity index 97% rename from data-new/Implementation/Infrastructure Hardening/1/SimpleAccessControlForSystems.yaml rename to data-new/Implementation/InfrastructureHardening/1/SimpleAccessControlForSystems.yaml index a9f60e024..8f893c932 100755 --- a/data-new/Implementation/Infrastructure Hardening/1/SimpleAccessControlForSystems.yaml +++ b/data-new/Implementation/InfrastructureHardening/1/SimpleAccessControlForSystems.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 3 resources: 3 usefulness: 5 -level: 1 dependsOn: - Defined deployment process implementation: HTTP-Basic Authentication, TLS, VPN diff --git a/data-new/Implementation/Infrastructure Hardening/1/UsageOfTestAndProductionEnvironments.yaml b/data-new/Implementation/InfrastructureHardening/1/UsageOfTestAndProductionEnvironments.yaml similarity index 98% rename from data-new/Implementation/Infrastructure Hardening/1/UsageOfTestAndProductionEnvironments.yaml rename to data-new/Implementation/InfrastructureHardening/1/UsageOfTestAndProductionEnvironments.yaml index e34936dca..535d3713a 100755 --- a/data-new/Implementation/Infrastructure Hardening/1/UsageOfTestAndProductionEnvironments.yaml +++ b/data-new/Implementation/InfrastructureHardening/1/UsageOfTestAndProductionEnvironments.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 3 resources: 5 usefulness: 4 -level: 1 dependsOn: - Defined deployment process samm2: o-environment-management|A|1 diff --git a/data-new/Implementation/Infrastructure Hardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml b/data-new/Implementation/InfrastructureHardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml similarity index 98% rename from data-new/Implementation/Infrastructure Hardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml rename to data-new/Implementation/InfrastructureHardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml index ebc15ec49..c43ded208 100755 --- a/data-new/Implementation/Infrastructure Hardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml +++ b/data-new/Implementation/InfrastructureHardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 3 resources: 5 usefulness: 3 -level: 2 samm2: o-environment-management|A|1 iso27001-2017: - virtual environments are not explicitly covered by ISO 27001 - too specific diff --git a/data-new/Implementation/Infrastructure Hardening/2/CheckingTheSourcesOfUsedLibraries.yaml b/data-new/Implementation/InfrastructureHardening/2/CheckingTheSourcesOfUsedLibraries.yaml similarity index 97% rename from data-new/Implementation/Infrastructure Hardening/2/CheckingTheSourcesOfUsedLibraries.yaml rename to data-new/Implementation/InfrastructureHardening/2/CheckingTheSourcesOfUsedLibraries.yaml index a15088c24..0d3838401 100755 --- a/data-new/Implementation/Infrastructure Hardening/2/CheckingTheSourcesOfUsedLibraries.yaml +++ b/data-new/Implementation/InfrastructureHardening/2/CheckingTheSourcesOfUsedLibraries.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 3 resources: 1 usefulness: 3 -level: 2 samm: SA1-A samm2: o-environment-management|A|1 iso27001-2017: diff --git a/data-new/Implementation/Infrastructure Hardening/2/FilterOutgoingTraffic.yaml b/data-new/Implementation/InfrastructureHardening/2/FilterOutgoingTraffic.yaml similarity index 98% rename from data-new/Implementation/Infrastructure Hardening/2/FilterOutgoingTraffic.yaml rename to data-new/Implementation/InfrastructureHardening/2/FilterOutgoingTraffic.yaml index 79000d7ff..c6d130de9 100755 --- a/data-new/Implementation/Infrastructure Hardening/2/FilterOutgoingTraffic.yaml +++ b/data-new/Implementation/InfrastructureHardening/2/FilterOutgoingTraffic.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 3 resources: 3 usefulness: 2 -level: 2 dependsOn: [] implementation: - Open Policy Agent diff --git a/data-new/Implementation/Infrastructure Hardening/2/TheClusterIsHardened.yaml b/data-new/Implementation/InfrastructureHardening/2/TheClusterIsHardened.yaml similarity index 98% rename from data-new/Implementation/Infrastructure Hardening/2/TheClusterIsHardened.yaml rename to data-new/Implementation/InfrastructureHardening/2/TheClusterIsHardened.yaml index a10986197..57b776b06 100755 --- a/data-new/Implementation/Infrastructure Hardening/2/TheClusterIsHardened.yaml +++ b/data-new/Implementation/InfrastructureHardening/2/TheClusterIsHardened.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 3 resources: 2 usefulness: 4 -level: 2 implementation: - CIS Kubernetes Bench for Security - CIS Docker Bench for Security diff --git a/data-new/Implementation/Infrastructure Hardening/2/UsageOfSecurityByDefaultForComponents.yaml b/data-new/Implementation/InfrastructureHardening/2/UsageOfSecurityByDefaultForComponents.yaml similarity index 98% rename from data-new/Implementation/Infrastructure Hardening/2/UsageOfSecurityByDefaultForComponents.yaml rename to data-new/Implementation/InfrastructureHardening/2/UsageOfSecurityByDefaultForComponents.yaml index 6d328c630..266fb22d7 100755 --- a/data-new/Implementation/Infrastructure Hardening/2/UsageOfSecurityByDefaultForComponents.yaml +++ b/data-new/Implementation/InfrastructureHardening/2/UsageOfSecurityByDefaultForComponents.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 3 resources: 1 usefulness: 3 -level: 2 implementation: 'For applications: Check default encoding, managing secrets, crypto, authentication' dependsOn: diff --git a/data-new/Implementation/Infrastructure Hardening/2/VirtualEnvironmentsAreLimited.yaml b/data-new/Implementation/InfrastructureHardening/2/VirtualEnvironmentsAreLimited.yaml similarity index 98% rename from data-new/Implementation/Infrastructure Hardening/2/VirtualEnvironmentsAreLimited.yaml rename to data-new/Implementation/InfrastructureHardening/2/VirtualEnvironmentsAreLimited.yaml index 6bd7946e2..960accda2 100755 --- a/data-new/Implementation/Infrastructure Hardening/2/VirtualEnvironmentsAreLimited.yaml +++ b/data-new/Implementation/InfrastructureHardening/2/VirtualEnvironmentsAreLimited.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 2 resources: 3 usefulness: 3 -level: 2 dependsOn: - Applications are running in virtualized environments samm2: o-environment-management|A|1 diff --git a/data-new/Implementation/Infrastructure Hardening/3/2Fa.yaml b/data-new/Implementation/InfrastructureHardening/3/2Fa.yaml similarity index 98% rename from data-new/Implementation/Infrastructure Hardening/3/2Fa.yaml rename to data-new/Implementation/InfrastructureHardening/3/2Fa.yaml index 9b0b83e42..696ef82b0 100755 --- a/data-new/Implementation/Infrastructure Hardening/3/2Fa.yaml +++ b/data-new/Implementation/InfrastructureHardening/3/2Fa.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 2 resources: 3 usefulness: 4 -level: 3 implementation: Smartcard, YubiKey, SMS, TOTP samm2: TODO iso27001-2017: diff --git a/data-new/Implementation/Infrastructure Hardening/3/ImmutableInfrastructure.yaml b/data-new/Implementation/InfrastructureHardening/3/ImmutableInfrastructure.yaml similarity index 98% rename from data-new/Implementation/Infrastructure Hardening/3/ImmutableInfrastructure.yaml rename to data-new/Implementation/InfrastructureHardening/3/ImmutableInfrastructure.yaml index cf891ada1..b2a54e549 100755 --- a/data-new/Implementation/Infrastructure Hardening/3/ImmutableInfrastructure.yaml +++ b/data-new/Implementation/InfrastructureHardening/3/ImmutableInfrastructure.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 3 -level: 3 dependsOn: - Infrastructure as Code - Usage of Semantic Versioning for components like diff --git a/data-new/Implementation/Infrastructure Hardening/3/InfrastructureAsCode.yaml b/data-new/Implementation/InfrastructureHardening/3/InfrastructureAsCode.yaml similarity index 98% rename from data-new/Implementation/Infrastructure Hardening/3/InfrastructureAsCode.yaml rename to data-new/Implementation/InfrastructureHardening/3/InfrastructureAsCode.yaml index 1db015fc4..eda76472c 100755 --- a/data-new/Implementation/Infrastructure Hardening/3/InfrastructureAsCode.yaml +++ b/data-new/Implementation/InfrastructureHardening/3/InfrastructureAsCode.yaml @@ -9,7 +9,6 @@ difficultyOfImplementation: time: 5 resources: 4 usefulness: 4 -level: 3 implementation: GitOps, Ansible, Chef, Puppet, Jenkinsfile samm2: o-environment-management|A|1 iso27001-2017: diff --git a/data-new/Implementation/Infrastructure Hardening/3/RoleBasedAuthenticationAndAuthorization.yaml b/data-new/Implementation/InfrastructureHardening/3/RoleBasedAuthenticationAndAuthorization.yaml similarity index 98% rename from data-new/Implementation/Infrastructure Hardening/3/RoleBasedAuthenticationAndAuthorization.yaml rename to data-new/Implementation/InfrastructureHardening/3/RoleBasedAuthenticationAndAuthorization.yaml index 210b4ee89..f485e5ece 100755 --- a/data-new/Implementation/Infrastructure Hardening/3/RoleBasedAuthenticationAndAuthorization.yaml +++ b/data-new/Implementation/InfrastructureHardening/3/RoleBasedAuthenticationAndAuthorization.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 3 resources: 1 usefulness: 3 -level: 3 implementation: Directory Service, Plugins dependsOn: - Defined deployment process diff --git a/data-new/Implementation/Infrastructure Hardening/3/Versioning.yaml b/data-new/Implementation/InfrastructureHardening/3/Versioning.yaml similarity index 98% rename from data-new/Implementation/Infrastructure Hardening/3/Versioning.yaml rename to data-new/Implementation/InfrastructureHardening/3/Versioning.yaml index bf00d47f6..34ac4a628 100755 --- a/data-new/Implementation/Infrastructure Hardening/3/Versioning.yaml +++ b/data-new/Implementation/InfrastructureHardening/3/Versioning.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 3 resources: 3 usefulness: 5 -level: 3 dependsOn: - Defined deployment process samm2: o-environment-management|A|1 diff --git a/data-new/Implementation/Infrastructure Hardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml b/data-new/Implementation/InfrastructureHardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml similarity index 98% rename from data-new/Implementation/Infrastructure Hardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml rename to data-new/Implementation/InfrastructureHardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml index 8dc68f24f..2710c7b97 100755 --- a/data-new/Implementation/Infrastructure Hardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml +++ b/data-new/Implementation/InfrastructureHardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 3 resources: 3 usefulness: 5 -level: 4 dependsOn: - Applications are running in virtualized environments implementation: seccomp, strace diff --git a/data-new/Implementation/Infrastructure Hardening/4/Microservice-Architecture.yaml b/data-new/Implementation/InfrastructureHardening/4/Microservice-Architecture.yaml similarity index 97% rename from data-new/Implementation/Infrastructure Hardening/4/Microservice-Architecture.yaml rename to data-new/Implementation/InfrastructureHardening/4/Microservice-Architecture.yaml index eb48cbc5c..2b15ded4d 100755 --- a/data-new/Implementation/Infrastructure Hardening/4/Microservice-Architecture.yaml +++ b/data-new/Implementation/InfrastructureHardening/4/Microservice-Architecture.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 5 resources: 5 usefulness: 3 -level: 4 samm: SA2 samm2: o-environment-management|A|1 iso27001-2017: diff --git a/data-new/Implementation/Infrastructure Hardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml b/data-new/Implementation/InfrastructureHardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml similarity index 98% rename from data-new/Implementation/Infrastructure Hardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml rename to data-new/Implementation/InfrastructureHardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml index 33a86bc71..b0f3618c7 100755 --- a/data-new/Implementation/Infrastructure Hardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml +++ b/data-new/Implementation/InfrastructureHardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml @@ -10,7 +10,6 @@ difficultyOfImplementation: time: 3 resources: 3 usefulness: 4 -level: 4 dependsOn: - Defined deployment process - Infrastructure as Code diff --git a/data-new/Implementation/Infrastructure Hardening/4/UsageOfAChaosMonkey.yaml b/data-new/Implementation/InfrastructureHardening/4/UsageOfAChaosMonkey.yaml similarity index 98% rename from data-new/Implementation/Infrastructure Hardening/4/UsageOfAChaosMonkey.yaml rename to data-new/Implementation/InfrastructureHardening/4/UsageOfAChaosMonkey.yaml index 9cc978259..90788ad5f 100755 --- a/data-new/Implementation/Infrastructure Hardening/4/UsageOfAChaosMonkey.yaml +++ b/data-new/Implementation/InfrastructureHardening/4/UsageOfAChaosMonkey.yaml @@ -9,7 +9,6 @@ difficultyOfImplementation: time: 5 resources: 5 usefulness: 3 -level: 4 samm2: o-environment-management|A|1 iso27001-2017: - not explicitly covered by ISO 27001 - too specific diff --git a/data-new/Information Gathering/Logging/1/CentralizedSystemLogging.yaml b/data-new/InformationGathering/Logging/1/CentralizedSystemLogging.yaml similarity index 98% rename from data-new/Information Gathering/Logging/1/CentralizedSystemLogging.yaml rename to data-new/InformationGathering/Logging/1/CentralizedSystemLogging.yaml index 72a43f835..3d276c7eb 100755 --- a/data-new/Information Gathering/Logging/1/CentralizedSystemLogging.yaml +++ b/data-new/InformationGathering/Logging/1/CentralizedSystemLogging.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 1 resources: 1 usefulness: 2 -level: 1 implementation: rsyslog, Logstash samm2: o-incident-management|A|1 iso27001-2017: diff --git a/data-new/Information Gathering/Logging/1/LoggingOfSecurityEvents.yaml b/data-new/InformationGathering/Logging/1/LoggingOfSecurityEvents.yaml similarity index 98% rename from data-new/Information Gathering/Logging/1/LoggingOfSecurityEvents.yaml rename to data-new/InformationGathering/Logging/1/LoggingOfSecurityEvents.yaml index f17599617..ba7933b77 100755 --- a/data-new/Information Gathering/Logging/1/LoggingOfSecurityEvents.yaml +++ b/data-new/InformationGathering/Logging/1/LoggingOfSecurityEvents.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 1 resources: 1 usefulness: 4 -level: 1 dependsOn: - PII logging concept implementation: rsyslog, logstash, fluentd, bash diff --git a/data-new/Information Gathering/Logging/1/PiiLoggingConcept.yaml b/data-new/InformationGathering/Logging/1/PiiLoggingConcept.yaml similarity index 97% rename from data-new/Information Gathering/Logging/1/PiiLoggingConcept.yaml rename to data-new/InformationGathering/Logging/1/PiiLoggingConcept.yaml index df834382f..8a687afea 100755 --- a/data-new/Information Gathering/Logging/1/PiiLoggingConcept.yaml +++ b/data-new/InformationGathering/Logging/1/PiiLoggingConcept.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 1 resources: 1 usefulness: 1 -level: 1 implementation: rsyslog, logstash, fluentd, bash samm2: o-incident-management|A|1 iso27001-2017: diff --git a/data-new/Information Gathering/Logging/2/VisualizedLogging.yaml b/data-new/InformationGathering/Logging/2/VisualizedLogging.yaml similarity index 98% rename from data-new/Information Gathering/Logging/2/VisualizedLogging.yaml rename to data-new/InformationGathering/Logging/2/VisualizedLogging.yaml index 0d3ba4d5f..117e54981 100755 --- a/data-new/Information Gathering/Logging/2/VisualizedLogging.yaml +++ b/data-new/InformationGathering/Logging/2/VisualizedLogging.yaml @@ -9,7 +9,6 @@ difficultyOfImplementation: time: 3 resources: 3 usefulness: 4 -level: 2 dependsOn: - Centralized system logging - Centralized application logging diff --git a/data-new/Information Gathering/Logging/3/CentralizedApplicationLogging.yaml b/data-new/InformationGathering/Logging/3/CentralizedApplicationLogging.yaml similarity index 98% rename from data-new/Information Gathering/Logging/3/CentralizedApplicationLogging.yaml rename to data-new/InformationGathering/Logging/3/CentralizedApplicationLogging.yaml index 276fd3cae..33cb9d781 100755 --- a/data-new/Information Gathering/Logging/3/CentralizedApplicationLogging.yaml +++ b/data-new/InformationGathering/Logging/3/CentralizedApplicationLogging.yaml @@ -9,7 +9,6 @@ difficultyOfImplementation: time: 1 resources: 1 usefulness: 5 -level: 3 dependsOn: - Visualized logging - Alerting diff --git a/data-new/Information Gathering/Logging/4/CorrelationOfSecurityEvents.yaml b/data-new/InformationGathering/Logging/4/CorrelationOfSecurityEvents.yaml similarity index 98% rename from data-new/Information Gathering/Logging/4/CorrelationOfSecurityEvents.yaml rename to data-new/InformationGathering/Logging/4/CorrelationOfSecurityEvents.yaml index 9bae7e283..ac3a4fcdc 100755 --- a/data-new/Information Gathering/Logging/4/CorrelationOfSecurityEvents.yaml +++ b/data-new/InformationGathering/Logging/4/CorrelationOfSecurityEvents.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 4 resources: 4 usefulness: 3 -level: 4 dependsOn: - Visualized logging - Alerting diff --git a/data-new/Information Gathering/Monitoring/1/SimpleApplicationMetrics.yaml b/data-new/InformationGathering/Monitoring/1/SimpleApplicationMetrics.yaml similarity index 97% rename from data-new/Information Gathering/Monitoring/1/SimpleApplicationMetrics.yaml rename to data-new/InformationGathering/Monitoring/1/SimpleApplicationMetrics.yaml index 4a4e282bb..3671f0e82 100755 --- a/data-new/Information Gathering/Monitoring/1/SimpleApplicationMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/1/SimpleApplicationMetrics.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 2 resources: 2 usefulness: 5 -level: 1 implementation: Prometheus samm2: o-incident-management|A|1 iso27001-2017: diff --git a/data-new/Information Gathering/Monitoring/1/SimpleSystemMetrics.yaml b/data-new/InformationGathering/Monitoring/1/SimpleSystemMetrics.yaml similarity index 98% rename from data-new/Information Gathering/Monitoring/1/SimpleSystemMetrics.yaml rename to data-new/InformationGathering/Monitoring/1/SimpleSystemMetrics.yaml index aa5762912..89e146f5b 100755 --- a/data-new/Information Gathering/Monitoring/1/SimpleSystemMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/1/SimpleSystemMetrics.yaml @@ -9,7 +9,6 @@ difficultyOfImplementation: time: 2 resources: 2 usefulness: 5 -level: 1 implementation: collectd samm2: o-incident-management|A|1 iso27001-2017: diff --git a/data-new/Information Gathering/Monitoring/2/Alerting.yaml b/data-new/InformationGathering/Monitoring/2/Alerting.yaml similarity index 97% rename from data-new/Information Gathering/Monitoring/2/Alerting.yaml rename to data-new/InformationGathering/Monitoring/2/Alerting.yaml index 57242e799..0e1ed9144 100755 --- a/data-new/Information Gathering/Monitoring/2/Alerting.yaml +++ b/data-new/InformationGathering/Monitoring/2/Alerting.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 5 resources: 5 usefulness: 5 -level: 2 dependsOn: - Visualized metrics samm2: o-operational-management|B|3 diff --git a/data-new/Information Gathering/Monitoring/2/VisualizedMetrics.yaml b/data-new/InformationGathering/Monitoring/2/VisualizedMetrics.yaml similarity index 97% rename from data-new/Information Gathering/Monitoring/2/VisualizedMetrics.yaml rename to data-new/InformationGathering/Monitoring/2/VisualizedMetrics.yaml index c78acfacd..7822a42e3 100755 --- a/data-new/Information Gathering/Monitoring/2/VisualizedMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/2/VisualizedMetrics.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 2 resources: 2 usefulness: 3 -level: 2 dependsOn: - Simple application metrics - Simple system metrics diff --git a/data-new/Information Gathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml b/data-new/InformationGathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml similarity index 97% rename from data-new/Information Gathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml rename to data-new/InformationGathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml index 308598de7..62c59e8cf 100755 --- a/data-new/Information Gathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 3 resources: 2 usefulness: 4 -level: 3 dependsOn: - Simple application metrics - Visualized metrics diff --git a/data-new/Information Gathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml b/data-new/InformationGathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml similarity index 97% rename from data-new/Information Gathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml rename to data-new/InformationGathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml index ced25a5d2..b68a41f46 100755 --- a/data-new/Information Gathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 3 resources: 2 usefulness: 4 -level: 3 dependsOn: - Simple application metrics - Visualized metrics diff --git a/data-new/Information Gathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml b/data-new/InformationGathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml similarity index 97% rename from data-new/Information Gathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml rename to data-new/InformationGathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml index 682e9fe5f..e44d466a4 100755 --- a/data-new/Information Gathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 5 resources: 5 usefulness: 5 -level: 3 dependsOn: - Visualized metrics samm2: o-incident-management|A|1 diff --git a/data-new/Information Gathering/Monitoring/3/GroupingOfMetrics.yaml b/data-new/InformationGathering/Monitoring/3/GroupingOfMetrics.yaml similarity index 97% rename from data-new/Information Gathering/Monitoring/3/GroupingOfMetrics.yaml rename to data-new/InformationGathering/Monitoring/3/GroupingOfMetrics.yaml index 39f84fcad..b22be00fd 100755 --- a/data-new/Information Gathering/Monitoring/3/GroupingOfMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/3/GroupingOfMetrics.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 4 resources: 2 usefulness: 2 -level: 3 samm2: o-incident-management|A|2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific diff --git a/data-new/Information Gathering/Monitoring/3/TargetedAlerting.yaml b/data-new/InformationGathering/Monitoring/3/TargetedAlerting.yaml similarity index 98% rename from data-new/Information Gathering/Monitoring/3/TargetedAlerting.yaml rename to data-new/InformationGathering/Monitoring/3/TargetedAlerting.yaml index 890ece8b4..8e67bc5a9 100755 --- a/data-new/Information Gathering/Monitoring/3/TargetedAlerting.yaml +++ b/data-new/InformationGathering/Monitoring/3/TargetedAlerting.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 5 resources: 5 usefulness: 5 -level: 3 dependsOn: - Alerting samm: OE1-B diff --git a/data-new/Information Gathering/Monitoring/4/CoverageAndControlMetrics.yaml b/data-new/InformationGathering/Monitoring/4/CoverageAndControlMetrics.yaml similarity index 99% rename from data-new/Information Gathering/Monitoring/4/CoverageAndControlMetrics.yaml rename to data-new/InformationGathering/Monitoring/4/CoverageAndControlMetrics.yaml index d897a877c..30c8b766c 100755 --- a/data-new/Information Gathering/Monitoring/4/CoverageAndControlMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/4/CoverageAndControlMetrics.yaml @@ -11,7 +11,6 @@ difficultyOfImplementation: time: 5 resources: 2 usefulness: 4 -level: 4 dependsOn: - Visualized metrics implementation: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf diff --git a/data-new/Information Gathering/Monitoring/4/DefenceMetrics.yaml b/data-new/InformationGathering/Monitoring/4/DefenceMetrics.yaml similarity index 98% rename from data-new/Information Gathering/Monitoring/4/DefenceMetrics.yaml rename to data-new/InformationGathering/Monitoring/4/DefenceMetrics.yaml index 283fe6ef6..025357c58 100755 --- a/data-new/Information Gathering/Monitoring/4/DefenceMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/4/DefenceMetrics.yaml @@ -9,7 +9,6 @@ difficultyOfImplementation: time: 5 resources: 2 usefulness: 4 -level: 4 dependsOn: - Visualized metrics - Filter outcoing traffic diff --git a/data-new/Information Gathering/Monitoring/4/MetricsAreCombinedWithTests.yaml b/data-new/InformationGathering/Monitoring/4/MetricsAreCombinedWithTests.yaml similarity index 97% rename from data-new/Information Gathering/Monitoring/4/MetricsAreCombinedWithTests.yaml rename to data-new/InformationGathering/Monitoring/4/MetricsAreCombinedWithTests.yaml index 7c685553f..0914f486c 100755 --- a/data-new/Information Gathering/Monitoring/4/MetricsAreCombinedWithTests.yaml +++ b/data-new/InformationGathering/Monitoring/4/MetricsAreCombinedWithTests.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 3 resources: 2 usefulness: 5 -level: 4 dependsOn: - Grouping of metrics samm2: o-incident-management|A|2 diff --git a/data-new/Information Gathering/Monitoring/4/ScreensWithMetricVisualization.yaml b/data-new/InformationGathering/Monitoring/4/ScreensWithMetricVisualization.yaml similarity index 98% rename from data-new/Information Gathering/Monitoring/4/ScreensWithMetricVisualization.yaml rename to data-new/InformationGathering/Monitoring/4/ScreensWithMetricVisualization.yaml index 90ca5046d..88ff96a53 100755 --- a/data-new/Information Gathering/Monitoring/4/ScreensWithMetricVisualization.yaml +++ b/data-new/InformationGathering/Monitoring/4/ScreensWithMetricVisualization.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 1 resources: 1 usefulness: 5 -level: 4 dependsOn: - Grouping of metrics samm2: o-incident-management|A|2 diff --git a/data-new/Test and Verification/Application tests/2/SecurityUnitTestsForImportantComponents.yaml b/data-new/TestAndVerification/ApplicationTests/2/SecurityUnitTestsForImportantComponents.yaml similarity index 98% rename from data-new/Test and Verification/Application tests/2/SecurityUnitTestsForImportantComponents.yaml rename to data-new/TestAndVerification/ApplicationTests/2/SecurityUnitTestsForImportantComponents.yaml index b982e0464..29dbbc7ac 100755 --- a/data-new/Test and Verification/Application tests/2/SecurityUnitTestsForImportantComponents.yaml +++ b/data-new/TestAndVerification/ApplicationTests/2/SecurityUnitTestsForImportantComponents.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 4 resources: 2 usefulness: 3 -level: 2 comment: The integration of module tests takes place during development instead, it highlights vulnerabilities in sub-routines, functions, modules, libraries etc. checked. implementation: diff --git a/data-new/Test and Verification/Application tests/3/SecurityIntegrationTestsForImportantComponents.yaml b/data-new/TestAndVerification/ApplicationTests/3/SecurityIntegrationTestsForImportantComponents.yaml similarity index 98% rename from data-new/Test and Verification/Application tests/3/SecurityIntegrationTestsForImportantComponents.yaml rename to data-new/TestAndVerification/ApplicationTests/3/SecurityIntegrationTestsForImportantComponents.yaml index aac136b49..7b8eb114e 100755 --- a/data-new/Test and Verification/Application tests/3/SecurityIntegrationTestsForImportantComponents.yaml +++ b/data-new/TestAndVerification/ApplicationTests/3/SecurityIntegrationTestsForImportantComponents.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 4 resources: 2 usefulness: 2 -level: 3 implementation: HttpUnit samm: ST2-B samm2: v-security-testing|B|3 diff --git a/data-new/Test and Verification/Application tests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml b/data-new/TestAndVerification/ApplicationTests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml similarity index 98% rename from data-new/Test and Verification/Application tests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml rename to data-new/TestAndVerification/ApplicationTests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml index 6036ce5e1..7e3a7495f 100755 --- a/data-new/Test and Verification/Application tests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml +++ b/data-new/TestAndVerification/ApplicationTests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 5 resources: 3 usefulness: 3 -level: 4 samm: ST2-B samm2: v-security-testing|B|3 iso27001-2017: diff --git a/data-new/Test and Verification/Application tests/4/SmokeTest.yaml b/data-new/TestAndVerification/ApplicationTests/4/SmokeTest.yaml similarity index 98% rename from data-new/Test and Verification/Application tests/4/SmokeTest.yaml rename to data-new/TestAndVerification/ApplicationTests/4/SmokeTest.yaml index f007ecda6..b26571d46 100755 --- a/data-new/Test and Verification/Application tests/4/SmokeTest.yaml +++ b/data-new/TestAndVerification/ApplicationTests/4/SmokeTest.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 2 resources: 2 usefulness: 2 -level: 4 implementation: "" dependsOn: - Defined deployment process diff --git a/data-new/Test and Verification/Consolidation/1/DefinitionOfQualityGates.yaml b/data-new/TestAndVerification/Consolidation/1/DefinitionOfQualityGates.yaml similarity index 98% rename from data-new/Test and Verification/Consolidation/1/DefinitionOfQualityGates.yaml rename to data-new/TestAndVerification/Consolidation/1/DefinitionOfQualityGates.yaml index 2385eeec6..616040166 100755 --- a/data-new/Test and Verification/Consolidation/1/DefinitionOfQualityGates.yaml +++ b/data-new/TestAndVerification/Consolidation/1/DefinitionOfQualityGates.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 1 resources: 1 usefulness: 4 -level: 1 samm: IR2-A samm2: i-defect-management|A|2 iso27001-2017: diff --git a/data-new/Test and Verification/Consolidation/1/SimpleFalsePositiveTreatment.yaml b/data-new/TestAndVerification/Consolidation/1/SimpleFalsePositiveTreatment.yaml similarity index 98% rename from data-new/Test and Verification/Consolidation/1/SimpleFalsePositiveTreatment.yaml rename to data-new/TestAndVerification/Consolidation/1/SimpleFalsePositiveTreatment.yaml index c0febd8e4..7be7972f3 100755 --- a/data-new/Test and Verification/Consolidation/1/SimpleFalsePositiveTreatment.yaml +++ b/data-new/TestAndVerification/Consolidation/1/SimpleFalsePositiveTreatment.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 1 resources: 1 usefulness: 4 -level: 1 implementation: - OWASP Defect Dojo - Purify diff --git a/data-new/Test and Verification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml b/data-new/TestAndVerification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml similarity index 97% rename from data-new/Test and Verification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml rename to data-new/TestAndVerification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml index a7bee3cda..b24b37493 100755 --- a/data-new/Test and Verification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml +++ b/data-new/TestAndVerification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 4 -level: 1 comment: False positive analysis, specially for static analysis, is time consuming. samm2: i-defect-management|B|2 iso27001-2017: diff --git a/data-new/Test and Verification/Consolidation/2/SimpleVisualizationOfDefects.yaml b/data-new/TestAndVerification/Consolidation/2/SimpleVisualizationOfDefects.yaml similarity index 98% rename from data-new/Test and Verification/Consolidation/2/SimpleVisualizationOfDefects.yaml rename to data-new/TestAndVerification/Consolidation/2/SimpleVisualizationOfDefects.yaml index 84f5bc84c..18d95b617 100755 --- a/data-new/Test and Verification/Consolidation/2/SimpleVisualizationOfDefects.yaml +++ b/data-new/TestAndVerification/Consolidation/2/SimpleVisualizationOfDefects.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 3 -level: 2 implementation: - OWASP Dependency Check Jenkins Plugin - LogParser Jenkins Plugins diff --git a/data-new/Test and Verification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml b/data-new/TestAndVerification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml similarity index 99% rename from data-new/Test and Verification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml rename to data-new/TestAndVerification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml index 97bda3e19..518c40a93 100755 --- a/data-new/Test and Verification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml +++ b/data-new/TestAndVerification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 2 -level: 3 implementation: 'At SAST (Static Application Security Testing): Server-side / client-side teams can easily be recorded. With microservice architecture, individual microservices can be used usually Teams. At DAST (Dynamic Application Security Testing): vulnerabilities diff --git a/data-new/Test and Verification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml b/data-new/TestAndVerification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml similarity index 97% rename from data-new/Test and Verification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml rename to data-new/TestAndVerification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml index 5fc960135..78fc91137 100755 --- a/data-new/Test and Verification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml +++ b/data-new/TestAndVerification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 3 -level: 3 comment: False positive analysis, specially for static analysis, is time consuming. samm2: i-defect-management|B|2 iso27001-2017: diff --git a/data-new/Test and Verification/Consolidation/4/AdvancedVisualizationOfDefects.yaml b/data-new/TestAndVerification/Consolidation/4/AdvancedVisualizationOfDefects.yaml similarity index 98% rename from data-new/Test and Verification/Consolidation/4/AdvancedVisualizationOfDefects.yaml rename to data-new/TestAndVerification/Consolidation/4/AdvancedVisualizationOfDefects.yaml index e0fb1f2b2..d4a70739a 100755 --- a/data-new/Test and Verification/Consolidation/4/AdvancedVisualizationOfDefects.yaml +++ b/data-new/TestAndVerification/Consolidation/4/AdvancedVisualizationOfDefects.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 4 resources: 1 usefulness: 2 -level: 4 implementation: - OWASP Defect Dojo - Purify diff --git a/data-new/Test and Verification/Consolidation/4/ReproducibleDefectTickets.yaml b/data-new/TestAndVerification/Consolidation/4/ReproducibleDefectTickets.yaml similarity index 98% rename from data-new/Test and Verification/Consolidation/4/ReproducibleDefectTickets.yaml rename to data-new/TestAndVerification/Consolidation/4/ReproducibleDefectTickets.yaml index 162995aac..fd203ffe3 100755 --- a/data-new/Test and Verification/Consolidation/4/ReproducibleDefectTickets.yaml +++ b/data-new/TestAndVerification/Consolidation/4/ReproducibleDefectTickets.yaml @@ -9,7 +9,6 @@ difficultyOfImplementation: time: 2 resources: 2 usefulness: 2 -level: 4 implementation: Mozilla Zest samm2: i-defect-management|B|2 iso27001-2017: diff --git a/data-new/Test and Verification/Consolidation/4/TreatmentOfAllDefects.yaml b/data-new/TestAndVerification/Consolidation/4/TreatmentOfAllDefects.yaml similarity index 97% rename from data-new/Test and Verification/Consolidation/4/TreatmentOfAllDefects.yaml rename to data-new/TestAndVerification/Consolidation/4/TreatmentOfAllDefects.yaml index 2c36c7625..406f1e635 100755 --- a/data-new/Test and Verification/Consolidation/4/TreatmentOfAllDefects.yaml +++ b/data-new/TestAndVerification/Consolidation/4/TreatmentOfAllDefects.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 2 -level: 4 samm2: i-defect-management|B|2 iso27001-2017: - 16.1.4 diff --git a/data-new/Test and Verification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml b/data-new/TestAndVerification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml similarity index 98% rename from data-new/Test and Verification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml rename to data-new/TestAndVerification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml index 199106878..3b2065090 100755 --- a/data-new/Test and Verification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml +++ b/data-new/TestAndVerification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 3 resources: 2 usefulness: 2 -level: 4 implementation: - OWASP Defect Dojo - Purify diff --git a/data-new/Test and Verification/Dynamic depth for applications/1/SimpleScan.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/1/SimpleScan.yaml similarity index 98% rename from data-new/Test and Verification/Dynamic depth for applications/1/SimpleScan.yaml rename to data-new/TestAndVerification/DynamicDepthForApplications/1/SimpleScan.yaml index 34f29432f..b53c8b048 100755 --- a/data-new/Test and Verification/Dynamic depth for applications/1/SimpleScan.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/1/SimpleScan.yaml @@ -9,7 +9,6 @@ difficultyOfImplementation: time: 3 resources: 1 usefulness: 2 -level: 1 dependsOn: - Defined build process samm: ST2 diff --git a/data-new/Test and Verification/Dynamic depth for applications/2/CoverageOfClientSideDynamicComponents.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/2/CoverageOfClientSideDynamicComponents.yaml similarity index 98% rename from data-new/Test and Verification/Dynamic depth for applications/2/CoverageOfClientSideDynamicComponents.yaml rename to data-new/TestAndVerification/DynamicDepthForApplications/2/CoverageOfClientSideDynamicComponents.yaml index 2c522ae0f..67efffa5b 100755 --- a/data-new/Test and Verification/Dynamic depth for applications/2/CoverageOfClientSideDynamicComponents.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/2/CoverageOfClientSideDynamicComponents.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 3 resources: 1 usefulness: 4 -level: 2 dependsOn: - Usage of different roles samm: ST-2 diff --git a/data-new/Test and Verification/Dynamic depth for applications/2/UsageOfDifferentRoles.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/2/UsageOfDifferentRoles.yaml similarity index 97% rename from data-new/Test and Verification/Dynamic depth for applications/2/UsageOfDifferentRoles.yaml rename to data-new/TestAndVerification/DynamicDepthForApplications/2/UsageOfDifferentRoles.yaml index a696db0be..c8ce5ff36 100755 --- a/data-new/Test and Verification/Dynamic depth for applications/2/UsageOfDifferentRoles.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/2/UsageOfDifferentRoles.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 3 resources: 1 usefulness: 2 -level: 2 dependsOn: - Simple Scan samm2: v-security-testing|A|2 diff --git a/data-new/Test and Verification/Dynamic depth for applications/3/CoverageOfHiddenEndpoints.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfHiddenEndpoints.yaml similarity index 97% rename from data-new/Test and Verification/Dynamic depth for applications/3/CoverageOfHiddenEndpoints.yaml rename to data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfHiddenEndpoints.yaml index 14a67e116..72ffc7c95 100755 --- a/data-new/Test and Verification/Dynamic depth for applications/3/CoverageOfHiddenEndpoints.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfHiddenEndpoints.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 5 -level: 3 implementation: cURL, OpenAPI dependsOn: - Usage of different roles diff --git a/data-new/Test and Verification/Dynamic depth for applications/3/CoverageOfMoreInputVectors.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfMoreInputVectors.yaml similarity index 98% rename from data-new/Test and Verification/Dynamic depth for applications/3/CoverageOfMoreInputVectors.yaml rename to data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfMoreInputVectors.yaml index 65ee4bc46..9fd71cd3e 100755 --- a/data-new/Test and Verification/Dynamic depth for applications/3/CoverageOfMoreInputVectors.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfMoreInputVectors.yaml @@ -9,7 +9,6 @@ difficultyOfImplementation: time: 5 resources: 1 usefulness: 4 -level: 3 dependsOn: - Usage of different roles samm2: v-security-testing|A|2 diff --git a/data-new/Test and Verification/Dynamic depth for applications/3/CoverageOfSequentialOperations.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfSequentialOperations.yaml similarity index 97% rename from data-new/Test and Verification/Dynamic depth for applications/3/CoverageOfSequentialOperations.yaml rename to data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfSequentialOperations.yaml index c938b4d3b..d3f2a6728 100755 --- a/data-new/Test and Verification/Dynamic depth for applications/3/CoverageOfSequentialOperations.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfSequentialOperations.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 3 resources: 1 usefulness: 5 -level: 3 implementation: cURL dependsOn: - Usage of different roles diff --git a/data-new/Test and Verification/Dynamic depth for applications/3/UsageOfMultipleScanners.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/3/UsageOfMultipleScanners.yaml similarity index 98% rename from data-new/Test and Verification/Dynamic depth for applications/3/UsageOfMultipleScanners.yaml rename to data-new/TestAndVerification/DynamicDepthForApplications/3/UsageOfMultipleScanners.yaml index 34459f5bd..8e726b889 100755 --- a/data-new/Test and Verification/Dynamic depth for applications/3/UsageOfMultipleScanners.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/3/UsageOfMultipleScanners.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 3 resources: 5 usefulness: 1 -level: 3 dependsOn: - Usage of different roles implementation: SecureCodeBox diff --git a/data-new/Test and Verification/Dynamic depth for applications/4/CoverageAnalysis.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageAnalysis.yaml similarity index 97% rename from data-new/Test and Verification/Dynamic depth for applications/4/CoverageAnalysis.yaml rename to data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageAnalysis.yaml index 544f5d111..57b78be3e 100755 --- a/data-new/Test and Verification/Dynamic depth for applications/4/CoverageAnalysis.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageAnalysis.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 5 resources: 3 usefulness: 4 -level: 4 implementation: OWASP Code Pulse samm2: v-security-testing|A|2 iso27001-2017: diff --git a/data-new/Test and Verification/Dynamic depth for applications/4/CoverageOfServiceToServiceCommunication.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageOfServiceToServiceCommunication.yaml similarity index 97% rename from data-new/Test and Verification/Dynamic depth for applications/4/CoverageOfServiceToServiceCommunication.yaml rename to data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageOfServiceToServiceCommunication.yaml index 80ff595e5..b0581e88d 100755 --- a/data-new/Test and Verification/Dynamic depth for applications/4/CoverageOfServiceToServiceCommunication.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageOfServiceToServiceCommunication.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 5 resources: 2 usefulness: 3 -level: 4 dependsOn: - Simple Scan samm2: v-security-testing|A|2 diff --git a/data-new/Test and Verification/Dynamic depth for infrastructure/1/TestForExposedServices.yaml b/data-new/TestAndVerification/DynamicDepthForInfrastructure/1/TestForExposedServices.yaml similarity index 98% rename from data-new/Test and Verification/Dynamic depth for infrastructure/1/TestForExposedServices.yaml rename to data-new/TestAndVerification/DynamicDepthForInfrastructure/1/TestForExposedServices.yaml index 8b3f7d196..a3514e419 100755 --- a/data-new/Test and Verification/Dynamic depth for infrastructure/1/TestForExposedServices.yaml +++ b/data-new/TestAndVerification/DynamicDepthForInfrastructure/1/TestForExposedServices.yaml @@ -9,7 +9,6 @@ difficultyOfImplementation: time: 1 resources: 1 usefulness: 3 -level: 1 implementation: - nmap - OWASP Amass diff --git a/data-new/Test and Verification/Dynamic depth for infrastructure/2/TestNetworkSegmentation.yaml b/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestNetworkSegmentation.yaml similarity index 98% rename from data-new/Test and Verification/Dynamic depth for infrastructure/2/TestNetworkSegmentation.yaml rename to data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestNetworkSegmentation.yaml index 0ea0e625a..8d2ac92b6 100755 --- a/data-new/Test and Verification/Dynamic depth for infrastructure/2/TestNetworkSegmentation.yaml +++ b/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestNetworkSegmentation.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 3 -level: 2 implementation: netassert dependendsOn: Segmented networks for virtual environments samm2: v-security-testing|A|2 diff --git a/data-new/Test and Verification/Dynamic depth for infrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml b/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml similarity index 98% rename from data-new/Test and Verification/Dynamic depth for infrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml rename to data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml index 70f09cc80..8b9febe0e 100755 --- a/data-new/Test and Verification/Dynamic depth for infrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml +++ b/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 4 -level: 2 implementation: - kube-hunter - openVAS diff --git a/data-new/Test and Verification/Dynamic depth for infrastructure/3/WeakPasswordTest.yaml b/data-new/TestAndVerification/DynamicDepthForInfrastructure/3/WeakPasswordTest.yaml similarity index 98% rename from data-new/Test and Verification/Dynamic depth for infrastructure/3/WeakPasswordTest.yaml rename to data-new/TestAndVerification/DynamicDepthForInfrastructure/3/WeakPasswordTest.yaml index bb532e24d..ed16c0f60 100755 --- a/data-new/Test and Verification/Dynamic depth for infrastructure/3/WeakPasswordTest.yaml +++ b/data-new/TestAndVerification/DynamicDepthForInfrastructure/3/WeakPasswordTest.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 1 resources: 1 usefulness: 1 -level: 3 implementation: HTC Hydra samm2: v-security-testing|A|2 iso27001-2017: diff --git a/data-new/Test and Verification/Dynamic depth for infrastructure/4/LoadTests.yaml b/data-new/TestAndVerification/DynamicDepthForInfrastructure/4/LoadTests.yaml similarity index 97% rename from data-new/Test and Verification/Dynamic depth for infrastructure/4/LoadTests.yaml rename to data-new/TestAndVerification/DynamicDepthForInfrastructure/4/LoadTests.yaml index b7d6020ee..6564755cb 100755 --- a/data-new/Test and Verification/Dynamic depth for infrastructure/4/LoadTests.yaml +++ b/data-new/TestAndVerification/DynamicDepthForInfrastructure/4/LoadTests.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 2 resources: 5 usefulness: 3 -level: 4 samm2: v-security-testing|A|1 iso27001-2017: - 12.1.3 diff --git a/data-new/Test and Verification/Static depth for applications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml b/data-new/TestAndVerification/StaticDepthForApplications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml similarity index 98% rename from data-new/Test and Verification/Static depth for applications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml rename to data-new/TestAndVerification/StaticDepthForApplications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml index 22c17f527..5d68e2315 100755 --- a/data-new/Test and Verification/Static depth for applications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 5 -level: 1 dependsOn: - Defined build process implementation: OWASP Dependency Check diff --git a/data-new/Test and Verification/Static depth for applications/2/StaticAnalysisForImportantServerSideComponents.yaml b/data-new/TestAndVerification/StaticDepthForApplications/2/StaticAnalysisForImportantServerSideComponents.yaml similarity index 98% rename from data-new/Test and Verification/Static depth for applications/2/StaticAnalysisForImportantServerSideComponents.yaml rename to data-new/TestAndVerification/StaticDepthForApplications/2/StaticAnalysisForImportantServerSideComponents.yaml index 5e1a7bba7..2adc62e20 100755 --- a/data-new/Test and Verification/Static depth for applications/2/StaticAnalysisForImportantServerSideComponents.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/2/StaticAnalysisForImportantServerSideComponents.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 4 -level: 2 implementation: eslint, FindSecurityBugs, jsprime dependsOn: - Defined build process diff --git a/data-new/Test and Verification/Static depth for applications/3/StaticAnalysisForImportantClientSideComponents.yaml b/data-new/TestAndVerification/StaticDepthForApplications/3/StaticAnalysisForImportantClientSideComponents.yaml similarity index 98% rename from data-new/Test and Verification/Static depth for applications/3/StaticAnalysisForImportantClientSideComponents.yaml rename to data-new/TestAndVerification/StaticDepthForApplications/3/StaticAnalysisForImportantClientSideComponents.yaml index 2837b3644..d6c4a89e1 100755 --- a/data-new/Test and Verification/Static depth for applications/3/StaticAnalysisForImportantClientSideComponents.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/3/StaticAnalysisForImportantClientSideComponents.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 3 -level: 3 implementation: - eslint - FindSecurityBugs diff --git a/data-new/Test and Verification/Static depth for applications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml b/data-new/TestAndVerification/StaticDepthForApplications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml similarity index 98% rename from data-new/Test and Verification/Static depth for applications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml rename to data-new/TestAndVerification/StaticDepthForApplications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml index 6cbfcd377..43a565cbd 100755 --- a/data-new/Test and Verification/Static depth for applications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 2 -level: 3 dependsOn: - Defined build process implementation: diff --git a/data-new/Test and Verification/Static depth for applications/4/ExclusionOfSourceCodeDuplicates.yaml b/data-new/TestAndVerification/StaticDepthForApplications/4/ExclusionOfSourceCodeDuplicates.yaml similarity index 98% rename from data-new/Test and Verification/Static depth for applications/4/ExclusionOfSourceCodeDuplicates.yaml rename to data-new/TestAndVerification/StaticDepthForApplications/4/ExclusionOfSourceCodeDuplicates.yaml index 83d20da46..569efbfff 100755 --- a/data-new/Test and Verification/Static depth for applications/4/ExclusionOfSourceCodeDuplicates.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/4/ExclusionOfSourceCodeDuplicates.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 1 resources: 1 usefulness: 1 -level: 4 implementation: PMD dependsOn: - Defined build process diff --git a/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllComponentsOrlibraries.yaml b/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllComponentsOrlibraries.yaml new file mode 100755 index 000000000..7565424f6 --- /dev/null +++ b/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllComponentsOrlibraries.yaml @@ -0,0 +1,16 @@ +--- +risk: Used components like libraries and legacy applications might have vulnerabilities +measure: Usage of a static analysis for all used components. +difficultyOfImplementation: + knowledge: 2 + time: 4 + resources: 2 +usefulness: 3 +dependsOn: +- Static analysis for important client side components +- Static analysis for important server side components +samm2: v-security-testing|A|2 +iso27001-2017: +- 12.6.1 +id: StaticAnalysisForAllComponentsOrlibraries +... diff --git a/data-new/Test and Verification/Static depth for applications/4/StaticAnalysisForAllSelfWrittenComponents.yaml b/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllSelfWrittenComponents.yaml similarity index 98% rename from data-new/Test and Verification/Static depth for applications/4/StaticAnalysisForAllSelfWrittenComponents.yaml rename to data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllSelfWrittenComponents.yaml index b66ea8726..de9060b56 100755 --- a/data-new/Test and Verification/Static depth for applications/4/StaticAnalysisForAllSelfWrittenComponents.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllSelfWrittenComponents.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 4 -level: 4 implementation: eslint, FindSecurityBugs, jsprime dependsOn: - Static analysis for important client side components diff --git a/data-new/Test and Verification/Static depth for applications/4/StylisticAnalysis.yaml b/data-new/TestAndVerification/StaticDepthForApplications/4/StylisticAnalysis.yaml similarity index 97% rename from data-new/Test and Verification/Static depth for applications/4/StylisticAnalysis.yaml rename to data-new/TestAndVerification/StaticDepthForApplications/4/StylisticAnalysis.yaml index 425490182..729e56823 100755 --- a/data-new/Test and Verification/Static depth for applications/4/StylisticAnalysis.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/4/StylisticAnalysis.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 1 resources: 1 usefulness: 1 -level: 4 implementation: PMD samm2: v-security-testing|A|2 iso27001-2017: diff --git a/data-new/Test and Verification/Static depth for applications/4/UsageOfMultipleAnalysers.yaml b/data-new/TestAndVerification/StaticDepthForApplications/4/UsageOfMultipleAnalysers.yaml similarity index 98% rename from data-new/Test and Verification/Static depth for applications/4/UsageOfMultipleAnalysers.yaml rename to data-new/TestAndVerification/StaticDepthForApplications/4/UsageOfMultipleAnalysers.yaml index f218a3dc2..f0402e48b 100755 --- a/data-new/Test and Verification/Static depth for applications/4/UsageOfMultipleAnalysers.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/4/UsageOfMultipleAnalysers.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 3 resources: 5 usefulness: 1 -level: 4 samm2: v-security-testing|A|3 iso27001-2017: - 12.6.1 diff --git a/data-new/Test and Verification/Static depth for infrastructure/1/StoredSecrets.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/1/StoredSecrets.yaml similarity index 98% rename from data-new/Test and Verification/Static depth for infrastructure/1/StoredSecrets.yaml rename to data-new/TestAndVerification/StaticDepthForInfrastructure/1/StoredSecrets.yaml index 9e4b1dae3..6a9ccb8da 100755 --- a/data-new/Test and Verification/Static depth for infrastructure/1/StoredSecrets.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/1/StoredSecrets.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 1 resources: 2 usefulness: 2 -level: 1 implementation: - truffleHog - go-pillage-registries diff --git a/data-new/Test and Verification/Static depth for infrastructure/2/TestClusterDeploymentResources.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestClusterDeploymentResources.yaml similarity index 98% rename from data-new/Test and Verification/Static depth for infrastructure/2/TestClusterDeploymentResources.yaml rename to data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestClusterDeploymentResources.yaml index 31952dc7d..38ca47513 100755 --- a/data-new/Test and Verification/Static depth for infrastructure/2/TestClusterDeploymentResources.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestClusterDeploymentResources.yaml @@ -8,7 +8,6 @@ difficultyOfImplementation: time: 1 resources: 2 usefulness: 3 -level: 2 implementation: - kubesec samm2: v-security-testing|A|1 diff --git a/data-new/Test and Verification/Static depth for infrastructure/2/TestOfVirtualizedEnvironments.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestOfVirtualizedEnvironments.yaml similarity index 98% rename from data-new/Test and Verification/Static depth for infrastructure/2/TestOfVirtualizedEnvironments.yaml rename to data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestOfVirtualizedEnvironments.yaml index 69bf4281e..68a59914c 100755 --- a/data-new/Test and Verification/Static depth for infrastructure/2/TestOfVirtualizedEnvironments.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestOfVirtualizedEnvironments.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 1 resources: 2 usefulness: 3 -level: 2 implementation: - Dive to inspect a container images - Cluster Scanner (will be open sourced soon) to check different aspects diff --git a/data-new/Test and Verification/Static depth for infrastructure/2/TestTheClouldConfiguration.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheClouldConfiguration.yaml similarity index 98% rename from data-new/Test and Verification/Static depth for infrastructure/2/TestTheClouldConfiguration.yaml rename to data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheClouldConfiguration.yaml index 05850106b..702e7175f 100755 --- a/data-new/Test and Verification/Static depth for infrastructure/2/TestTheClouldConfiguration.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheClouldConfiguration.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 2 resources: 1 usefulness: 4 -level: 2 implementation: - kube-bench samm: EH2-B diff --git a/data-new/Test and Verification/Static depth for infrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml similarity index 98% rename from data-new/Test and Verification/Static depth for infrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml rename to data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml index 9f6886d61..0ca73a5e9 100755 --- a/data-new/Test and Verification/Static depth for infrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 1 resources: 2 usefulness: 3 -level: 2 implementation: - Dockerfile with hadolint - Deployment with kube-score diff --git a/data-new/Test and Verification/Static depth for infrastructure/3/CheckForImageLifetime.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForImageLifetime.yaml similarity index 97% rename from data-new/Test and Verification/Static depth for infrastructure/3/CheckForImageLifetime.yaml rename to data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForImageLifetime.yaml index d5d91db4a..29b512da1 100755 --- a/data-new/Test and Verification/Static depth for infrastructure/3/CheckForImageLifetime.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForImageLifetime.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 1 resources: 1 usefulness: 2 -level: 3 implementation: ~ samm2: v-security-testing|A|1 iso27001-2017: diff --git a/data-new/Test and Verification/Static depth for infrastructure/3/CheckForMalware.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForMalware.yaml similarity index 98% rename from data-new/Test and Verification/Static depth for infrastructure/3/CheckForMalware.yaml rename to data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForMalware.yaml index 60e215448..470c832c5 100755 --- a/data-new/Test and Verification/Static depth for infrastructure/3/CheckForMalware.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForMalware.yaml @@ -9,7 +9,6 @@ difficultyOfImplementation: time: 2 resources: 2 usefulness: 3 -level: 3 implementation: ~ samm2: v-security-testing|A|2 iso27001-2017: diff --git a/data-new/Test and Verification/Static depth for infrastructure/3/CheckForNewImageVersion.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForNewImageVersion.yaml similarity index 97% rename from data-new/Test and Verification/Static depth for infrastructure/3/CheckForNewImageVersion.yaml rename to data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForNewImageVersion.yaml index 36e16a8ed..d8333fa30 100755 --- a/data-new/Test and Verification/Static depth for infrastructure/3/CheckForNewImageVersion.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForNewImageVersion.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 3 resources: 1 usefulness: 2 -level: 3 implementation: ~ samm2: v-security-testing|A|2 iso27001-2017: diff --git a/data-new/Test and Verification/Static depth for infrastructure/4/CheckForKnownVulnerabilities.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CheckForKnownVulnerabilities.yaml similarity index 98% rename from data-new/Test and Verification/Static depth for infrastructure/4/CheckForKnownVulnerabilities.yaml rename to data-new/TestAndVerification/StaticDepthForInfrastructure/4/CheckForKnownVulnerabilities.yaml index d8a742c2b..89b7a4a41 100755 --- a/data-new/Test and Verification/Static depth for infrastructure/4/CheckForKnownVulnerabilities.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CheckForKnownVulnerabilities.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 1 resources: 1 usefulness: 4 -level: 4 implementation: - https://github.com/aquasecurity/trivy - Registries like quay, dockerhub provide (commercial) offerings, often not suiteable diff --git a/data-new/Test and Verification/Static depth for infrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml similarity index 97% rename from data-new/Test and Verification/Static depth for infrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml rename to data-new/TestAndVerification/StaticDepthForInfrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml index 2a6ab7f21..76e2dd999 100755 --- a/data-new/Test and Verification/Static depth for infrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 5 resources: 4 usefulness: 1 -level: 4 dependsOn: - Usage of a maximum lifetime for images implementation: diff --git a/data-new/Test and Verification/Static depth for infrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml similarity index 98% rename from data-new/Test and Verification/Static depth for infrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml rename to data-new/TestAndVerification/StaticDepthForInfrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml index 6304cb80b..583f1d792 100755 --- a/data-new/Test and Verification/Static depth for infrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml @@ -9,7 +9,6 @@ difficultyOfImplementation: time: 5 resources: 2 usefulness: 1 -level: 4 dependsOn: - Usage of a maximum lifetime for images implementation: diff --git a/data-new/Test and Verification/Test-Intensity/1/DefaultSettingsForIntensity.yaml b/data-new/TestAndVerification/Test-Intensity/1/DefaultSettingsForIntensity.yaml similarity index 97% rename from data-new/Test and Verification/Test-Intensity/1/DefaultSettingsForIntensity.yaml rename to data-new/TestAndVerification/Test-Intensity/1/DefaultSettingsForIntensity.yaml index 4ed6f8608..6487e415a 100755 --- a/data-new/Test and Verification/Test-Intensity/1/DefaultSettingsForIntensity.yaml +++ b/data-new/TestAndVerification/Test-Intensity/1/DefaultSettingsForIntensity.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 1 resources: 1 usefulness: 1 -level: 1 samm2: v-security-testing|A|1 iso27001-2017: - 12.6.1 diff --git a/data-new/Test and Verification/Test-Intensity/1/HighTestIntensity.yaml b/data-new/TestAndVerification/Test-Intensity/1/HighTestIntensity.yaml similarity index 97% rename from data-new/Test and Verification/Test-Intensity/1/HighTestIntensity.yaml rename to data-new/TestAndVerification/Test-Intensity/1/HighTestIntensity.yaml index 5523c5991..453f2e45f 100755 --- a/data-new/Test and Verification/Test-Intensity/1/HighTestIntensity.yaml +++ b/data-new/TestAndVerification/Test-Intensity/1/HighTestIntensity.yaml @@ -6,7 +6,6 @@ difficultyOfImplementation: time: 3 resources: 5 usefulness: 3 -level: 1 samm2: v-security-testing|A|2 iso27001-2017: - 12.6.1 diff --git a/data-new/Test and Verification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml b/data-new/TestAndVerification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml similarity index 98% rename from data-new/Test and Verification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml rename to data-new/TestAndVerification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml index 31c8a09be..879bf4a2b 100755 --- a/data-new/Test and Verification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml +++ b/data-new/TestAndVerification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml @@ -10,7 +10,6 @@ difficultyOfImplementation: time: 3 resources: 1 usefulness: 1 -level: 2 samm2: v-security-testing|A|2 iso27001-2017: - 12.6.1 diff --git a/data-new/Test and Verification/Test-Intensity/2/RegularTests.yaml b/data-new/TestAndVerification/Test-Intensity/2/RegularTests.yaml similarity index 97% rename from data-new/Test and Verification/Test-Intensity/2/RegularTests.yaml rename to data-new/TestAndVerification/Test-Intensity/2/RegularTests.yaml index bddf8484d..d46c427a6 100755 --- a/data-new/Test and Verification/Test-Intensity/2/RegularTests.yaml +++ b/data-new/TestAndVerification/Test-Intensity/2/RegularTests.yaml @@ -7,7 +7,6 @@ difficultyOfImplementation: time: 1 resources: 1 usefulness: 2 -level: 2 implementation: "" samm2: i-secure-build|A|3 iso27001-2017: diff --git a/data-new/Test and Verification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml b/data-new/TestAndVerification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml similarity index 98% rename from data-new/Test and Verification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml rename to data-new/TestAndVerification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml index f146d77c6..f986f9492 100755 --- a/data-new/Test and Verification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml +++ b/data-new/TestAndVerification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml @@ -9,7 +9,6 @@ difficultyOfImplementation: time: 3 resources: 3 usefulness: 2 -level: 3 samm2: v-security-testing|A|2 iso27001-2017: - 14.2.2 diff --git a/newFolder.php b/newFolder-Migration-2021.php similarity index 65% rename from newFolder.php rename to newFolder-Migration-2021.php index d9bac2218..860e915b6 100644 --- a/newFolder.php +++ b/newFolder-Migration-2021.php @@ -24,13 +24,17 @@ function readYaml($file) ksort($newElements); $dimensions[$dimensionName][$subDimensionName] = $newElements; foreach($elements as $elementName => $element) { - $folder = "data-new/$dimensionName/$subDimensionName/" . $element['level'] . "/"; + $dimensionIdWithSpace = mb_convert_case($dimensionName, MB_CASE_TITLE); + $dimensionId = str_replace(" ", "", $dimensionIdWithSpace); + $subDimensionId = str_replace(" ", "",mb_convert_case($subDimensionName, MB_CASE_TITLE)); + $folder = "data-new/$dimensionId/$subDimensionId/" . $element['level'] . "/"; //echo $folder; mkdir($folder, 755, true); - + unset($element['level']); // level from folder $idWithSpace=mb_convert_case($elementName, MB_CASE_TITLE); - $id = str_replace(" ", "", $idWithSpace); - $filePath = $folder . "/" . $id . ".yaml"; + $idSanitized = str_replace("/", "Or", $idWithSpace); + $id = str_replace(" ", "", $idSanitized); + $filePath = $folder . $id . ".yaml"; $element['id'] = $id; $yamlContent = yaml_emit ( $element ); From 8c78fb10d018e0f6f9f68cd3dfec39a71e53a96c Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 9 Feb 2021 21:01:01 +0100 Subject: [PATCH 3/6] Add title --- data-new/BuildAndDeployment/Build/1/DefinedBuildProcess.yaml | 1 + .../2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml | 1 + data-new/BuildAndDeployment/Build/3/SigningOfArtifacts.yaml | 1 + data-new/BuildAndDeployment/Build/3/SigningOfCode.yaml | 1 + .../Deployment/1/DefinedDeploymentProcess.yaml | 1 + .../BuildAndDeployment/Deployment/2/BackupBeforeDeployment.yaml | 1 + .../2/EnvironmentDependingConfigurationParameters.yaml | 1 + .../BuildAndDeployment/Deployment/2/UsageOfTrustedImages.yaml | 1 + .../Deployment/3/HandoverOfConfidentialParameters.yaml | 1 + .../Deployment/3/InventoryOfRunningArtifacts.yaml | 1 + .../Deployment/3/RollingUpdateOnDeployment.yaml | 1 + .../Deployment/3/SameArtifactForEnvironments.yaml | 1 + .../BuildAndDeployment/Deployment/3/UsageOfFeatureToggles.yaml | 1 + .../BuildAndDeployment/Deployment/4/BlueOrgreenDeployment.yaml | 1 + .../PatchManagement/1/APatchPolicyIsDefined.yaml | 1 + .../PatchManagement/1/AutomatedPrsForPatches.yaml | 1 + .../PatchManagement/2/NightlyBuildOfImages.yaml | 1 + .../PatchManagement/2/ReductionOfTheAttackSurface.yaml | 1 + .../PatchManagement/2/UsageOfAMaximumLifetimeForImages.yaml | 1 + .../PatchManagement/4/UsageOfAShortMaximumLifetimeForImages.yaml | 1 + .../Design/0/InformationSecurityTargetsAreCommunicated.yaml | 1 + .../1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml | 1 + .../2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml | 1 + .../Design/2/CreationOfSimpleAbuseStories.yaml | 1 + .../Design/3/ConductionOfAdvancedThreatModelling.yaml | 1 + .../Design/4/CreationOfAdvancedAbuseStories.yaml | 1 + .../1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml | 1 + .../EducationAndGuidance/1/SecurityConsultingOnRequest.yaml | 1 + .../EducationAndGuidance/2/EachTeamHasASecurityChampion.yaml | 1 + .../EducationAndGuidance/2/RegularSecurityTrainingForAll.yaml | 1 + .../2/RegularSecurityTrainingOfSecurityChampions.yaml | 1 + .../EducationAndGuidance/2/RewardOfGoodCommunication.yaml | 1 + .../3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml | 1 + ...ativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml | 1 + .../3/RegularSecurityTrainingForEveryone.yaml | 1 + .../EducationAndGuidance/3/Security-Lessoned-Learned.yaml | 1 + .../EducationAndGuidance/4/AligningSecurityInTeams.yaml | 1 + .../4/ConductionOfCollaborativeTeamSecurityChecks.yaml | 1 + .../EducationAndGuidance/4/ConductionOfWarGames.yaml | 1 + .../1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml | 1 + .../Process/3/ApprovalByReviewingAnyNewVersion.yaml | 1 + .../Process/3/DefinitionOfAChangeManagementProcess.yaml | 1 + .../Process/3/PreventionOfUnauthorizedInstallation.yaml | 1 + .../ApplicationHardening/1/ApplicationHardeningLevel1.yaml | 1 + .../ApplicationHardening/2/App.HardeningLevel2.yaml | 1 + .../ApplicationHardening/3/App.HardeningLevel3.yaml | 1 + .../4/FullCoverageOfApp.HardeningLevel3.yaml | 1 + .../1/IsolatedNetworksForVirtualEnvironments.yaml | 1 + .../InfrastructureHardening/1/SimpleAccessControlForSystems.yaml | 1 + .../1/UsageOfTestAndProductionEnvironments.yaml | 1 + .../2/ApplicationsAreRunningInVirtualizedEnvironments.yaml | 1 + .../2/CheckingTheSourcesOfUsedLibraries.yaml | 1 + .../InfrastructureHardening/2/FilterOutgoingTraffic.yaml | 1 + .../InfrastructureHardening/2/TheClusterIsHardened.yaml | 1 + .../2/UsageOfSecurityByDefaultForComponents.yaml | 1 + .../InfrastructureHardening/2/VirtualEnvironmentsAreLimited.yaml | 1 + data-new/Implementation/InfrastructureHardening/3/2Fa.yaml | 1 + .../InfrastructureHardening/3/ImmutableInfrastructure.yaml | 1 + .../InfrastructureHardening/3/InfrastructureAsCode.yaml | 1 + .../3/RoleBasedAuthenticationAndAuthorization.yaml | 1 + .../Implementation/InfrastructureHardening/3/Versioning.yaml | 1 + .../4/LimitationOfSystemCallsInVirtualEnvironments.yaml | 1 + .../InfrastructureHardening/4/Microservice-Architecture.yaml | 1 + .../4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml | 1 + .../InfrastructureHardening/4/UsageOfAChaosMonkey.yaml | 1 + .../InformationGathering/Logging/1/CentralizedSystemLogging.yaml | 1 + .../InformationGathering/Logging/1/LoggingOfSecurityEvents.yaml | 1 + data-new/InformationGathering/Logging/1/PiiLoggingConcept.yaml | 1 + data-new/InformationGathering/Logging/2/VisualizedLogging.yaml | 1 + .../Logging/3/CentralizedApplicationLogging.yaml | 1 + .../Logging/4/CorrelationOfSecurityEvents.yaml | 1 + .../Monitoring/1/SimpleApplicationMetrics.yaml | 1 + .../InformationGathering/Monitoring/1/SimpleSystemMetrics.yaml | 1 + data-new/InformationGathering/Monitoring/2/Alerting.yaml | 1 + .../InformationGathering/Monitoring/2/VisualizedMetrics.yaml | 1 + .../Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml | 1 + .../Monitoring/3/AdvancedWebapplicationMetrics.yaml | 1 + .../Monitoring/3/DeactivationOfUnusedMetrics.yaml | 1 + .../InformationGathering/Monitoring/3/GroupingOfMetrics.yaml | 1 + data-new/InformationGathering/Monitoring/3/TargetedAlerting.yaml | 1 + .../Monitoring/4/CoverageAndControlMetrics.yaml | 1 + data-new/InformationGathering/Monitoring/4/DefenceMetrics.yaml | 1 + .../Monitoring/4/MetricsAreCombinedWithTests.yaml | 1 + .../Monitoring/4/ScreensWithMetricVisualization.yaml | 1 + .../2/SecurityUnitTestsForImportantComponents.yaml | 1 + .../3/SecurityIntegrationTestsForImportantComponents.yaml | 1 + .../HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml | 1 + data-new/TestAndVerification/ApplicationTests/4/SmokeTest.yaml | 1 + .../Consolidation/1/DefinitionOfQualityGates.yaml | 1 + .../Consolidation/1/SimpleFalsePositiveTreatment.yaml | 1 + .../1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml | 1 + .../Consolidation/2/SimpleVisualizationOfDefects.yaml | 1 + ...ntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml | 1 + .../Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml | 1 + .../Consolidation/4/AdvancedVisualizationOfDefects.yaml | 1 + .../Consolidation/4/ReproducibleDefectTickets.yaml | 1 + .../Consolidation/4/TreatmentOfAllDefects.yaml | 1 + .../Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml | 1 + .../DynamicDepthForApplications/1/SimpleScan.yaml | 1 + .../2/CoverageOfClientSideDynamicComponents.yaml | 1 + .../DynamicDepthForApplications/2/UsageOfDifferentRoles.yaml | 1 + .../DynamicDepthForApplications/3/CoverageOfHiddenEndpoints.yaml | 1 + .../3/CoverageOfMoreInputVectors.yaml | 1 + .../3/CoverageOfSequentialOperations.yaml | 1 + .../DynamicDepthForApplications/3/UsageOfMultipleScanners.yaml | 1 + .../DynamicDepthForApplications/4/CoverageAnalysis.yaml | 1 + .../4/CoverageOfServiceToServiceCommunication.yaml | 1 + .../DynamicDepthForInfrastructure/1/TestForExposedServices.yaml | 1 + .../DynamicDepthForInfrastructure/2/TestNetworkSegmentation.yaml | 1 + .../2/TestOfTheConfigurationOfCloudEnvironments.yaml | 1 + .../DynamicDepthForInfrastructure/3/WeakPasswordTest.yaml | 1 + .../DynamicDepthForInfrastructure/4/LoadTests.yaml | 1 + .../1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml | 1 + .../2/StaticAnalysisForImportantServerSideComponents.yaml | 1 + .../3/StaticAnalysisForImportantClientSideComponents.yaml | 1 + .../3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml | 1 + .../4/ExclusionOfSourceCodeDuplicates.yaml | 1 + .../4/StaticAnalysisForAllComponentsOrlibraries.yaml | 1 + .../4/StaticAnalysisForAllSelfWrittenComponents.yaml | 1 + .../StaticDepthForApplications/4/StylisticAnalysis.yaml | 1 + .../StaticDepthForApplications/4/UsageOfMultipleAnalysers.yaml | 1 + .../StaticDepthForInfrastructure/1/StoredSecrets.yaml | 1 + .../2/TestClusterDeploymentResources.yaml | 1 + .../2/TestOfVirtualizedEnvironments.yaml | 1 + .../2/TestTheClouldConfiguration.yaml | 1 + .../2/TestTheDefinitionOfVirtualizedEnvironments.yaml | 1 + .../StaticDepthForInfrastructure/3/CheckForImageLifetime.yaml | 1 + .../StaticDepthForInfrastructure/3/CheckForMalware.yaml | 1 + .../StaticDepthForInfrastructure/3/CheckForNewImageVersion.yaml | 1 + .../4/CheckForKnownVulnerabilities.yaml | 1 + ...KnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml | 1 + .../4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml | 1 + .../Test-Intensity/1/DefaultSettingsForIntensity.yaml | 1 + .../TestAndVerification/Test-Intensity/1/HighTestIntensity.yaml | 1 + .../Test-Intensity/2/DeactivatingOfUnneededTests.yaml | 1 + data-new/TestAndVerification/Test-Intensity/2/RegularTests.yaml | 1 + .../3/CreationAndApplicationOfATestingConcept.yaml | 1 + newFolder-Migration-2021.php | 1 + 138 files changed, 138 insertions(+) diff --git a/data-new/BuildAndDeployment/Build/1/DefinedBuildProcess.yaml b/data-new/BuildAndDeployment/Build/1/DefinedBuildProcess.yaml index 61fc29551..b1bea77f9 100755 --- a/data-new/BuildAndDeployment/Build/1/DefinedBuildProcess.yaml +++ b/data-new/BuildAndDeployment/Build/1/DefinedBuildProcess.yaml @@ -18,5 +18,6 @@ samm2: i-secure-build|A|1 iso27001-2017: - 12.1.1 - 14.2.2 +title: Defined build process id: DefinedBuildProcess ... diff --git a/data-new/BuildAndDeployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml b/data-new/BuildAndDeployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml index ae69f2f12..8bbfa29e3 100755 --- a/data-new/BuildAndDeployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml +++ b/data-new/BuildAndDeployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml @@ -19,5 +19,6 @@ implementation: samm2: i-secure-build|A|2 iso27001-2017: - 14.2.6 +title: Building and testing of artifacts in virtual environments id: BuildingAndTestingOfArtifactsInVirtualEnvironments ... diff --git a/data-new/BuildAndDeployment/Build/3/SigningOfArtifacts.yaml b/data-new/BuildAndDeployment/Build/3/SigningOfArtifacts.yaml index 439494fb7..cff6c3ba9 100755 --- a/data-new/BuildAndDeployment/Build/3/SigningOfArtifacts.yaml +++ b/data-new/BuildAndDeployment/Build/3/SigningOfArtifacts.yaml @@ -17,5 +17,6 @@ samm: OA3-B samm2: i-secure-build|A|1 iso27001-2017: - 14.2.6 +title: Signing of artifacts id: SigningOfArtifacts ... diff --git a/data-new/BuildAndDeployment/Build/3/SigningOfCode.yaml b/data-new/BuildAndDeployment/Build/3/SigningOfCode.yaml index 9560d1958..b55b00c98 100755 --- a/data-new/BuildAndDeployment/Build/3/SigningOfCode.yaml +++ b/data-new/BuildAndDeployment/Build/3/SigningOfCode.yaml @@ -14,5 +14,6 @@ samm: OA3-B samm2: i-secure-build|A|2 iso27001-2017: - 14.2.6 +title: Signing of code id: SigningOfCode ... diff --git a/data-new/BuildAndDeployment/Deployment/1/DefinedDeploymentProcess.yaml b/data-new/BuildAndDeployment/Deployment/1/DefinedDeploymentProcess.yaml index 7aea8a7b8..133576324 100755 --- a/data-new/BuildAndDeployment/Deployment/1/DefinedDeploymentProcess.yaml +++ b/data-new/BuildAndDeployment/Deployment/1/DefinedDeploymentProcess.yaml @@ -13,5 +13,6 @@ samm2: i-secure-deployment|A|1 iso27001-2017: - 12.1.1 - 14.2.2 +title: Defined deployment process id: DefinedDeploymentProcess ... diff --git a/data-new/BuildAndDeployment/Deployment/2/BackupBeforeDeployment.yaml b/data-new/BuildAndDeployment/Deployment/2/BackupBeforeDeployment.yaml index 0c8ce5edd..1245dbf68 100755 --- a/data-new/BuildAndDeployment/Deployment/2/BackupBeforeDeployment.yaml +++ b/data-new/BuildAndDeployment/Deployment/2/BackupBeforeDeployment.yaml @@ -17,5 +17,6 @@ samm2: TODO iso27001-2017: - "12.3" - 14.2.6 +title: Backup before deployment id: BackupBeforeDeployment ... diff --git a/data-new/BuildAndDeployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml b/data-new/BuildAndDeployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml index 8b67ddd30..dd1d12cbe 100755 --- a/data-new/BuildAndDeployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml +++ b/data-new/BuildAndDeployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml @@ -13,5 +13,6 @@ samm2: i-secure-deployment|B|1 iso27001-2017: - 9.4.5 - 14.2.6 +title: Environment depending configuration parameters id: EnvironmentDependingConfigurationParameters ... diff --git a/data-new/BuildAndDeployment/Deployment/2/UsageOfTrustedImages.yaml b/data-new/BuildAndDeployment/Deployment/2/UsageOfTrustedImages.yaml index 9ed3ab781..a10c34138 100755 --- a/data-new/BuildAndDeployment/Deployment/2/UsageOfTrustedImages.yaml +++ b/data-new/BuildAndDeployment/Deployment/2/UsageOfTrustedImages.yaml @@ -16,5 +16,6 @@ iso27001-2017: - 15.1.2 - 15.1.3 - 14.1.3 +title: Usage of trusted images id: UsageOfTrustedImages ... diff --git a/data-new/BuildAndDeployment/Deployment/3/HandoverOfConfidentialParameters.yaml b/data-new/BuildAndDeployment/Deployment/3/HandoverOfConfidentialParameters.yaml index e9ed103c9..24e4e7883 100755 --- a/data-new/BuildAndDeployment/Deployment/3/HandoverOfConfidentialParameters.yaml +++ b/data-new/BuildAndDeployment/Deployment/3/HandoverOfConfidentialParameters.yaml @@ -21,5 +21,6 @@ iso27001-2017: - 9.4.3 - 9.4.1 - 10.1.2 +title: Handover of confidential parameters id: HandoverOfConfidentialParameters ... diff --git a/data-new/BuildAndDeployment/Deployment/3/InventoryOfRunningArtifacts.yaml b/data-new/BuildAndDeployment/Deployment/3/InventoryOfRunningArtifacts.yaml index 63eb72f97..ba3d63276 100755 --- a/data-new/BuildAndDeployment/Deployment/3/InventoryOfRunningArtifacts.yaml +++ b/data-new/BuildAndDeployment/Deployment/3/InventoryOfRunningArtifacts.yaml @@ -14,5 +14,6 @@ samm2: o-incident-management|TODO iso27001-2017: - "8.1" - "8.2" +title: Inventory of running artifacts id: InventoryOfRunningArtifacts ... diff --git a/data-new/BuildAndDeployment/Deployment/3/RollingUpdateOnDeployment.yaml b/data-new/BuildAndDeployment/Deployment/3/RollingUpdateOnDeployment.yaml index 5e46dfa9a..a4c6ac158 100755 --- a/data-new/BuildAndDeployment/Deployment/3/RollingUpdateOnDeployment.yaml +++ b/data-new/BuildAndDeployment/Deployment/3/RollingUpdateOnDeployment.yaml @@ -14,5 +14,6 @@ iso27001-2017: - 12.5.1 - 14.2.2 - 17.2.1 +title: Rolling update on deployment id: RollingUpdateOnDeployment ... diff --git a/data-new/BuildAndDeployment/Deployment/3/SameArtifactForEnvironments.yaml b/data-new/BuildAndDeployment/Deployment/3/SameArtifactForEnvironments.yaml index 075ee154b..15278e45e 100755 --- a/data-new/BuildAndDeployment/Deployment/3/SameArtifactForEnvironments.yaml +++ b/data-new/BuildAndDeployment/Deployment/3/SameArtifactForEnvironments.yaml @@ -17,5 +17,6 @@ iso27001-2017: - 14.3.1 - 14.2.8 - 12.1.4 +title: Same artifact for environments id: SameArtifactForEnvironments ... diff --git a/data-new/BuildAndDeployment/Deployment/3/UsageOfFeatureToggles.yaml b/data-new/BuildAndDeployment/Deployment/3/UsageOfFeatureToggles.yaml index f1dfb99db..c81468557 100755 --- a/data-new/BuildAndDeployment/Deployment/3/UsageOfFeatureToggles.yaml +++ b/data-new/BuildAndDeployment/Deployment/3/UsageOfFeatureToggles.yaml @@ -18,5 +18,6 @@ iso27001-2017: - 14.2.8 - 14.2.9 - 12.1.4 +title: Usage of feature toggles id: UsageOfFeatureToggles ... diff --git a/data-new/BuildAndDeployment/Deployment/4/BlueOrgreenDeployment.yaml b/data-new/BuildAndDeployment/Deployment/4/BlueOrgreenDeployment.yaml index d1b50df75..57b9da834 100755 --- a/data-new/BuildAndDeployment/Deployment/4/BlueOrgreenDeployment.yaml +++ b/data-new/BuildAndDeployment/Deployment/4/BlueOrgreenDeployment.yaml @@ -20,5 +20,6 @@ iso27001-2017: - 12.1.4 - 12.5.1 - 14.2.9 +title: Blue/Green Deployment id: BlueOrgreenDeployment ... diff --git a/data-new/BuildAndDeployment/PatchManagement/1/APatchPolicyIsDefined.yaml b/data-new/BuildAndDeployment/PatchManagement/1/APatchPolicyIsDefined.yaml index 36ce4dd90..5f46d12e8 100755 --- a/data-new/BuildAndDeployment/PatchManagement/1/APatchPolicyIsDefined.yaml +++ b/data-new/BuildAndDeployment/PatchManagement/1/APatchPolicyIsDefined.yaml @@ -12,5 +12,6 @@ iso27001-2017: - 12.6.1 - 12.5.1 - 14.2.5 +title: A patch policy is defined id: APatchPolicyIsDefined ... diff --git a/data-new/BuildAndDeployment/PatchManagement/1/AutomatedPrsForPatches.yaml b/data-new/BuildAndDeployment/PatchManagement/1/AutomatedPrsForPatches.yaml index 93f52bec8..18e7991df 100755 --- a/data-new/BuildAndDeployment/PatchManagement/1/AutomatedPrsForPatches.yaml +++ b/data-new/BuildAndDeployment/PatchManagement/1/AutomatedPrsForPatches.yaml @@ -17,5 +17,6 @@ iso27001-2017: implementation: - dependabot - Jenkins +title: Automated PRs for patches id: AutomatedPrsForPatches ... diff --git a/data-new/BuildAndDeployment/PatchManagement/2/NightlyBuildOfImages.yaml b/data-new/BuildAndDeployment/PatchManagement/2/NightlyBuildOfImages.yaml index 8c576b214..b0353da82 100755 --- a/data-new/BuildAndDeployment/PatchManagement/2/NightlyBuildOfImages.yaml +++ b/data-new/BuildAndDeployment/PatchManagement/2/NightlyBuildOfImages.yaml @@ -9,5 +9,6 @@ usefulness: 3 samm2: o-environment-management|B|1 iso27001-2017: - 12.6.1 +title: Nightly build of images id: NightlyBuildOfImages ... diff --git a/data-new/BuildAndDeployment/PatchManagement/2/ReductionOfTheAttackSurface.yaml b/data-new/BuildAndDeployment/PatchManagement/2/ReductionOfTheAttackSurface.yaml index 3a23a74c1..d36f90a60 100755 --- a/data-new/BuildAndDeployment/PatchManagement/2/ReductionOfTheAttackSurface.yaml +++ b/data-new/BuildAndDeployment/PatchManagement/2/ReductionOfTheAttackSurface.yaml @@ -15,5 +15,6 @@ iso27001-2017: implementation: - Distroless - Fedora CoreOS +title: Reduction of the attack surface id: ReductionOfTheAttackSurface ... diff --git a/data-new/BuildAndDeployment/PatchManagement/2/UsageOfAMaximumLifetimeForImages.yaml b/data-new/BuildAndDeployment/PatchManagement/2/UsageOfAMaximumLifetimeForImages.yaml index 7ce947d1b..262283e4f 100755 --- a/data-new/BuildAndDeployment/PatchManagement/2/UsageOfAMaximumLifetimeForImages.yaml +++ b/data-new/BuildAndDeployment/PatchManagement/2/UsageOfAMaximumLifetimeForImages.yaml @@ -13,5 +13,6 @@ usefulness: 3 samm2: o-environment-management|B|1 iso27001-2017: - 12.6.1 +title: Usage of a maximum lifetime for images id: UsageOfAMaximumLifetimeForImages ... diff --git a/data-new/BuildAndDeployment/PatchManagement/4/UsageOfAShortMaximumLifetimeForImages.yaml b/data-new/BuildAndDeployment/PatchManagement/4/UsageOfAShortMaximumLifetimeForImages.yaml index 890406b0e..d2d3fbba7 100755 --- a/data-new/BuildAndDeployment/PatchManagement/4/UsageOfAShortMaximumLifetimeForImages.yaml +++ b/data-new/BuildAndDeployment/PatchManagement/4/UsageOfAShortMaximumLifetimeForImages.yaml @@ -20,5 +20,6 @@ implementation: will ensure that if (and only if) something buggy has been introduced which breaks functionality the canary deployment will make sure the "older version" is being used and not the buggy newer one. +title: Usage of a short maximum lifetime for images id: UsageOfAShortMaximumLifetimeForImages ... diff --git a/data-new/CultureAndOrganization/Design/0/InformationSecurityTargetsAreCommunicated.yaml b/data-new/CultureAndOrganization/Design/0/InformationSecurityTargetsAreCommunicated.yaml index 4233c2a3e..2207bc8db 100755 --- a/data-new/CultureAndOrganization/Design/0/InformationSecurityTargetsAreCommunicated.yaml +++ b/data-new/CultureAndOrganization/Design/0/InformationSecurityTargetsAreCommunicated.yaml @@ -12,5 +12,6 @@ samm: SM1-B iso27001-2017: - 5.1.1 - 7.2.1 +title: Information security targets are communicated id: InformationSecurityTargetsAreCommunicated ... diff --git a/data-new/CultureAndOrganization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml b/data-new/CultureAndOrganization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml index 601f16c8d..5b0b06fc2 100755 --- a/data-new/CultureAndOrganization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml +++ b/data-new/CultureAndOrganization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml @@ -51,5 +51,6 @@ iso27001-2017: - may be part of risk assessment - 8.2.1 - 14.2.1 +title: Conduction of simple threat modelling on technical level id: ConductionOfSimpleThreatModellingOnTechnicalLevel ... diff --git a/data-new/CultureAndOrganization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml b/data-new/CultureAndOrganization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml index dde02bae5..61b292c00 100755 --- a/data-new/CultureAndOrganization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml +++ b/data-new/CultureAndOrganization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml @@ -14,5 +14,6 @@ iso27001-2017: - may be part of risk assessment - 8.2.1 - 14.2.1 +title: Conduction of simple threat modelling on business level id: ConductionOfSimpleThreatModellingOnBusinessLevel ... diff --git a/data-new/CultureAndOrganization/Design/2/CreationOfSimpleAbuseStories.yaml b/data-new/CultureAndOrganization/Design/2/CreationOfSimpleAbuseStories.yaml index b3cf67a6f..9331f38ef 100755 --- a/data-new/CultureAndOrganization/Design/2/CreationOfSimpleAbuseStories.yaml +++ b/data-new/CultureAndOrganization/Design/2/CreationOfSimpleAbuseStories.yaml @@ -17,5 +17,6 @@ iso27001-2017: implementation: Don't Forget EVIL User Stories and Practical Security Stories and Security Tasks for Agile Development Environments +title: Creation of simple abuse stories id: CreationOfSimpleAbuseStories ... diff --git a/data-new/CultureAndOrganization/Design/3/ConductionOfAdvancedThreatModelling.yaml b/data-new/CultureAndOrganization/Design/3/ConductionOfAdvancedThreatModelling.yaml index fc9f22b39..21bd17aa3 100755 --- a/data-new/CultureAndOrganization/Design/3/ConductionOfAdvancedThreatModelling.yaml +++ b/data-new/CultureAndOrganization/Design/3/ConductionOfAdvancedThreatModelling.yaml @@ -26,5 +26,6 @@ iso27001-2017: - may be part of risk assessment - 8.2.1 - 14.2.1 +title: Conduction of advanced threat modelling id: ConductionOfAdvancedThreatModelling ... diff --git a/data-new/CultureAndOrganization/Design/4/CreationOfAdvancedAbuseStories.yaml b/data-new/CultureAndOrganization/Design/4/CreationOfAdvancedAbuseStories.yaml index fc51356ad..e5ca81bc1 100755 --- a/data-new/CultureAndOrganization/Design/4/CreationOfAdvancedAbuseStories.yaml +++ b/data-new/CultureAndOrganization/Design/4/CreationOfAdvancedAbuseStories.yaml @@ -20,5 +20,6 @@ iso27001-2017: implementation: Don't Forget EVIL User Stories and Practical Security Stories and Security Tasks for Agile Development Environments +title: Creation of advanced abuse stories id: CreationOfAdvancedAbuseStories ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml index eea684d96..2367b3cf9 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml @@ -14,5 +14,6 @@ samm: EG1-A - In case you do not have the budget to hire an external security ex Juice Shop on a "hacking Friday" - https://cheatsheetseries.owasp.org/ iso27001-2017: - 7.2.2 +title: Ad-Hoc Security trainings for software developers id: Ad-HocSecurityTrainingsForSoftwareDevelopers ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/1/SecurityConsultingOnRequest.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/1/SecurityConsultingOnRequest.yaml index 78160ba6c..4e3c91b34 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/1/SecurityConsultingOnRequest.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/1/SecurityConsultingOnRequest.yaml @@ -14,5 +14,6 @@ iso27001-2017: - 6.1.1 - 6.1.4 - 6.1.5 +title: Security consulting on request id: SecurityConsultingOnRequest ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/2/EachTeamHasASecurityChampion.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/2/EachTeamHasASecurityChampion.yaml index cf2215007..b970dad9e 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/2/EachTeamHasASecurityChampion.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/2/EachTeamHasASecurityChampion.yaml @@ -14,5 +14,6 @@ iso27001-2017: - 7.2.1 - 7.2.2 implementation: https://www.owasp.org/index.php/Security_Champions_Playbook +title: Each team has a security champion id: EachTeamHasASecurityChampion ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingForAll.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingForAll.yaml index 15337a502..0f826db52 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingForAll.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingForAll.yaml @@ -15,5 +15,6 @@ implementation: is to use the OWASP Juice Shop on a "hacking Friday" - https://cheatsheetseries.owasp.org/ +title: Regular security training for all id: RegularSecurityTrainingForAll ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingOfSecurityChampions.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingOfSecurityChampions.yaml index 7b5c76d3e..12bf23a0a 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingOfSecurityChampions.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingOfSecurityChampions.yaml @@ -13,5 +13,6 @@ samm: EG2-B iso27001-2017: - security champions are missing in ISO 27001 - 7.2.2 +title: Regular security training of security champions id: RegularSecurityTrainingOfSecurityChampions ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/2/RewardOfGoodCommunication.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/2/RewardOfGoodCommunication.yaml index aa6a276e9..2d65d1ed5 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/2/RewardOfGoodCommunication.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/2/RewardOfGoodCommunication.yaml @@ -16,5 +16,6 @@ implementation: - Enhance motivation can be performed with the distribution of pins as a reward, see OWASP Security Pins Project - https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx +title: Reward of good communication id: RewardOfGoodCommunication ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml index 3bcd217e7..05479ed2f 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml @@ -13,5 +13,6 @@ usefulness: 3 iso27001-2017: - 7.2.2 implementation: https://builditbreakit.org/ +title: Conduction of build-it, break-it, fix-it contests id: ConductionOfBuild-It,Break-It,Fix-ItContests ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml index 1a9b2171e..586477909 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml @@ -15,5 +15,6 @@ iso27001-2017: - 7.2.2 - 12.6.1 - 12.7.1 +title: Conduction of collaborative security checks with developers and system administrators id: ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/3/RegularSecurityTrainingForEveryone.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/3/RegularSecurityTrainingForEveryone.yaml index ad02b01e0..814a6ce1f 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/3/RegularSecurityTrainingForEveryone.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/3/RegularSecurityTrainingForEveryone.yaml @@ -12,5 +12,6 @@ iso27001-2017: implementation: Often, external employees are not invited for interal trainings. This activity focuses on providing security trainings to internal as well as external employees. It is conducted every two weeks for around one hour. +title: Regular security training for everyone id: RegularSecurityTrainingForEveryone ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/3/Security-Lessoned-Learned.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/3/Security-Lessoned-Learned.yaml index 107eac7b2..236e2799a 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/3/Security-Lessoned-Learned.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/3/Security-Lessoned-Learned.yaml @@ -11,5 +11,6 @@ usefulness: 3 samm: IM-3, ST-3, SR2-B iso27001-2017: - 16.1.6 +title: Security-Lessoned-Learned id: Security-Lessoned-Learned ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/4/AligningSecurityInTeams.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/4/AligningSecurityInTeams.yaml index 5a8c47708..58f877ee2 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/4/AligningSecurityInTeams.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/4/AligningSecurityInTeams.yaml @@ -13,5 +13,6 @@ usefulness: 5 samm: EG2-B iso27001-2017: - 7.1.1 +title: Aligning security in teams id: AligningSecurityInTeams ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml index 9a800187c..3b0f23c7f 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml @@ -11,5 +11,6 @@ samm: EG2-A iso27001-2017: - Mutual scurity testing is not explicitly required in ISO 27001 may be - 7.2.2 +title: Conduction of collaborative team security checks id: ConductionOfCollaborativeTeamSecurityChecks ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfWarGames.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfWarGames.yaml index b001ba639..258e0b69f 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfWarGames.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfWarGames.yaml @@ -13,5 +13,6 @@ iso27001-2017: - 7.2.2 - "16.1" - 16.1.5 +title: Conduction of war games id: ConductionOfWarGames ... diff --git a/data-new/CultureAndOrganization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml b/data-new/CultureAndOrganization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml index 6d0f52826..5c51c7be7 100755 --- a/data-new/CultureAndOrganization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml +++ b/data-new/CultureAndOrganization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml @@ -12,5 +12,6 @@ difficultyOfImplementation: usefulness: 4 iso27001-2017: - 17.1.1 +title: Definition of simple BCDR practices for critical components id: DefinitionOfSimpleBcdrPracticesForCriticalComponents ... diff --git a/data-new/CultureAndOrganization/Process/3/ApprovalByReviewingAnyNewVersion.yaml b/data-new/CultureAndOrganization/Process/3/ApprovalByReviewingAnyNewVersion.yaml index 781454150..89e809a06 100755 --- a/data-new/CultureAndOrganization/Process/3/ApprovalByReviewingAnyNewVersion.yaml +++ b/data-new/CultureAndOrganization/Process/3/ApprovalByReviewingAnyNewVersion.yaml @@ -14,5 +14,6 @@ iso27001-2017: - peer review - four eyes principle is not explicitly required by ISO 27001 - 6.1.2 - 14.2.1 +title: Approval by reviewing any new version id: ApprovalByReviewingAnyNewVersion ... diff --git a/data-new/CultureAndOrganization/Process/3/DefinitionOfAChangeManagementProcess.yaml b/data-new/CultureAndOrganization/Process/3/DefinitionOfAChangeManagementProcess.yaml index 3208fdeef..6fe421976 100755 --- a/data-new/CultureAndOrganization/Process/3/DefinitionOfAChangeManagementProcess.yaml +++ b/data-new/CultureAndOrganization/Process/3/DefinitionOfAChangeManagementProcess.yaml @@ -10,5 +10,6 @@ iso27001-2017: - 14.2.2 - 12.1.2 - 12.4.1 +title: Definition of a change management process id: DefinitionOfAChangeManagementProcess ... diff --git a/data-new/CultureAndOrganization/Process/3/PreventionOfUnauthorizedInstallation.yaml b/data-new/CultureAndOrganization/Process/3/PreventionOfUnauthorizedInstallation.yaml index 945dcab35..19830fd89 100755 --- a/data-new/CultureAndOrganization/Process/3/PreventionOfUnauthorizedInstallation.yaml +++ b/data-new/CultureAndOrganization/Process/3/PreventionOfUnauthorizedInstallation.yaml @@ -14,5 +14,6 @@ iso27001-2017: implementation: 'Example: All docker images used by teams need to be based on standard images.' comment: By preventing teams from trying out new components, innovation might be hampered +title: Prevention of unauthorized installation id: PreventionOfUnauthorizedInstallation ... diff --git a/data-new/Implementation/ApplicationHardening/1/ApplicationHardeningLevel1.yaml b/data-new/Implementation/ApplicationHardening/1/ApplicationHardeningLevel1.yaml index b2e4302aa..7dc93b24c 100755 --- a/data-new/Implementation/ApplicationHardening/1/ApplicationHardeningLevel1.yaml +++ b/data-new/Implementation/ApplicationHardening/1/ApplicationHardeningLevel1.yaml @@ -39,5 +39,6 @@ samm2: software-requirements|A|1 iso27001-2017: - hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 +title: Application Hardening Level 1 id: ApplicationHardeningLevel1 ... diff --git a/data-new/Implementation/ApplicationHardening/2/App.HardeningLevel2.yaml b/data-new/Implementation/ApplicationHardening/2/App.HardeningLevel2.yaml index ca02d4b11..31c1b4b63 100755 --- a/data-new/Implementation/ApplicationHardening/2/App.HardeningLevel2.yaml +++ b/data-new/Implementation/ApplicationHardening/2/App.HardeningLevel2.yaml @@ -20,5 +20,6 @@ samm2: software-requirements|A|2 iso27001-2017: - hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 +title: App. Hardening Level 2 id: App.HardeningLevel2 ... diff --git a/data-new/Implementation/ApplicationHardening/3/App.HardeningLevel3.yaml b/data-new/Implementation/ApplicationHardening/3/App.HardeningLevel3.yaml index 48fe0042e..d099bda62 100755 --- a/data-new/Implementation/ApplicationHardening/3/App.HardeningLevel3.yaml +++ b/data-new/Implementation/ApplicationHardening/3/App.HardeningLevel3.yaml @@ -21,5 +21,6 @@ samm2: software-requirements|A|3 iso27001-2017: - hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 +title: App. Hardening Level 3 id: App.HardeningLevel3 ... diff --git a/data-new/Implementation/ApplicationHardening/4/FullCoverageOfApp.HardeningLevel3.yaml b/data-new/Implementation/ApplicationHardening/4/FullCoverageOfApp.HardeningLevel3.yaml index a56ed72e4..db76cf6ea 100755 --- a/data-new/Implementation/ApplicationHardening/4/FullCoverageOfApp.HardeningLevel3.yaml +++ b/data-new/Implementation/ApplicationHardening/4/FullCoverageOfApp.HardeningLevel3.yaml @@ -21,5 +21,6 @@ samm2: software-requirements|A|3 iso27001-2017: - hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 +title: Full Coverage of App. Hardening Level 3 id: FullCoverageOfApp.HardeningLevel3 ... diff --git a/data-new/Implementation/InfrastructureHardening/1/IsolatedNetworksForVirtualEnvironments.yaml b/data-new/Implementation/InfrastructureHardening/1/IsolatedNetworksForVirtualEnvironments.yaml index 6d949b7ff..1091b3aba 100755 --- a/data-new/Implementation/InfrastructureHardening/1/IsolatedNetworksForVirtualEnvironments.yaml +++ b/data-new/Implementation/InfrastructureHardening/1/IsolatedNetworksForVirtualEnvironments.yaml @@ -18,5 +18,6 @@ samm2: o-environment-management|A|1 iso27001-2017: - virtual environments are not explicitly covered by ISO 27001 - too specific - 13.1.3 +title: Isolated networks for virtual environments id: IsolatedNetworksForVirtualEnvironments ... diff --git a/data-new/Implementation/InfrastructureHardening/1/SimpleAccessControlForSystems.yaml b/data-new/Implementation/InfrastructureHardening/1/SimpleAccessControlForSystems.yaml index 8f893c932..e89042f5d 100755 --- a/data-new/Implementation/InfrastructureHardening/1/SimpleAccessControlForSystems.yaml +++ b/data-new/Implementation/InfrastructureHardening/1/SimpleAccessControlForSystems.yaml @@ -13,5 +13,6 @@ samm: EH1-B samm2: o-environment-management|A|1 iso27001-2017: - 9.4.1 +title: Simple access control for systems id: SimpleAccessControlForSystems ... diff --git a/data-new/Implementation/InfrastructureHardening/1/UsageOfTestAndProductionEnvironments.yaml b/data-new/Implementation/InfrastructureHardening/1/UsageOfTestAndProductionEnvironments.yaml index 535d3713a..aac4ce7b4 100755 --- a/data-new/Implementation/InfrastructureHardening/1/UsageOfTestAndProductionEnvironments.yaml +++ b/data-new/Implementation/InfrastructureHardening/1/UsageOfTestAndProductionEnvironments.yaml @@ -13,5 +13,6 @@ iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 12.1.4 - 17.2.1 +title: Usage of test and production environments id: UsageOfTestAndProductionEnvironments ... diff --git a/data-new/Implementation/InfrastructureHardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml b/data-new/Implementation/InfrastructureHardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml index c43ded208..35d576f47 100755 --- a/data-new/Implementation/InfrastructureHardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml +++ b/data-new/Implementation/InfrastructureHardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml @@ -11,5 +11,6 @@ samm2: o-environment-management|A|1 iso27001-2017: - virtual environments are not explicitly covered by ISO 27001 - too specific - 13.1.3 +title: Applications are running in virtualized environments id: ApplicationsAreRunningInVirtualizedEnvironments ... diff --git a/data-new/Implementation/InfrastructureHardening/2/CheckingTheSourcesOfUsedLibraries.yaml b/data-new/Implementation/InfrastructureHardening/2/CheckingTheSourcesOfUsedLibraries.yaml index 0d3838401..81c7a04d4 100755 --- a/data-new/Implementation/InfrastructureHardening/2/CheckingTheSourcesOfUsedLibraries.yaml +++ b/data-new/Implementation/InfrastructureHardening/2/CheckingTheSourcesOfUsedLibraries.yaml @@ -13,5 +13,6 @@ iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 14.2.1 - 14.2.5 +title: Checking the sources of used libraries id: CheckingTheSourcesOfUsedLibraries ... diff --git a/data-new/Implementation/InfrastructureHardening/2/FilterOutgoingTraffic.yaml b/data-new/Implementation/InfrastructureHardening/2/FilterOutgoingTraffic.yaml index c6d130de9..b0050899d 100755 --- a/data-new/Implementation/InfrastructureHardening/2/FilterOutgoingTraffic.yaml +++ b/data-new/Implementation/InfrastructureHardening/2/FilterOutgoingTraffic.yaml @@ -15,5 +15,6 @@ samm2: o-environment-management|A|1 iso27001-2017: - virtual environments are not explicitly covered by ISO 27001 - too specific - 13.1.3 +title: Filter outgoing traffic id: FilterOutgoingTraffic ... diff --git a/data-new/Implementation/InfrastructureHardening/2/TheClusterIsHardened.yaml b/data-new/Implementation/InfrastructureHardening/2/TheClusterIsHardened.yaml index 57b776b06..50597152d 100755 --- a/data-new/Implementation/InfrastructureHardening/2/TheClusterIsHardened.yaml +++ b/data-new/Implementation/InfrastructureHardening/2/TheClusterIsHardened.yaml @@ -17,5 +17,6 @@ samm2: o-environment-management|A|1 iso27001-2017: - system hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 +title: The cluster is hardened id: TheClusterIsHardened ... diff --git a/data-new/Implementation/InfrastructureHardening/2/UsageOfSecurityByDefaultForComponents.yaml b/data-new/Implementation/InfrastructureHardening/2/UsageOfSecurityByDefaultForComponents.yaml index 266fb22d7..30fdfcf67 100755 --- a/data-new/Implementation/InfrastructureHardening/2/UsageOfSecurityByDefaultForComponents.yaml +++ b/data-new/Implementation/InfrastructureHardening/2/UsageOfSecurityByDefaultForComponents.yaml @@ -15,5 +15,6 @@ dependsOn: samm2: o-environment-management|A|1 iso27001-2017: - not explicitly covered by ISO 27001 - too specific +title: Usage of security by default for components id: UsageOfSecurityByDefaultForComponents ... diff --git a/data-new/Implementation/InfrastructureHardening/2/VirtualEnvironmentsAreLimited.yaml b/data-new/Implementation/InfrastructureHardening/2/VirtualEnvironmentsAreLimited.yaml index 960accda2..6a7cfb707 100755 --- a/data-new/Implementation/InfrastructureHardening/2/VirtualEnvironmentsAreLimited.yaml +++ b/data-new/Implementation/InfrastructureHardening/2/VirtualEnvironmentsAreLimited.yaml @@ -16,5 +16,6 @@ iso27001-2017: - 12.1.3 - 13.1.3 - 17.2.1 +title: Virtual environments are limited id: VirtualEnvironmentsAreLimited ... diff --git a/data-new/Implementation/InfrastructureHardening/3/2Fa.yaml b/data-new/Implementation/InfrastructureHardening/3/2Fa.yaml index 696ef82b0..a2d1167d6 100755 --- a/data-new/Implementation/InfrastructureHardening/3/2Fa.yaml +++ b/data-new/Implementation/InfrastructureHardening/3/2Fa.yaml @@ -14,5 +14,6 @@ iso27001-2017: - 9.1.1 - 9.4.2 - 14.2.5 +title: 2FA id: 2Fa ... diff --git a/data-new/Implementation/InfrastructureHardening/3/ImmutableInfrastructure.yaml b/data-new/Implementation/InfrastructureHardening/3/ImmutableInfrastructure.yaml index b2a54e549..78ee666a2 100755 --- a/data-new/Implementation/InfrastructureHardening/3/ImmutableInfrastructure.yaml +++ b/data-new/Implementation/InfrastructureHardening/3/ImmutableInfrastructure.yaml @@ -15,5 +15,6 @@ samm2: o-environment-management|A|1 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 17.2.1 +title: Immutable Infrastructure id: ImmutableInfrastructure ... diff --git a/data-new/Implementation/InfrastructureHardening/3/InfrastructureAsCode.yaml b/data-new/Implementation/InfrastructureHardening/3/InfrastructureAsCode.yaml index eda76472c..8f4289054 100755 --- a/data-new/Implementation/InfrastructureHardening/3/InfrastructureAsCode.yaml +++ b/data-new/Implementation/InfrastructureHardening/3/InfrastructureAsCode.yaml @@ -15,5 +15,6 @@ iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 12.1.1 - 12.1.2 +title: Infrastructure as Code id: InfrastructureAsCode ... diff --git a/data-new/Implementation/InfrastructureHardening/3/RoleBasedAuthenticationAndAuthorization.yaml b/data-new/Implementation/InfrastructureHardening/3/RoleBasedAuthenticationAndAuthorization.yaml index f485e5ece..ec0cbd708 100755 --- a/data-new/Implementation/InfrastructureHardening/3/RoleBasedAuthenticationAndAuthorization.yaml +++ b/data-new/Implementation/InfrastructureHardening/3/RoleBasedAuthenticationAndAuthorization.yaml @@ -15,5 +15,6 @@ dependsOn: samm2: o-environment-management|A|1 iso27001-2017: - 9.4.1 +title: Role based authentication and authorization id: RoleBasedAuthenticationAndAuthorization ... diff --git a/data-new/Implementation/InfrastructureHardening/3/Versioning.yaml b/data-new/Implementation/InfrastructureHardening/3/Versioning.yaml index 34ac4a628..c6e020afc 100755 --- a/data-new/Implementation/InfrastructureHardening/3/Versioning.yaml +++ b/data-new/Implementation/InfrastructureHardening/3/Versioning.yaml @@ -15,5 +15,6 @@ iso27001-2017: - 12.1.1 - 12.1.2 - 14.2.2 +title: versioning id: Versioning ... diff --git a/data-new/Implementation/InfrastructureHardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml b/data-new/Implementation/InfrastructureHardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml index 2710c7b97..aca5c0ed3 100755 --- a/data-new/Implementation/InfrastructureHardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml +++ b/data-new/Implementation/InfrastructureHardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml @@ -12,5 +12,6 @@ implementation: seccomp, strace samm2: o-environment-management|A|1 iso27001-2017: - system hardenong is not explicitly covered by ISO 27001 - too specific +title: Limitation of system calls in virtual environments id: LimitationOfSystemCallsInVirtualEnvironments ... diff --git a/data-new/Implementation/InfrastructureHardening/4/Microservice-Architecture.yaml b/data-new/Implementation/InfrastructureHardening/4/Microservice-Architecture.yaml index 2b15ded4d..b6f07c665 100755 --- a/data-new/Implementation/InfrastructureHardening/4/Microservice-Architecture.yaml +++ b/data-new/Implementation/InfrastructureHardening/4/Microservice-Architecture.yaml @@ -11,5 +11,6 @@ samm: SA2 samm2: o-environment-management|A|1 iso27001-2017: - not explicitly covered by ISO 27001 +title: Microservice-Architecture id: Microservice-Architecture ... diff --git a/data-new/Implementation/InfrastructureHardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml b/data-new/Implementation/InfrastructureHardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml index b0f3618c7..6fe4f954e 100755 --- a/data-new/Implementation/InfrastructureHardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml +++ b/data-new/Implementation/InfrastructureHardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml @@ -18,5 +18,6 @@ samm2: o-environment-management|A|1 iso27001-2017: - 12.1.4 - 17.2.1 +title: Production near environments are used by developers id: ProductionNearEnvironmentsAreUsedByDevelopers ... diff --git a/data-new/Implementation/InfrastructureHardening/4/UsageOfAChaosMonkey.yaml b/data-new/Implementation/InfrastructureHardening/4/UsageOfAChaosMonkey.yaml index 90788ad5f..d81392193 100755 --- a/data-new/Implementation/InfrastructureHardening/4/UsageOfAChaosMonkey.yaml +++ b/data-new/Implementation/InfrastructureHardening/4/UsageOfAChaosMonkey.yaml @@ -13,5 +13,6 @@ samm2: o-environment-management|A|1 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 17.1.3 +title: Usage of a chaos monkey id: UsageOfAChaosMonkey ... diff --git a/data-new/InformationGathering/Logging/1/CentralizedSystemLogging.yaml b/data-new/InformationGathering/Logging/1/CentralizedSystemLogging.yaml index 3d276c7eb..1a9f98b33 100755 --- a/data-new/InformationGathering/Logging/1/CentralizedSystemLogging.yaml +++ b/data-new/InformationGathering/Logging/1/CentralizedSystemLogging.yaml @@ -13,5 +13,6 @@ samm2: o-incident-management|A|1 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 12.4.1 +title: Centralized system logging id: CentralizedSystemLogging ... diff --git a/data-new/InformationGathering/Logging/1/LoggingOfSecurityEvents.yaml b/data-new/InformationGathering/Logging/1/LoggingOfSecurityEvents.yaml index ba7933b77..1689f7ddd 100755 --- a/data-new/InformationGathering/Logging/1/LoggingOfSecurityEvents.yaml +++ b/data-new/InformationGathering/Logging/1/LoggingOfSecurityEvents.yaml @@ -13,5 +13,6 @@ implementation: rsyslog, logstash, fluentd, bash samm2: o-incident-management|A|1 iso27001-2017: - 12.4.1 +title: Logging of security events id: LoggingOfSecurityEvents ... diff --git a/data-new/InformationGathering/Logging/1/PiiLoggingConcept.yaml b/data-new/InformationGathering/Logging/1/PiiLoggingConcept.yaml index 8a687afea..4c09da91d 100755 --- a/data-new/InformationGathering/Logging/1/PiiLoggingConcept.yaml +++ b/data-new/InformationGathering/Logging/1/PiiLoggingConcept.yaml @@ -13,5 +13,6 @@ iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 12.4.1 - 18.1.1 +title: PII logging concept id: PiiLoggingConcept ... diff --git a/data-new/InformationGathering/Logging/2/VisualizedLogging.yaml b/data-new/InformationGathering/Logging/2/VisualizedLogging.yaml index 117e54981..6ebaf271d 100755 --- a/data-new/InformationGathering/Logging/2/VisualizedLogging.yaml +++ b/data-new/InformationGathering/Logging/2/VisualizedLogging.yaml @@ -17,5 +17,6 @@ samm2: o-incident-management|A|1 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 12.4.1 +title: Visualized logging id: VisualizedLogging ... diff --git a/data-new/InformationGathering/Logging/3/CentralizedApplicationLogging.yaml b/data-new/InformationGathering/Logging/3/CentralizedApplicationLogging.yaml index 33cb9d781..104ee67d0 100755 --- a/data-new/InformationGathering/Logging/3/CentralizedApplicationLogging.yaml +++ b/data-new/InformationGathering/Logging/3/CentralizedApplicationLogging.yaml @@ -17,5 +17,6 @@ samm2: o-incident-management|A|1 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 12.4.1 +title: Centralized application logging id: CentralizedApplicationLogging ... diff --git a/data-new/InformationGathering/Logging/4/CorrelationOfSecurityEvents.yaml b/data-new/InformationGathering/Logging/4/CorrelationOfSecurityEvents.yaml index ac3a4fcdc..0715e1768 100755 --- a/data-new/InformationGathering/Logging/4/CorrelationOfSecurityEvents.yaml +++ b/data-new/InformationGathering/Logging/4/CorrelationOfSecurityEvents.yaml @@ -15,5 +15,6 @@ samm2: o-incident-management|A|2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 12.4.1 +title: Correlation of security events id: CorrelationOfSecurityEvents ... diff --git a/data-new/InformationGathering/Monitoring/1/SimpleApplicationMetrics.yaml b/data-new/InformationGathering/Monitoring/1/SimpleApplicationMetrics.yaml index 3671f0e82..05ccda121 100755 --- a/data-new/InformationGathering/Monitoring/1/SimpleApplicationMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/1/SimpleApplicationMetrics.yaml @@ -11,5 +11,6 @@ implementation: Prometheus samm2: o-incident-management|A|1 iso27001-2017: - 12.4.1 +title: Simple application metrics id: SimpleApplicationMetrics ... diff --git a/data-new/InformationGathering/Monitoring/1/SimpleSystemMetrics.yaml b/data-new/InformationGathering/Monitoring/1/SimpleSystemMetrics.yaml index 89e146f5b..21cb70136 100755 --- a/data-new/InformationGathering/Monitoring/1/SimpleSystemMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/1/SimpleSystemMetrics.yaml @@ -13,5 +13,6 @@ implementation: collectd samm2: o-incident-management|A|1 iso27001-2017: - 12.1.3 +title: Simple system metrics id: SimpleSystemMetrics ... diff --git a/data-new/InformationGathering/Monitoring/2/Alerting.yaml b/data-new/InformationGathering/Monitoring/2/Alerting.yaml index 0e1ed9144..979ab6ab1 100755 --- a/data-new/InformationGathering/Monitoring/2/Alerting.yaml +++ b/data-new/InformationGathering/Monitoring/2/Alerting.yaml @@ -15,5 +15,6 @@ iso27001-2017: - 16.1.2 - 16.1.4 - 12.1.4 +title: Alerting id: Alerting ... diff --git a/data-new/InformationGathering/Monitoring/2/VisualizedMetrics.yaml b/data-new/InformationGathering/Monitoring/2/VisualizedMetrics.yaml index 7822a42e3..ba02683ee 100755 --- a/data-new/InformationGathering/Monitoring/2/VisualizedMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/2/VisualizedMetrics.yaml @@ -12,5 +12,6 @@ dependsOn: samm2: o-incident-management|A|2 iso27001-2017: - 12.1.3 +title: Visualized metrics id: VisualizedMetrics ... diff --git a/data-new/InformationGathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml b/data-new/InformationGathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml index 62c59e8cf..11144bd32 100755 --- a/data-new/InformationGathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml @@ -13,5 +13,6 @@ dependsOn: samm2: o-incident-management|A|2 iso27001-2017: - 12.1.3 +title: Advanced availablity and stability metrics id: AdvancedAvailablityAndStabilityMetrics ... diff --git a/data-new/InformationGathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml b/data-new/InformationGathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml index b68a41f46..dd21ef3a6 100755 --- a/data-new/InformationGathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml @@ -13,5 +13,6 @@ dependsOn: samm2: o-incident-management|A|2 iso27001-2017: - 12.6.1 +title: Advanced webapplication metrics id: AdvancedWebapplicationMetrics ... diff --git a/data-new/InformationGathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml b/data-new/InformationGathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml index e44d466a4..fc4a3ffdd 100755 --- a/data-new/InformationGathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml @@ -12,5 +12,6 @@ samm2: o-incident-management|A|1 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 12.1.3 +title: Deactivation of unused metrics id: DeactivationOfUnusedMetrics ... diff --git a/data-new/InformationGathering/Monitoring/3/GroupingOfMetrics.yaml b/data-new/InformationGathering/Monitoring/3/GroupingOfMetrics.yaml index b22be00fd..c3415e33f 100755 --- a/data-new/InformationGathering/Monitoring/3/GroupingOfMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/3/GroupingOfMetrics.yaml @@ -10,5 +10,6 @@ samm2: o-incident-management|A|2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 12.1.3 +title: Grouping of metrics id: GroupingOfMetrics ... diff --git a/data-new/InformationGathering/Monitoring/3/TargetedAlerting.yaml b/data-new/InformationGathering/Monitoring/3/TargetedAlerting.yaml index 8e67bc5a9..4d886cde6 100755 --- a/data-new/InformationGathering/Monitoring/3/TargetedAlerting.yaml +++ b/data-new/InformationGathering/Monitoring/3/TargetedAlerting.yaml @@ -15,5 +15,6 @@ samm2: o-operational-management|B|3 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 16.1.5 +title: Targeted alerting id: TargetedAlerting ... diff --git a/data-new/InformationGathering/Monitoring/4/CoverageAndControlMetrics.yaml b/data-new/InformationGathering/Monitoring/4/CoverageAndControlMetrics.yaml index 30c8b766c..f302704f0 100755 --- a/data-new/InformationGathering/Monitoring/4/CoverageAndControlMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/4/CoverageAndControlMetrics.yaml @@ -17,5 +17,6 @@ implementation: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20F samm2: o-incident-management|A|2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific +title: Coverage and control metrics id: CoverageAndControlMetrics ... diff --git a/data-new/InformationGathering/Monitoring/4/DefenceMetrics.yaml b/data-new/InformationGathering/Monitoring/4/DefenceMetrics.yaml index 025357c58..9a7dbf9ee 100755 --- a/data-new/InformationGathering/Monitoring/4/DefenceMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/4/DefenceMetrics.yaml @@ -16,5 +16,6 @@ samm2: o-incident-management|A|2 iso27001-2017: - 12.4.1 - 13.1.1 +title: Defence metrics id: DefenceMetrics ... diff --git a/data-new/InformationGathering/Monitoring/4/MetricsAreCombinedWithTests.yaml b/data-new/InformationGathering/Monitoring/4/MetricsAreCombinedWithTests.yaml index 0914f486c..be3f1b578 100755 --- a/data-new/InformationGathering/Monitoring/4/MetricsAreCombinedWithTests.yaml +++ b/data-new/InformationGathering/Monitoring/4/MetricsAreCombinedWithTests.yaml @@ -11,5 +11,6 @@ dependsOn: samm2: o-incident-management|A|2 iso27001-2017: - not explicitly covered by ISO 27001 +title: Metrics are combined with tests id: MetricsAreCombinedWithTests ... diff --git a/data-new/InformationGathering/Monitoring/4/ScreensWithMetricVisualization.yaml b/data-new/InformationGathering/Monitoring/4/ScreensWithMetricVisualization.yaml index 88ff96a53..1b460f6ec 100755 --- a/data-new/InformationGathering/Monitoring/4/ScreensWithMetricVisualization.yaml +++ b/data-new/InformationGathering/Monitoring/4/ScreensWithMetricVisualization.yaml @@ -13,5 +13,6 @@ samm2: o-incident-management|A|2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 16.1.5 +title: Screens with metric visualization id: ScreensWithMetricVisualization ... diff --git a/data-new/TestAndVerification/ApplicationTests/2/SecurityUnitTestsForImportantComponents.yaml b/data-new/TestAndVerification/ApplicationTests/2/SecurityUnitTestsForImportantComponents.yaml index 29dbbc7ac..db0f20f4b 100755 --- a/data-new/TestAndVerification/ApplicationTests/2/SecurityUnitTestsForImportantComponents.yaml +++ b/data-new/TestAndVerification/ApplicationTests/2/SecurityUnitTestsForImportantComponents.yaml @@ -17,5 +17,6 @@ samm2: v-security-testing|B|3 iso27001-2017: - 14.2.3 - 14.2.8 +title: Security unit tests for important components id: SecurityUnitTestsForImportantComponents ... diff --git a/data-new/TestAndVerification/ApplicationTests/3/SecurityIntegrationTestsForImportantComponents.yaml b/data-new/TestAndVerification/ApplicationTests/3/SecurityIntegrationTestsForImportantComponents.yaml index 7b8eb114e..8946420ea 100755 --- a/data-new/TestAndVerification/ApplicationTests/3/SecurityIntegrationTestsForImportantComponents.yaml +++ b/data-new/TestAndVerification/ApplicationTests/3/SecurityIntegrationTestsForImportantComponents.yaml @@ -13,5 +13,6 @@ samm2: v-security-testing|B|3 iso27001-2017: - 14.2.3 - 14.2.8 +title: Security integration tests for important components id: SecurityIntegrationTestsForImportantComponents ... diff --git a/data-new/TestAndVerification/ApplicationTests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml b/data-new/TestAndVerification/ApplicationTests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml index 7e3a7495f..b69b839e3 100755 --- a/data-new/TestAndVerification/ApplicationTests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml +++ b/data-new/TestAndVerification/ApplicationTests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml @@ -13,5 +13,6 @@ samm2: v-security-testing|B|3 iso27001-2017: - 14.2.3 - 14.2.8 +title: High coverage of security related module and integration tests id: HighCoverageOfSecurityRelatedModuleAndIntegrationTests ... diff --git a/data-new/TestAndVerification/ApplicationTests/4/SmokeTest.yaml b/data-new/TestAndVerification/ApplicationTests/4/SmokeTest.yaml index b26571d46..a9c0b1e27 100755 --- a/data-new/TestAndVerification/ApplicationTests/4/SmokeTest.yaml +++ b/data-new/TestAndVerification/ApplicationTests/4/SmokeTest.yaml @@ -16,5 +16,6 @@ samm2: v-security-testing|B|3 iso27001-2017: - 14.2.3 - 14.2.8 +title: Smoke Test id: SmokeTest ... diff --git a/data-new/TestAndVerification/Consolidation/1/DefinitionOfQualityGates.yaml b/data-new/TestAndVerification/Consolidation/1/DefinitionOfQualityGates.yaml index 616040166..e5d526026 100755 --- a/data-new/TestAndVerification/Consolidation/1/DefinitionOfQualityGates.yaml +++ b/data-new/TestAndVerification/Consolidation/1/DefinitionOfQualityGates.yaml @@ -15,5 +15,6 @@ iso27001-2017: - 12.6.1 - 16.1.4 implementation: See other actions, e.g. "Treatment of defects with severity high". +title: Definition of quality gates id: DefinitionOfQualityGates ... diff --git a/data-new/TestAndVerification/Consolidation/1/SimpleFalsePositiveTreatment.yaml b/data-new/TestAndVerification/Consolidation/1/SimpleFalsePositiveTreatment.yaml index 7be7972f3..3cbc69cdb 100755 --- a/data-new/TestAndVerification/Consolidation/1/SimpleFalsePositiveTreatment.yaml +++ b/data-new/TestAndVerification/Consolidation/1/SimpleFalsePositiveTreatment.yaml @@ -16,5 +16,6 @@ samm2: i-defect-management|A|2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 16.1.6 +title: Simple false positive treatment id: SimpleFalsePositiveTreatment ... diff --git a/data-new/TestAndVerification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml b/data-new/TestAndVerification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml index b24b37493..765ca7bfc 100755 --- a/data-new/TestAndVerification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml +++ b/data-new/TestAndVerification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml @@ -11,5 +11,6 @@ samm2: i-defect-management|B|2 iso27001-2017: - 16.1.4 - 12.6.1 +title: Treatment of defects with severity high or higher id: TreatmentOfDefectsWithSeverityHighOrHigher ... diff --git a/data-new/TestAndVerification/Consolidation/2/SimpleVisualizationOfDefects.yaml b/data-new/TestAndVerification/Consolidation/2/SimpleVisualizationOfDefects.yaml index 18d95b617..151366a64 100755 --- a/data-new/TestAndVerification/Consolidation/2/SimpleVisualizationOfDefects.yaml +++ b/data-new/TestAndVerification/Consolidation/2/SimpleVisualizationOfDefects.yaml @@ -18,5 +18,6 @@ iso27001-2017: - 8.2.1 - 8.2.2 - 8.2.3 +title: Simple visualization of defects id: SimpleVisualizationOfDefects ... diff --git a/data-new/TestAndVerification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml b/data-new/TestAndVerification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml index 518c40a93..3c5850d8a 100755 --- a/data-new/TestAndVerification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml +++ b/data-new/TestAndVerification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml @@ -18,5 +18,6 @@ iso27001-2017: - 16.1.4 - 16.1.5 - 16.1.6 +title: Integration of vulnerability issues into the development process id: IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess ... diff --git a/data-new/TestAndVerification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml b/data-new/TestAndVerification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml index 78fc91137..9485ec743 100755 --- a/data-new/TestAndVerification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml +++ b/data-new/TestAndVerification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml @@ -11,5 +11,6 @@ samm2: i-defect-management|B|2 iso27001-2017: - 16.1.4 - 12.6.1 +title: Treatment of defects with severity middle id: TreatmentOfDefectsWithSeverityMiddle ... diff --git a/data-new/TestAndVerification/Consolidation/4/AdvancedVisualizationOfDefects.yaml b/data-new/TestAndVerification/Consolidation/4/AdvancedVisualizationOfDefects.yaml index d4a70739a..af61c93f6 100755 --- a/data-new/TestAndVerification/Consolidation/4/AdvancedVisualizationOfDefects.yaml +++ b/data-new/TestAndVerification/Consolidation/4/AdvancedVisualizationOfDefects.yaml @@ -16,5 +16,6 @@ iso27001-2017: - 8.2.1 - 8.2.2 - 8.2.3 +title: Advanced visualization of defects id: AdvancedVisualizationOfDefects ... diff --git a/data-new/TestAndVerification/Consolidation/4/ReproducibleDefectTickets.yaml b/data-new/TestAndVerification/Consolidation/4/ReproducibleDefectTickets.yaml index fd203ffe3..99f23d3ae 100755 --- a/data-new/TestAndVerification/Consolidation/4/ReproducibleDefectTickets.yaml +++ b/data-new/TestAndVerification/Consolidation/4/ReproducibleDefectTickets.yaml @@ -16,5 +16,6 @@ iso27001-2017: - 8.2.1 - 8.2.2 - 8.2.3 +title: Reproducible defect tickets id: ReproducibleDefectTickets ... diff --git a/data-new/TestAndVerification/Consolidation/4/TreatmentOfAllDefects.yaml b/data-new/TestAndVerification/Consolidation/4/TreatmentOfAllDefects.yaml index 406f1e635..bf4ce825b 100755 --- a/data-new/TestAndVerification/Consolidation/4/TreatmentOfAllDefects.yaml +++ b/data-new/TestAndVerification/Consolidation/4/TreatmentOfAllDefects.yaml @@ -10,5 +10,6 @@ samm2: i-defect-management|B|2 iso27001-2017: - 16.1.4 - 12.6.1 +title: Treatment of all defects id: TreatmentOfAllDefects ... diff --git a/data-new/TestAndVerification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml b/data-new/TestAndVerification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml index 3b2065090..d2916bae0 100755 --- a/data-new/TestAndVerification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml +++ b/data-new/TestAndVerification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml @@ -18,5 +18,6 @@ iso27001-2017: - 16.1.4 - 16.1.5 - 16.1.6 +title: Usage of a vulnerability management system id: UsageOfAVulnerabilityManagementSystem ... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/1/SimpleScan.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/1/SimpleScan.yaml index b53c8b048..cf2bd4649 100755 --- a/data-new/TestAndVerification/DynamicDepthForApplications/1/SimpleScan.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/1/SimpleScan.yaml @@ -19,5 +19,6 @@ samm2: v-security-testing|A|1 iso27001-2017: - 14.2.3 - 14.2.8 +title: Simple Scan id: SimpleScan ... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/2/CoverageOfClientSideDynamicComponents.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/2/CoverageOfClientSideDynamicComponents.yaml index 67efffa5b..da525be90 100755 --- a/data-new/TestAndVerification/DynamicDepthForApplications/2/CoverageOfClientSideDynamicComponents.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/2/CoverageOfClientSideDynamicComponents.yaml @@ -16,5 +16,6 @@ iso27001-2017: - 14.2.3 - 14.2.8 implementation: Ajax Spider +title: Coverage of client side dynamic components id: CoverageOfClientSideDynamicComponents ... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/2/UsageOfDifferentRoles.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/2/UsageOfDifferentRoles.yaml index c8ce5ff36..94ed3cfe3 100755 --- a/data-new/TestAndVerification/DynamicDepthForApplications/2/UsageOfDifferentRoles.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/2/UsageOfDifferentRoles.yaml @@ -14,5 +14,6 @@ iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 14.2.3 - 14.2.8 +title: Usage of different roles id: UsageOfDifferentRoles ... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfHiddenEndpoints.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfHiddenEndpoints.yaml index 72ffc7c95..80eaf859d 100755 --- a/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfHiddenEndpoints.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfHiddenEndpoints.yaml @@ -12,5 +12,6 @@ dependsOn: samm2: v-security-testing|A|2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific +title: Coverage of hidden endpoints id: CoverageOfHiddenEndpoints ... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfMoreInputVectors.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfMoreInputVectors.yaml index 9fd71cd3e..5e44a87d6 100755 --- a/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfMoreInputVectors.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfMoreInputVectors.yaml @@ -14,5 +14,6 @@ dependsOn: samm2: v-security-testing|A|2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific +title: Coverage of more input vectors id: CoverageOfMoreInputVectors ... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfSequentialOperations.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfSequentialOperations.yaml index d3f2a6728..1b94d5098 100755 --- a/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfSequentialOperations.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfSequentialOperations.yaml @@ -14,5 +14,6 @@ samm2: v-security-testing|A|2 iso27001-2017: - 14.2.8 - 14.2.3 +title: Coverage of sequential operations id: CoverageOfSequentialOperations ... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/3/UsageOfMultipleScanners.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/3/UsageOfMultipleScanners.yaml index 8e726b889..0c7e95ce5 100755 --- a/data-new/TestAndVerification/DynamicDepthForApplications/3/UsageOfMultipleScanners.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/3/UsageOfMultipleScanners.yaml @@ -14,5 +14,6 @@ samm2: v-security-testing|A|2 iso27001-2017: - 12.6.1 - 14.2.5 +title: Usage of multiple scanners id: UsageOfMultipleScanners ... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageAnalysis.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageAnalysis.yaml index 57b78be3e..541bac0b2 100755 --- a/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageAnalysis.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageAnalysis.yaml @@ -11,5 +11,6 @@ samm2: v-security-testing|A|2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - part of periodic review, PDCA +title: Coverage analysis id: CoverageAnalysis ... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageOfServiceToServiceCommunication.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageOfServiceToServiceCommunication.yaml index b0581e88d..b00ea9309 100755 --- a/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageOfServiceToServiceCommunication.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageOfServiceToServiceCommunication.yaml @@ -12,5 +12,6 @@ samm2: v-security-testing|A|2 iso27001-2017: - 14.2.3 - 14.2.8 +title: Coverage of service to service communication id: CoverageOfServiceToServiceCommunication ... diff --git a/data-new/TestAndVerification/DynamicDepthForInfrastructure/1/TestForExposedServices.yaml b/data-new/TestAndVerification/DynamicDepthForInfrastructure/1/TestForExposedServices.yaml index a3514e419..4a9db1b0c 100755 --- a/data-new/TestAndVerification/DynamicDepthForInfrastructure/1/TestForExposedServices.yaml +++ b/data-new/TestAndVerification/DynamicDepthForInfrastructure/1/TestForExposedServices.yaml @@ -18,5 +18,6 @@ iso27001-2017: - 13.1.3 - 14.2.3 - 14.2.8 +title: Test for exposed services id: TestForExposedServices ... diff --git a/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestNetworkSegmentation.yaml b/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestNetworkSegmentation.yaml index 8d2ac92b6..f0ea2858c 100755 --- a/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestNetworkSegmentation.yaml +++ b/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestNetworkSegmentation.yaml @@ -15,5 +15,6 @@ iso27001-2017: - 13.1.3 - 14.2.3 - 14.2.8 +title: Test network segmentation id: TestNetworkSegmentation ... diff --git a/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml b/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml index 8b9febe0e..067305eba 100755 --- a/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml +++ b/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml @@ -16,5 +16,6 @@ iso27001-2017: - 12.6.1 - 14.2.3 - 14.2.8 +title: Test of the configuration of cloud environments id: TestOfTheConfigurationOfCloudEnvironments ... diff --git a/data-new/TestAndVerification/DynamicDepthForInfrastructure/3/WeakPasswordTest.yaml b/data-new/TestAndVerification/DynamicDepthForInfrastructure/3/WeakPasswordTest.yaml index ed16c0f60..9feb0edf5 100755 --- a/data-new/TestAndVerification/DynamicDepthForInfrastructure/3/WeakPasswordTest.yaml +++ b/data-new/TestAndVerification/DynamicDepthForInfrastructure/3/WeakPasswordTest.yaml @@ -12,5 +12,6 @@ implementation: HTC Hydra samm2: v-security-testing|A|2 iso27001-2017: - 9.4.3 +title: Weak password test id: WeakPasswordTest ... diff --git a/data-new/TestAndVerification/DynamicDepthForInfrastructure/4/LoadTests.yaml b/data-new/TestAndVerification/DynamicDepthForInfrastructure/4/LoadTests.yaml index 6564755cb..4e1128c7c 100755 --- a/data-new/TestAndVerification/DynamicDepthForInfrastructure/4/LoadTests.yaml +++ b/data-new/TestAndVerification/DynamicDepthForInfrastructure/4/LoadTests.yaml @@ -12,5 +12,6 @@ iso27001-2017: - 12.1.3 - 14.2.3 - 14.2.8 +title: Load tests id: LoadTests ... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml b/data-new/TestAndVerification/StaticDepthForApplications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml index 5d68e2315..07ee1d3ef 100755 --- a/data-new/TestAndVerification/StaticDepthForApplications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml @@ -14,5 +14,6 @@ samm: SA samm2: v-security-testing|A|2 iso27001-2017: - 12.6.1 +title: Test of server side components with known vulnerabilities id: TestOfServerSideComponentsWithKnownVulnerabilities ... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/2/StaticAnalysisForImportantServerSideComponents.yaml b/data-new/TestAndVerification/StaticDepthForApplications/2/StaticAnalysisForImportantServerSideComponents.yaml index 2adc62e20..7ed490ab2 100755 --- a/data-new/TestAndVerification/StaticDepthForApplications/2/StaticAnalysisForImportantServerSideComponents.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/2/StaticAnalysisForImportantServerSideComponents.yaml @@ -14,5 +14,6 @@ dependsOn: samm2: v-security-testing|A|2 iso27001-2017: - 12.6.1 +title: Static analysis for important server side components id: StaticAnalysisForImportantServerSideComponents ... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/3/StaticAnalysisForImportantClientSideComponents.yaml b/data-new/TestAndVerification/StaticDepthForApplications/3/StaticAnalysisForImportantClientSideComponents.yaml index d6c4a89e1..2f2f7e5a0 100755 --- a/data-new/TestAndVerification/StaticDepthForApplications/3/StaticAnalysisForImportantClientSideComponents.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/3/StaticAnalysisForImportantClientSideComponents.yaml @@ -17,5 +17,6 @@ iso27001-2017: - 12.6.1 dependsOn: - Defined build process +title: Static analysis for important client side components id: StaticAnalysisForImportantClientSideComponents ... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml b/data-new/TestAndVerification/StaticDepthForApplications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml index 43a565cbd..45fea1028 100755 --- a/data-new/TestAndVerification/StaticDepthForApplications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml @@ -14,5 +14,6 @@ implementation: samm2: v-security-testing|A|2 iso27001-2017: - 12.6.1 +title: Test of client side components with known vulnerabilities id: TestOfClientSideComponentsWithKnownVulnerabilities ... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/4/ExclusionOfSourceCodeDuplicates.yaml b/data-new/TestAndVerification/StaticDepthForApplications/4/ExclusionOfSourceCodeDuplicates.yaml index 569efbfff..5889f78ce 100755 --- a/data-new/TestAndVerification/StaticDepthForApplications/4/ExclusionOfSourceCodeDuplicates.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/4/ExclusionOfSourceCodeDuplicates.yaml @@ -14,5 +14,6 @@ iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 14.2.1 - 14.2.5 +title: Exclusion of source code duplicates id: ExclusionOfSourceCodeDuplicates ... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllComponentsOrlibraries.yaml b/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllComponentsOrlibraries.yaml index 7565424f6..ef123ee17 100755 --- a/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllComponentsOrlibraries.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllComponentsOrlibraries.yaml @@ -12,5 +12,6 @@ dependsOn: samm2: v-security-testing|A|2 iso27001-2017: - 12.6.1 +title: Static analysis for all components/libraries id: StaticAnalysisForAllComponentsOrlibraries ... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllSelfWrittenComponents.yaml b/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllSelfWrittenComponents.yaml index de9060b56..5915ef37d 100755 --- a/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllSelfWrittenComponents.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllSelfWrittenComponents.yaml @@ -14,5 +14,6 @@ dependsOn: samm2: v-security-testing|A|2 iso27001-2017: - 12.6.1 +title: Static analysis for all self written components id: StaticAnalysisForAllSelfWrittenComponents ... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/4/StylisticAnalysis.yaml b/data-new/TestAndVerification/StaticDepthForApplications/4/StylisticAnalysis.yaml index 729e56823..9e1985cfa 100755 --- a/data-new/TestAndVerification/StaticDepthForApplications/4/StylisticAnalysis.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/4/StylisticAnalysis.yaml @@ -13,5 +13,6 @@ iso27001-2017: - 12.6.1 - 14.2.1 - 14.2.5 +title: Stylistic analysis id: StylisticAnalysis ... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/4/UsageOfMultipleAnalysers.yaml b/data-new/TestAndVerification/StaticDepthForApplications/4/UsageOfMultipleAnalysers.yaml index f0402e48b..ff4c0bc71 100755 --- a/data-new/TestAndVerification/StaticDepthForApplications/4/UsageOfMultipleAnalysers.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/4/UsageOfMultipleAnalysers.yaml @@ -16,5 +16,6 @@ dependsOn: - Test of server side components with known vulnerabilities - Test of client side components with known vulnerabilities - Static analysis for all self written components +title: Usage of multiple analysers id: UsageOfMultipleAnalysers ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/1/StoredSecrets.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/1/StoredSecrets.yaml index 6a9ccb8da..8f4354021 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/1/StoredSecrets.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/1/StoredSecrets.yaml @@ -15,5 +15,6 @@ iso27001-2017: - vcs usage is not explicitly covered by ISO 27001 - too specific - 9.4.3 - 10.1.2 +title: Stored Secrets id: StoredSecrets ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestClusterDeploymentResources.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestClusterDeploymentResources.yaml index 38ca47513..320455d0e 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestClusterDeploymentResources.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestClusterDeploymentResources.yaml @@ -16,5 +16,6 @@ iso27001-2017: - 12.6.1 - 14.2.3 - 14.2.8 +title: Test cluster deployment resources id: TestClusterDeploymentResources ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestOfVirtualizedEnvironments.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestOfVirtualizedEnvironments.yaml index 68a59914c..d3516201f 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestOfVirtualizedEnvironments.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestOfVirtualizedEnvironments.yaml @@ -11,5 +11,6 @@ implementation: - Dive to inspect a container images - Cluster Scanner (will be open sourced soon) to check different aspects samm2: v-security-testing|A|1 +title: Test of virtualized environments id: TestOfVirtualizedEnvironments ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheClouldConfiguration.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheClouldConfiguration.yaml index 702e7175f..32828d37a 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheClouldConfiguration.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheClouldConfiguration.yaml @@ -16,5 +16,6 @@ iso27001-2017: - 12.6.1 - 14.2.3 - 14.2.8 +title: Test the clould configuration id: TestTheClouldConfiguration ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml index 0ca73a5e9..2d3a5441b 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml @@ -18,5 +18,6 @@ iso27001-2017: - 14.2.3 - 14.2.8 - 14.2.1 +title: Test the definition of virtualized environments id: TestTheDefinitionOfVirtualizedEnvironments ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForImageLifetime.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForImageLifetime.yaml index 29b512da1..0fc846f25 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForImageLifetime.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForImageLifetime.yaml @@ -12,5 +12,6 @@ samm2: v-security-testing|A|1 iso27001-2017: - 12.6.1 - 14.2.5 +title: Check for image lifetime id: CheckForImageLifetime ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForMalware.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForMalware.yaml index 470c832c5..cd03bb842 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForMalware.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForMalware.yaml @@ -13,5 +13,6 @@ implementation: ~ samm2: v-security-testing|A|2 iso27001-2017: - 12.2.1 +title: Check for malware id: CheckForMalware ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForNewImageVersion.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForNewImageVersion.yaml index d8333fa30..40e8f1598 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForNewImageVersion.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForNewImageVersion.yaml @@ -12,5 +12,6 @@ iso27001-2017: - 12.6.1 - 14.2.5 - 12.2.1 +title: Check for new image version id: CheckForNewImageVersion ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CheckForKnownVulnerabilities.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CheckForKnownVulnerabilities.yaml index 89b7a4a41..1f29ece4e 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CheckForKnownVulnerabilities.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CheckForKnownVulnerabilities.yaml @@ -14,5 +14,6 @@ implementation: samm2: v-security-testing|A|2 iso27001-2017: - 12.6.1 +title: Check for known vulnerabilities id: CheckForKnownVulnerabilities ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml index 76e2dd999..7d7329d45 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml @@ -17,5 +17,6 @@ samm2: v-security-testing|A|1 iso27001-2017: - 12.6.1 - 14.2.1 +title: Correlate known vulnerabilities in infrastructure with new image versions id: CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml index 583f1d792..090f6c298 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml @@ -20,5 +20,6 @@ samm2: v-security-testing|A|1 iso27001-2017: - 12.6.1 - 14.2.1 +title: Test of infrastructure components for known vulnerabilities id: TestOfInfrastructureComponentsForKnownVulnerabilities ... diff --git a/data-new/TestAndVerification/Test-Intensity/1/DefaultSettingsForIntensity.yaml b/data-new/TestAndVerification/Test-Intensity/1/DefaultSettingsForIntensity.yaml index 6487e415a..3dc132d11 100755 --- a/data-new/TestAndVerification/Test-Intensity/1/DefaultSettingsForIntensity.yaml +++ b/data-new/TestAndVerification/Test-Intensity/1/DefaultSettingsForIntensity.yaml @@ -11,5 +11,6 @@ iso27001-2017: - 12.6.1 - 14.2.1 - 14.2.5 +title: Default settings for intensity id: DefaultSettingsForIntensity ... diff --git a/data-new/TestAndVerification/Test-Intensity/1/HighTestIntensity.yaml b/data-new/TestAndVerification/Test-Intensity/1/HighTestIntensity.yaml index 453f2e45f..278b96a37 100755 --- a/data-new/TestAndVerification/Test-Intensity/1/HighTestIntensity.yaml +++ b/data-new/TestAndVerification/Test-Intensity/1/HighTestIntensity.yaml @@ -11,5 +11,6 @@ iso27001-2017: - 12.6.1 - 14.2.1 - 14.2.5 +title: High test intensity id: HighTestIntensity ... diff --git a/data-new/TestAndVerification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml b/data-new/TestAndVerification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml index 879bf4a2b..c2b1398f8 100755 --- a/data-new/TestAndVerification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml +++ b/data-new/TestAndVerification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml @@ -15,5 +15,6 @@ iso27001-2017: - 12.6.1 - 14.2.1 - 14.2.5 +title: Deactivating of unneeded tests id: DeactivatingOfUnneededTests ... diff --git a/data-new/TestAndVerification/Test-Intensity/2/RegularTests.yaml b/data-new/TestAndVerification/Test-Intensity/2/RegularTests.yaml index d46c427a6..a24f9be39 100755 --- a/data-new/TestAndVerification/Test-Intensity/2/RegularTests.yaml +++ b/data-new/TestAndVerification/Test-Intensity/2/RegularTests.yaml @@ -13,5 +13,6 @@ iso27001-2017: - 14.2.3 - 14.2.8 - 14.2.9 +title: Regular tests id: RegularTests ... diff --git a/data-new/TestAndVerification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml b/data-new/TestAndVerification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml index f986f9492..a196b2fdb 100755 --- a/data-new/TestAndVerification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml +++ b/data-new/TestAndVerification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml @@ -16,5 +16,6 @@ iso27001-2017: - 14.2.1 - 14.2.5 - 12.6.1 +title: Creation and application of a testing concept id: CreationAndApplicationOfATestingConcept ... diff --git a/newFolder-Migration-2021.php b/newFolder-Migration-2021.php index 860e915b6..3a2fbc296 100644 --- a/newFolder-Migration-2021.php +++ b/newFolder-Migration-2021.php @@ -33,6 +33,7 @@ function readYaml($file) unset($element['level']); // level from folder $idWithSpace=mb_convert_case($elementName, MB_CASE_TITLE); $idSanitized = str_replace("/", "Or", $idWithSpace); + $element['title'] = $elementName; $id = str_replace(" ", "", $idSanitized); $filePath = $folder . $id . ".yaml"; $element['id'] = $id; From 9a84a8b2411f7fc3f0e747dc5799b6b03e255f12 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 9 Feb 2021 21:06:44 +0100 Subject: [PATCH 4/6] add id/title to the top and not on the bottom --- .../PatchManagement/1/APatchPolicyIsDefined.yaml | 4 ++-- newFolder-Migration-2021.php | 3 ++- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/data-new/BuildAndDeployment/PatchManagement/1/APatchPolicyIsDefined.yaml b/data-new/BuildAndDeployment/PatchManagement/1/APatchPolicyIsDefined.yaml index 5f46d12e8..2088be7c5 100755 --- a/data-new/BuildAndDeployment/PatchManagement/1/APatchPolicyIsDefined.yaml +++ b/data-new/BuildAndDeployment/PatchManagement/1/APatchPolicyIsDefined.yaml @@ -1,4 +1,6 @@ --- +title: A patch policy is defined +id: APatchPolicyIsDefined risk: Vulnerabilities in running containers stay for long and might get exploited. measure: A patch policy for all artifacts (e.g. in images) is defined. How often is an image rebuilt? @@ -12,6 +14,4 @@ iso27001-2017: - 12.6.1 - 12.5.1 - 14.2.5 -title: A patch policy is defined -id: APatchPolicyIsDefined ... diff --git a/newFolder-Migration-2021.php b/newFolder-Migration-2021.php index 3a2fbc296..ee9fcb865 100644 --- a/newFolder-Migration-2021.php +++ b/newFolder-Migration-2021.php @@ -33,9 +33,10 @@ function readYaml($file) unset($element['level']); // level from folder $idWithSpace=mb_convert_case($elementName, MB_CASE_TITLE); $idSanitized = str_replace("/", "Or", $idWithSpace); - $element['title'] = $elementName; + $id = str_replace(" ", "", $idSanitized); $filePath = $folder . $id . ".yaml"; + $element = array('id' => $id) + array('title' => $elementName) + $element; // Add properties to the top $element['id'] = $id; $yamlContent = yaml_emit ( $element ); From 2a6eba9ece31d509c33253eca0a1b0f20aebac74 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 9 Feb 2021 21:06:57 +0100 Subject: [PATCH 5/6] add id/title to the top and not on the bottom --- data-new/BuildAndDeployment/Build/1/DefinedBuildProcess.yaml | 4 ++-- .../2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml | 4 ++-- data-new/BuildAndDeployment/Build/3/SigningOfArtifacts.yaml | 4 ++-- data-new/BuildAndDeployment/Build/3/SigningOfCode.yaml | 4 ++-- .../Deployment/1/DefinedDeploymentProcess.yaml | 4 ++-- .../Deployment/2/BackupBeforeDeployment.yaml | 4 ++-- .../2/EnvironmentDependingConfigurationParameters.yaml | 4 ++-- .../BuildAndDeployment/Deployment/2/UsageOfTrustedImages.yaml | 4 ++-- .../Deployment/3/HandoverOfConfidentialParameters.yaml | 4 ++-- .../Deployment/3/InventoryOfRunningArtifacts.yaml | 4 ++-- .../Deployment/3/RollingUpdateOnDeployment.yaml | 4 ++-- .../Deployment/3/SameArtifactForEnvironments.yaml | 4 ++-- .../Deployment/3/UsageOfFeatureToggles.yaml | 4 ++-- .../Deployment/4/BlueOrgreenDeployment.yaml | 4 ++-- .../PatchManagement/1/APatchPolicyIsDefined.yaml | 2 +- .../PatchManagement/1/AutomatedPrsForPatches.yaml | 4 ++-- .../PatchManagement/2/NightlyBuildOfImages.yaml | 4 ++-- .../PatchManagement/2/ReductionOfTheAttackSurface.yaml | 4 ++-- .../PatchManagement/2/UsageOfAMaximumLifetimeForImages.yaml | 4 ++-- .../4/UsageOfAShortMaximumLifetimeForImages.yaml | 4 ++-- .../Design/0/InformationSecurityTargetsAreCommunicated.yaml | 4 ++-- .../1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml | 4 ++-- .../2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml | 4 ++-- .../Design/2/CreationOfSimpleAbuseStories.yaml | 4 ++-- .../Design/3/ConductionOfAdvancedThreatModelling.yaml | 4 ++-- .../Design/4/CreationOfAdvancedAbuseStories.yaml | 4 ++-- .../1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml | 4 ++-- .../EducationAndGuidance/1/SecurityConsultingOnRequest.yaml | 4 ++-- .../EducationAndGuidance/2/EachTeamHasASecurityChampion.yaml | 4 ++-- .../EducationAndGuidance/2/RegularSecurityTrainingForAll.yaml | 4 ++-- .../2/RegularSecurityTrainingOfSecurityChampions.yaml | 4 ++-- .../EducationAndGuidance/2/RewardOfGoodCommunication.yaml | 4 ++-- .../3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml | 4 ++-- ...veSecurityChecksWithDevelopersAndSystemAdministrators.yaml | 4 ++-- .../3/RegularSecurityTrainingForEveryone.yaml | 4 ++-- .../EducationAndGuidance/3/Security-Lessoned-Learned.yaml | 4 ++-- .../EducationAndGuidance/4/AligningSecurityInTeams.yaml | 4 ++-- .../4/ConductionOfCollaborativeTeamSecurityChecks.yaml | 4 ++-- .../EducationAndGuidance/4/ConductionOfWarGames.yaml | 4 ++-- .../DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml | 4 ++-- .../Process/3/ApprovalByReviewingAnyNewVersion.yaml | 4 ++-- .../Process/3/DefinitionOfAChangeManagementProcess.yaml | 4 ++-- .../Process/3/PreventionOfUnauthorizedInstallation.yaml | 4 ++-- .../ApplicationHardening/1/ApplicationHardeningLevel1.yaml | 4 ++-- .../ApplicationHardening/2/App.HardeningLevel2.yaml | 4 ++-- .../ApplicationHardening/3/App.HardeningLevel3.yaml | 4 ++-- .../4/FullCoverageOfApp.HardeningLevel3.yaml | 4 ++-- .../1/IsolatedNetworksForVirtualEnvironments.yaml | 4 ++-- .../1/SimpleAccessControlForSystems.yaml | 4 ++-- .../1/UsageOfTestAndProductionEnvironments.yaml | 4 ++-- .../2/ApplicationsAreRunningInVirtualizedEnvironments.yaml | 4 ++-- .../2/CheckingTheSourcesOfUsedLibraries.yaml | 4 ++-- .../InfrastructureHardening/2/FilterOutgoingTraffic.yaml | 4 ++-- .../InfrastructureHardening/2/TheClusterIsHardened.yaml | 4 ++-- .../2/UsageOfSecurityByDefaultForComponents.yaml | 4 ++-- .../2/VirtualEnvironmentsAreLimited.yaml | 4 ++-- data-new/Implementation/InfrastructureHardening/3/2Fa.yaml | 4 ++-- .../InfrastructureHardening/3/ImmutableInfrastructure.yaml | 4 ++-- .../InfrastructureHardening/3/InfrastructureAsCode.yaml | 4 ++-- .../3/RoleBasedAuthenticationAndAuthorization.yaml | 4 ++-- .../Implementation/InfrastructureHardening/3/Versioning.yaml | 4 ++-- .../4/LimitationOfSystemCallsInVirtualEnvironments.yaml | 4 ++-- .../InfrastructureHardening/4/Microservice-Architecture.yaml | 4 ++-- .../4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml | 4 ++-- .../InfrastructureHardening/4/UsageOfAChaosMonkey.yaml | 4 ++-- .../Logging/1/CentralizedSystemLogging.yaml | 4 ++-- .../Logging/1/LoggingOfSecurityEvents.yaml | 4 ++-- .../InformationGathering/Logging/1/PiiLoggingConcept.yaml | 4 ++-- .../InformationGathering/Logging/2/VisualizedLogging.yaml | 4 ++-- .../Logging/3/CentralizedApplicationLogging.yaml | 4 ++-- .../Logging/4/CorrelationOfSecurityEvents.yaml | 4 ++-- .../Monitoring/1/SimpleApplicationMetrics.yaml | 4 ++-- .../Monitoring/1/SimpleSystemMetrics.yaml | 4 ++-- data-new/InformationGathering/Monitoring/2/Alerting.yaml | 4 ++-- .../InformationGathering/Monitoring/2/VisualizedMetrics.yaml | 4 ++-- .../Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml | 4 ++-- .../Monitoring/3/AdvancedWebapplicationMetrics.yaml | 4 ++-- .../Monitoring/3/DeactivationOfUnusedMetrics.yaml | 4 ++-- .../InformationGathering/Monitoring/3/GroupingOfMetrics.yaml | 4 ++-- .../InformationGathering/Monitoring/3/TargetedAlerting.yaml | 4 ++-- .../Monitoring/4/CoverageAndControlMetrics.yaml | 4 ++-- .../InformationGathering/Monitoring/4/DefenceMetrics.yaml | 4 ++-- .../Monitoring/4/MetricsAreCombinedWithTests.yaml | 4 ++-- .../Monitoring/4/ScreensWithMetricVisualization.yaml | 4 ++-- .../2/SecurityUnitTestsForImportantComponents.yaml | 4 ++-- .../3/SecurityIntegrationTestsForImportantComponents.yaml | 4 ++-- ...ighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml | 4 ++-- .../TestAndVerification/ApplicationTests/4/SmokeTest.yaml | 4 ++-- .../Consolidation/1/DefinitionOfQualityGates.yaml | 4 ++-- .../Consolidation/1/SimpleFalsePositiveTreatment.yaml | 4 ++-- .../1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml | 4 ++-- .../Consolidation/2/SimpleVisualizationOfDefects.yaml | 4 ++-- ...grationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml | 4 ++-- .../Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml | 4 ++-- .../Consolidation/4/AdvancedVisualizationOfDefects.yaml | 4 ++-- .../Consolidation/4/ReproducibleDefectTickets.yaml | 4 ++-- .../Consolidation/4/TreatmentOfAllDefects.yaml | 4 ++-- .../4/UsageOfAVulnerabilityManagementSystem.yaml | 4 ++-- .../DynamicDepthForApplications/1/SimpleScan.yaml | 4 ++-- .../2/CoverageOfClientSideDynamicComponents.yaml | 4 ++-- .../DynamicDepthForApplications/2/UsageOfDifferentRoles.yaml | 4 ++-- .../3/CoverageOfHiddenEndpoints.yaml | 4 ++-- .../3/CoverageOfMoreInputVectors.yaml | 4 ++-- .../3/CoverageOfSequentialOperations.yaml | 4 ++-- .../3/UsageOfMultipleScanners.yaml | 4 ++-- .../DynamicDepthForApplications/4/CoverageAnalysis.yaml | 4 ++-- .../4/CoverageOfServiceToServiceCommunication.yaml | 4 ++-- .../1/TestForExposedServices.yaml | 4 ++-- .../2/TestNetworkSegmentation.yaml | 4 ++-- .../2/TestOfTheConfigurationOfCloudEnvironments.yaml | 4 ++-- .../DynamicDepthForInfrastructure/3/WeakPasswordTest.yaml | 4 ++-- .../DynamicDepthForInfrastructure/4/LoadTests.yaml | 4 ++-- .../1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml | 4 ++-- .../2/StaticAnalysisForImportantServerSideComponents.yaml | 4 ++-- .../3/StaticAnalysisForImportantClientSideComponents.yaml | 4 ++-- .../3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml | 4 ++-- .../4/ExclusionOfSourceCodeDuplicates.yaml | 4 ++-- .../4/StaticAnalysisForAllComponentsOrlibraries.yaml | 4 ++-- .../4/StaticAnalysisForAllSelfWrittenComponents.yaml | 4 ++-- .../StaticDepthForApplications/4/StylisticAnalysis.yaml | 4 ++-- .../4/UsageOfMultipleAnalysers.yaml | 4 ++-- .../StaticDepthForInfrastructure/1/StoredSecrets.yaml | 4 ++-- .../2/TestClusterDeploymentResources.yaml | 4 ++-- .../2/TestOfVirtualizedEnvironments.yaml | 4 ++-- .../2/TestTheClouldConfiguration.yaml | 4 ++-- .../2/TestTheDefinitionOfVirtualizedEnvironments.yaml | 4 ++-- .../StaticDepthForInfrastructure/3/CheckForImageLifetime.yaml | 4 ++-- .../StaticDepthForInfrastructure/3/CheckForMalware.yaml | 4 ++-- .../3/CheckForNewImageVersion.yaml | 4 ++-- .../4/CheckForKnownVulnerabilities.yaml | 4 ++-- ...wnVulnerabilitiesInInfrastructureWithNewImageVersions.yaml | 4 ++-- ...TestOfInfrastructureComponentsForKnownVulnerabilities.yaml | 4 ++-- .../Test-Intensity/1/DefaultSettingsForIntensity.yaml | 4 ++-- .../Test-Intensity/1/HighTestIntensity.yaml | 4 ++-- .../Test-Intensity/2/DeactivatingOfUnneededTests.yaml | 4 ++-- .../TestAndVerification/Test-Intensity/2/RegularTests.yaml | 4 ++-- .../3/CreationAndApplicationOfATestingConcept.yaml | 4 ++-- 137 files changed, 273 insertions(+), 273 deletions(-) diff --git a/data-new/BuildAndDeployment/Build/1/DefinedBuildProcess.yaml b/data-new/BuildAndDeployment/Build/1/DefinedBuildProcess.yaml index b1bea77f9..3dac134a6 100755 --- a/data-new/BuildAndDeployment/Build/1/DefinedBuildProcess.yaml +++ b/data-new/BuildAndDeployment/Build/1/DefinedBuildProcess.yaml @@ -1,4 +1,6 @@ --- +id: DefinedBuildProcess +title: Defined build process risk: Performing builds without a defined process is error prone. For example, as a result of incorrect security related configuration. measure: A well defined build process lowers the possibility of errors during the @@ -18,6 +20,4 @@ samm2: i-secure-build|A|1 iso27001-2017: - 12.1.1 - 14.2.2 -title: Defined build process -id: DefinedBuildProcess ... diff --git a/data-new/BuildAndDeployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml b/data-new/BuildAndDeployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml index 8bbfa29e3..8939828da 100755 --- a/data-new/BuildAndDeployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml +++ b/data-new/BuildAndDeployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml @@ -1,4 +1,6 @@ --- +id: BuildingAndTestingOfArtifactsInVirtualEnvironments +title: Building and testing of artifacts in virtual environments risk: While building and testing artifacts, third party systems, application frameworks and 3rd party libraries are used. These might be malicious as a result of vulnerable libraries or because they are altered during the delivery phase. @@ -19,6 +21,4 @@ implementation: samm2: i-secure-build|A|2 iso27001-2017: - 14.2.6 -title: Building and testing of artifacts in virtual environments -id: BuildingAndTestingOfArtifactsInVirtualEnvironments ... diff --git a/data-new/BuildAndDeployment/Build/3/SigningOfArtifacts.yaml b/data-new/BuildAndDeployment/Build/3/SigningOfArtifacts.yaml index cff6c3ba9..2e4884636 100755 --- a/data-new/BuildAndDeployment/Build/3/SigningOfArtifacts.yaml +++ b/data-new/BuildAndDeployment/Build/3/SigningOfArtifacts.yaml @@ -1,4 +1,6 @@ --- +id: SigningOfArtifacts +title: Signing of artifacts risk: Unauthorized manipulation of artifacts might be difficult to spot. For example, this may result in images with malicious code in the Docker registry. measure: Digitally signing artifacts for all steps during the build and especially @@ -17,6 +19,4 @@ samm: OA3-B samm2: i-secure-build|A|1 iso27001-2017: - 14.2.6 -title: Signing of artifacts -id: SigningOfArtifacts ... diff --git a/data-new/BuildAndDeployment/Build/3/SigningOfCode.yaml b/data-new/BuildAndDeployment/Build/3/SigningOfCode.yaml index b55b00c98..8d606e2ca 100755 --- a/data-new/BuildAndDeployment/Build/3/SigningOfCode.yaml +++ b/data-new/BuildAndDeployment/Build/3/SigningOfCode.yaml @@ -1,4 +1,6 @@ --- +id: SigningOfCode +title: Signing of code risk: Unauthorized manipulation of source code might be difficult to spot. measure: Digitally signing commits helps to prevent unauthorized manipulation of source code. @@ -14,6 +16,4 @@ samm: OA3-B samm2: i-secure-build|A|2 iso27001-2017: - 14.2.6 -title: Signing of code -id: SigningOfCode ... diff --git a/data-new/BuildAndDeployment/Deployment/1/DefinedDeploymentProcess.yaml b/data-new/BuildAndDeployment/Deployment/1/DefinedDeploymentProcess.yaml index 133576324..01f077b74 100755 --- a/data-new/BuildAndDeployment/Deployment/1/DefinedDeploymentProcess.yaml +++ b/data-new/BuildAndDeployment/Deployment/1/DefinedDeploymentProcess.yaml @@ -1,4 +1,6 @@ --- +id: DefinedDeploymentProcess +title: Defined deployment process risk: Deployments without a defined process are error prone thus allowing old or untested artifact to be deployed. measure: A defined deployment process significantly lowers the likelihood of errors @@ -13,6 +15,4 @@ samm2: i-secure-deployment|A|1 iso27001-2017: - 12.1.1 - 14.2.2 -title: Defined deployment process -id: DefinedDeploymentProcess ... diff --git a/data-new/BuildAndDeployment/Deployment/2/BackupBeforeDeployment.yaml b/data-new/BuildAndDeployment/Deployment/2/BackupBeforeDeployment.yaml index 1245dbf68..ea965ed52 100755 --- a/data-new/BuildAndDeployment/Deployment/2/BackupBeforeDeployment.yaml +++ b/data-new/BuildAndDeployment/Deployment/2/BackupBeforeDeployment.yaml @@ -1,4 +1,6 @@ --- +id: BackupBeforeDeployment +title: Backup before deployment risk: If errors are experienced during the deployment process you want to deploy an old release. However, due to changes in the database this is often unfeasible. measure: Performing automated backups before deployment can help facilitate deployments @@ -17,6 +19,4 @@ samm2: TODO iso27001-2017: - "12.3" - 14.2.6 -title: Backup before deployment -id: BackupBeforeDeployment ... diff --git a/data-new/BuildAndDeployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml b/data-new/BuildAndDeployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml index dd1d12cbe..1213d5df9 100755 --- a/data-new/BuildAndDeployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml +++ b/data-new/BuildAndDeployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml @@ -1,4 +1,6 @@ --- +id: EnvironmentDependingConfigurationParameters +title: Environment depending configuration parameters risk: Attackers who compromise source code can see confidential access information like database credentials. measure: Configuration parameters are set for each environment not in the source code. @@ -13,6 +15,4 @@ samm2: i-secure-deployment|B|1 iso27001-2017: - 9.4.5 - 14.2.6 -title: Environment depending configuration parameters -id: EnvironmentDependingConfigurationParameters ... diff --git a/data-new/BuildAndDeployment/Deployment/2/UsageOfTrustedImages.yaml b/data-new/BuildAndDeployment/Deployment/2/UsageOfTrustedImages.yaml index a10c34138..129643d10 100755 --- a/data-new/BuildAndDeployment/Deployment/2/UsageOfTrustedImages.yaml +++ b/data-new/BuildAndDeployment/Deployment/2/UsageOfTrustedImages.yaml @@ -1,4 +1,6 @@ --- +id: UsageOfTrustedImages +title: Usage of trusted images risk: Developers or operations might start random images in the production cluster which have malicous code or known vulnerabilities. measure: Create image assessment criteria, perform an evaluation of images and create @@ -16,6 +18,4 @@ iso27001-2017: - 15.1.2 - 15.1.3 - 14.1.3 -title: Usage of trusted images -id: UsageOfTrustedImages ... diff --git a/data-new/BuildAndDeployment/Deployment/3/HandoverOfConfidentialParameters.yaml b/data-new/BuildAndDeployment/Deployment/3/HandoverOfConfidentialParameters.yaml index 24e4e7883..055c5b0f1 100755 --- a/data-new/BuildAndDeployment/Deployment/3/HandoverOfConfidentialParameters.yaml +++ b/data-new/BuildAndDeployment/Deployment/3/HandoverOfConfidentialParameters.yaml @@ -1,4 +1,6 @@ --- +id: HandoverOfConfidentialParameters +title: Handover of confidential parameters risk: Attackers who compromise a system can see confidential access information like database credentials. Parameters are often used to set credentials, for example by starting containers or applications. These parameters can often be seen by any @@ -21,6 +23,4 @@ iso27001-2017: - 9.4.3 - 9.4.1 - 10.1.2 -title: Handover of confidential parameters -id: HandoverOfConfidentialParameters ... diff --git a/data-new/BuildAndDeployment/Deployment/3/InventoryOfRunningArtifacts.yaml b/data-new/BuildAndDeployment/Deployment/3/InventoryOfRunningArtifacts.yaml index ba3d63276..2dedf8104 100755 --- a/data-new/BuildAndDeployment/Deployment/3/InventoryOfRunningArtifacts.yaml +++ b/data-new/BuildAndDeployment/Deployment/3/InventoryOfRunningArtifacts.yaml @@ -1,4 +1,6 @@ --- +id: InventoryOfRunningArtifacts +title: Inventory of running artifacts risk: In case a vulnerability of severity high or critical exists, it needs to be known where an artifacts with that vulnerability is deployed with which dependencies. measure: A documented inventory or a possibility to gather the needed information @@ -14,6 +16,4 @@ samm2: o-incident-management|TODO iso27001-2017: - "8.1" - "8.2" -title: Inventory of running artifacts -id: InventoryOfRunningArtifacts ... diff --git a/data-new/BuildAndDeployment/Deployment/3/RollingUpdateOnDeployment.yaml b/data-new/BuildAndDeployment/Deployment/3/RollingUpdateOnDeployment.yaml index a4c6ac158..a87efc752 100755 --- a/data-new/BuildAndDeployment/Deployment/3/RollingUpdateOnDeployment.yaml +++ b/data-new/BuildAndDeployment/Deployment/3/RollingUpdateOnDeployment.yaml @@ -1,4 +1,6 @@ --- +id: RollingUpdateOnDeployment +title: Rolling update on deployment risk: While a deployment is performed, the application can not be reached. measure: A deployment without downtime is performed*. difficultyOfImplementation: @@ -14,6 +16,4 @@ iso27001-2017: - 12.5.1 - 14.2.2 - 17.2.1 -title: Rolling update on deployment -id: RollingUpdateOnDeployment ... diff --git a/data-new/BuildAndDeployment/Deployment/3/SameArtifactForEnvironments.yaml b/data-new/BuildAndDeployment/Deployment/3/SameArtifactForEnvironments.yaml index 15278e45e..d3baf4827 100755 --- a/data-new/BuildAndDeployment/Deployment/3/SameArtifactForEnvironments.yaml +++ b/data-new/BuildAndDeployment/Deployment/3/SameArtifactForEnvironments.yaml @@ -1,4 +1,6 @@ --- +id: SameArtifactForEnvironments +title: Same artifact for environments risk: Building of an artifact for different environments means that an untested artifact might reach the production environment. measure: Building an artifact once and deploying it to different environments means @@ -17,6 +19,4 @@ iso27001-2017: - 14.3.1 - 14.2.8 - 12.1.4 -title: Same artifact for environments -id: SameArtifactForEnvironments ... diff --git a/data-new/BuildAndDeployment/Deployment/3/UsageOfFeatureToggles.yaml b/data-new/BuildAndDeployment/Deployment/3/UsageOfFeatureToggles.yaml index c81468557..63827670c 100755 --- a/data-new/BuildAndDeployment/Deployment/3/UsageOfFeatureToggles.yaml +++ b/data-new/BuildAndDeployment/Deployment/3/UsageOfFeatureToggles.yaml @@ -1,4 +1,6 @@ --- +id: UsageOfFeatureToggles +title: Usage of feature toggles risk: By using environment dependent configuration, some parameters will not be tested correctly. i.e. 
    if (host == 'production') {} else {}
    measure: Usage of environment independent configuration parameter, called feature @@ -18,6 +20,4 @@ iso27001-2017: - 14.2.8 - 14.2.9 - 12.1.4 -title: Usage of feature toggles -id: UsageOfFeatureToggles ... diff --git a/data-new/BuildAndDeployment/Deployment/4/BlueOrgreenDeployment.yaml b/data-new/BuildAndDeployment/Deployment/4/BlueOrgreenDeployment.yaml index 57b9da834..88d08fa30 100755 --- a/data-new/BuildAndDeployment/Deployment/4/BlueOrgreenDeployment.yaml +++ b/data-new/BuildAndDeployment/Deployment/4/BlueOrgreenDeployment.yaml @@ -1,4 +1,6 @@ --- +id: BlueOrgreenDeployment +title: Blue/Green Deployment risk: A new artifacts version can have unknown defects. measure: By having multiple production environments, a deployment can be performant on the first environment to spot possible defects before it is deployment in the @@ -20,6 +22,4 @@ iso27001-2017: - 12.1.4 - 12.5.1 - 14.2.9 -title: Blue/Green Deployment -id: BlueOrgreenDeployment ... diff --git a/data-new/BuildAndDeployment/PatchManagement/1/APatchPolicyIsDefined.yaml b/data-new/BuildAndDeployment/PatchManagement/1/APatchPolicyIsDefined.yaml index 2088be7c5..4f7d051f4 100755 --- a/data-new/BuildAndDeployment/PatchManagement/1/APatchPolicyIsDefined.yaml +++ b/data-new/BuildAndDeployment/PatchManagement/1/APatchPolicyIsDefined.yaml @@ -1,6 +1,6 @@ --- -title: A patch policy is defined id: APatchPolicyIsDefined +title: A patch policy is defined risk: Vulnerabilities in running containers stay for long and might get exploited. measure: A patch policy for all artifacts (e.g. in images) is defined. How often is an image rebuilt? diff --git a/data-new/BuildAndDeployment/PatchManagement/1/AutomatedPrsForPatches.yaml b/data-new/BuildAndDeployment/PatchManagement/1/AutomatedPrsForPatches.yaml index 18e7991df..14de1b816 100755 --- a/data-new/BuildAndDeployment/PatchManagement/1/AutomatedPrsForPatches.yaml +++ b/data-new/BuildAndDeployment/PatchManagement/1/AutomatedPrsForPatches.yaml @@ -1,4 +1,6 @@ --- +id: AutomatedPrsForPatches +title: Automated PRs for patches risk: Known vulnerabilities components might stay for long and get exploited, even when a patch is available. measure: Fast patching of third party component is needed. The DevOps way is to have @@ -17,6 +19,4 @@ iso27001-2017: implementation: - dependabot - Jenkins -title: Automated PRs for patches -id: AutomatedPrsForPatches ... diff --git a/data-new/BuildAndDeployment/PatchManagement/2/NightlyBuildOfImages.yaml b/data-new/BuildAndDeployment/PatchManagement/2/NightlyBuildOfImages.yaml index b0353da82..41f3b63b5 100755 --- a/data-new/BuildAndDeployment/PatchManagement/2/NightlyBuildOfImages.yaml +++ b/data-new/BuildAndDeployment/PatchManagement/2/NightlyBuildOfImages.yaml @@ -1,4 +1,6 @@ --- +id: NightlyBuildOfImages +title: Nightly build of images risk: Vulnerabilities in running containers stay for too long and might get exploited. measure: Images are built at least nightly. difficultyOfImplementation: @@ -9,6 +11,4 @@ usefulness: 3 samm2: o-environment-management|B|1 iso27001-2017: - 12.6.1 -title: Nightly build of images -id: NightlyBuildOfImages ... diff --git a/data-new/BuildAndDeployment/PatchManagement/2/ReductionOfTheAttackSurface.yaml b/data-new/BuildAndDeployment/PatchManagement/2/ReductionOfTheAttackSurface.yaml index d36f90a60..9e4e66297 100755 --- a/data-new/BuildAndDeployment/PatchManagement/2/ReductionOfTheAttackSurface.yaml +++ b/data-new/BuildAndDeployment/PatchManagement/2/ReductionOfTheAttackSurface.yaml @@ -1,4 +1,6 @@ --- +id: ReductionOfTheAttackSurface +title: Reduction of the attack surface risk: Components, dependencies, files or file access rights might have vulnerabilities, but the they are not needed. measure: Removal of unneeded components, dependencies, files or file access rights. @@ -15,6 +17,4 @@ iso27001-2017: implementation: - Distroless - Fedora CoreOS -title: Reduction of the attack surface -id: ReductionOfTheAttackSurface ... diff --git a/data-new/BuildAndDeployment/PatchManagement/2/UsageOfAMaximumLifetimeForImages.yaml b/data-new/BuildAndDeployment/PatchManagement/2/UsageOfAMaximumLifetimeForImages.yaml index 262283e4f..b1971c61e 100755 --- a/data-new/BuildAndDeployment/PatchManagement/2/UsageOfAMaximumLifetimeForImages.yaml +++ b/data-new/BuildAndDeployment/PatchManagement/2/UsageOfAMaximumLifetimeForImages.yaml @@ -1,4 +1,6 @@ --- +id: UsageOfAMaximumLifetimeForImages +title: Usage of a maximum lifetime for images risk: Vulnerabilities in images of running containers stay for too long and might get exploited. Long running containers have potential memory leaks. A compromised container might get killed by restarting the container (e.g. in case the attacker @@ -13,6 +15,4 @@ usefulness: 3 samm2: o-environment-management|B|1 iso27001-2017: - 12.6.1 -title: Usage of a maximum lifetime for images -id: UsageOfAMaximumLifetimeForImages ... diff --git a/data-new/BuildAndDeployment/PatchManagement/4/UsageOfAShortMaximumLifetimeForImages.yaml b/data-new/BuildAndDeployment/PatchManagement/4/UsageOfAShortMaximumLifetimeForImages.yaml index d2d3fbba7..f06bbf25a 100755 --- a/data-new/BuildAndDeployment/PatchManagement/4/UsageOfAShortMaximumLifetimeForImages.yaml +++ b/data-new/BuildAndDeployment/PatchManagement/4/UsageOfAShortMaximumLifetimeForImages.yaml @@ -1,4 +1,6 @@ --- +id: UsageOfAShortMaximumLifetimeForImages +title: Usage of a short maximum lifetime for images risk: Vulnerabilities in running containers stay for too long and might get exploited. measure: Nightly built images are deployed at minimum every 1 day. difficultyOfImplementation: @@ -20,6 +22,4 @@ implementation: will ensure that if (and only if) something buggy has been introduced which breaks functionality the canary deployment will make sure the "older version" is being used and not the buggy newer one. -title: Usage of a short maximum lifetime for images -id: UsageOfAShortMaximumLifetimeForImages ... diff --git a/data-new/CultureAndOrganization/Design/0/InformationSecurityTargetsAreCommunicated.yaml b/data-new/CultureAndOrganization/Design/0/InformationSecurityTargetsAreCommunicated.yaml index 2207bc8db..f06755ae5 100755 --- a/data-new/CultureAndOrganization/Design/0/InformationSecurityTargetsAreCommunicated.yaml +++ b/data-new/CultureAndOrganization/Design/0/InformationSecurityTargetsAreCommunicated.yaml @@ -1,4 +1,6 @@ --- +id: InformationSecurityTargetsAreCommunicated +title: Information security targets are communicated risk: Employees don't known their organisation security targets. Therefore security is not considered during development and administration as much as it should be. measure: Transparent and timely communication of the security targets by senior management @@ -12,6 +14,4 @@ samm: SM1-B iso27001-2017: - 5.1.1 - 7.2.1 -title: Information security targets are communicated -id: InformationSecurityTargetsAreCommunicated ... diff --git a/data-new/CultureAndOrganization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml b/data-new/CultureAndOrganization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml index 5b0b06fc2..3348983e2 100755 --- a/data-new/CultureAndOrganization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml +++ b/data-new/CultureAndOrganization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml @@ -1,4 +1,6 @@ --- +id: ConductionOfSimpleThreatModellingOnTechnicalLevel +title: Conduction of simple threat modelling on technical level risk: Technical related threats are discovered too late in the development and deployment process. measure: Threat modelling of technical features is performed during the product sprint @@ -51,6 +53,4 @@ iso27001-2017: - may be part of risk assessment - 8.2.1 - 14.2.1 -title: Conduction of simple threat modelling on technical level -id: ConductionOfSimpleThreatModellingOnTechnicalLevel ... diff --git a/data-new/CultureAndOrganization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml b/data-new/CultureAndOrganization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml index 61b292c00..a25bb9d6b 100755 --- a/data-new/CultureAndOrganization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml +++ b/data-new/CultureAndOrganization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml @@ -1,4 +1,6 @@ --- +id: ConductionOfSimpleThreatModellingOnBusinessLevel +title: Conduction of simple threat modelling on business level risk: Business related threats are discovered too late in the development and deployment process. measure: Threat modelling of business functionality is performed during the product @@ -14,6 +16,4 @@ iso27001-2017: - may be part of risk assessment - 8.2.1 - 14.2.1 -title: Conduction of simple threat modelling on business level -id: ConductionOfSimpleThreatModellingOnBusinessLevel ... diff --git a/data-new/CultureAndOrganization/Design/2/CreationOfSimpleAbuseStories.yaml b/data-new/CultureAndOrganization/Design/2/CreationOfSimpleAbuseStories.yaml index 9331f38ef..bab7a16ea 100755 --- a/data-new/CultureAndOrganization/Design/2/CreationOfSimpleAbuseStories.yaml +++ b/data-new/CultureAndOrganization/Design/2/CreationOfSimpleAbuseStories.yaml @@ -1,4 +1,6 @@ --- +id: CreationOfSimpleAbuseStories +title: Creation of simple abuse stories risk: User stories mostly don't consider security implications. Security flaws are discovered too late in the development and deployment process. measure: Abuse stories are created during the creation of user stories. @@ -17,6 +19,4 @@ iso27001-2017: implementation: Don't Forget EVIL User Stories and Practical Security Stories and Security Tasks for Agile Development Environments -title: Creation of simple abuse stories -id: CreationOfSimpleAbuseStories ... diff --git a/data-new/CultureAndOrganization/Design/3/ConductionOfAdvancedThreatModelling.yaml b/data-new/CultureAndOrganization/Design/3/ConductionOfAdvancedThreatModelling.yaml index 21bd17aa3..fb5567ced 100755 --- a/data-new/CultureAndOrganization/Design/3/ConductionOfAdvancedThreatModelling.yaml +++ b/data-new/CultureAndOrganization/Design/3/ConductionOfAdvancedThreatModelling.yaml @@ -1,4 +1,6 @@ --- +id: ConductionOfAdvancedThreatModelling +title: Conduction of advanced threat modelling risk: Inadequate identification of business and technical risks. measure: Threat modelling is performed by using reviewing user stories and producing security driven data flow diagrams. @@ -26,6 +28,4 @@ iso27001-2017: - may be part of risk assessment - 8.2.1 - 14.2.1 -title: Conduction of advanced threat modelling -id: ConductionOfAdvancedThreatModelling ... diff --git a/data-new/CultureAndOrganization/Design/4/CreationOfAdvancedAbuseStories.yaml b/data-new/CultureAndOrganization/Design/4/CreationOfAdvancedAbuseStories.yaml index e5ca81bc1..d4ab01a49 100755 --- a/data-new/CultureAndOrganization/Design/4/CreationOfAdvancedAbuseStories.yaml +++ b/data-new/CultureAndOrganization/Design/4/CreationOfAdvancedAbuseStories.yaml @@ -1,4 +1,6 @@ --- +id: CreationOfAdvancedAbuseStories +title: Creation of advanced abuse stories risk: Simple user stories are not going deep enough. Relevant security considerations are performed. Security flaws are discovered too late in the development and deployment process @@ -20,6 +22,4 @@ iso27001-2017: implementation: Don't Forget EVIL User Stories and Practical Security Stories and Security Tasks for Agile Development Environments -title: Creation of advanced abuse stories -id: CreationOfAdvancedAbuseStories ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml index 2367b3cf9..a327ec034 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml @@ -1,4 +1,6 @@ --- +id: Ad-HocSecurityTrainingsForSoftwareDevelopers +title: Ad-Hoc Security trainings for software developers risk: Understanding security is hard and personnel needs to be trained on it. Otherwise, flaws like an SQL Injection might be introduced into the software which might get exploited. @@ -14,6 +16,4 @@ samm: EG1-A - In case you do not have the budget to hire an external security ex Juice Shop on a "hacking Friday" - https://cheatsheetseries.owasp.org/ iso27001-2017: - 7.2.2 -title: Ad-Hoc Security trainings for software developers -id: Ad-HocSecurityTrainingsForSoftwareDevelopers ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/1/SecurityConsultingOnRequest.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/1/SecurityConsultingOnRequest.yaml index 4e3c91b34..87a305198 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/1/SecurityConsultingOnRequest.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/1/SecurityConsultingOnRequest.yaml @@ -1,4 +1,6 @@ --- +id: SecurityConsultingOnRequest +title: Security consulting on request risk: Not asking a security expert when questions regarding security appear might lead to flaws. measure: Security consulting to teams is given on request. The security consultants @@ -14,6 +16,4 @@ iso27001-2017: - 6.1.1 - 6.1.4 - 6.1.5 -title: Security consulting on request -id: SecurityConsultingOnRequest ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/2/EachTeamHasASecurityChampion.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/2/EachTeamHasASecurityChampion.yaml index b970dad9e..046d6f873 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/2/EachTeamHasASecurityChampion.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/2/EachTeamHasASecurityChampion.yaml @@ -1,4 +1,6 @@ --- +id: EachTeamHasASecurityChampion +title: Each team has a security champion risk: No one feels directly responsible for security and the security champion does not have enough time to allocate to each team. measure: Each team defines an individual to be responsible for security. These individuals @@ -14,6 +16,4 @@ iso27001-2017: - 7.2.1 - 7.2.2 implementation: https://www.owasp.org/index.php/Security_Champions_Playbook -title: Each team has a security champion -id: EachTeamHasASecurityChampion ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingForAll.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingForAll.yaml index 0f826db52..d8ee44320 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingForAll.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingForAll.yaml @@ -1,4 +1,6 @@ --- +id: RegularSecurityTrainingForAll +title: Regular security training for all risk: Understanding security is hard. measure: Provide security awareness training for all personnel involved in software development on a regular basis like twice in a year for 1-3 days. @@ -15,6 +17,4 @@ implementation: is to use the OWASP Juice Shop on a "hacking Friday" - https://cheatsheetseries.owasp.org/ -title: Regular security training for all -id: RegularSecurityTrainingForAll ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingOfSecurityChampions.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingOfSecurityChampions.yaml index 12bf23a0a..39df03a29 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingOfSecurityChampions.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingOfSecurityChampions.yaml @@ -1,4 +1,6 @@ --- +id: RegularSecurityTrainingOfSecurityChampions +title: Regular security training of security champions risk: Understanding security is hard, even for security champions. measure: Regular security training of security champions. evidence: | @@ -13,6 +15,4 @@ samm: EG2-B iso27001-2017: - security champions are missing in ISO 27001 - 7.2.2 -title: Regular security training of security champions -id: RegularSecurityTrainingOfSecurityChampions ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/2/RewardOfGoodCommunication.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/2/RewardOfGoodCommunication.yaml index 2d65d1ed5..3d7a8b6f8 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/2/RewardOfGoodCommunication.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/2/RewardOfGoodCommunication.yaml @@ -1,4 +1,6 @@ --- +id: RewardOfGoodCommunication +title: Reward of good communication risk: Employees are not getting excited about security. measure: Good communication and transparency encourages cross-organisational support. Gamification of security is also known to help, examples include T-Shirts, mugs, @@ -16,6 +18,4 @@ implementation: - Enhance motivation can be performed with the distribution of pins as a reward, see OWASP Security Pins Project - https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx -title: Reward of good communication -id: RewardOfGoodCommunication ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml index 05479ed2f..d2e76ccb4 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml @@ -1,4 +1,6 @@ --- +id: ConductionOfBuild-It,Break-It,Fix-ItContests +title: Conduction of build-it, break-it, fix-it contests risk: Understanding security is hard, even for security champions and the conduction of security training often focuses on breaking a component instead of building a component secure. @@ -13,6 +15,4 @@ usefulness: 3 iso27001-2017: - 7.2.2 implementation: https://builditbreakit.org/ -title: Conduction of build-it, break-it, fix-it contests -id: ConductionOfBuild-It,Break-It,Fix-ItContests ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml index 586477909..c8733b89d 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml @@ -1,4 +1,6 @@ --- +id: ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators +title: Conduction of collaborative security checks with developers and system administrators risk: Security checks by external companies do not increase the understanding of an application/system for internal employees. measure: Periodically security reviews of source code (SCA), in which security SME, @@ -15,6 +17,4 @@ iso27001-2017: - 7.2.2 - 12.6.1 - 12.7.1 -title: Conduction of collaborative security checks with developers and system administrators -id: ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/3/RegularSecurityTrainingForEveryone.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/3/RegularSecurityTrainingForEveryone.yaml index 814a6ce1f..f6a6772d9 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/3/RegularSecurityTrainingForEveryone.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/3/RegularSecurityTrainingForEveryone.yaml @@ -1,4 +1,6 @@ --- +id: RegularSecurityTrainingForEveryone +title: Regular security training for everyone risk: Understanding security is hard, for internal as well as external employees. measure: Regular security training for everyone. difficultyOfImplementation: @@ -12,6 +14,4 @@ iso27001-2017: implementation: Often, external employees are not invited for interal trainings. This activity focuses on providing security trainings to internal as well as external employees. It is conducted every two weeks for around one hour. -title: Regular security training for everyone -id: RegularSecurityTrainingForEveryone ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/3/Security-Lessoned-Learned.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/3/Security-Lessoned-Learned.yaml index 236e2799a..1a28256c1 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/3/Security-Lessoned-Learned.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/3/Security-Lessoned-Learned.yaml @@ -1,4 +1,6 @@ --- +id: Security-Lessoned-Learned +title: Security-Lessoned-Learned risk: After an incident, a similar incident might reoccur. measure: Running a 'lessons learned' session after an incident helps drive continuous improvement. Regular meetings with security champions are a good place to share @@ -11,6 +13,4 @@ usefulness: 3 samm: IM-3, ST-3, SR2-B iso27001-2017: - 16.1.6 -title: Security-Lessoned-Learned -id: Security-Lessoned-Learned ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/4/AligningSecurityInTeams.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/4/AligningSecurityInTeams.yaml index 58f877ee2..160d18ad0 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/4/AligningSecurityInTeams.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/4/AligningSecurityInTeams.yaml @@ -1,4 +1,6 @@ --- +id: AligningSecurityInTeams +title: Aligning security in teams risk: The concept of Security Champions might suggest that only he/she is responsible for security. However, everyone in the project team should be responsible for security. measure: By aligning security SME with project teams, a higher security standard can @@ -13,6 +15,4 @@ usefulness: 5 samm: EG2-B iso27001-2017: - 7.1.1 -title: Aligning security in teams -id: AligningSecurityInTeams ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml index 3b0f23c7f..623472c7f 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml @@ -1,4 +1,6 @@ --- +id: ConductionOfCollaborativeTeamSecurityChecks +title: Conduction of collaborative team security checks risk: Development teams limited insight over security practices. measure: Mutual security testing the security of other teams's project enhances security awareness and knowledge. @@ -11,6 +13,4 @@ samm: EG2-A iso27001-2017: - Mutual scurity testing is not explicitly required in ISO 27001 may be - 7.2.2 -title: Conduction of collaborative team security checks -id: ConductionOfCollaborativeTeamSecurityChecks ... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfWarGames.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfWarGames.yaml index 258e0b69f..af7be1ab1 100755 --- a/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfWarGames.yaml +++ b/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfWarGames.yaml @@ -1,4 +1,6 @@ --- +id: ConductionOfWarGames +title: Conduction of war games risk: Understanding incident response plans during an incident is hard and ineffective. measure: War Games like activities help train for incidents. Security SMEs create attack scenarios in a testing environment enabling the trainees to learn how to @@ -13,6 +15,4 @@ iso27001-2017: - 7.2.2 - "16.1" - 16.1.5 -title: Conduction of war games -id: ConductionOfWarGames ... diff --git a/data-new/CultureAndOrganization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml b/data-new/CultureAndOrganization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml index 5c51c7be7..f20a68740 100755 --- a/data-new/CultureAndOrganization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml +++ b/data-new/CultureAndOrganization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml @@ -1,4 +1,6 @@ --- +id: DefinitionOfSimpleBcdrPracticesForCriticalComponents +title: Definition of simple BCDR practices for critical components risk: In case of an emergency, like a power outage, DR actions to perform are not clear. This leads to reaction and remediation delays. measure: By understanding and documenting a business continuity and disaster recovery @@ -12,6 +14,4 @@ difficultyOfImplementation: usefulness: 4 iso27001-2017: - 17.1.1 -title: Definition of simple BCDR practices for critical components -id: DefinitionOfSimpleBcdrPracticesForCriticalComponents ... diff --git a/data-new/CultureAndOrganization/Process/3/ApprovalByReviewingAnyNewVersion.yaml b/data-new/CultureAndOrganization/Process/3/ApprovalByReviewingAnyNewVersion.yaml index 89e809a06..a23efdad3 100755 --- a/data-new/CultureAndOrganization/Process/3/ApprovalByReviewingAnyNewVersion.yaml +++ b/data-new/CultureAndOrganization/Process/3/ApprovalByReviewingAnyNewVersion.yaml @@ -1,4 +1,6 @@ --- +id: ApprovalByReviewingAnyNewVersion +title: Approval by reviewing any new version risk: An individual might forget to implement security measures to protect source code or infrastructure components. measure: On each new version (e.g. Pull Request) of source code or infrastructure @@ -14,6 +16,4 @@ iso27001-2017: - peer review - four eyes principle is not explicitly required by ISO 27001 - 6.1.2 - 14.2.1 -title: Approval by reviewing any new version -id: ApprovalByReviewingAnyNewVersion ... diff --git a/data-new/CultureAndOrganization/Process/3/DefinitionOfAChangeManagementProcess.yaml b/data-new/CultureAndOrganization/Process/3/DefinitionOfAChangeManagementProcess.yaml index 6fe421976..11cd487c8 100755 --- a/data-new/CultureAndOrganization/Process/3/DefinitionOfAChangeManagementProcess.yaml +++ b/data-new/CultureAndOrganization/Process/3/DefinitionOfAChangeManagementProcess.yaml @@ -1,4 +1,6 @@ --- +id: DefinitionOfAChangeManagementProcess +title: Definition of a change management process risk: The impact of a change is not controlled because these are not recorded or documented. measure: Each change of a system is automatically recorded and adequately logged. difficultyOfImplementation: @@ -10,6 +12,4 @@ iso27001-2017: - 14.2.2 - 12.1.2 - 12.4.1 -title: Definition of a change management process -id: DefinitionOfAChangeManagementProcess ... diff --git a/data-new/CultureAndOrganization/Process/3/PreventionOfUnauthorizedInstallation.yaml b/data-new/CultureAndOrganization/Process/3/PreventionOfUnauthorizedInstallation.yaml index 19830fd89..e49799b72 100755 --- a/data-new/CultureAndOrganization/Process/3/PreventionOfUnauthorizedInstallation.yaml +++ b/data-new/CultureAndOrganization/Process/3/PreventionOfUnauthorizedInstallation.yaml @@ -1,4 +1,6 @@ --- +id: PreventionOfUnauthorizedInstallation +title: Prevention of unauthorized installation risk: Unapproved components are used. measure: Components must be whitelisted. Regular scans on the docker infrastructure (e.g. cluster) need to be performed, to verify that only standardized base images @@ -14,6 +16,4 @@ iso27001-2017: implementation: 'Example: All docker images used by teams need to be based on standard images.' comment: By preventing teams from trying out new components, innovation might be hampered -title: Prevention of unauthorized installation -id: PreventionOfUnauthorizedInstallation ... diff --git a/data-new/Implementation/ApplicationHardening/1/ApplicationHardeningLevel1.yaml b/data-new/Implementation/ApplicationHardening/1/ApplicationHardeningLevel1.yaml index 7dc93b24c..eecc4c00c 100755 --- a/data-new/Implementation/ApplicationHardening/1/ApplicationHardeningLevel1.yaml +++ b/data-new/Implementation/ApplicationHardening/1/ApplicationHardeningLevel1.yaml @@ -1,4 +1,6 @@ --- +id: ApplicationHardeningLevel1 +title: Application Hardening Level 1 risk: Using an insecure application might lead to a compromised application. This might lead to total data theft or data modification. measure: | @@ -39,6 +41,4 @@ samm2: software-requirements|A|1 iso27001-2017: - hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 -title: Application Hardening Level 1 -id: ApplicationHardeningLevel1 ... diff --git a/data-new/Implementation/ApplicationHardening/2/App.HardeningLevel2.yaml b/data-new/Implementation/ApplicationHardening/2/App.HardeningLevel2.yaml index 31c1b4b63..0fe1669c0 100755 --- a/data-new/Implementation/ApplicationHardening/2/App.HardeningLevel2.yaml +++ b/data-new/Implementation/ApplicationHardening/2/App.HardeningLevel2.yaml @@ -1,4 +1,6 @@ --- +id: App.HardeningLevel2 +title: App. Hardening Level 2 risk: Using an insecure application might lead to a compromised application. This might lead to total data theft or data modification. measure: | @@ -20,6 +22,4 @@ samm2: software-requirements|A|2 iso27001-2017: - hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 -title: App. Hardening Level 2 -id: App.HardeningLevel2 ... diff --git a/data-new/Implementation/ApplicationHardening/3/App.HardeningLevel3.yaml b/data-new/Implementation/ApplicationHardening/3/App.HardeningLevel3.yaml index d099bda62..bf5b8ccf5 100755 --- a/data-new/Implementation/ApplicationHardening/3/App.HardeningLevel3.yaml +++ b/data-new/Implementation/ApplicationHardening/3/App.HardeningLevel3.yaml @@ -1,4 +1,6 @@ --- +id: App.HardeningLevel3 +title: App. Hardening Level 3 risk: Using an insecure application might lead to a compromised application. This might lead to total data theft or data modification. measure: | @@ -21,6 +23,4 @@ samm2: software-requirements|A|3 iso27001-2017: - hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 -title: App. Hardening Level 3 -id: App.HardeningLevel3 ... diff --git a/data-new/Implementation/ApplicationHardening/4/FullCoverageOfApp.HardeningLevel3.yaml b/data-new/Implementation/ApplicationHardening/4/FullCoverageOfApp.HardeningLevel3.yaml index db76cf6ea..4b32af899 100755 --- a/data-new/Implementation/ApplicationHardening/4/FullCoverageOfApp.HardeningLevel3.yaml +++ b/data-new/Implementation/ApplicationHardening/4/FullCoverageOfApp.HardeningLevel3.yaml @@ -1,4 +1,6 @@ --- +id: FullCoverageOfApp.HardeningLevel3 +title: Full Coverage of App. Hardening Level 3 risk: Using an insecure application might lead to a compromised application. This might lead to total data theft or data modification. measure: | @@ -21,6 +23,4 @@ samm2: software-requirements|A|3 iso27001-2017: - hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 -title: Full Coverage of App. Hardening Level 3 -id: FullCoverageOfApp.HardeningLevel3 ... diff --git a/data-new/Implementation/InfrastructureHardening/1/IsolatedNetworksForVirtualEnvironments.yaml b/data-new/Implementation/InfrastructureHardening/1/IsolatedNetworksForVirtualEnvironments.yaml index 1091b3aba..8080a6946 100755 --- a/data-new/Implementation/InfrastructureHardening/1/IsolatedNetworksForVirtualEnvironments.yaml +++ b/data-new/Implementation/InfrastructureHardening/1/IsolatedNetworksForVirtualEnvironments.yaml @@ -1,4 +1,6 @@ --- +id: IsolatedNetworksForVirtualEnvironments +title: Isolated networks for virtual environments risk: Virtual environments in default settings are able to access other virtual environments on the network stack. By using virtual machines, it is often possible to connect to other virtual machines. By using docker, one bridge is used by default so that @@ -18,6 +20,4 @@ samm2: o-environment-management|A|1 iso27001-2017: - virtual environments are not explicitly covered by ISO 27001 - too specific - 13.1.3 -title: Isolated networks for virtual environments -id: IsolatedNetworksForVirtualEnvironments ... diff --git a/data-new/Implementation/InfrastructureHardening/1/SimpleAccessControlForSystems.yaml b/data-new/Implementation/InfrastructureHardening/1/SimpleAccessControlForSystems.yaml index e89042f5d..e20189515 100755 --- a/data-new/Implementation/InfrastructureHardening/1/SimpleAccessControlForSystems.yaml +++ b/data-new/Implementation/InfrastructureHardening/1/SimpleAccessControlForSystems.yaml @@ -1,4 +1,6 @@ --- +id: SimpleAccessControlForSystems +title: Simple access control for systems risk: Attackers a gaining access to internal systems and application interfaces measure: All internal systems are using simple authentication difficultyOfImplementation: @@ -13,6 +15,4 @@ samm: EH1-B samm2: o-environment-management|A|1 iso27001-2017: - 9.4.1 -title: Simple access control for systems -id: SimpleAccessControlForSystems ... diff --git a/data-new/Implementation/InfrastructureHardening/1/UsageOfTestAndProductionEnvironments.yaml b/data-new/Implementation/InfrastructureHardening/1/UsageOfTestAndProductionEnvironments.yaml index aac4ce7b4..867980763 100755 --- a/data-new/Implementation/InfrastructureHardening/1/UsageOfTestAndProductionEnvironments.yaml +++ b/data-new/Implementation/InfrastructureHardening/1/UsageOfTestAndProductionEnvironments.yaml @@ -1,4 +1,6 @@ --- +id: UsageOfTestAndProductionEnvironments +title: Usage of test and production environments risk: Security tests are not running regularly because test environments are missing measure: A production and a production like envirnoment is used difficultyOfImplementation: @@ -13,6 +15,4 @@ iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 12.1.4 - 17.2.1 -title: Usage of test and production environments -id: UsageOfTestAndProductionEnvironments ... diff --git a/data-new/Implementation/InfrastructureHardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml b/data-new/Implementation/InfrastructureHardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml index 35d576f47..429be6f5d 100755 --- a/data-new/Implementation/InfrastructureHardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml +++ b/data-new/Implementation/InfrastructureHardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml @@ -1,4 +1,6 @@ --- +id: ApplicationsAreRunningInVirtualizedEnvironments +title: Applications are running in virtualized environments risk: Through a vulnerability in one service on a server, the attacker gains access to other services running on the same server. measure: Applications are running in a dedicated and isolated virtualized environments. @@ -11,6 +13,4 @@ samm2: o-environment-management|A|1 iso27001-2017: - virtual environments are not explicitly covered by ISO 27001 - too specific - 13.1.3 -title: Applications are running in virtualized environments -id: ApplicationsAreRunningInVirtualizedEnvironments ... diff --git a/data-new/Implementation/InfrastructureHardening/2/CheckingTheSourcesOfUsedLibraries.yaml b/data-new/Implementation/InfrastructureHardening/2/CheckingTheSourcesOfUsedLibraries.yaml index 81c7a04d4..75f7b9f17 100755 --- a/data-new/Implementation/InfrastructureHardening/2/CheckingTheSourcesOfUsedLibraries.yaml +++ b/data-new/Implementation/InfrastructureHardening/2/CheckingTheSourcesOfUsedLibraries.yaml @@ -1,4 +1,6 @@ --- +id: CheckingTheSourcesOfUsedLibraries +title: Checking the sources of used libraries risk: Application and system libraries can have implementation flaws or deployment flaws. measure: Each libraries source is checked to have a trusted source. @@ -13,6 +15,4 @@ iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 14.2.1 - 14.2.5 -title: Checking the sources of used libraries -id: CheckingTheSourcesOfUsedLibraries ... diff --git a/data-new/Implementation/InfrastructureHardening/2/FilterOutgoingTraffic.yaml b/data-new/Implementation/InfrastructureHardening/2/FilterOutgoingTraffic.yaml index b0050899d..71ceaedfa 100755 --- a/data-new/Implementation/InfrastructureHardening/2/FilterOutgoingTraffic.yaml +++ b/data-new/Implementation/InfrastructureHardening/2/FilterOutgoingTraffic.yaml @@ -1,4 +1,6 @@ --- +id: FilterOutgoingTraffic +title: Filter outgoing traffic risk: A compromised infrastructure component might try to send out stolen data. measure: Having a whitelist and explizitly allowing egress traffic provides the ability to stop unauthorized data leackage. @@ -15,6 +17,4 @@ samm2: o-environment-management|A|1 iso27001-2017: - virtual environments are not explicitly covered by ISO 27001 - too specific - 13.1.3 -title: Filter outgoing traffic -id: FilterOutgoingTraffic ... diff --git a/data-new/Implementation/InfrastructureHardening/2/TheClusterIsHardened.yaml b/data-new/Implementation/InfrastructureHardening/2/TheClusterIsHardened.yaml index 50597152d..f36108250 100755 --- a/data-new/Implementation/InfrastructureHardening/2/TheClusterIsHardened.yaml +++ b/data-new/Implementation/InfrastructureHardening/2/TheClusterIsHardened.yaml @@ -1,4 +1,6 @@ --- +id: TheClusterIsHardened +title: The cluster is hardened risk: Using default configurations for a cluster environment leads to potential risks. measure: Harden cluster environments according to best practices. Level 1 and partiually level 2 from hardening practices like 'CIS Kubernetes Bench for Security' should @@ -17,6 +19,4 @@ samm2: o-environment-management|A|1 iso27001-2017: - system hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 -title: The cluster is hardened -id: TheClusterIsHardened ... diff --git a/data-new/Implementation/InfrastructureHardening/2/UsageOfSecurityByDefaultForComponents.yaml b/data-new/Implementation/InfrastructureHardening/2/UsageOfSecurityByDefaultForComponents.yaml index 30fdfcf67..f33d5cd53 100755 --- a/data-new/Implementation/InfrastructureHardening/2/UsageOfSecurityByDefaultForComponents.yaml +++ b/data-new/Implementation/InfrastructureHardening/2/UsageOfSecurityByDefaultForComponents.yaml @@ -1,4 +1,6 @@ --- +id: UsageOfSecurityByDefaultForComponents +title: Usage of security by default for components risk: Components (images, libraries, applications) are not hardened. measure: Hardening of components is important, specially for image on which other teams base on. Hardening should be performed on the operation system and on the @@ -15,6 +17,4 @@ dependsOn: samm2: o-environment-management|A|1 iso27001-2017: - not explicitly covered by ISO 27001 - too specific -title: Usage of security by default for components -id: UsageOfSecurityByDefaultForComponents ... diff --git a/data-new/Implementation/InfrastructureHardening/2/VirtualEnvironmentsAreLimited.yaml b/data-new/Implementation/InfrastructureHardening/2/VirtualEnvironmentsAreLimited.yaml index 6a7cfb707..1b4946308 100755 --- a/data-new/Implementation/InfrastructureHardening/2/VirtualEnvironmentsAreLimited.yaml +++ b/data-new/Implementation/InfrastructureHardening/2/VirtualEnvironmentsAreLimited.yaml @@ -1,4 +1,6 @@ --- +id: VirtualEnvironmentsAreLimited +title: Virtual environments are limited risk: Denial of service (internally by an attacker or unintentionally by a bug) on one service effects other services measure: All virtual environments are using resource limits on hard disks, memory @@ -16,6 +18,4 @@ iso27001-2017: - 12.1.3 - 13.1.3 - 17.2.1 -title: Virtual environments are limited -id: VirtualEnvironmentsAreLimited ... diff --git a/data-new/Implementation/InfrastructureHardening/3/2Fa.yaml b/data-new/Implementation/InfrastructureHardening/3/2Fa.yaml index a2d1167d6..b9dfd7033 100755 --- a/data-new/Implementation/InfrastructureHardening/3/2Fa.yaml +++ b/data-new/Implementation/InfrastructureHardening/3/2Fa.yaml @@ -1,4 +1,6 @@ --- +id: 2Fa +title: 2FA risk: One factor authentication is more vulnerable to brute force attacks and is considered less secure. measure: Two factor authentication for all privileged accounts on systems and applications @@ -14,6 +16,4 @@ iso27001-2017: - 9.1.1 - 9.4.2 - 14.2.5 -title: 2FA -id: 2Fa ... diff --git a/data-new/Implementation/InfrastructureHardening/3/ImmutableInfrastructure.yaml b/data-new/Implementation/InfrastructureHardening/3/ImmutableInfrastructure.yaml index 78ee666a2..21532578b 100755 --- a/data-new/Implementation/InfrastructureHardening/3/ImmutableInfrastructure.yaml +++ b/data-new/Implementation/InfrastructureHardening/3/ImmutableInfrastructure.yaml @@ -1,4 +1,6 @@ --- +id: ImmutableInfrastructure +title: Immutable Infrastructure risk: The availability of IT systems might be disturbed due to components failures measure: Redundancies in the IT systems difficultyOfImplementation: @@ -15,6 +17,4 @@ samm2: o-environment-management|A|1 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 17.2.1 -title: Immutable Infrastructure -id: ImmutableInfrastructure ... diff --git a/data-new/Implementation/InfrastructureHardening/3/InfrastructureAsCode.yaml b/data-new/Implementation/InfrastructureHardening/3/InfrastructureAsCode.yaml index 8f4289054..5aeb863bf 100755 --- a/data-new/Implementation/InfrastructureHardening/3/InfrastructureAsCode.yaml +++ b/data-new/Implementation/InfrastructureHardening/3/InfrastructureAsCode.yaml @@ -1,4 +1,6 @@ --- +id: InfrastructureAsCode +title: Infrastructure as Code risk: No tracking of changes in systems might lead to errors in the configuration. In additions, it might lead to unauthorized changes. An examples is jenkins. measure: Systems are setup by code. A full environment can be provisioned. In addition, @@ -15,6 +17,4 @@ iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 12.1.1 - 12.1.2 -title: Infrastructure as Code -id: InfrastructureAsCode ... diff --git a/data-new/Implementation/InfrastructureHardening/3/RoleBasedAuthenticationAndAuthorization.yaml b/data-new/Implementation/InfrastructureHardening/3/RoleBasedAuthenticationAndAuthorization.yaml index ec0cbd708..051637d92 100755 --- a/data-new/Implementation/InfrastructureHardening/3/RoleBasedAuthenticationAndAuthorization.yaml +++ b/data-new/Implementation/InfrastructureHardening/3/RoleBasedAuthenticationAndAuthorization.yaml @@ -1,4 +1,6 @@ --- +id: RoleBasedAuthenticationAndAuthorization +title: Role based authentication and authorization risk: Everyone is able to get unauthorized access to information on systems or to modify information unauthorized on systems. measure: The usage of a (role based) access control helps to restrict system access @@ -15,6 +17,4 @@ dependsOn: samm2: o-environment-management|A|1 iso27001-2017: - 9.4.1 -title: Role based authentication and authorization -id: RoleBasedAuthenticationAndAuthorization ... diff --git a/data-new/Implementation/InfrastructureHardening/3/Versioning.yaml b/data-new/Implementation/InfrastructureHardening/3/Versioning.yaml index c6e020afc..f89c2f32f 100755 --- a/data-new/Implementation/InfrastructureHardening/3/Versioning.yaml +++ b/data-new/Implementation/InfrastructureHardening/3/Versioning.yaml @@ -1,4 +1,6 @@ --- +id: Versioning +title: versioning risk: Changes to production systems can not be undone. measure: versioning of artifacts related to production environments. For example Jenkins configuration, docker images, system provisioning code. @@ -15,6 +17,4 @@ iso27001-2017: - 12.1.1 - 12.1.2 - 14.2.2 -title: versioning -id: Versioning ... diff --git a/data-new/Implementation/InfrastructureHardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml b/data-new/Implementation/InfrastructureHardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml index aca5c0ed3..76cf2a874 100755 --- a/data-new/Implementation/InfrastructureHardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml +++ b/data-new/Implementation/InfrastructureHardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml @@ -1,4 +1,6 @@ --- +id: LimitationOfSystemCallsInVirtualEnvironments +title: Limitation of system calls in virtual environments risk: System calls in virtual environments like docker can lead to privilege escalation. measure: System calls in virtual environments like docker are audited and limited. difficultyOfImplementation: @@ -12,6 +14,4 @@ implementation: seccomp, strace samm2: o-environment-management|A|1 iso27001-2017: - system hardenong is not explicitly covered by ISO 27001 - too specific -title: Limitation of system calls in virtual environments -id: LimitationOfSystemCallsInVirtualEnvironments ... diff --git a/data-new/Implementation/InfrastructureHardening/4/Microservice-Architecture.yaml b/data-new/Implementation/InfrastructureHardening/4/Microservice-Architecture.yaml index b6f07c665..dcfcafaee 100755 --- a/data-new/Implementation/InfrastructureHardening/4/Microservice-Architecture.yaml +++ b/data-new/Implementation/InfrastructureHardening/4/Microservice-Architecture.yaml @@ -1,4 +1,6 @@ --- +id: Microservice-Architecture +title: Microservice-Architecture risk: Monolithic applications are hard to test. measure: A microservice-architecture helps to have small components, which are more easy to test. @@ -11,6 +13,4 @@ samm: SA2 samm2: o-environment-management|A|1 iso27001-2017: - not explicitly covered by ISO 27001 -title: Microservice-Architecture -id: Microservice-Architecture ... diff --git a/data-new/Implementation/InfrastructureHardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml b/data-new/Implementation/InfrastructureHardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml index 6fe4f954e..3079e36bf 100755 --- a/data-new/Implementation/InfrastructureHardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml +++ b/data-new/Implementation/InfrastructureHardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml @@ -1,4 +1,6 @@ --- +id: ProductionNearEnvironmentsAreUsedByDevelopers +title: Production near environments are used by developers risk: In case an errors occurs in production, the developer need to be able to create a production near environment on a local development environment. measure: Usage of infrastructure as code helps to create a production near environment. @@ -18,6 +20,4 @@ samm2: o-environment-management|A|1 iso27001-2017: - 12.1.4 - 17.2.1 -title: Production near environments are used by developers -id: ProductionNearEnvironmentsAreUsedByDevelopers ... diff --git a/data-new/Implementation/InfrastructureHardening/4/UsageOfAChaosMonkey.yaml b/data-new/Implementation/InfrastructureHardening/4/UsageOfAChaosMonkey.yaml index d81392193..9bb6b574f 100755 --- a/data-new/Implementation/InfrastructureHardening/4/UsageOfAChaosMonkey.yaml +++ b/data-new/Implementation/InfrastructureHardening/4/UsageOfAChaosMonkey.yaml @@ -1,4 +1,6 @@ --- +id: UsageOfAChaosMonkey +title: Usage of a chaos monkey risk: Due to manuel changes on a system, they are not replaceable anymore. In case of a crash it might happen that a planned redundant system is unavailable. In addition, it is hard to replay manual changes. @@ -13,6 +15,4 @@ samm2: o-environment-management|A|1 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 17.1.3 -title: Usage of a chaos monkey -id: UsageOfAChaosMonkey ... diff --git a/data-new/InformationGathering/Logging/1/CentralizedSystemLogging.yaml b/data-new/InformationGathering/Logging/1/CentralizedSystemLogging.yaml index 1a9f98b33..f9c254110 100755 --- a/data-new/InformationGathering/Logging/1/CentralizedSystemLogging.yaml +++ b/data-new/InformationGathering/Logging/1/CentralizedSystemLogging.yaml @@ -1,4 +1,6 @@ --- +id: CentralizedSystemLogging +title: Centralized system logging risk: Local stored system logs can be unauthorized manipulated by attackers or might be corrupt after an incident. In addition, it is hard to perform a aggregation of logs. @@ -13,6 +15,4 @@ samm2: o-incident-management|A|1 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 12.4.1 -title: Centralized system logging -id: CentralizedSystemLogging ... diff --git a/data-new/InformationGathering/Logging/1/LoggingOfSecurityEvents.yaml b/data-new/InformationGathering/Logging/1/LoggingOfSecurityEvents.yaml index 1689f7ddd..37128a518 100755 --- a/data-new/InformationGathering/Logging/1/LoggingOfSecurityEvents.yaml +++ b/data-new/InformationGathering/Logging/1/LoggingOfSecurityEvents.yaml @@ -1,4 +1,6 @@ --- +id: LoggingOfSecurityEvents +title: Logging of security events risk: No track of security-relevant events makes it harder to analyse an incident. measure: Security-relevant events like login/logout or creation, change, deletion of users should be logged. @@ -13,6 +15,4 @@ implementation: rsyslog, logstash, fluentd, bash samm2: o-incident-management|A|1 iso27001-2017: - 12.4.1 -title: Logging of security events -id: LoggingOfSecurityEvents ... diff --git a/data-new/InformationGathering/Logging/1/PiiLoggingConcept.yaml b/data-new/InformationGathering/Logging/1/PiiLoggingConcept.yaml index 4c09da91d..b5b8e1db2 100755 --- a/data-new/InformationGathering/Logging/1/PiiLoggingConcept.yaml +++ b/data-new/InformationGathering/Logging/1/PiiLoggingConcept.yaml @@ -1,4 +1,6 @@ --- +id: PiiLoggingConcept +title: PII logging concept risk: Personal identifiable information (PII) is logged and the law of GDPR is not followed. measure: A concept how to log PII is documented and applied. @@ -13,6 +15,4 @@ iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 12.4.1 - 18.1.1 -title: PII logging concept -id: PiiLoggingConcept ... diff --git a/data-new/InformationGathering/Logging/2/VisualizedLogging.yaml b/data-new/InformationGathering/Logging/2/VisualizedLogging.yaml index 6ebaf271d..584b483b2 100755 --- a/data-new/InformationGathering/Logging/2/VisualizedLogging.yaml +++ b/data-new/InformationGathering/Logging/2/VisualizedLogging.yaml @@ -1,4 +1,6 @@ --- +id: VisualizedLogging +title: Visualized logging risk: System and application protocols are not visualized properly which leads to no or very limited logging assessment. Specially developers might have difficulty to read applications logs with unusually tools like the Linux tool 'cat' @@ -17,6 +19,4 @@ samm2: o-incident-management|A|1 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 12.4.1 -title: Visualized logging -id: VisualizedLogging ... diff --git a/data-new/InformationGathering/Logging/3/CentralizedApplicationLogging.yaml b/data-new/InformationGathering/Logging/3/CentralizedApplicationLogging.yaml index 104ee67d0..02e1a22a3 100755 --- a/data-new/InformationGathering/Logging/3/CentralizedApplicationLogging.yaml +++ b/data-new/InformationGathering/Logging/3/CentralizedApplicationLogging.yaml @@ -1,4 +1,6 @@ --- +id: CentralizedApplicationLogging +title: Centralized application logging risk: Local stored logs can be unauthorized manipulated by attackers with system access or might be corrupt after an incident. In addition, it is hard to perform an correlation of logs. This leads attacks, which can be performed silently. @@ -17,6 +19,4 @@ samm2: o-incident-management|A|1 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 12.4.1 -title: Centralized application logging -id: CentralizedApplicationLogging ... diff --git a/data-new/InformationGathering/Logging/4/CorrelationOfSecurityEvents.yaml b/data-new/InformationGathering/Logging/4/CorrelationOfSecurityEvents.yaml index 0715e1768..c1a1ce5ec 100755 --- a/data-new/InformationGathering/Logging/4/CorrelationOfSecurityEvents.yaml +++ b/data-new/InformationGathering/Logging/4/CorrelationOfSecurityEvents.yaml @@ -1,4 +1,6 @@ --- +id: CorrelationOfSecurityEvents +title: Correlation of security events risk: Detection of security related events with hints on different systems/tools/metrics is not possible. measure: Events are correlated on one system. For example the correlation and visualisation @@ -15,6 +17,4 @@ samm2: o-incident-management|A|2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 12.4.1 -title: Correlation of security events -id: CorrelationOfSecurityEvents ... diff --git a/data-new/InformationGathering/Monitoring/1/SimpleApplicationMetrics.yaml b/data-new/InformationGathering/Monitoring/1/SimpleApplicationMetrics.yaml index 05ccda121..841ae66e5 100755 --- a/data-new/InformationGathering/Monitoring/1/SimpleApplicationMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/1/SimpleApplicationMetrics.yaml @@ -1,4 +1,6 @@ --- +id: SimpleApplicationMetrics +title: Simple application metrics risk: Attacks on an application are not recognized. measure: Gathering of application metrics helps to identify incidents like brute force attacks, login/logout. @@ -11,6 +13,4 @@ implementation: Prometheus samm2: o-incident-management|A|1 iso27001-2017: - 12.4.1 -title: Simple application metrics -id: SimpleApplicationMetrics ... diff --git a/data-new/InformationGathering/Monitoring/1/SimpleSystemMetrics.yaml b/data-new/InformationGathering/Monitoring/1/SimpleSystemMetrics.yaml index 21cb70136..b8f8fc024 100755 --- a/data-new/InformationGathering/Monitoring/1/SimpleSystemMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/1/SimpleSystemMetrics.yaml @@ -1,4 +1,6 @@ --- +id: SimpleSystemMetrics +title: Simple system metrics risk: Without simple metrics analysis of incidents are hard. In case an application uses a lot of CPU from time to time, it is hard for a developer to find out the source with linux commands. @@ -13,6 +15,4 @@ implementation: collectd samm2: o-incident-management|A|1 iso27001-2017: - 12.1.3 -title: Simple system metrics -id: SimpleSystemMetrics ... diff --git a/data-new/InformationGathering/Monitoring/2/Alerting.yaml b/data-new/InformationGathering/Monitoring/2/Alerting.yaml index 979ab6ab1..0bcd3834c 100755 --- a/data-new/InformationGathering/Monitoring/2/Alerting.yaml +++ b/data-new/InformationGathering/Monitoring/2/Alerting.yaml @@ -1,4 +1,6 @@ --- +id: Alerting +title: Alerting risk: Incidents are discovered after they happend. measure: | Thresholds for metrics are set. In case the thresholds are reached, alarms are send out. Which should get attention due to the critically. @@ -15,6 +17,4 @@ iso27001-2017: - 16.1.2 - 16.1.4 - 12.1.4 -title: Alerting -id: Alerting ... diff --git a/data-new/InformationGathering/Monitoring/2/VisualizedMetrics.yaml b/data-new/InformationGathering/Monitoring/2/VisualizedMetrics.yaml index ba02683ee..d35da9390 100755 --- a/data-new/InformationGathering/Monitoring/2/VisualizedMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/2/VisualizedMetrics.yaml @@ -1,4 +1,6 @@ --- +id: VisualizedMetrics +title: Visualized metrics risk: Not visualized metrics lead to restricted usage of metrics. measure: Metrics are visualized in real time in a user friendly way. difficultyOfImplementation: @@ -12,6 +14,4 @@ dependsOn: samm2: o-incident-management|A|2 iso27001-2017: - 12.1.3 -title: Visualized metrics -id: VisualizedMetrics ... diff --git a/data-new/InformationGathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml b/data-new/InformationGathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml index 11144bd32..91215d076 100755 --- a/data-new/InformationGathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml @@ -1,4 +1,6 @@ --- +id: AdvancedAvailablityAndStabilityMetrics +title: Advanced availablity and stability metrics risk: Trends and advanced attacks are not detected. measure: Advanced metrics are gathered in relation to availability and stability. For example unplanned downtime's per year. @@ -13,6 +15,4 @@ dependsOn: samm2: o-incident-management|A|2 iso27001-2017: - 12.1.3 -title: Advanced availablity and stability metrics -id: AdvancedAvailablityAndStabilityMetrics ... diff --git a/data-new/InformationGathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml b/data-new/InformationGathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml index dd21ef3a6..b0d22f267 100755 --- a/data-new/InformationGathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml @@ -1,4 +1,6 @@ --- +id: AdvancedWebapplicationMetrics +title: Advanced webapplication metrics risk: People are not looking into tests results. Vulnerabilities not recolonized, even they are detected by tools. measure: All defects from the dimension Test- and Verification are instrumented. @@ -13,6 +15,4 @@ dependsOn: samm2: o-incident-management|A|2 iso27001-2017: - 12.6.1 -title: Advanced webapplication metrics -id: AdvancedWebapplicationMetrics ... diff --git a/data-new/InformationGathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml b/data-new/InformationGathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml index fc4a3ffdd..1093e99ac 100755 --- a/data-new/InformationGathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml @@ -1,4 +1,6 @@ --- +id: DeactivationOfUnusedMetrics +title: Deactivation of unused metrics risk: High resources are used while gathering unused metrics. measure: Deactivation of unused metrics helps to free resources. difficultyOfImplementation: @@ -12,6 +14,4 @@ samm2: o-incident-management|A|1 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 12.1.3 -title: Deactivation of unused metrics -id: DeactivationOfUnusedMetrics ... diff --git a/data-new/InformationGathering/Monitoring/3/GroupingOfMetrics.yaml b/data-new/InformationGathering/Monitoring/3/GroupingOfMetrics.yaml index c3415e33f..9e1fb6064 100755 --- a/data-new/InformationGathering/Monitoring/3/GroupingOfMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/3/GroupingOfMetrics.yaml @@ -1,4 +1,6 @@ --- +id: GroupingOfMetrics +title: Grouping of metrics risk: The analysis of metrics takes long. measure: Meaningful grouping of metrics helps to speed up analysis. difficultyOfImplementation: @@ -10,6 +12,4 @@ samm2: o-incident-management|A|2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 12.1.3 -title: Grouping of metrics -id: GroupingOfMetrics ... diff --git a/data-new/InformationGathering/Monitoring/3/TargetedAlerting.yaml b/data-new/InformationGathering/Monitoring/3/TargetedAlerting.yaml index 4d886cde6..38288dbe5 100755 --- a/data-new/InformationGathering/Monitoring/3/TargetedAlerting.yaml +++ b/data-new/InformationGathering/Monitoring/3/TargetedAlerting.yaml @@ -1,4 +1,6 @@ --- +id: TargetedAlerting +title: Targeted alerting risk: People are bored (ignorant) of incident alarm messages, as they are not responsible to react. measure: By the definition of target groups for incidents people are only getting @@ -15,6 +17,4 @@ samm2: o-operational-management|B|3 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 16.1.5 -title: Targeted alerting -id: TargetedAlerting ... diff --git a/data-new/InformationGathering/Monitoring/4/CoverageAndControlMetrics.yaml b/data-new/InformationGathering/Monitoring/4/CoverageAndControlMetrics.yaml index f302704f0..642266234 100755 --- a/data-new/InformationGathering/Monitoring/4/CoverageAndControlMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/4/CoverageAndControlMetrics.yaml @@ -1,4 +1,6 @@ --- +id: CoverageAndControlMetrics +title: Coverage and control metrics risk: The effectiveness of configuration, patch and vulnerability management is unknown. measure: "Usage of Coverage- and control-metrics to show the effectiveness of the security program. Coverage is the degree in \n which a specific security @@ -17,6 +19,4 @@ implementation: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20F samm2: o-incident-management|A|2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific -title: Coverage and control metrics -id: CoverageAndControlMetrics ... diff --git a/data-new/InformationGathering/Monitoring/4/DefenceMetrics.yaml b/data-new/InformationGathering/Monitoring/4/DefenceMetrics.yaml index 9a7dbf9ee..7f97831a3 100755 --- a/data-new/InformationGathering/Monitoring/4/DefenceMetrics.yaml +++ b/data-new/InformationGathering/Monitoring/4/DefenceMetrics.yaml @@ -1,4 +1,6 @@ --- +id: DefenceMetrics +title: Defence metrics risk: IDS/IPS systems like packet- or application-firewalls detect and prevent attacks. It is not known how many attacks has been detected and blocked. measure: | @@ -16,6 +18,4 @@ samm2: o-incident-management|A|2 iso27001-2017: - 12.4.1 - 13.1.1 -title: Defence metrics -id: DefenceMetrics ... diff --git a/data-new/InformationGathering/Monitoring/4/MetricsAreCombinedWithTests.yaml b/data-new/InformationGathering/Monitoring/4/MetricsAreCombinedWithTests.yaml index be3f1b578..17fa4840b 100755 --- a/data-new/InformationGathering/Monitoring/4/MetricsAreCombinedWithTests.yaml +++ b/data-new/InformationGathering/Monitoring/4/MetricsAreCombinedWithTests.yaml @@ -1,4 +1,6 @@ --- +id: MetricsAreCombinedWithTests +title: Metrics are combined with tests risk: Changes might cause high load due to programming errors. measure: Metrics during tests helps to identify programming errors. difficultyOfImplementation: @@ -11,6 +13,4 @@ dependsOn: samm2: o-incident-management|A|2 iso27001-2017: - not explicitly covered by ISO 27001 -title: Metrics are combined with tests -id: MetricsAreCombinedWithTests ... diff --git a/data-new/InformationGathering/Monitoring/4/ScreensWithMetricVisualization.yaml b/data-new/InformationGathering/Monitoring/4/ScreensWithMetricVisualization.yaml index 1b460f6ec..576780c67 100755 --- a/data-new/InformationGathering/Monitoring/4/ScreensWithMetricVisualization.yaml +++ b/data-new/InformationGathering/Monitoring/4/ScreensWithMetricVisualization.yaml @@ -1,4 +1,6 @@ --- +id: ScreensWithMetricVisualization +title: Screens with metric visualization risk: Security related information is discovered too late during an incident. measure: By having an internal accessible screen with a security related dashboards helps to visualize incidents. @@ -13,6 +15,4 @@ samm2: o-incident-management|A|2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 16.1.5 -title: Screens with metric visualization -id: ScreensWithMetricVisualization ... diff --git a/data-new/TestAndVerification/ApplicationTests/2/SecurityUnitTestsForImportantComponents.yaml b/data-new/TestAndVerification/ApplicationTests/2/SecurityUnitTestsForImportantComponents.yaml index db0f20f4b..803d5891b 100755 --- a/data-new/TestAndVerification/ApplicationTests/2/SecurityUnitTestsForImportantComponents.yaml +++ b/data-new/TestAndVerification/ApplicationTests/2/SecurityUnitTestsForImportantComponents.yaml @@ -1,4 +1,6 @@ --- +id: SecurityUnitTestsForImportantComponents +title: Security unit tests for important components risk: Vulnerabilities are rising due to code changes. measure: Usage of unit tests to test important security related features like authentication and authorization. @@ -17,6 +19,4 @@ samm2: v-security-testing|B|3 iso27001-2017: - 14.2.3 - 14.2.8 -title: Security unit tests for important components -id: SecurityUnitTestsForImportantComponents ... diff --git a/data-new/TestAndVerification/ApplicationTests/3/SecurityIntegrationTestsForImportantComponents.yaml b/data-new/TestAndVerification/ApplicationTests/3/SecurityIntegrationTestsForImportantComponents.yaml index 8946420ea..bfae9a0ff 100755 --- a/data-new/TestAndVerification/ApplicationTests/3/SecurityIntegrationTestsForImportantComponents.yaml +++ b/data-new/TestAndVerification/ApplicationTests/3/SecurityIntegrationTestsForImportantComponents.yaml @@ -1,4 +1,6 @@ --- +id: SecurityIntegrationTestsForImportantComponents +title: Security integration tests for important components risk: Vulnerabilities are rising due to code changes in a complex microservice environment. measure: Implementation of essential security related integration tests. For example for authentication and authorization. @@ -13,6 +15,4 @@ samm2: v-security-testing|B|3 iso27001-2017: - 14.2.3 - 14.2.8 -title: Security integration tests for important components -id: SecurityIntegrationTestsForImportantComponents ... diff --git a/data-new/TestAndVerification/ApplicationTests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml b/data-new/TestAndVerification/ApplicationTests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml index b69b839e3..92e0a7104 100755 --- a/data-new/TestAndVerification/ApplicationTests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml +++ b/data-new/TestAndVerification/ApplicationTests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml @@ -1,4 +1,6 @@ --- +id: HighCoverageOfSecurityRelatedModuleAndIntegrationTests +title: High coverage of security related module and integration tests risk: Vulnerabilities are rising due to code changes in a complex microservice environment in not important components. measure: Implementation of security related tests via unit tests and integration tests. @@ -13,6 +15,4 @@ samm2: v-security-testing|B|3 iso27001-2017: - 14.2.3 - 14.2.8 -title: High coverage of security related module and integration tests -id: HighCoverageOfSecurityRelatedModuleAndIntegrationTests ... diff --git a/data-new/TestAndVerification/ApplicationTests/4/SmokeTest.yaml b/data-new/TestAndVerification/ApplicationTests/4/SmokeTest.yaml index a9c0b1e27..ebdcfb03c 100755 --- a/data-new/TestAndVerification/ApplicationTests/4/SmokeTest.yaml +++ b/data-new/TestAndVerification/ApplicationTests/4/SmokeTest.yaml @@ -1,4 +1,6 @@ --- +id: SmokeTest +title: Smoke Test risk: During a deployment an error might happen which leads to non-availability of the system, a part of the system or a feature. measure: Integration tests are performed against the production environment after @@ -16,6 +18,4 @@ samm2: v-security-testing|B|3 iso27001-2017: - 14.2.3 - 14.2.8 -title: Smoke Test -id: SmokeTest ... diff --git a/data-new/TestAndVerification/Consolidation/1/DefinitionOfQualityGates.yaml b/data-new/TestAndVerification/Consolidation/1/DefinitionOfQualityGates.yaml index e5d526026..c4b2b4c5c 100755 --- a/data-new/TestAndVerification/Consolidation/1/DefinitionOfQualityGates.yaml +++ b/data-new/TestAndVerification/Consolidation/1/DefinitionOfQualityGates.yaml @@ -1,4 +1,6 @@ --- +id: DefinitionOfQualityGates +title: Definition of quality gates risk: Improper examination of vulnerabilities leads to no visibility at all. measure: Quality gates for found vulnerabilities are defined. In the start it is important to not overload the security analyst, therefore the recommendation is to start with @@ -15,6 +17,4 @@ iso27001-2017: - 12.6.1 - 16.1.4 implementation: See other actions, e.g. "Treatment of defects with severity high". -title: Definition of quality gates -id: DefinitionOfQualityGates ... diff --git a/data-new/TestAndVerification/Consolidation/1/SimpleFalsePositiveTreatment.yaml b/data-new/TestAndVerification/Consolidation/1/SimpleFalsePositiveTreatment.yaml index 3cbc69cdb..5516a410c 100755 --- a/data-new/TestAndVerification/Consolidation/1/SimpleFalsePositiveTreatment.yaml +++ b/data-new/TestAndVerification/Consolidation/1/SimpleFalsePositiveTreatment.yaml @@ -1,4 +1,6 @@ --- +id: SimpleFalsePositiveTreatment +title: Simple false positive treatment risk: As false positive occure during each test, all vulnerabilities might be ignored. measure: False positives are suppressed so they will not show up on the next tests again. Most security tools have the possibility to suppress false positives. A Vulnerability @@ -16,6 +18,4 @@ samm2: i-defect-management|A|2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 16.1.6 -title: Simple false positive treatment -id: SimpleFalsePositiveTreatment ... diff --git a/data-new/TestAndVerification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml b/data-new/TestAndVerification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml index 765ca7bfc..583fa2877 100755 --- a/data-new/TestAndVerification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml +++ b/data-new/TestAndVerification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml @@ -1,4 +1,6 @@ --- +id: TreatmentOfDefectsWithSeverityHighOrHigher +title: Treatment of defects with severity high or higher risk: Vulnerabilities with severity high or higher are not visible. measure: Vulnerabilities with severity high or higher are added to the quality gate. difficultyOfImplementation: @@ -11,6 +13,4 @@ samm2: i-defect-management|B|2 iso27001-2017: - 16.1.4 - 12.6.1 -title: Treatment of defects with severity high or higher -id: TreatmentOfDefectsWithSeverityHighOrHigher ... diff --git a/data-new/TestAndVerification/Consolidation/2/SimpleVisualizationOfDefects.yaml b/data-new/TestAndVerification/Consolidation/2/SimpleVisualizationOfDefects.yaml index 151366a64..5b6218b0a 100755 --- a/data-new/TestAndVerification/Consolidation/2/SimpleVisualizationOfDefects.yaml +++ b/data-new/TestAndVerification/Consolidation/2/SimpleVisualizationOfDefects.yaml @@ -1,4 +1,6 @@ --- +id: SimpleVisualizationOfDefects +title: Simple visualization of defects risk: The security level of a component is not visible. Therefore, the motivation to enhance the security is not give. measure: Vulnerabilities are simple visualized. @@ -18,6 +20,4 @@ iso27001-2017: - 8.2.1 - 8.2.2 - 8.2.3 -title: Simple visualization of defects -id: SimpleVisualizationOfDefects ... diff --git a/data-new/TestAndVerification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml b/data-new/TestAndVerification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml index 3c5850d8a..684dc36dc 100755 --- a/data-new/TestAndVerification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml +++ b/data-new/TestAndVerification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml @@ -1,4 +1,6 @@ --- +id: IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess +title: Integration of vulnerability issues into the development process risk: To read console output of the build server to search for vulnerabilities might be difficult. Also, to check a vulnerability management system might not be a daily task for a developer. @@ -18,6 +20,4 @@ iso27001-2017: - 16.1.4 - 16.1.5 - 16.1.6 -title: Integration of vulnerability issues into the development process -id: IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess ... diff --git a/data-new/TestAndVerification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml b/data-new/TestAndVerification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml index 9485ec743..baf3a9a44 100755 --- a/data-new/TestAndVerification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml +++ b/data-new/TestAndVerification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml @@ -1,4 +1,6 @@ --- +id: TreatmentOfDefectsWithSeverityMiddle +title: Treatment of defects with severity middle risk: Vulnerabilities with severity middle are not visible. measure: Vulnerabilities with severity middle are added to the quality gate. difficultyOfImplementation: @@ -11,6 +13,4 @@ samm2: i-defect-management|B|2 iso27001-2017: - 16.1.4 - 12.6.1 -title: Treatment of defects with severity middle -id: TreatmentOfDefectsWithSeverityMiddle ... diff --git a/data-new/TestAndVerification/Consolidation/4/AdvancedVisualizationOfDefects.yaml b/data-new/TestAndVerification/Consolidation/4/AdvancedVisualizationOfDefects.yaml index af61c93f6..ace347b51 100755 --- a/data-new/TestAndVerification/Consolidation/4/AdvancedVisualizationOfDefects.yaml +++ b/data-new/TestAndVerification/Consolidation/4/AdvancedVisualizationOfDefects.yaml @@ -1,4 +1,6 @@ --- +id: AdvancedVisualizationOfDefects +title: Advanced visualization of defects risk: Correlation of the vulnerabilities of different tools to have an overview of the the overall security level per component/project/team is not given. measure: Findings are visualized per component/project/team. @@ -16,6 +18,4 @@ iso27001-2017: - 8.2.1 - 8.2.2 - 8.2.3 -title: Advanced visualization of defects -id: AdvancedVisualizationOfDefects ... diff --git a/data-new/TestAndVerification/Consolidation/4/ReproducibleDefectTickets.yaml b/data-new/TestAndVerification/Consolidation/4/ReproducibleDefectTickets.yaml index 99f23d3ae..0291e2f98 100755 --- a/data-new/TestAndVerification/Consolidation/4/ReproducibleDefectTickets.yaml +++ b/data-new/TestAndVerification/Consolidation/4/ReproducibleDefectTickets.yaml @@ -1,4 +1,6 @@ --- +id: ReproducibleDefectTickets +title: Reproducible defect tickets risk: Vulnerability descriptions are hard to understand by staff from operations and development. measure: Vulnerabilities include the test procedure to give the staff from operations @@ -16,6 +18,4 @@ iso27001-2017: - 8.2.1 - 8.2.2 - 8.2.3 -title: Reproducible defect tickets -id: ReproducibleDefectTickets ... diff --git a/data-new/TestAndVerification/Consolidation/4/TreatmentOfAllDefects.yaml b/data-new/TestAndVerification/Consolidation/4/TreatmentOfAllDefects.yaml index bf4ce825b..723ed8049 100755 --- a/data-new/TestAndVerification/Consolidation/4/TreatmentOfAllDefects.yaml +++ b/data-new/TestAndVerification/Consolidation/4/TreatmentOfAllDefects.yaml @@ -1,4 +1,6 @@ --- +id: TreatmentOfAllDefects +title: Treatment of all defects risk: Vulnerabilities with severity low are not visible. measure: All vulnerabilities are added to the quality gate. difficultyOfImplementation: @@ -10,6 +12,4 @@ samm2: i-defect-management|B|2 iso27001-2017: - 16.1.4 - 12.6.1 -title: Treatment of all defects -id: TreatmentOfAllDefects ... diff --git a/data-new/TestAndVerification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml b/data-new/TestAndVerification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml index d2916bae0..c20fc176a 100755 --- a/data-new/TestAndVerification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml +++ b/data-new/TestAndVerification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml @@ -1,4 +1,6 @@ --- +id: UsageOfAVulnerabilityManagementSystem +title: Usage of a vulnerability management system risk: Maintenance of false positives in each tool enforces a high workload. In addition a correlation of the same finding from different tools is not possible. measure: Aggregation of vulnerabilities in one tool reduce the workload to mark false @@ -18,6 +20,4 @@ iso27001-2017: - 16.1.4 - 16.1.5 - 16.1.6 -title: Usage of a vulnerability management system -id: UsageOfAVulnerabilityManagementSystem ... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/1/SimpleScan.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/1/SimpleScan.yaml index cf2bd4649..0b97d9611 100755 --- a/data-new/TestAndVerification/DynamicDepthForApplications/1/SimpleScan.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/1/SimpleScan.yaml @@ -1,4 +1,6 @@ --- +id: SimpleScan +title: Simple Scan risk: Deficient security tests are performed. Simple vulnerabilities are not detected and missing security configurations (e.g. headers) are not set. Fast feedback is not given. @@ -19,6 +21,4 @@ samm2: v-security-testing|A|1 iso27001-2017: - 14.2.3 - 14.2.8 -title: Simple Scan -id: SimpleScan ... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/2/CoverageOfClientSideDynamicComponents.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/2/CoverageOfClientSideDynamicComponents.yaml index da525be90..893a07a6b 100755 --- a/data-new/TestAndVerification/DynamicDepthForApplications/2/CoverageOfClientSideDynamicComponents.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/2/CoverageOfClientSideDynamicComponents.yaml @@ -1,4 +1,6 @@ --- +id: CoverageOfClientSideDynamicComponents +title: Coverage of client side dynamic components risk: Parts of the service are not covered during the scan, because JavaScript is not getting executed. Therefore, the co measure: Usage of a spider which executes dynamic content like JavaScript, e.g. via @@ -16,6 +18,4 @@ iso27001-2017: - 14.2.3 - 14.2.8 implementation: Ajax Spider -title: Coverage of client side dynamic components -id: CoverageOfClientSideDynamicComponents ... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/2/UsageOfDifferentRoles.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/2/UsageOfDifferentRoles.yaml index 94ed3cfe3..dbc433eb9 100755 --- a/data-new/TestAndVerification/DynamicDepthForApplications/2/UsageOfDifferentRoles.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/2/UsageOfDifferentRoles.yaml @@ -1,4 +1,6 @@ --- +id: UsageOfDifferentRoles +title: Usage of different roles risk: Parts of the service are not covered during the scan, because a login is not performed. measure: Integration of authentication with all roles used in the service. @@ -14,6 +16,4 @@ iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 14.2.3 - 14.2.8 -title: Usage of different roles -id: UsageOfDifferentRoles ... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfHiddenEndpoints.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfHiddenEndpoints.yaml index 80eaf859d..f76cf1108 100755 --- a/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfHiddenEndpoints.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfHiddenEndpoints.yaml @@ -1,4 +1,6 @@ --- +id: CoverageOfHiddenEndpoints +title: Coverage of hidden endpoints risk: Hidden endpoints of the service are not getting tracked. measure: Hidden endpoints are getting detected and included in the vulnerability scan. difficultyOfImplementation: @@ -12,6 +14,4 @@ dependsOn: samm2: v-security-testing|A|2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific -title: Coverage of hidden endpoints -id: CoverageOfHiddenEndpoints ... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfMoreInputVectors.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfMoreInputVectors.yaml index 5e44a87d6..fe3dfda45 100755 --- a/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfMoreInputVectors.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfMoreInputVectors.yaml @@ -1,4 +1,6 @@ --- +id: CoverageOfMoreInputVectors +title: Coverage of more input vectors risk: Parts of the service are not covered. For example specially formatted or coded parameters are not getting detected as parameter (e.g. parameters in REST-like URLs, parameters in JSON-Format or base64-coded parameters). @@ -14,6 +16,4 @@ dependsOn: samm2: v-security-testing|A|2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific -title: Coverage of more input vectors -id: CoverageOfMoreInputVectors ... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfSequentialOperations.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfSequentialOperations.yaml index 1b94d5098..bb4f23289 100755 --- a/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfSequentialOperations.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfSequentialOperations.yaml @@ -1,4 +1,6 @@ --- +id: CoverageOfSequentialOperations +title: Coverage of sequential operations risk: Sequential operations like workflows (e.g. login -> put products in the basket measure: Sequential operations are defined and checked by the vulnerability scanner in the defined order. @@ -14,6 +16,4 @@ samm2: v-security-testing|A|2 iso27001-2017: - 14.2.8 - 14.2.3 -title: Coverage of sequential operations -id: CoverageOfSequentialOperations ... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/3/UsageOfMultipleScanners.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/3/UsageOfMultipleScanners.yaml index 0c7e95ce5..733e7bf7f 100755 --- a/data-new/TestAndVerification/DynamicDepthForApplications/3/UsageOfMultipleScanners.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/3/UsageOfMultipleScanners.yaml @@ -1,4 +1,6 @@ --- +id: UsageOfMultipleScanners +title: Usage of multiple scanners risk: Each vulnerability scanner has different opportunities. By using just one scanner, some vulnerabilities might not be found. measure: Usage of multiple spiders and scanner enhance the coverage and the vulnerabilities. @@ -14,6 +16,4 @@ samm2: v-security-testing|A|2 iso27001-2017: - 12.6.1 - 14.2.5 -title: Usage of multiple scanners -id: UsageOfMultipleScanners ... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageAnalysis.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageAnalysis.yaml index 541bac0b2..a3ce5c0df 100755 --- a/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageAnalysis.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageAnalysis.yaml @@ -1,4 +1,6 @@ --- +id: CoverageAnalysis +title: Coverage analysis risk: Parts of the service are not still covered. measure: Check that there are no missing paths in the application with coverage-tools. difficultyOfImplementation: @@ -11,6 +13,4 @@ samm2: v-security-testing|A|2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - part of periodic review, PDCA -title: Coverage analysis -id: CoverageAnalysis ... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageOfServiceToServiceCommunication.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageOfServiceToServiceCommunication.yaml index b00ea9309..0f4aba6aa 100755 --- a/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageOfServiceToServiceCommunication.yaml +++ b/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageOfServiceToServiceCommunication.yaml @@ -1,4 +1,6 @@ --- +id: CoverageOfServiceToServiceCommunication +title: Coverage of service to service communication risk: Service to service communication is not covered. measure: Service to service communication is dumped and checked. difficultyOfImplementation: @@ -12,6 +14,4 @@ samm2: v-security-testing|A|2 iso27001-2017: - 14.2.3 - 14.2.8 -title: Coverage of service to service communication -id: CoverageOfServiceToServiceCommunication ... diff --git a/data-new/TestAndVerification/DynamicDepthForInfrastructure/1/TestForExposedServices.yaml b/data-new/TestAndVerification/DynamicDepthForInfrastructure/1/TestForExposedServices.yaml index 4a9db1b0c..4e3419e7b 100755 --- a/data-new/TestAndVerification/DynamicDepthForInfrastructure/1/TestForExposedServices.yaml +++ b/data-new/TestAndVerification/DynamicDepthForInfrastructure/1/TestForExposedServices.yaml @@ -1,4 +1,6 @@ --- +id: TestForExposedServices +title: Test for exposed services risk: Standard network segmentation and firewalling has not been performed, leading to world open cluster management ports. measure: With the help of tools the network configuration of unintenonal exposed cluster(s) @@ -18,6 +20,4 @@ iso27001-2017: - 13.1.3 - 14.2.3 - 14.2.8 -title: Test for exposed services -id: TestForExposedServices ... diff --git a/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestNetworkSegmentation.yaml b/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestNetworkSegmentation.yaml index f0ea2858c..a2eb19a92 100755 --- a/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestNetworkSegmentation.yaml +++ b/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestNetworkSegmentation.yaml @@ -1,4 +1,6 @@ --- +id: TestNetworkSegmentation +title: Test network segmentation risk: Wrong or no network segmentation of pods makes it easyer for an attacker to access a database and extract or modify data. measure: Cluster interal test needs to be performed. Integration of fine granulated @@ -15,6 +17,4 @@ iso27001-2017: - 13.1.3 - 14.2.3 - 14.2.8 -title: Test network segmentation -id: TestNetworkSegmentation ... diff --git a/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml b/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml index 067305eba..bccc17b3f 100755 --- a/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml +++ b/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml @@ -1,4 +1,6 @@ --- +id: TestOfTheConfigurationOfCloudEnvironments +title: Test of the configuration of cloud environments risk: Standard hardening practices for cloud environments are not performed leading to vulnerabilities. measure: With the help of tools the configuration of virtual environments are tested. @@ -16,6 +18,4 @@ iso27001-2017: - 12.6.1 - 14.2.3 - 14.2.8 -title: Test of the configuration of cloud environments -id: TestOfTheConfigurationOfCloudEnvironments ... diff --git a/data-new/TestAndVerification/DynamicDepthForInfrastructure/3/WeakPasswordTest.yaml b/data-new/TestAndVerification/DynamicDepthForInfrastructure/3/WeakPasswordTest.yaml index 9feb0edf5..e3e701f28 100755 --- a/data-new/TestAndVerification/DynamicDepthForInfrastructure/3/WeakPasswordTest.yaml +++ b/data-new/TestAndVerification/DynamicDepthForInfrastructure/3/WeakPasswordTest.yaml @@ -1,4 +1,6 @@ --- +id: WeakPasswordTest +title: Weak password test risk: Weak passwords in components like applications or systems, specially for privileged accounts, lead to take over of that account. measure: Automatic brute force attacks are performed. Specially the usage of standard @@ -12,6 +14,4 @@ implementation: HTC Hydra samm2: v-security-testing|A|2 iso27001-2017: - 9.4.3 -title: Weak password test -id: WeakPasswordTest ... diff --git a/data-new/TestAndVerification/DynamicDepthForInfrastructure/4/LoadTests.yaml b/data-new/TestAndVerification/DynamicDepthForInfrastructure/4/LoadTests.yaml index 4e1128c7c..e5636eeeb 100755 --- a/data-new/TestAndVerification/DynamicDepthForInfrastructure/4/LoadTests.yaml +++ b/data-new/TestAndVerification/DynamicDepthForInfrastructure/4/LoadTests.yaml @@ -1,4 +1,6 @@ --- +id: LoadTests +title: Load tests risk: As it is unknown how many requests the systems and applications can serve, due to an unexpected load the availability is disturbed. measure: Load test against the production system or a production near system is performed. @@ -12,6 +14,4 @@ iso27001-2017: - 12.1.3 - 14.2.3 - 14.2.8 -title: Load tests -id: LoadTests ... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml b/data-new/TestAndVerification/StaticDepthForApplications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml index 07ee1d3ef..60f856eee 100755 --- a/data-new/TestAndVerification/StaticDepthForApplications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml @@ -1,4 +1,6 @@ --- +id: TestOfServerSideComponentsWithKnownVulnerabilities +title: Test of server side components with known vulnerabilities risk: Server side components might have vulnerabilities. measure: Tests for known vulnerabilities in server side components (e.g. backend/middleware) are performed. @@ -14,6 +16,4 @@ samm: SA samm2: v-security-testing|A|2 iso27001-2017: - 12.6.1 -title: Test of server side components with known vulnerabilities -id: TestOfServerSideComponentsWithKnownVulnerabilities ... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/2/StaticAnalysisForImportantServerSideComponents.yaml b/data-new/TestAndVerification/StaticDepthForApplications/2/StaticAnalysisForImportantServerSideComponents.yaml index 7ed490ab2..763280417 100755 --- a/data-new/TestAndVerification/StaticDepthForApplications/2/StaticAnalysisForImportantServerSideComponents.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/2/StaticAnalysisForImportantServerSideComponents.yaml @@ -1,4 +1,6 @@ --- +id: StaticAnalysisForImportantServerSideComponents +title: Static analysis for important server side components risk: Important parts in the source code of the middleware have vulnerabilities. measure: Usage of static analysis tools for important parts of the middleware are used. Static analysis uses for example string matching algorithms and/or dataflow @@ -14,6 +16,4 @@ dependsOn: samm2: v-security-testing|A|2 iso27001-2017: - 12.6.1 -title: Static analysis for important server side components -id: StaticAnalysisForImportantServerSideComponents ... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/3/StaticAnalysisForImportantClientSideComponents.yaml b/data-new/TestAndVerification/StaticDepthForApplications/3/StaticAnalysisForImportantClientSideComponents.yaml index 2f2f7e5a0..b7e8e1428 100755 --- a/data-new/TestAndVerification/StaticDepthForApplications/3/StaticAnalysisForImportantClientSideComponents.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/3/StaticAnalysisForImportantClientSideComponents.yaml @@ -1,4 +1,6 @@ --- +id: StaticAnalysisForImportantClientSideComponents +title: Static analysis for important client side components risk: Important parts in the source code of the frontend have vulnerabilities. measure: Usage of static analysis tools for important parts of the frontend are used. Static analysis uses for example string matching algorithms and/or dataflow analysis. @@ -17,6 +19,4 @@ iso27001-2017: - 12.6.1 dependsOn: - Defined build process -title: Static analysis for important client side components -id: StaticAnalysisForImportantClientSideComponents ... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml b/data-new/TestAndVerification/StaticDepthForApplications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml index 45fea1028..8c368a1da 100755 --- a/data-new/TestAndVerification/StaticDepthForApplications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml @@ -1,4 +1,6 @@ --- +id: TestOfClientSideComponentsWithKnownVulnerabilities +title: Test of client side components with known vulnerabilities risk: Client side components might have vulnerabilities. measure: Tests for known vulnerabilities in components of the frontend are performed. difficultyOfImplementation: @@ -14,6 +16,4 @@ implementation: samm2: v-security-testing|A|2 iso27001-2017: - 12.6.1 -title: Test of client side components with known vulnerabilities -id: TestOfClientSideComponentsWithKnownVulnerabilities ... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/4/ExclusionOfSourceCodeDuplicates.yaml b/data-new/TestAndVerification/StaticDepthForApplications/4/ExclusionOfSourceCodeDuplicates.yaml index 5889f78ce..cf37ab34c 100755 --- a/data-new/TestAndVerification/StaticDepthForApplications/4/ExclusionOfSourceCodeDuplicates.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/4/ExclusionOfSourceCodeDuplicates.yaml @@ -1,4 +1,6 @@ --- +id: ExclusionOfSourceCodeDuplicates +title: Exclusion of source code duplicates risk: Duplicates in source code might influence the stability of the application. measure: Automatic Detection and manual removal of duplicates in source code. difficultyOfImplementation: @@ -14,6 +16,4 @@ iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 14.2.1 - 14.2.5 -title: Exclusion of source code duplicates -id: ExclusionOfSourceCodeDuplicates ... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllComponentsOrlibraries.yaml b/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllComponentsOrlibraries.yaml index ef123ee17..af0b2824f 100755 --- a/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllComponentsOrlibraries.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllComponentsOrlibraries.yaml @@ -1,4 +1,6 @@ --- +id: StaticAnalysisForAllComponentsOrlibraries +title: Static analysis for all components/libraries risk: Used components like libraries and legacy applications might have vulnerabilities measure: Usage of a static analysis for all used components. difficultyOfImplementation: @@ -12,6 +14,4 @@ dependsOn: samm2: v-security-testing|A|2 iso27001-2017: - 12.6.1 -title: Static analysis for all components/libraries -id: StaticAnalysisForAllComponentsOrlibraries ... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllSelfWrittenComponents.yaml b/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllSelfWrittenComponents.yaml index 5915ef37d..55aad488a 100755 --- a/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllSelfWrittenComponents.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllSelfWrittenComponents.yaml @@ -1,4 +1,6 @@ --- +id: StaticAnalysisForAllSelfWrittenComponents +title: Static analysis for all self written components risk: Parts in the source code of the frontend or middleware have vulnerabilities. measure: Usage of static analysis tools for all parts of the middleware and frontend. Static analysis uses for example string matching algorithms and/or dataflow analysis. @@ -14,6 +16,4 @@ dependsOn: samm2: v-security-testing|A|2 iso27001-2017: - 12.6.1 -title: Static analysis for all self written components -id: StaticAnalysisForAllSelfWrittenComponents ... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/4/StylisticAnalysis.yaml b/data-new/TestAndVerification/StaticDepthForApplications/4/StylisticAnalysis.yaml index 9e1985cfa..e052d73f0 100755 --- a/data-new/TestAndVerification/StaticDepthForApplications/4/StylisticAnalysis.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/4/StylisticAnalysis.yaml @@ -1,4 +1,6 @@ --- +id: StylisticAnalysis +title: Stylistic analysis risk: False source code indenting might lead to vulnerabilities. measure: Analysis of compliance to style guides of the source code ensures that source code indenting rules are met. @@ -13,6 +15,4 @@ iso27001-2017: - 12.6.1 - 14.2.1 - 14.2.5 -title: Stylistic analysis -id: StylisticAnalysis ... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/4/UsageOfMultipleAnalysers.yaml b/data-new/TestAndVerification/StaticDepthForApplications/4/UsageOfMultipleAnalysers.yaml index ff4c0bc71..439306bd8 100755 --- a/data-new/TestAndVerification/StaticDepthForApplications/4/UsageOfMultipleAnalysers.yaml +++ b/data-new/TestAndVerification/StaticDepthForApplications/4/UsageOfMultipleAnalysers.yaml @@ -1,4 +1,6 @@ --- +id: UsageOfMultipleAnalysers +title: Usage of multiple analysers risk: Each vulnerability analyser has different opportunities. By using just one analyser, some vulnerabilities might not be found. measure: Usage of multiple static tools to find more vulnerabilities. @@ -16,6 +18,4 @@ dependsOn: - Test of server side components with known vulnerabilities - Test of client side components with known vulnerabilities - Static analysis for all self written components -title: Usage of multiple analysers -id: UsageOfMultipleAnalysers ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/1/StoredSecrets.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/1/StoredSecrets.yaml index 8f4354021..8e7a7cf3e 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/1/StoredSecrets.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/1/StoredSecrets.yaml @@ -1,4 +1,6 @@ --- +id: StoredSecrets +title: Stored Secrets risk: Stored secrets in git history, in container images or directly in code shouldn't exists because they might be read unauthorized. measure: Test for secrets in code, container images and history @@ -15,6 +17,4 @@ iso27001-2017: - vcs usage is not explicitly covered by ISO 27001 - too specific - 9.4.3 - 10.1.2 -title: Stored Secrets -id: StoredSecrets ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestClusterDeploymentResources.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestClusterDeploymentResources.yaml index 320455d0e..e2701e46f 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestClusterDeploymentResources.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestClusterDeploymentResources.yaml @@ -1,4 +1,6 @@ --- +id: TestClusterDeploymentResources +title: Test cluster deployment resources risk: The deployment configuration (e.g. kubernetes deployment resources) might contain unsecured configurations. measure: Test the deployment configuration for virtualized environments for unsecured @@ -16,6 +18,4 @@ iso27001-2017: - 12.6.1 - 14.2.3 - 14.2.8 -title: Test cluster deployment resources -id: TestClusterDeploymentResources ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestOfVirtualizedEnvironments.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestOfVirtualizedEnvironments.yaml index d3516201f..258b104a3 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestOfVirtualizedEnvironments.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestOfVirtualizedEnvironments.yaml @@ -1,4 +1,6 @@ --- +id: TestOfVirtualizedEnvironments +title: Test of virtualized environments risk: Virtualized environments (e.g. via Container Images) might contains unsecure configurations. measure: Test virtualized environments for unsecured configurations. @@ -11,6 +13,4 @@ implementation: - Dive to inspect a container images - Cluster Scanner (will be open sourced soon) to check different aspects samm2: v-security-testing|A|1 -title: Test of virtualized environments -id: TestOfVirtualizedEnvironments ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheClouldConfiguration.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheClouldConfiguration.yaml index 32828d37a..66feac6cd 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheClouldConfiguration.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheClouldConfiguration.yaml @@ -1,4 +1,6 @@ --- +id: TestTheClouldConfiguration +title: Test the clould configuration risk: Standard hardening practices for cloud environments are not performed leading to vulnerabilities. measure: With the help of tools the configuration of virtual environments are tested. @@ -16,6 +18,4 @@ iso27001-2017: - 12.6.1 - 14.2.3 - 14.2.8 -title: Test the clould configuration -id: TestTheClouldConfiguration ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml index 2d3a5441b..35c8473cb 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml @@ -1,4 +1,6 @@ --- +id: TestTheDefinitionOfVirtualizedEnvironments +title: Test the definition of virtualized environments risk: The definition of virtualized environments (e.g. via Dockerfile) might contains unsecure configurations. measure: Test the definition of virtualized environments for unsecured configurations. @@ -18,6 +20,4 @@ iso27001-2017: - 14.2.3 - 14.2.8 - 14.2.1 -title: Test the definition of virtualized environments -id: TestTheDefinitionOfVirtualizedEnvironments ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForImageLifetime.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForImageLifetime.yaml index 0fc846f25..af82cbe8c 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForImageLifetime.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForImageLifetime.yaml @@ -1,4 +1,6 @@ --- +id: CheckForImageLifetime +title: Check for image lifetime risk: Old container images in production indicate that patch management is not performed and therefore vulnerabilities might exists. measure: Check the image age of containers in production. @@ -12,6 +14,4 @@ samm2: v-security-testing|A|1 iso27001-2017: - 12.6.1 - 14.2.5 -title: Check for image lifetime -id: CheckForImageLifetime ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForMalware.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForMalware.yaml index cd03bb842..384fb4959 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForMalware.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForMalware.yaml @@ -1,4 +1,6 @@ --- +id: CheckForMalware +title: Check for malware risk: Third party might include malware. Ether due to the maintainer (e.g. typo squatting of an image name and using the wrong image) or by an attacker on behalf of the maintainer with stolen credentials. @@ -13,6 +15,4 @@ implementation: ~ samm2: v-security-testing|A|2 iso27001-2017: - 12.2.1 -title: Check for malware -id: CheckForMalware ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForNewImageVersion.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForNewImageVersion.yaml index 40e8f1598..e9c1795ab 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForNewImageVersion.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForNewImageVersion.yaml @@ -1,4 +1,6 @@ --- +id: CheckForNewImageVersion +title: Check for new image version risk: When a new version of an image is available, it might fixes security vulnerabilities. measure: Check for new images of containers in production. difficultyOfImplementation: @@ -12,6 +14,4 @@ iso27001-2017: - 12.6.1 - 14.2.5 - 12.2.1 -title: Check for new image version -id: CheckForNewImageVersion ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CheckForKnownVulnerabilities.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CheckForKnownVulnerabilities.yaml index 1f29ece4e..88cefaeb6 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CheckForKnownVulnerabilities.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CheckForKnownVulnerabilities.yaml @@ -1,4 +1,6 @@ --- +id: CheckForKnownVulnerabilities +title: Check for known vulnerabilities risk: Known vulnerabilities in infrastructure components like container images might get exploited. measure: Check for known vulnerabilities @@ -14,6 +16,4 @@ implementation: samm2: v-security-testing|A|2 iso27001-2017: - 12.6.1 -title: Check for known vulnerabilities -id: CheckForKnownVulnerabilities ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml index 7d7329d45..484ba0b62 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml @@ -1,4 +1,6 @@ --- +id: CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions +title: Correlate known vulnerabilities in infrastructure with new image versions risk: TODO. measure: TODO difficultyOfImplementation: @@ -17,6 +19,4 @@ samm2: v-security-testing|A|1 iso27001-2017: - 12.6.1 - 14.2.1 -title: Correlate known vulnerabilities in infrastructure with new image versions -id: CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions ... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml index 090f6c298..06dd279a8 100755 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml +++ b/data-new/TestAndVerification/StaticDepthForInfrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml @@ -1,4 +1,6 @@ --- +id: TestOfInfrastructureComponentsForKnownVulnerabilities +title: Test of infrastructure components for known vulnerabilities risk: Infrastructure components might have vulnerabilities. measure: Test for known vulnerabilities in infrastructure components. Often, the only way to respond to known vulnerabilities in operating system packages is to accept @@ -20,6 +22,4 @@ samm2: v-security-testing|A|1 iso27001-2017: - 12.6.1 - 14.2.1 -title: Test of infrastructure components for known vulnerabilities -id: TestOfInfrastructureComponentsForKnownVulnerabilities ... diff --git a/data-new/TestAndVerification/Test-Intensity/1/DefaultSettingsForIntensity.yaml b/data-new/TestAndVerification/Test-Intensity/1/DefaultSettingsForIntensity.yaml index 3dc132d11..e96f0022a 100755 --- a/data-new/TestAndVerification/Test-Intensity/1/DefaultSettingsForIntensity.yaml +++ b/data-new/TestAndVerification/Test-Intensity/1/DefaultSettingsForIntensity.yaml @@ -1,4 +1,6 @@ --- +id: DefaultSettingsForIntensity +title: Default settings for intensity risk: Time pressure and ignorance might lead to false predictions for the test intensity. measure: The intensity of the used tools are not modified to safe time. difficultyOfImplementation: @@ -11,6 +13,4 @@ iso27001-2017: - 12.6.1 - 14.2.1 - 14.2.5 -title: Default settings for intensity -id: DefaultSettingsForIntensity ... diff --git a/data-new/TestAndVerification/Test-Intensity/1/HighTestIntensity.yaml b/data-new/TestAndVerification/Test-Intensity/1/HighTestIntensity.yaml index 278b96a37..2a824a242 100755 --- a/data-new/TestAndVerification/Test-Intensity/1/HighTestIntensity.yaml +++ b/data-new/TestAndVerification/Test-Intensity/1/HighTestIntensity.yaml @@ -1,4 +1,6 @@ --- +id: HighTestIntensity +title: High test intensity risk: A too small intensity or a too high confidence might lead to not visible vulnerabilities. measure: A deep scan with high test intensity and a low confidence threshold is performed. difficultyOfImplementation: @@ -11,6 +13,4 @@ iso27001-2017: - 12.6.1 - 14.2.1 - 14.2.5 -title: High test intensity -id: HighTestIntensity ... diff --git a/data-new/TestAndVerification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml b/data-new/TestAndVerification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml index c2b1398f8..c290d21e5 100755 --- a/data-new/TestAndVerification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml +++ b/data-new/TestAndVerification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml @@ -1,4 +1,6 @@ --- +id: DeactivatingOfUnneededTests +title: Deactivating of unneeded tests risk: As tools cover a wide range of different vulnerability tests, they might not match the used components. Therefore, they need more time and resources as they need and the feedback loops takes too much time. @@ -15,6 +17,4 @@ iso27001-2017: - 12.6.1 - 14.2.1 - 14.2.5 -title: Deactivating of unneeded tests -id: DeactivatingOfUnneededTests ... diff --git a/data-new/TestAndVerification/Test-Intensity/2/RegularTests.yaml b/data-new/TestAndVerification/Test-Intensity/2/RegularTests.yaml index a24f9be39..8d793e3d6 100755 --- a/data-new/TestAndVerification/Test-Intensity/2/RegularTests.yaml +++ b/data-new/TestAndVerification/Test-Intensity/2/RegularTests.yaml @@ -1,4 +1,6 @@ --- +id: RegularTests +title: Regular tests risk: After pushing source code to the version control system, any delay in receiving feedback on defects makes them harder for the developer to remediate. measure: On each push and/or at given intervals automatic security tests are performed. @@ -13,6 +15,4 @@ iso27001-2017: - 14.2.3 - 14.2.8 - 14.2.9 -title: Regular tests -id: RegularTests ... diff --git a/data-new/TestAndVerification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml b/data-new/TestAndVerification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml index a196b2fdb..84aa2effd 100755 --- a/data-new/TestAndVerification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml +++ b/data-new/TestAndVerification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml @@ -1,4 +1,6 @@ --- +id: CreationAndApplicationOfATestingConcept +title: Creation and application of a testing concept risk: Scans might use a too small or too high test intensity. measure: A testing concept considering the amount of time per scan/intensity is created and applied. A dynamic analysis needs more time than a static analysis. The dynamic @@ -16,6 +18,4 @@ iso27001-2017: - 14.2.1 - 14.2.5 - 12.6.1 -title: Creation and application of a testing concept -id: CreationAndApplicationOfATestingConcept ... From 4b6eaacbaa75eeb1fecd3dbf6228972f9a4336a1 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 11 Feb 2021 19:04:36 +0100 Subject: [PATCH 6/6] Use composer --- Dockerfile | 14 +- .../Build/1/DefinedBuildProcess.yaml | 23 - ...stingOfArtifactsInVirtualEnvironments.yaml | 24 - .../Build/3/SigningOfArtifacts.yaml | 22 - .../Build/3/SigningOfCode.yaml | 19 - .../1/DefinedDeploymentProcess.yaml | 18 - .../Deployment/2/BackupBeforeDeployment.yaml | 22 - ...nmentDependingConfigurationParameters.yaml | 18 - .../Deployment/2/UsageOfTrustedImages.yaml | 21 - .../3/HandoverOfConfidentialParameters.yaml | 26 - .../3/InventoryOfRunningArtifacts.yaml | 19 - .../3/RollingUpdateOnDeployment.yaml | 19 - .../3/SameArtifactForEnvironments.yaml | 22 - .../Deployment/3/UsageOfFeatureToggles.yaml | 23 - .../Deployment/4/BlueOrgreenDeployment.yaml | 25 - .../1/APatchPolicyIsDefined.yaml | 17 - .../1/AutomatedPrsForPatches.yaml | 22 - .../2/NightlyBuildOfImages.yaml | 14 - .../2/ReductionOfTheAttackSurface.yaml | 20 - .../2/UsageOfAMaximumLifetimeForImages.yaml | 18 - ...UsageOfAShortMaximumLifetimeForImages.yaml | 25 - ...rmationSecurityTargetsAreCommunicated.yaml | 17 - ...SimpleThreatModellingOnTechnicalLevel.yaml | 56 - ...fSimpleThreatModellingOnBusinessLevel.yaml | 19 - .../2/CreationOfSimpleAbuseStories.yaml | 22 - .../ConductionOfAdvancedThreatModelling.yaml | 31 - .../4/CreationOfAdvancedAbuseStories.yaml | 25 - ...ecurityTrainingsForSoftwareDevelopers.yaml | 19 - .../1/SecurityConsultingOnRequest.yaml | 19 - .../2/EachTeamHasASecurityChampion.yaml | 19 - .../2/RegularSecurityTrainingForAll.yaml | 20 - ...arSecurityTrainingOfSecurityChampions.yaml | 18 - .../2/RewardOfGoodCommunication.yaml | 21 - ...ionOfBuild-It,Break-It,Fix-ItContests.yaml | 18 - ...WithDevelopersAndSystemAdministrators.yaml | 20 - .../3/RegularSecurityTrainingForEveryone.yaml | 17 - .../3/Security-Lessoned-Learned.yaml | 16 - .../4/AligningSecurityInTeams.yaml | 18 - ...tionOfCollaborativeTeamSecurityChecks.yaml | 16 - .../4/ConductionOfWarGames.yaml | 18 - ...pleBcdrPracticesForCriticalComponents.yaml | 17 - .../3/ApprovalByReviewingAnyNewVersion.yaml | 19 - .../DefinitionOfAChangeManagementProcess.yaml | 15 - .../PreventionOfUnauthorizedInstallation.yaml | 19 - .../1/ApplicationHardeningLevel1.yaml | 44 - .../2/App.HardeningLevel2.yaml | 25 - .../3/App.HardeningLevel3.yaml | 26 - .../4/FullCoverageOfApp.HardeningLevel3.yaml | 26 - ...solatedNetworksForVirtualEnvironments.yaml | 23 - .../1/SimpleAccessControlForSystems.yaml | 18 - .../UsageOfTestAndProductionEnvironments.yaml | 18 - ...nsAreRunningInVirtualizedEnvironments.yaml | 16 - .../2/CheckingTheSourcesOfUsedLibraries.yaml | 18 - .../2/FilterOutgoingTraffic.yaml | 20 - .../2/TheClusterIsHardened.yaml | 22 - ...UsageOfSecurityByDefaultForComponents.yaml | 20 - .../2/VirtualEnvironmentsAreLimited.yaml | 21 - .../InfrastructureHardening/3/2Fa.yaml | 19 - .../3/ImmutableInfrastructure.yaml | 20 - .../3/InfrastructureAsCode.yaml | 20 - ...leBasedAuthenticationAndAuthorization.yaml | 20 - .../InfrastructureHardening/3/Versioning.yaml | 20 - ...ionOfSystemCallsInVirtualEnvironments.yaml | 17 - .../4/Microservice-Architecture.yaml | 16 - ...onNearEnvironmentsAreUsedByDevelopers.yaml | 23 - .../4/UsageOfAChaosMonkey.yaml | 18 - .../Logging/1/CentralizedSystemLogging.yaml | 18 - .../Logging/1/LoggingOfSecurityEvents.yaml | 18 - .../Logging/1/PiiLoggingConcept.yaml | 18 - .../Logging/2/VisualizedLogging.yaml | 22 - .../3/CentralizedApplicationLogging.yaml | 22 - .../4/CorrelationOfSecurityEvents.yaml | 20 - .../1/SimpleApplicationMetrics.yaml | 16 - .../Monitoring/1/SimpleSystemMetrics.yaml | 18 - .../Monitoring/2/Alerting.yaml | 20 - .../Monitoring/2/VisualizedMetrics.yaml | 17 - ...dvancedAvailablityAndStabilityMetrics.yaml | 18 - .../3/AdvancedWebapplicationMetrics.yaml | 18 - .../3/DeactivationOfUnusedMetrics.yaml | 17 - .../Monitoring/3/GroupingOfMetrics.yaml | 15 - .../Monitoring/3/TargetedAlerting.yaml | 20 - .../4/CoverageAndControlMetrics.yaml | 22 - .../Monitoring/4/DefenceMetrics.yaml | 21 - .../4/MetricsAreCombinedWithTests.yaml | 16 - .../4/ScreensWithMetricVisualization.yaml | 18 - ...curityUnitTestsForImportantComponents.yaml | 22 - ...ntegrationTestsForImportantComponents.yaml | 18 - ...urityRelatedModuleAndIntegrationTests.yaml | 18 - .../ApplicationTests/4/SmokeTest.yaml | 21 - .../1/DefinitionOfQualityGates.yaml | 20 - .../1/SimpleFalsePositiveTreatment.yaml | 21 - ...mentOfDefectsWithSeverityHighOrHigher.yaml | 16 - .../2/SimpleVisualizationOfDefects.yaml | 23 - ...bilityIssuesIntoTheDevelopmentProcess.yaml | 23 - .../TreatmentOfDefectsWithSeverityMiddle.yaml | 16 - .../4/AdvancedVisualizationOfDefects.yaml | 21 - .../4/ReproducibleDefectTickets.yaml | 21 - .../4/TreatmentOfAllDefects.yaml | 15 - ...UsageOfAVulnerabilityManagementSystem.yaml | 23 - .../1/SimpleScan.yaml | 24 - ...CoverageOfClientSideDynamicComponents.yaml | 21 - .../2/UsageOfDifferentRoles.yaml | 19 - .../3/CoverageOfHiddenEndpoints.yaml | 17 - .../3/CoverageOfMoreInputVectors.yaml | 19 - .../3/CoverageOfSequentialOperations.yaml | 19 - .../3/UsageOfMultipleScanners.yaml | 19 - .../4/CoverageAnalysis.yaml | 16 - ...verageOfServiceToServiceCommunication.yaml | 17 - .../1/TestForExposedServices.yaml | 23 - .../2/TestNetworkSegmentation.yaml | 20 - ...OfTheConfigurationOfCloudEnvironments.yaml | 21 - .../3/WeakPasswordTest.yaml | 17 - .../4/LoadTests.yaml | 17 - ...ideComponentsWithKnownVulnerabilities.yaml | 19 - ...lysisForImportantServerSideComponents.yaml | 19 - ...lysisForImportantClientSideComponents.yaml | 22 - ...ideComponentsWithKnownVulnerabilities.yaml | 19 - .../4/ExclusionOfSourceCodeDuplicates.yaml | 19 - ...icAnalysisForAllComponentsOrlibraries.yaml | 17 - ...icAnalysisForAllSelfWrittenComponents.yaml | 19 - .../4/StylisticAnalysis.yaml | 18 - .../4/UsageOfMultipleAnalysers.yaml | 21 - .../1/StoredSecrets.yaml | 20 - .../2/TestClusterDeploymentResources.yaml | 21 - .../2/TestOfVirtualizedEnvironments.yaml | 16 - .../2/TestTheClouldConfiguration.yaml | 21 - ...heDefinitionOfVirtualizedEnvironments.yaml | 23 - .../3/CheckForImageLifetime.yaml | 17 - .../3/CheckForMalware.yaml | 18 - .../3/CheckForNewImageVersion.yaml | 17 - .../4/CheckForKnownVulnerabilities.yaml | 19 - ...sInInfrastructureWithNewImageVersions.yaml | 22 - ...tureComponentsForKnownVulnerabilities.yaml | 25 - .../1/DefaultSettingsForIntensity.yaml | 16 - .../Test-Intensity/1/HighTestIntensity.yaml | 16 - .../2/DeactivatingOfUnneededTests.yaml | 20 - .../Test-Intensity/2/RegularTests.yaml | 18 - ...eationAndApplicationOfATestingConcept.yaml | 21 - newFolder-Migration-2021.php | 27 +- startDocker.bash | 3 +- vendor/autoload.php | 7 - vendor/bin/yaml-lint | 1 - vendor/composer/ClassLoader.php | 445 ----- vendor/composer/LICENSE | 19 - vendor/composer/autoload_classmap.php | 9 - vendor/composer/autoload_files.php | 11 - vendor/composer/autoload_namespaces.php | 11 - vendor/composer/autoload_psr4.php | 12 - vendor/composer/autoload_real.php | 73 - vendor/composer/autoload_static.php | 64 - vendor/composer/installed.json | 354 ---- vendor/erusev/parsedown-extra/.travis.yml | 30 - vendor/erusev/parsedown-extra/LICENSE.txt | 20 - .../erusev/parsedown-extra/ParsedownExtra.php | 538 ------ vendor/erusev/parsedown-extra/README.md | 31 - vendor/erusev/parsedown-extra/composer.json | 33 - .../erusev/parsedown-extra/phpunit.xml.dist | 8 - .../test/ParsedownExtraTest.php | 11 - .../parsedown-extra/test/TestParsedown.php | 9 - .../test/data/abbreviation.html | 3 - .../parsedown-extra/test/data/abbreviation.md | 7 - .../test/data/compound_footnote.html | 18 - .../test/data/compound_footnote.md | 14 - .../test/data/definition_list.html | 17 - .../test/data/definition_list.md | 20 - .../parsedown-extra/test/data/footnote.html | 20 - .../parsedown-extra/test/data/footnote.md | 11 - .../test/data/markdown_inside_markup.html | 25 - .../test/data/markdown_inside_markup.md | 32 - .../test/data/special_attributes.html | 6 - .../test/data/special_attributes.md | 12 - vendor/erusev/parsedown/LICENSE.txt | 20 - vendor/erusev/parsedown/Parsedown.php | 1712 ----------------- vendor/erusev/parsedown/README.md | 86 - vendor/erusev/parsedown/composer.json | 33 - vendor/mnapoli/front-yaml/.gitattributes | 5 - vendor/mnapoli/front-yaml/.gitignore | 5 - vendor/mnapoli/front-yaml/LICENSE | 18 - vendor/mnapoli/front-yaml/README.md | 86 - vendor/mnapoli/front-yaml/composer.json | 23 - vendor/mnapoli/front-yaml/phpunit.xml.dist | 21 - .../Bridge/CommonMark/CommonMarkParser.php | 33 - .../src/Bridge/Parsedown/ParsedownParser.php | 33 - .../src/Bridge/Symfony/SymfonyYAMLParser.php | 38 - vendor/mnapoli/front-yaml/src/Document.php | 53 - .../src/Markdown/MarkdownParser.php | 26 - vendor/mnapoli/front-yaml/src/Parser.php | 84 - .../front-yaml/src/YAML/YAMLParser.php | 26 - .../symfony/deprecation-contracts/.gitignore | 3 - .../deprecation-contracts/CHANGELOG.md | 5 - vendor/symfony/deprecation-contracts/LICENSE | 19 - .../symfony/deprecation-contracts/README.md | 26 - .../deprecation-contracts/composer.json | 35 - .../deprecation-contracts/function.php | 27 - vendor/symfony/polyfill-ctype/Ctype.php | 227 --- vendor/symfony/polyfill-ctype/LICENSE | 19 - vendor/symfony/polyfill-ctype/README.md | 12 - vendor/symfony/polyfill-ctype/bootstrap.php | 50 - vendor/symfony/polyfill-ctype/bootstrap80.php | 46 - vendor/symfony/polyfill-ctype/composer.json | 38 - vendor/symfony/yaml/CHANGELOG.md | 224 --- vendor/symfony/yaml/Command/LintCommand.php | 248 --- vendor/symfony/yaml/Dumper.php | 142 -- vendor/symfony/yaml/Escaper.php | 103 - .../symfony/yaml/Exception/DumpException.php | 21 - .../yaml/Exception/ExceptionInterface.php | 21 - .../symfony/yaml/Exception/ParseException.php | 133 -- .../yaml/Exception/RuntimeException.php | 21 - vendor/symfony/yaml/Inline.php | 794 -------- vendor/symfony/yaml/LICENSE | 19 - vendor/symfony/yaml/Parser.php | 1308 ------------- vendor/symfony/yaml/README.md | 13 - vendor/symfony/yaml/Resources/bin/yaml-lint | 45 - vendor/symfony/yaml/Tag/TaggedValue.php | 38 - vendor/symfony/yaml/Unescaper.php | 138 -- vendor/symfony/yaml/Yaml.php | 102 - vendor/symfony/yaml/composer.json | 42 - 217 files changed, 29 insertions(+), 10857 deletions(-) delete mode 100755 data-new/BuildAndDeployment/Build/1/DefinedBuildProcess.yaml delete mode 100755 data-new/BuildAndDeployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml delete mode 100755 data-new/BuildAndDeployment/Build/3/SigningOfArtifacts.yaml delete mode 100755 data-new/BuildAndDeployment/Build/3/SigningOfCode.yaml delete mode 100755 data-new/BuildAndDeployment/Deployment/1/DefinedDeploymentProcess.yaml delete mode 100755 data-new/BuildAndDeployment/Deployment/2/BackupBeforeDeployment.yaml delete mode 100755 data-new/BuildAndDeployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml delete mode 100755 data-new/BuildAndDeployment/Deployment/2/UsageOfTrustedImages.yaml delete mode 100755 data-new/BuildAndDeployment/Deployment/3/HandoverOfConfidentialParameters.yaml delete mode 100755 data-new/BuildAndDeployment/Deployment/3/InventoryOfRunningArtifacts.yaml delete mode 100755 data-new/BuildAndDeployment/Deployment/3/RollingUpdateOnDeployment.yaml delete mode 100755 data-new/BuildAndDeployment/Deployment/3/SameArtifactForEnvironments.yaml delete mode 100755 data-new/BuildAndDeployment/Deployment/3/UsageOfFeatureToggles.yaml delete mode 100755 data-new/BuildAndDeployment/Deployment/4/BlueOrgreenDeployment.yaml delete mode 100755 data-new/BuildAndDeployment/PatchManagement/1/APatchPolicyIsDefined.yaml delete mode 100755 data-new/BuildAndDeployment/PatchManagement/1/AutomatedPrsForPatches.yaml delete mode 100755 data-new/BuildAndDeployment/PatchManagement/2/NightlyBuildOfImages.yaml delete mode 100755 data-new/BuildAndDeployment/PatchManagement/2/ReductionOfTheAttackSurface.yaml delete mode 100755 data-new/BuildAndDeployment/PatchManagement/2/UsageOfAMaximumLifetimeForImages.yaml delete mode 100755 data-new/BuildAndDeployment/PatchManagement/4/UsageOfAShortMaximumLifetimeForImages.yaml delete mode 100755 data-new/CultureAndOrganization/Design/0/InformationSecurityTargetsAreCommunicated.yaml delete mode 100755 data-new/CultureAndOrganization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml delete mode 100755 data-new/CultureAndOrganization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml delete mode 100755 data-new/CultureAndOrganization/Design/2/CreationOfSimpleAbuseStories.yaml delete mode 100755 data-new/CultureAndOrganization/Design/3/ConductionOfAdvancedThreatModelling.yaml delete mode 100755 data-new/CultureAndOrganization/Design/4/CreationOfAdvancedAbuseStories.yaml delete mode 100755 data-new/CultureAndOrganization/EducationAndGuidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml delete mode 100755 data-new/CultureAndOrganization/EducationAndGuidance/1/SecurityConsultingOnRequest.yaml delete mode 100755 data-new/CultureAndOrganization/EducationAndGuidance/2/EachTeamHasASecurityChampion.yaml delete mode 100755 data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingForAll.yaml delete mode 100755 data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingOfSecurityChampions.yaml delete mode 100755 data-new/CultureAndOrganization/EducationAndGuidance/2/RewardOfGoodCommunication.yaml delete mode 100755 data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml delete mode 100755 data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml delete mode 100755 data-new/CultureAndOrganization/EducationAndGuidance/3/RegularSecurityTrainingForEveryone.yaml delete mode 100755 data-new/CultureAndOrganization/EducationAndGuidance/3/Security-Lessoned-Learned.yaml delete mode 100755 data-new/CultureAndOrganization/EducationAndGuidance/4/AligningSecurityInTeams.yaml delete mode 100755 data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml delete mode 100755 data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfWarGames.yaml delete mode 100755 data-new/CultureAndOrganization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml delete mode 100755 data-new/CultureAndOrganization/Process/3/ApprovalByReviewingAnyNewVersion.yaml delete mode 100755 data-new/CultureAndOrganization/Process/3/DefinitionOfAChangeManagementProcess.yaml delete mode 100755 data-new/CultureAndOrganization/Process/3/PreventionOfUnauthorizedInstallation.yaml delete mode 100755 data-new/Implementation/ApplicationHardening/1/ApplicationHardeningLevel1.yaml delete mode 100755 data-new/Implementation/ApplicationHardening/2/App.HardeningLevel2.yaml delete mode 100755 data-new/Implementation/ApplicationHardening/3/App.HardeningLevel3.yaml delete mode 100755 data-new/Implementation/ApplicationHardening/4/FullCoverageOfApp.HardeningLevel3.yaml delete mode 100755 data-new/Implementation/InfrastructureHardening/1/IsolatedNetworksForVirtualEnvironments.yaml delete mode 100755 data-new/Implementation/InfrastructureHardening/1/SimpleAccessControlForSystems.yaml delete mode 100755 data-new/Implementation/InfrastructureHardening/1/UsageOfTestAndProductionEnvironments.yaml delete mode 100755 data-new/Implementation/InfrastructureHardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml delete mode 100755 data-new/Implementation/InfrastructureHardening/2/CheckingTheSourcesOfUsedLibraries.yaml delete mode 100755 data-new/Implementation/InfrastructureHardening/2/FilterOutgoingTraffic.yaml delete mode 100755 data-new/Implementation/InfrastructureHardening/2/TheClusterIsHardened.yaml delete mode 100755 data-new/Implementation/InfrastructureHardening/2/UsageOfSecurityByDefaultForComponents.yaml delete mode 100755 data-new/Implementation/InfrastructureHardening/2/VirtualEnvironmentsAreLimited.yaml delete mode 100755 data-new/Implementation/InfrastructureHardening/3/2Fa.yaml delete mode 100755 data-new/Implementation/InfrastructureHardening/3/ImmutableInfrastructure.yaml delete mode 100755 data-new/Implementation/InfrastructureHardening/3/InfrastructureAsCode.yaml delete mode 100755 data-new/Implementation/InfrastructureHardening/3/RoleBasedAuthenticationAndAuthorization.yaml delete mode 100755 data-new/Implementation/InfrastructureHardening/3/Versioning.yaml delete mode 100755 data-new/Implementation/InfrastructureHardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml delete mode 100755 data-new/Implementation/InfrastructureHardening/4/Microservice-Architecture.yaml delete mode 100755 data-new/Implementation/InfrastructureHardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml delete mode 100755 data-new/Implementation/InfrastructureHardening/4/UsageOfAChaosMonkey.yaml delete mode 100755 data-new/InformationGathering/Logging/1/CentralizedSystemLogging.yaml delete mode 100755 data-new/InformationGathering/Logging/1/LoggingOfSecurityEvents.yaml delete mode 100755 data-new/InformationGathering/Logging/1/PiiLoggingConcept.yaml delete mode 100755 data-new/InformationGathering/Logging/2/VisualizedLogging.yaml delete mode 100755 data-new/InformationGathering/Logging/3/CentralizedApplicationLogging.yaml delete mode 100755 data-new/InformationGathering/Logging/4/CorrelationOfSecurityEvents.yaml delete mode 100755 data-new/InformationGathering/Monitoring/1/SimpleApplicationMetrics.yaml delete mode 100755 data-new/InformationGathering/Monitoring/1/SimpleSystemMetrics.yaml delete mode 100755 data-new/InformationGathering/Monitoring/2/Alerting.yaml delete mode 100755 data-new/InformationGathering/Monitoring/2/VisualizedMetrics.yaml delete mode 100755 data-new/InformationGathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml delete mode 100755 data-new/InformationGathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml delete mode 100755 data-new/InformationGathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml delete mode 100755 data-new/InformationGathering/Monitoring/3/GroupingOfMetrics.yaml delete mode 100755 data-new/InformationGathering/Monitoring/3/TargetedAlerting.yaml delete mode 100755 data-new/InformationGathering/Monitoring/4/CoverageAndControlMetrics.yaml delete mode 100755 data-new/InformationGathering/Monitoring/4/DefenceMetrics.yaml delete mode 100755 data-new/InformationGathering/Monitoring/4/MetricsAreCombinedWithTests.yaml delete mode 100755 data-new/InformationGathering/Monitoring/4/ScreensWithMetricVisualization.yaml delete mode 100755 data-new/TestAndVerification/ApplicationTests/2/SecurityUnitTestsForImportantComponents.yaml delete mode 100755 data-new/TestAndVerification/ApplicationTests/3/SecurityIntegrationTestsForImportantComponents.yaml delete mode 100755 data-new/TestAndVerification/ApplicationTests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml delete mode 100755 data-new/TestAndVerification/ApplicationTests/4/SmokeTest.yaml delete mode 100755 data-new/TestAndVerification/Consolidation/1/DefinitionOfQualityGates.yaml delete mode 100755 data-new/TestAndVerification/Consolidation/1/SimpleFalsePositiveTreatment.yaml delete mode 100755 data-new/TestAndVerification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml delete mode 100755 data-new/TestAndVerification/Consolidation/2/SimpleVisualizationOfDefects.yaml delete mode 100755 data-new/TestAndVerification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml delete mode 100755 data-new/TestAndVerification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml delete mode 100755 data-new/TestAndVerification/Consolidation/4/AdvancedVisualizationOfDefects.yaml delete mode 100755 data-new/TestAndVerification/Consolidation/4/ReproducibleDefectTickets.yaml delete mode 100755 data-new/TestAndVerification/Consolidation/4/TreatmentOfAllDefects.yaml delete mode 100755 data-new/TestAndVerification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml delete mode 100755 data-new/TestAndVerification/DynamicDepthForApplications/1/SimpleScan.yaml delete mode 100755 data-new/TestAndVerification/DynamicDepthForApplications/2/CoverageOfClientSideDynamicComponents.yaml delete mode 100755 data-new/TestAndVerification/DynamicDepthForApplications/2/UsageOfDifferentRoles.yaml delete mode 100755 data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfHiddenEndpoints.yaml delete mode 100755 data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfMoreInputVectors.yaml delete mode 100755 data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfSequentialOperations.yaml delete mode 100755 data-new/TestAndVerification/DynamicDepthForApplications/3/UsageOfMultipleScanners.yaml delete mode 100755 data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageAnalysis.yaml delete mode 100755 data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageOfServiceToServiceCommunication.yaml delete mode 100755 data-new/TestAndVerification/DynamicDepthForInfrastructure/1/TestForExposedServices.yaml delete mode 100755 data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestNetworkSegmentation.yaml delete mode 100755 data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml delete mode 100755 data-new/TestAndVerification/DynamicDepthForInfrastructure/3/WeakPasswordTest.yaml delete mode 100755 data-new/TestAndVerification/DynamicDepthForInfrastructure/4/LoadTests.yaml delete mode 100755 data-new/TestAndVerification/StaticDepthForApplications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml delete mode 100755 data-new/TestAndVerification/StaticDepthForApplications/2/StaticAnalysisForImportantServerSideComponents.yaml delete mode 100755 data-new/TestAndVerification/StaticDepthForApplications/3/StaticAnalysisForImportantClientSideComponents.yaml delete mode 100755 data-new/TestAndVerification/StaticDepthForApplications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml delete mode 100755 data-new/TestAndVerification/StaticDepthForApplications/4/ExclusionOfSourceCodeDuplicates.yaml delete mode 100755 data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllComponentsOrlibraries.yaml delete mode 100755 data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllSelfWrittenComponents.yaml delete mode 100755 data-new/TestAndVerification/StaticDepthForApplications/4/StylisticAnalysis.yaml delete mode 100755 data-new/TestAndVerification/StaticDepthForApplications/4/UsageOfMultipleAnalysers.yaml delete mode 100755 data-new/TestAndVerification/StaticDepthForInfrastructure/1/StoredSecrets.yaml delete mode 100755 data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestClusterDeploymentResources.yaml delete mode 100755 data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestOfVirtualizedEnvironments.yaml delete mode 100755 data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheClouldConfiguration.yaml delete mode 100755 data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml delete mode 100755 data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForImageLifetime.yaml delete mode 100755 data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForMalware.yaml delete mode 100755 data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForNewImageVersion.yaml delete mode 100755 data-new/TestAndVerification/StaticDepthForInfrastructure/4/CheckForKnownVulnerabilities.yaml delete mode 100755 data-new/TestAndVerification/StaticDepthForInfrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml delete mode 100755 data-new/TestAndVerification/StaticDepthForInfrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml delete mode 100755 data-new/TestAndVerification/Test-Intensity/1/DefaultSettingsForIntensity.yaml delete mode 100755 data-new/TestAndVerification/Test-Intensity/1/HighTestIntensity.yaml delete mode 100755 data-new/TestAndVerification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml delete mode 100755 data-new/TestAndVerification/Test-Intensity/2/RegularTests.yaml delete mode 100755 data-new/TestAndVerification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml delete mode 100644 vendor/autoload.php delete mode 120000 vendor/bin/yaml-lint delete mode 100644 vendor/composer/ClassLoader.php delete mode 100644 vendor/composer/LICENSE delete mode 100644 vendor/composer/autoload_classmap.php delete mode 100644 vendor/composer/autoload_files.php delete mode 100644 vendor/composer/autoload_namespaces.php delete mode 100644 vendor/composer/autoload_psr4.php delete mode 100644 vendor/composer/autoload_real.php delete mode 100644 vendor/composer/autoload_static.php delete mode 100644 vendor/composer/installed.json delete mode 100644 vendor/erusev/parsedown-extra/.travis.yml delete mode 100644 vendor/erusev/parsedown-extra/LICENSE.txt delete mode 100644 vendor/erusev/parsedown-extra/ParsedownExtra.php delete mode 100644 vendor/erusev/parsedown-extra/README.md delete mode 100644 vendor/erusev/parsedown-extra/composer.json delete mode 100644 vendor/erusev/parsedown-extra/phpunit.xml.dist delete mode 100644 vendor/erusev/parsedown-extra/test/ParsedownExtraTest.php delete mode 100644 vendor/erusev/parsedown-extra/test/TestParsedown.php delete mode 100644 vendor/erusev/parsedown-extra/test/data/abbreviation.html delete mode 100644 vendor/erusev/parsedown-extra/test/data/abbreviation.md delete mode 100644 vendor/erusev/parsedown-extra/test/data/compound_footnote.html delete mode 100644 vendor/erusev/parsedown-extra/test/data/compound_footnote.md delete mode 100644 vendor/erusev/parsedown-extra/test/data/definition_list.html delete mode 100644 vendor/erusev/parsedown-extra/test/data/definition_list.md delete mode 100644 vendor/erusev/parsedown-extra/test/data/footnote.html delete mode 100644 vendor/erusev/parsedown-extra/test/data/footnote.md delete mode 100644 vendor/erusev/parsedown-extra/test/data/markdown_inside_markup.html delete mode 100644 vendor/erusev/parsedown-extra/test/data/markdown_inside_markup.md delete mode 100644 vendor/erusev/parsedown-extra/test/data/special_attributes.html delete mode 100644 vendor/erusev/parsedown-extra/test/data/special_attributes.md delete mode 100644 vendor/erusev/parsedown/LICENSE.txt delete mode 100644 vendor/erusev/parsedown/Parsedown.php delete mode 100644 vendor/erusev/parsedown/README.md delete mode 100644 vendor/erusev/parsedown/composer.json delete mode 100644 vendor/mnapoli/front-yaml/.gitattributes delete mode 100644 vendor/mnapoli/front-yaml/.gitignore delete mode 100644 vendor/mnapoli/front-yaml/LICENSE delete mode 100644 vendor/mnapoli/front-yaml/README.md delete mode 100644 vendor/mnapoli/front-yaml/composer.json delete mode 100644 vendor/mnapoli/front-yaml/phpunit.xml.dist delete mode 100644 vendor/mnapoli/front-yaml/src/Bridge/CommonMark/CommonMarkParser.php delete mode 100644 vendor/mnapoli/front-yaml/src/Bridge/Parsedown/ParsedownParser.php delete mode 100644 vendor/mnapoli/front-yaml/src/Bridge/Symfony/SymfonyYAMLParser.php delete mode 100644 vendor/mnapoli/front-yaml/src/Document.php delete mode 100644 vendor/mnapoli/front-yaml/src/Markdown/MarkdownParser.php delete mode 100644 vendor/mnapoli/front-yaml/src/Parser.php delete mode 100644 vendor/mnapoli/front-yaml/src/YAML/YAMLParser.php delete mode 100644 vendor/symfony/deprecation-contracts/.gitignore delete mode 100644 vendor/symfony/deprecation-contracts/CHANGELOG.md delete mode 100644 vendor/symfony/deprecation-contracts/LICENSE delete mode 100644 vendor/symfony/deprecation-contracts/README.md delete mode 100644 vendor/symfony/deprecation-contracts/composer.json delete mode 100644 vendor/symfony/deprecation-contracts/function.php delete mode 100644 vendor/symfony/polyfill-ctype/Ctype.php delete mode 100644 vendor/symfony/polyfill-ctype/LICENSE delete mode 100644 vendor/symfony/polyfill-ctype/README.md delete mode 100644 vendor/symfony/polyfill-ctype/bootstrap.php delete mode 100644 vendor/symfony/polyfill-ctype/bootstrap80.php delete mode 100644 vendor/symfony/polyfill-ctype/composer.json delete mode 100644 vendor/symfony/yaml/CHANGELOG.md delete mode 100644 vendor/symfony/yaml/Command/LintCommand.php delete mode 100644 vendor/symfony/yaml/Dumper.php delete mode 100644 vendor/symfony/yaml/Escaper.php delete mode 100644 vendor/symfony/yaml/Exception/DumpException.php delete mode 100644 vendor/symfony/yaml/Exception/ExceptionInterface.php delete mode 100644 vendor/symfony/yaml/Exception/ParseException.php delete mode 100644 vendor/symfony/yaml/Exception/RuntimeException.php delete mode 100644 vendor/symfony/yaml/Inline.php delete mode 100644 vendor/symfony/yaml/LICENSE delete mode 100644 vendor/symfony/yaml/Parser.php delete mode 100644 vendor/symfony/yaml/README.md delete mode 100755 vendor/symfony/yaml/Resources/bin/yaml-lint delete mode 100644 vendor/symfony/yaml/Tag/TaggedValue.php delete mode 100644 vendor/symfony/yaml/Unescaper.php delete mode 100644 vendor/symfony/yaml/Yaml.php delete mode 100644 vendor/symfony/yaml/composer.json diff --git a/Dockerfile b/Dockerfile index ff51de490..49fa9b451 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,18 @@ +FROM composer AS vendor +COPY composer.json composer.json +COPY composer.lock composer.lock +RUN composer install \ + --ignore-platform-reqs \ + --no-interaction \ + --no-plugins \ + --no-scripts \ + --prefer-dist + FROM php:7.2-apache -RUN apt-get update && apt-get -y install apt-utils nano libyaml-dev +RUN apt-get update && apt-get -y install apt-utils libyaml-dev RUN docker-php-ext-install gettext RUN pecl channel-update pecl.php.net && pecl install yaml-2.0.0 && docker-php-ext-enable yaml RUN echo "ServerName localhost" >> /etc/apache2/apache2.conf COPY . /var/www/html/ +COPY --from=vendor /app/vendor/ /var/www/html/vendor/ + diff --git a/data-new/BuildAndDeployment/Build/1/DefinedBuildProcess.yaml b/data-new/BuildAndDeployment/Build/1/DefinedBuildProcess.yaml deleted file mode 100755 index 3dac134a6..000000000 --- a/data-new/BuildAndDeployment/Build/1/DefinedBuildProcess.yaml +++ /dev/null @@ -1,23 +0,0 @@ ---- -id: DefinedBuildProcess -title: Defined build process -risk: Performing builds without a defined process is error prone. For example, as - a result of incorrect security related configuration. -measure: A well defined build process lowers the possibility of errors during the - build process. -evidence: The build process is defined in REPLACE-ME Pipeline - in the folder vars. Projects are using a Jenkinsfile to use the defined - process. -difficultyOfImplementation: - knowledge: 2 - time: 3 - resources: 2 -usefulness: 4 -implementation: -- CI/CD Tools, e.g. Jenkins -- Container technologies and orchestration like Docker, Kubernetes -samm2: i-secure-build|A|1 -iso27001-2017: -- 12.1.1 -- 14.2.2 -... diff --git a/data-new/BuildAndDeployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml b/data-new/BuildAndDeployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml deleted file mode 100755 index 8939828da..000000000 --- a/data-new/BuildAndDeployment/Build/2/BuildingAndTestingOfArtifactsInVirtualEnvironments.yaml +++ /dev/null @@ -1,24 +0,0 @@ ---- -id: BuildingAndTestingOfArtifactsInVirtualEnvironments -title: Building and testing of artifacts in virtual environments -risk: While building and testing artifacts, third party systems, application frameworks - and 3rd party libraries are used. These might be malicious as a result of vulnerable - libraries or because they are altered during the delivery phase. -measure: Each step during within the build and testing phase is performed in a separate - virtual environments, which is destroyed afterward. -meta: - implementationGuide: Depending on your envirnoment, usage of virtual machines or - container technoligy is a good way. After the build, the filesystem should not - be used again in other builds. -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 -usefulness: 2 -implementation: -- Container technologies and orchestration like Docker, Kubernetes -- CI/CD Tools, e.g. Jenkins -samm2: i-secure-build|A|2 -iso27001-2017: -- 14.2.6 -... diff --git a/data-new/BuildAndDeployment/Build/3/SigningOfArtifacts.yaml b/data-new/BuildAndDeployment/Build/3/SigningOfArtifacts.yaml deleted file mode 100755 index 2e4884636..000000000 --- a/data-new/BuildAndDeployment/Build/3/SigningOfArtifacts.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -id: SigningOfArtifacts -title: Signing of artifacts -risk: Unauthorized manipulation of artifacts might be difficult to spot. For example, - this may result in images with malicious code in the Docker registry. -measure: Digitally signing artifacts for all steps during the build and especially - docker images, helps to ensure their integrity. -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 -usefulness: 4 -implementation: -- Docker Content Trust -- in-toto -dependsOn: -- Defined build process -samm: OA3-B -samm2: i-secure-build|A|1 -iso27001-2017: -- 14.2.6 -... diff --git a/data-new/BuildAndDeployment/Build/3/SigningOfCode.yaml b/data-new/BuildAndDeployment/Build/3/SigningOfCode.yaml deleted file mode 100755 index 8d606e2ca..000000000 --- a/data-new/BuildAndDeployment/Build/3/SigningOfCode.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -id: SigningOfCode -title: Signing of code -risk: Unauthorized manipulation of source code might be difficult to spot. -measure: Digitally signing commits helps to prevent unauthorized manipulation of source - code. -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 -usefulness: 3 -implementation: ~ -dependsOn: -- Defined build process -samm: OA3-B -samm2: i-secure-build|A|2 -iso27001-2017: -- 14.2.6 -... diff --git a/data-new/BuildAndDeployment/Deployment/1/DefinedDeploymentProcess.yaml b/data-new/BuildAndDeployment/Deployment/1/DefinedDeploymentProcess.yaml deleted file mode 100755 index 01f077b74..000000000 --- a/data-new/BuildAndDeployment/Deployment/1/DefinedDeploymentProcess.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: DefinedDeploymentProcess -title: Defined deployment process -risk: Deployments without a defined process are error prone thus allowing old or untested - artifact to be deployed. -measure: A defined deployment process significantly lowers the likelihood of errors - during the deployment phase. -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 -usefulness: 4 -implementation: Jenkins, Docker -samm2: i-secure-deployment|A|1 -iso27001-2017: -- 12.1.1 -- 14.2.2 -... diff --git a/data-new/BuildAndDeployment/Deployment/2/BackupBeforeDeployment.yaml b/data-new/BuildAndDeployment/Deployment/2/BackupBeforeDeployment.yaml deleted file mode 100755 index ea965ed52..000000000 --- a/data-new/BuildAndDeployment/Deployment/2/BackupBeforeDeployment.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -id: BackupBeforeDeployment -title: Backup before deployment -risk: If errors are experienced during the deployment process you want to deploy an - old release. However, due to changes in the database this is often unfeasible. -measure: Performing automated backups before deployment can help facilitate deployments - whilst testing the backup restore processes. -difficultyOfImplementation: - knowledge: 1 - time: 2 - resources: 1 -usefulness: 4 -implementation: A complete database backup might be performed*. For large and complex - environments, a Point in Time Recovery for databases should be implemented. -dependsOn: -- Defined deployment process -samm: OE2-A -samm2: TODO -iso27001-2017: -- "12.3" -- 14.2.6 -... diff --git a/data-new/BuildAndDeployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml b/data-new/BuildAndDeployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml deleted file mode 100755 index 1213d5df9..000000000 --- a/data-new/BuildAndDeployment/Deployment/2/EnvironmentDependingConfigurationParameters.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: EnvironmentDependingConfigurationParameters -title: Environment depending configuration parameters -risk: Attackers who compromise source code can see confidential access information - like database credentials. -measure: Configuration parameters are set for each environment not in the source code. -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 -usefulness: 4 -implementation: "" -samm: SA2-A -samm2: i-secure-deployment|B|1 -iso27001-2017: -- 9.4.5 -- 14.2.6 -... diff --git a/data-new/BuildAndDeployment/Deployment/2/UsageOfTrustedImages.yaml b/data-new/BuildAndDeployment/Deployment/2/UsageOfTrustedImages.yaml deleted file mode 100755 index 129643d10..000000000 --- a/data-new/BuildAndDeployment/Deployment/2/UsageOfTrustedImages.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -id: UsageOfTrustedImages -title: Usage of trusted images -risk: Developers or operations might start random images in the production cluster - which have malicous code or known vulnerabilities. -measure: Create image assessment criteria, perform an evaluation of images and create - a whitelist of artifacts/container images/virtual machine images. -implementation: Kubernetes Admission Controller can whitelist registries and/or whitelist - a signing key. -difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 -usefulness: 3 -samm2: i-secure-deployment|A|2 -iso27001-2017: -- 15.1.1 -- 15.1.2 -- 15.1.3 -- 14.1.3 -... diff --git a/data-new/BuildAndDeployment/Deployment/3/HandoverOfConfidentialParameters.yaml b/data-new/BuildAndDeployment/Deployment/3/HandoverOfConfidentialParameters.yaml deleted file mode 100755 index 055c5b0f1..000000000 --- a/data-new/BuildAndDeployment/Deployment/3/HandoverOfConfidentialParameters.yaml +++ /dev/null @@ -1,26 +0,0 @@ ---- -id: HandoverOfConfidentialParameters -title: Handover of confidential parameters -risk: Attackers who compromise a system can see confidential access information like - database credentials. Parameters are often used to set credentials, for example - by starting containers or applications. These parameters can often be seen by any - one listing running processes on the target system. -measure: By using encryption, it is harder to read credentials , e.g. from the file - system. Also, the usage of a credential management system can help protect credentials. -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 -usefulness: 4 -implementation: "" -dependsOn: -- Environment depending configuration parameters -samm: SA2-A -samm2: i-secure-deployment|B|2 TODO might be 1 -iso27001-2017: -- 14.1.3 -- 13.1.3 -- 9.4.3 -- 9.4.1 -- 10.1.2 -... diff --git a/data-new/BuildAndDeployment/Deployment/3/InventoryOfRunningArtifacts.yaml b/data-new/BuildAndDeployment/Deployment/3/InventoryOfRunningArtifacts.yaml deleted file mode 100755 index 2dedf8104..000000000 --- a/data-new/BuildAndDeployment/Deployment/3/InventoryOfRunningArtifacts.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -id: InventoryOfRunningArtifacts -title: Inventory of running artifacts -risk: In case a vulnerability of severity high or critical exists, it needs to be - known where an artifacts with that vulnerability is deployed with which dependencies. -measure: A documented inventory or a possibility to gather the needed information - (e.g. the documentation of which script needs to be run by whoom) must be in place. -dependsOn: -- Defined deployment process -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 3 -usefulness: 3 -samm2: o-incident-management|TODO -iso27001-2017: -- "8.1" -- "8.2" -... diff --git a/data-new/BuildAndDeployment/Deployment/3/RollingUpdateOnDeployment.yaml b/data-new/BuildAndDeployment/Deployment/3/RollingUpdateOnDeployment.yaml deleted file mode 100755 index a87efc752..000000000 --- a/data-new/BuildAndDeployment/Deployment/3/RollingUpdateOnDeployment.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -id: RollingUpdateOnDeployment -title: Rolling update on deployment -risk: While a deployment is performed, the application can not be reached. -measure: A deployment without downtime is performed*. -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 -usefulness: 2 -implementation: Docker, Webserver, rolling update -dependsOn: -- Defined deployment process -samm2: i-secure-deployment|A|1 -iso27001-2017: -- 12.5.1 -- 14.2.2 -- 17.2.1 -... diff --git a/data-new/BuildAndDeployment/Deployment/3/SameArtifactForEnvironments.yaml b/data-new/BuildAndDeployment/Deployment/3/SameArtifactForEnvironments.yaml deleted file mode 100755 index d3baf4827..000000000 --- a/data-new/BuildAndDeployment/Deployment/3/SameArtifactForEnvironments.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -id: SameArtifactForEnvironments -title: Same artifact for environments -risk: Building of an artifact for different environments means that an untested artifact - might reach the production environment. -measure: Building an artifact once and deploying it to different environments means - that only tested artifacts are allowed to reach the production environment -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 -usefulness: 4 -implementation: Docker -dependsOn: -- Defined build process -samm: OE2-A -samm2: i-secure-deployment|A|2 -iso27001-2017: -- 14.3.1 -- 14.2.8 -- 12.1.4 -... diff --git a/data-new/BuildAndDeployment/Deployment/3/UsageOfFeatureToggles.yaml b/data-new/BuildAndDeployment/Deployment/3/UsageOfFeatureToggles.yaml deleted file mode 100755 index 63827670c..000000000 --- a/data-new/BuildAndDeployment/Deployment/3/UsageOfFeatureToggles.yaml +++ /dev/null @@ -1,23 +0,0 @@ ---- -id: UsageOfFeatureToggles -title: Usage of feature toggles -risk: By using environment dependent configuration, some parameters will not be tested - correctly. i.e. 
    if (host == 'production') {} else {}
    -measure: Usage of environment independent configuration parameter, called feature - toggles, helps to enhance the test coverage. Only what has been tested, goes to - production. -difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 1 -usefulness: 2 -implementation: Docker -dependsOn: -- Same artifact for environments -samm: EG1-B -iso27001-2017: -- 14.3.1 -- 14.2.8 -- 14.2.9 -- 12.1.4 -... diff --git a/data-new/BuildAndDeployment/Deployment/4/BlueOrgreenDeployment.yaml b/data-new/BuildAndDeployment/Deployment/4/BlueOrgreenDeployment.yaml deleted file mode 100755 index 88d08fa30..000000000 --- a/data-new/BuildAndDeployment/Deployment/4/BlueOrgreenDeployment.yaml +++ /dev/null @@ -1,25 +0,0 @@ ---- -id: BlueOrgreenDeployment -title: Blue/Green Deployment -risk: A new artifacts version can have unknown defects. -measure: By having multiple production environments, a deployment can be performant - on the first environment to spot possible defects before it is deployment in the - production environment(s) -difficultyOfImplementation: - knowledge: 1 - time: 2 - resources: 1 -usefulness: 2 -implementation: Blue/Green - Deployments -dependsOn: -- Smoke Test -samm2: TODO -iso27001-2017: -- 17.2.1 -- 12.1.1 -- 12.1.2 -- 12.1.4 -- 12.5.1 -- 14.2.9 -... diff --git a/data-new/BuildAndDeployment/PatchManagement/1/APatchPolicyIsDefined.yaml b/data-new/BuildAndDeployment/PatchManagement/1/APatchPolicyIsDefined.yaml deleted file mode 100755 index 4f7d051f4..000000000 --- a/data-new/BuildAndDeployment/PatchManagement/1/APatchPolicyIsDefined.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -id: APatchPolicyIsDefined -title: A patch policy is defined -risk: Vulnerabilities in running containers stay for long and might get exploited. -measure: A patch policy for all artifacts (e.g. in images) is defined. How often is - an image rebuilt? -difficultyOfImplementation: - knowledge: 3 - time: 1 - resources: 2 -usefulness: 4 -samm2: o-environment-management|B|1 -iso27001-2017: -- 12.6.1 -- 12.5.1 -- 14.2.5 -... diff --git a/data-new/BuildAndDeployment/PatchManagement/1/AutomatedPrsForPatches.yaml b/data-new/BuildAndDeployment/PatchManagement/1/AutomatedPrsForPatches.yaml deleted file mode 100755 index 14de1b816..000000000 --- a/data-new/BuildAndDeployment/PatchManagement/1/AutomatedPrsForPatches.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -id: AutomatedPrsForPatches -title: Automated PRs for patches -risk: Known vulnerabilities components might stay for long and get exploited, even - when a patch is available. -measure: Fast patching of third party component is needed. The DevOps way is to have - an automated pull request for new components. This includes
    • Applications
    • Virutalized - operating system components (e.g. container images)
    • Operating Systems
    • Infrastructure - as Code/GitOps (e.g. argocd)
    -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 -usefulness: 5 -samm2: o-environment-management|B|1 -iso27001-2017: -- 12.6.1 -- 14.2.5 -implementation: -- dependabot -- Jenkins -... diff --git a/data-new/BuildAndDeployment/PatchManagement/2/NightlyBuildOfImages.yaml b/data-new/BuildAndDeployment/PatchManagement/2/NightlyBuildOfImages.yaml deleted file mode 100755 index 41f3b63b5..000000000 --- a/data-new/BuildAndDeployment/PatchManagement/2/NightlyBuildOfImages.yaml +++ /dev/null @@ -1,14 +0,0 @@ ---- -id: NightlyBuildOfImages -title: Nightly build of images -risk: Vulnerabilities in running containers stay for too long and might get exploited. -measure: Images are built at least nightly. -difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 2 -usefulness: 3 -samm2: o-environment-management|B|1 -iso27001-2017: -- 12.6.1 -... diff --git a/data-new/BuildAndDeployment/PatchManagement/2/ReductionOfTheAttackSurface.yaml b/data-new/BuildAndDeployment/PatchManagement/2/ReductionOfTheAttackSurface.yaml deleted file mode 100755 index 9e4e66297..000000000 --- a/data-new/BuildAndDeployment/PatchManagement/2/ReductionOfTheAttackSurface.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -id: ReductionOfTheAttackSurface -title: Reduction of the attack surface -risk: Components, dependencies, files or file access rights might have vulnerabilities, - but the they are not needed. -measure: Removal of unneeded components, dependencies, files or file access rights. - For container images the usage of distroless images is recommended. -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 2 -usefulness: 3 -samm2: o-environment-management|B|1 -iso27001-2017: -- hardening is missing in ISO 27001 -- 14.2.1 -implementation: -- Distroless -- Fedora CoreOS -... diff --git a/data-new/BuildAndDeployment/PatchManagement/2/UsageOfAMaximumLifetimeForImages.yaml b/data-new/BuildAndDeployment/PatchManagement/2/UsageOfAMaximumLifetimeForImages.yaml deleted file mode 100755 index b1971c61e..000000000 --- a/data-new/BuildAndDeployment/PatchManagement/2/UsageOfAMaximumLifetimeForImages.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: UsageOfAMaximumLifetimeForImages -title: Usage of a maximum lifetime for images -risk: Vulnerabilities in images of running containers stay for too long and might - get exploited. Long running containers have potential memory leaks. A compromised - container might get killed by restarting the container (e.g. in case the attacker - has not reached the persistence layer). -measure: The periodically built images are deployed minimum every 30 days (better - hourly/daily/weekly). Meaning an image is not in production for longer than 30 days. -difficultyOfImplementation: - knowledge: 3 - time: 4 - resources: 2 -usefulness: 3 -samm2: o-environment-management|B|1 -iso27001-2017: -- 12.6.1 -... diff --git a/data-new/BuildAndDeployment/PatchManagement/4/UsageOfAShortMaximumLifetimeForImages.yaml b/data-new/BuildAndDeployment/PatchManagement/4/UsageOfAShortMaximumLifetimeForImages.yaml deleted file mode 100755 index f06bbf25a..000000000 --- a/data-new/BuildAndDeployment/PatchManagement/4/UsageOfAShortMaximumLifetimeForImages.yaml +++ /dev/null @@ -1,25 +0,0 @@ ---- -id: UsageOfAShortMaximumLifetimeForImages -title: Usage of a short maximum lifetime for images -risk: Vulnerabilities in running containers stay for too long and might get exploited. -measure: Nightly built images are deployed at minimum every 1 day. -difficultyOfImplementation: - knowledge: 3 - time: 4 - resources: 2 -usefulness: 3 -samm2: o-environment-management|B|1 -iso27001-2017: -- 12.6.1 -implementation: -- Sample concept:
    (1) each container has a set lifetime and is killed / replaced - with a new container multiple times a day where you have some form of a graceful - replacement to ensure no (short) service outage will occur to the end users.
    (2) - twice a day a rebuild of images is done. The rebuilds are put into a automated testing - pipeline. If the testing has no blocking issues the new images will be released - for deployment during the next "restart" of a container. What has to be done, is - to ensure the new containers are deployed in some canary deployment manner, this - will ensure that if (and only if) something buggy has been introduced which breaks - functionality the canary deployment will make sure the "older version" is being - used and not the buggy newer one. -... diff --git a/data-new/CultureAndOrganization/Design/0/InformationSecurityTargetsAreCommunicated.yaml b/data-new/CultureAndOrganization/Design/0/InformationSecurityTargetsAreCommunicated.yaml deleted file mode 100755 index f06755ae5..000000000 --- a/data-new/CultureAndOrganization/Design/0/InformationSecurityTargetsAreCommunicated.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -id: InformationSecurityTargetsAreCommunicated -title: Information security targets are communicated -risk: Employees don't known their organisation security targets. Therefore security - is not considered during development and administration as much as it should be. -measure: Transparent and timely communication of the security targets by senior management - is essential to ensure teams' buy-in and support. -difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 -usefulness: 4 -samm: SM1-B -iso27001-2017: -- 5.1.1 -- 7.2.1 -... diff --git a/data-new/CultureAndOrganization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml b/data-new/CultureAndOrganization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml deleted file mode 100755 index 3348983e2..000000000 --- a/data-new/CultureAndOrganization/Design/1/ConductionOfSimpleThreatModellingOnTechnicalLevel.yaml +++ /dev/null @@ -1,56 +0,0 @@ ---- -id: ConductionOfSimpleThreatModellingOnTechnicalLevel -title: Conduction of simple threat modelling on technical level -risk: Technical related threats are discovered too late in the development and deployment - process. -measure: Threat modelling of technical features is performed during the product sprint - planning. -difficultyOfImplementation: - knowledge: 2 - time: 3 - resources: 1 -usefulness: 3 -implementation: -- Threat modelling Playbook -md-description: |2 - - Once requirements are gathered and analysis is performed, implementation specifics need to be defined. The outcome of this stage is usually a diagram outlining data flows and a general system architecture. This presents an opportunity for both threat modeling and attaching security considerations to every ticket and epic that is the outcome of this stage. - - There is some great advice on threat modeling out there *e.g.* [this](https://arstechnica.com/information-technology/2017/07/how-i-learned-to-stop-worrying-mostly-and-love-my-threat-model/) article or [this](https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling) one. - - A bite sized primer by Adam Shostack himself can be found [here](https://adam.shostack.org/blog/2018/03/threat-modeling-panel-at-appsec-cali-2018/). - - OWASP includes a short [article](https://wiki.owasp.org/index.php/Category:Threat_Modeling) on Threat Modeling along with a relevant [Cheatsheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html). Moreover, if you're following OWASP SAMM, it has a short section on [Threat Assessment](https://owaspsamm.org/model/design/threat-assessment/). - - There's a few projects that can help with creating Threat Models at this stage, [PyTM](https://github.com/izar/pytm) is one, [ThreatSpec](https://github.com/threatspec/threatspec) is another. - - > Note: _A threat model can be as simple as a data flow diagram with attack vectors on every flow and asset and equivalent remediations. An example can be found below._ - - ![Threat Model](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/threat_model.png "Threat Model") - - Last, if the organisation maps Features to Epics, the Security Knowledge Framework (SKF) can be used to facilitate this process by leveraging it's questionnaire function. - - ![SKF](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/skf_qs.png "SKF") - - This practice has the side effect that it trains non-security specialists to think like attackers. - - The outcomes of this stage should help lay the foundation of secure design and considerations. - - **Example Low Maturity Scenario:** - - Following vague feature requirements the design includes caching data to a local unencrypted database with a hardcoded password. - - Remote data store access secrets are hardcoded in the configuration files. All communication between backend systems is plaintext. - - Frontend serves data over GraphQL as a thin layer between caching system and end user. - - GraphQL queries are dynamically translated to SQL, Elasticsearch and NoSQL queries. Access to data is protected with basic auth set to _1234:1234_ for development purposes. - - Source: OWASP Project Integration Project -samm: TA1-A -iso27001-2017: -- not explicitly covered by ISO 27001 -- may be part of risk assessment -- 8.2.1 -- 14.2.1 -... diff --git a/data-new/CultureAndOrganization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml b/data-new/CultureAndOrganization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml deleted file mode 100755 index a25bb9d6b..000000000 --- a/data-new/CultureAndOrganization/Design/2/ConductionOfSimpleThreatModellingOnBusinessLevel.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -id: ConductionOfSimpleThreatModellingOnBusinessLevel -title: Conduction of simple threat modelling on business level -risk: Business related threats are discovered too late in the development and deployment - process. -measure: Threat modelling of business functionality is performed during the product - backlog creation to facilitate early detection of security defects. -difficultyOfImplementation: - knowledge: 2 - time: 3 - resources: 1 -usefulness: 3 -samm: TA1-A -iso27001-2017: -- not explicitly covered by ISO 27001 -- may be part of risk assessment -- 8.2.1 -- 14.2.1 -... diff --git a/data-new/CultureAndOrganization/Design/2/CreationOfSimpleAbuseStories.yaml b/data-new/CultureAndOrganization/Design/2/CreationOfSimpleAbuseStories.yaml deleted file mode 100755 index bab7a16ea..000000000 --- a/data-new/CultureAndOrganization/Design/2/CreationOfSimpleAbuseStories.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -id: CreationOfSimpleAbuseStories -title: Creation of simple abuse stories -risk: User stories mostly don't consider security implications. Security flaws are - discovered too late in the development and deployment process. -measure: Abuse stories are created during the creation of user stories. -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 -usefulness: 4 -samm: TA2-A -iso27001-2017: -- not explicitly covered by ISO 27001 -- may be part of project management -- 6.1.5 -- may be part of risk assesment -- 8.1.2 -implementation: Don't - Forget EVIL User Stories and Practical - Security Stories and Security Tasks for Agile Development Environments -... diff --git a/data-new/CultureAndOrganization/Design/3/ConductionOfAdvancedThreatModelling.yaml b/data-new/CultureAndOrganization/Design/3/ConductionOfAdvancedThreatModelling.yaml deleted file mode 100755 index fb5567ced..000000000 --- a/data-new/CultureAndOrganization/Design/3/ConductionOfAdvancedThreatModelling.yaml +++ /dev/null @@ -1,31 +0,0 @@ ---- -id: ConductionOfAdvancedThreatModelling -title: Conduction of advanced threat modelling -risk: Inadequate identification of business and technical risks. -measure: Threat modelling is performed by using reviewing user stories and producing - security driven data flow diagrams. -difficultyOfImplementation: - knowledge: 4 - time: 3 - resources: 2 -usefulness: 3 -md-description: | - **Example High Maturity Scenario:** - - Based on a detailed threat model defined and updated through code, the team decides the following: - - * Local encrypted caches need to expire and auto-purged. - * Communication channels encrypted and authenticated. - * All secrets persisted in shared secrets store. - * Frontend designed with permissions model integration. - * Permissions matrix defined. - * Input is escaped output is encoded appropriately using well established libraries. - - Source: OWASP Project Integration Project -samm: TA2-B -iso27001-2017: -- not explicitly covered by ISO 27001 -- may be part of risk assessment -- 8.2.1 -- 14.2.1 -... diff --git a/data-new/CultureAndOrganization/Design/4/CreationOfAdvancedAbuseStories.yaml b/data-new/CultureAndOrganization/Design/4/CreationOfAdvancedAbuseStories.yaml deleted file mode 100755 index d4ab01a49..000000000 --- a/data-new/CultureAndOrganization/Design/4/CreationOfAdvancedAbuseStories.yaml +++ /dev/null @@ -1,25 +0,0 @@ ---- -id: CreationOfAdvancedAbuseStories -title: Creation of advanced abuse stories -risk: Simple user stories are not going deep enough. Relevant security considerations - are performed. Security flaws are discovered too late in the development and deployment - process -measure: Advanced abuse stories are created as part of threat modelling activities. -difficultyOfImplementation: - knowledge: 4 - time: 2 - resources: 1 -usefulness: 4 -dependsOn: -- Creation of simple abuse stories -samm: TA2-A -iso27001-2017: -- not explicitly covered by ISO 27001 -- may be part of project management -- 6.1.5 -- may be part of risk assesment -- 8.1.2 -implementation: Don't - Forget EVIL User Stories and Practical - Security Stories and Security Tasks for Agile Development Environments -... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml deleted file mode 100755 index a327ec034..000000000 --- a/data-new/CultureAndOrganization/EducationAndGuidance/1/Ad-HocSecurityTrainingsForSoftwareDevelopers.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -id: Ad-HocSecurityTrainingsForSoftwareDevelopers -title: Ad-Hoc Security trainings for software developers -risk: Understanding security is hard and personnel needs to be trained on it. Otherwise, - flaws like an SQL Injection might be introduced into the software which might get - exploited. -measure: Provide security awareness training for all personnel involved in software - development Ad-Hoc. -difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 1 -usefulness: 3 -samm: EG1-A - In case you do not have the budget to hire an external security expert, - an option is to use the OWASP - Juice Shop on a "hacking Friday" - https://cheatsheetseries.owasp.org/ -iso27001-2017: -- 7.2.2 -... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/1/SecurityConsultingOnRequest.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/1/SecurityConsultingOnRequest.yaml deleted file mode 100755 index 87a305198..000000000 --- a/data-new/CultureAndOrganization/EducationAndGuidance/1/SecurityConsultingOnRequest.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -id: SecurityConsultingOnRequest -title: Security consulting on request -risk: Not asking a security expert when questions regarding security appear might - lead to flaws. -measure: Security consulting to teams is given on request. The security consultants - can be internal or external. -difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 1 -usefulness: 3 -samm: EG2-B -iso27001-2017: -- security consulting is missing in ISO 27001 may be -- 6.1.1 -- 6.1.4 -- 6.1.5 -... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/2/EachTeamHasASecurityChampion.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/2/EachTeamHasASecurityChampion.yaml deleted file mode 100755 index 046d6f873..000000000 --- a/data-new/CultureAndOrganization/EducationAndGuidance/2/EachTeamHasASecurityChampion.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -id: EachTeamHasASecurityChampion -title: Each team has a security champion -risk: No one feels directly responsible for security and the security champion does - not have enough time to allocate to each team. -measure: Each team defines an individual to be responsible for security. These individuals - are often referred to as 'security champions' -difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 1 -usefulness: 3 -samm: EG2-B -iso27001-2017: -- security champions are missing in ISO 27001 most likely -- 7.2.1 -- 7.2.2 -implementation: https://www.owasp.org/index.php/Security_Champions_Playbook -... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingForAll.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingForAll.yaml deleted file mode 100755 index d8ee44320..000000000 --- a/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingForAll.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -id: RegularSecurityTrainingForAll -title: Regular security training for all -risk: Understanding security is hard. -measure: Provide security awareness training for all personnel involved in software - development on a regular basis like twice in a year for 1-3 days. -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 -usefulness: 3 -samm: EG1-A -iso27001-2017: -- 7.2.2 -implementation: -- In case you do not have the budget to hire an external security expert, an option - is to use the OWASP Juice Shop - on a "hacking Friday" -- https://cheatsheetseries.owasp.org/ -... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingOfSecurityChampions.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingOfSecurityChampions.yaml deleted file mode 100755 index 39df03a29..000000000 --- a/data-new/CultureAndOrganization/EducationAndGuidance/2/RegularSecurityTrainingOfSecurityChampions.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: RegularSecurityTrainingOfSecurityChampions -title: Regular security training of security champions -risk: Understanding security is hard, even for security champions. -measure: Regular security training of security champions. -evidence: | - - Process Documentation: TODO - - Training Content: TOODO -difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 2 -usefulness: 3 -samm: EG2-B -iso27001-2017: -- security champions are missing in ISO 27001 -- 7.2.2 -... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/2/RewardOfGoodCommunication.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/2/RewardOfGoodCommunication.yaml deleted file mode 100755 index 3d7a8b6f8..000000000 --- a/data-new/CultureAndOrganization/EducationAndGuidance/2/RewardOfGoodCommunication.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -id: RewardOfGoodCommunication -title: Reward of good communication -risk: Employees are not getting excited about security. -measure: Good communication and transparency encourages cross-organisational support. - Gamification of security is also known to help, examples include T-Shirts, mugs, - cups, giftcards and 'High-Fives'. -difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 1 -usefulness: 3 -iso27001-2017: -- not required by ISO 27001 -- interestingly enough A7.2.3 is requiring a process to handle misconduct but nothing - to promote good behavior. -implementation: -- Enhance motivation can be performed with the distribution of pins as a reward, see - OWASP Security Pins Project -- https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx -... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml deleted file mode 100755 index d2e76ccb4..000000000 --- a/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfBuild-It,Break-It,Fix-ItContests.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: ConductionOfBuild-It,Break-It,Fix-ItContests -title: Conduction of build-it, break-it, fix-it contests -risk: Understanding security is hard, even for security champions and the conduction - of security training often focuses on breaking a component instead of building a - component secure. -measure: The build-it, break-it, fix-it contest allows to train people with security - related roles like security champions the build, break and fix part of a secure - application. This increases the learning of building secure components. -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 1 -usefulness: 3 -iso27001-2017: -- 7.2.2 -implementation: https://builditbreakit.org/ -... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml deleted file mode 100755 index c8733b89d..000000000 --- a/data-new/CultureAndOrganization/EducationAndGuidance/3/ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -id: ConductionOfCollaborativeSecurityChecksWithDevelopersAndSystemAdministrators -title: Conduction of collaborative security checks with developers and system administrators -risk: Security checks by external companies do not increase the understanding of an - application/system for internal employees. -measure: Periodically security reviews of source code (SCA), in which security SME, - developers and operations are involved, are effective at increasing the robustness - of software and the security knowledge of the teams involved. -difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 1 -usefulness: 3 -samm: IR1-B -iso27001-2017: -- Mutual review of source code is not explicitly required in ISO 27001 may be -- 7.2.2 -- 12.6.1 -- 12.7.1 -... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/3/RegularSecurityTrainingForEveryone.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/3/RegularSecurityTrainingForEveryone.yaml deleted file mode 100755 index f6a6772d9..000000000 --- a/data-new/CultureAndOrganization/EducationAndGuidance/3/RegularSecurityTrainingForEveryone.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -id: RegularSecurityTrainingForEveryone -title: Regular security training for everyone -risk: Understanding security is hard, for internal as well as external employees. -measure: Regular security training for everyone. -difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 2 -usefulness: 3 -samm: EG2-B -iso27001-2017: -- 7.2.2 -implementation: Often, external employees are not invited for interal trainings. This - activity focuses on providing security trainings to internal as well as external - employees. It is conducted every two weeks for around one hour. -... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/3/Security-Lessoned-Learned.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/3/Security-Lessoned-Learned.yaml deleted file mode 100755 index 1a28256c1..000000000 --- a/data-new/CultureAndOrganization/EducationAndGuidance/3/Security-Lessoned-Learned.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -id: Security-Lessoned-Learned -title: Security-Lessoned-Learned -risk: After an incident, a similar incident might reoccur. -measure: Running a 'lessons learned' session after an incident helps drive continuous - improvement. Regular meetings with security champions are a good place to share - and discuss lessons learned. -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 1 -usefulness: 3 -samm: IM-3, ST-3, SR2-B -iso27001-2017: -- 16.1.6 -... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/4/AligningSecurityInTeams.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/4/AligningSecurityInTeams.yaml deleted file mode 100755 index 160d18ad0..000000000 --- a/data-new/CultureAndOrganization/EducationAndGuidance/4/AligningSecurityInTeams.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: AligningSecurityInTeams -title: Aligning security in teams -risk: The concept of Security Champions might suggest that only he/she is responsible - for security. However, everyone in the project team should be responsible for security. -measure: By aligning security SME with project teams, a higher security standard can - be achieved. -difficultyOfImplementation: - knowledge: 4 - time: 5 - resources: 1 -implementation: Security SME are involved in discussion for requirements analysis, - software design and sprint planning to provide guidance and suggestions. -usefulness: 5 -samm: EG2-B -iso27001-2017: -- 7.1.1 -... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml deleted file mode 100755 index 623472c7f..000000000 --- a/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfCollaborativeTeamSecurityChecks.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -id: ConductionOfCollaborativeTeamSecurityChecks -title: Conduction of collaborative team security checks -risk: Development teams limited insight over security practices. -measure: Mutual security testing the security of other teams's project enhances security - awareness and knowledge. -difficultyOfImplementation: - resources: 2 - knowledge: 4 - time: 4 -usefulness: 2 -samm: EG2-A -iso27001-2017: -- Mutual scurity testing is not explicitly required in ISO 27001 may be -- 7.2.2 -... diff --git a/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfWarGames.yaml b/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfWarGames.yaml deleted file mode 100755 index af7be1ab1..000000000 --- a/data-new/CultureAndOrganization/EducationAndGuidance/4/ConductionOfWarGames.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: ConductionOfWarGames -title: Conduction of war games -risk: Understanding incident response plans during an incident is hard and ineffective. -measure: War Games like activities help train for incidents. Security SMEs create - attack scenarios in a testing environment enabling the trainees to learn how to - react in case of an incident. -difficultyOfImplementation: - knowledge: 4 - time: 5 - resources: 5 -usefulness: 2 -iso27001-2017: -- ware games are not explicitly required in ISO 27001 may be -- 7.2.2 -- "16.1" -- 16.1.5 -... diff --git a/data-new/CultureAndOrganization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml b/data-new/CultureAndOrganization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml deleted file mode 100755 index f20a68740..000000000 --- a/data-new/CultureAndOrganization/Process/1/DefinitionOfSimpleBcdrPracticesForCriticalComponents.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -id: DefinitionOfSimpleBcdrPracticesForCriticalComponents -title: Definition of simple BCDR practices for critical components -risk: In case of an emergency, like a power outage, DR actions to perform are not - clear. This leads to reaction and remediation delays. -measure: By understanding and documenting a business continuity and disaster recovery - (BCDR) plan, the overall availability of systems and applications is increased. - Success factors like responsibilities, Service Level Agreements, Recovery Point - Objectives, Recovery Time Objectives or Failover must be fully documented and understood. -difficultyOfImplementation: - knowledge: 4 - time: 3 - resources: 2 -usefulness: 4 -iso27001-2017: -- 17.1.1 -... diff --git a/data-new/CultureAndOrganization/Process/3/ApprovalByReviewingAnyNewVersion.yaml b/data-new/CultureAndOrganization/Process/3/ApprovalByReviewingAnyNewVersion.yaml deleted file mode 100755 index a23efdad3..000000000 --- a/data-new/CultureAndOrganization/Process/3/ApprovalByReviewingAnyNewVersion.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -id: ApprovalByReviewingAnyNewVersion -title: Approval by reviewing any new version -risk: An individual might forget to implement security measures to protect source - code or infrastructure components. -measure: On each new version (e.g. Pull Request) of source code or infrastructure - components a security peer review of the changes is performed (two eyes principle) - and approval given by the reviewer. -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 -usefulness: 3 -samm: IR1-B -iso27001-2017: -- peer review - four eyes principle is not explicitly required by ISO 27001 -- 6.1.2 -- 14.2.1 -... diff --git a/data-new/CultureAndOrganization/Process/3/DefinitionOfAChangeManagementProcess.yaml b/data-new/CultureAndOrganization/Process/3/DefinitionOfAChangeManagementProcess.yaml deleted file mode 100755 index 11cd487c8..000000000 --- a/data-new/CultureAndOrganization/Process/3/DefinitionOfAChangeManagementProcess.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -id: DefinitionOfAChangeManagementProcess -title: Definition of a change management process -risk: The impact of a change is not controlled because these are not recorded or documented. -measure: Each change of a system is automatically recorded and adequately logged. -difficultyOfImplementation: - knowledge: 4 - time: 3 - resources: 1 -usefulness: 3 -iso27001-2017: -- 14.2.2 -- 12.1.2 -- 12.4.1 -... diff --git a/data-new/CultureAndOrganization/Process/3/PreventionOfUnauthorizedInstallation.yaml b/data-new/CultureAndOrganization/Process/3/PreventionOfUnauthorizedInstallation.yaml deleted file mode 100755 index e49799b72..000000000 --- a/data-new/CultureAndOrganization/Process/3/PreventionOfUnauthorizedInstallation.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -id: PreventionOfUnauthorizedInstallation -title: Prevention of unauthorized installation -risk: Unapproved components are used. -measure: Components must be whitelisted. Regular scans on the docker infrastructure - (e.g. cluster) need to be performed, to verify that only standardized base images - are used. -difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 1 -usefulness: 3 -iso27001-2017: -- 12.5.1 -- 12.6.1 -implementation: 'Example: All docker images used by teams need to be based on standard - images.' -comment: By preventing teams from trying out new components, innovation might be hampered -... diff --git a/data-new/Implementation/ApplicationHardening/1/ApplicationHardeningLevel1.yaml b/data-new/Implementation/ApplicationHardening/1/ApplicationHardeningLevel1.yaml deleted file mode 100755 index eecc4c00c..000000000 --- a/data-new/Implementation/ApplicationHardening/1/ApplicationHardeningLevel1.yaml +++ /dev/null @@ -1,44 +0,0 @@ ---- -id: ApplicationHardeningLevel1 -title: Application Hardening Level 1 -risk: Using an insecure application might lead to a compromised application. This - might lead to total data theft or data modification. -measure: | - Following frameworks like the -
      -
    • OWASP Application Security Verification Standard Level 1
      • -
    • OWASP Mobile Application Security Verification Standard Level 1
      • -
    - - in all applications provides a good baseline. -difficultyOfImplementation: - knowledge: 4 - time: 4 - resources: 2 -usefulness: 4 -md-description: | - To tackle the security of code developed in-house, OWASP offers an extensive collection of [Cheatsheets](https://cheatsheetseries.owasp.org/) demonstrating how to implement features securely. Moreover, the Security Knowledge Framework[1] offers an extensive library of code patterns spanning several programming languages. These patterns can be used to not only jumpstart the development process, but also do so securely. - - [...] - - ### Planning aka Requirements Gathering & Analysis - The Requirements gathering process tries to answer the question: _"What is the system going to do?"_ At this stage, the [SAMM project](https://owaspsamm.org/model/) offers 3 distinct maturity levels covering both [in-house](https://owaspsamm.org/model/design/security-requirements/stream-a/) software development and [third party](https://owaspsamm.org/model/design/security-requirements/stream-b/) supplier security. - - ![SAMM Requirements](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/OWASP-in0.png) - - Organisations can use these to add solid security considerations at the start of the Software Development or Procurement process. - - These general security considerations can be audited by using a subsection of the ASVS controls in section V1 as a questionnaire. This process attempts to ensure that every feature has concrete security considerations. - - In case of internal development and if the organisation maps Features to Epics, the [Security Knowledge Framework](https://securityknowledgeframework.org/) can be used to facilitate this process by leveraging its questionnaire function, shown below. - - Source: [OWASP Project Integration](https://raw.githubusercontent.com/OWASP/www-project-integration-standards/master/writeups/owasp_in_sdlc/index.md) -implementation: -- OWASP - ASVS -- OWASP MASVS -samm2: software-requirements|A|1 -iso27001-2017: -- hardening is not explicitly covered by ISO 27001 - too specific -- 13.1.3 -... diff --git a/data-new/Implementation/ApplicationHardening/2/App.HardeningLevel2.yaml b/data-new/Implementation/ApplicationHardening/2/App.HardeningLevel2.yaml deleted file mode 100755 index 0fe1669c0..000000000 --- a/data-new/Implementation/ApplicationHardening/2/App.HardeningLevel2.yaml +++ /dev/null @@ -1,25 +0,0 @@ ---- -id: App.HardeningLevel2 -title: App. Hardening Level 2 -risk: Using an insecure application might lead to a compromised application. This - might lead to total data theft or data modification. -measure: | - Following frameworks like the -
      -
    • OWASP Application Security Verification Standard Level 2
      • -
    • OWASP Mobile Application Security Verification Standard Level 2
      • -
    -difficultyOfImplementation: - knowledge: 4 - time: 4 - resources: 2 -usefulness: 4 -implementation: -- OWASP - ASVS -- OWASP MASVS -samm2: software-requirements|A|2 -iso27001-2017: -- hardening is not explicitly covered by ISO 27001 - too specific -- 13.1.3 -... diff --git a/data-new/Implementation/ApplicationHardening/3/App.HardeningLevel3.yaml b/data-new/Implementation/ApplicationHardening/3/App.HardeningLevel3.yaml deleted file mode 100755 index bf5b8ccf5..000000000 --- a/data-new/Implementation/ApplicationHardening/3/App.HardeningLevel3.yaml +++ /dev/null @@ -1,26 +0,0 @@ ---- -id: App.HardeningLevel3 -title: App. Hardening Level 3 -risk: Using an insecure application might lead to a compromised application. This - might lead to total data theft or data modification. -measure: | - Following frameworks like the -
      -
    • OWASP Application Security Verification Standard Level 3
      • -
    • OWASP Mobile Application Security Verification Standard Maturity Requirements
      • -
    - and gain around 75% coverage of both. -difficultyOfImplementation: - knowledge: 4 - time: 4 - resources: 2 -usefulness: 4 -implementation: -- OWASP - ASVS -- OWASP MASVS -samm2: software-requirements|A|3 -iso27001-2017: -- hardening is not explicitly covered by ISO 27001 - too specific -- 13.1.3 -... diff --git a/data-new/Implementation/ApplicationHardening/4/FullCoverageOfApp.HardeningLevel3.yaml b/data-new/Implementation/ApplicationHardening/4/FullCoverageOfApp.HardeningLevel3.yaml deleted file mode 100755 index 4b32af899..000000000 --- a/data-new/Implementation/ApplicationHardening/4/FullCoverageOfApp.HardeningLevel3.yaml +++ /dev/null @@ -1,26 +0,0 @@ ---- -id: FullCoverageOfApp.HardeningLevel3 -title: Full Coverage of App. Hardening Level 3 -risk: Using an insecure application might lead to a compromised application. This - might lead to total data theft or data modification. -measure: | - Following frameworks like the -
      -
    • OWASP Application Security Verification Standard Level 3
      • -
    • OWASP Mobile Application Security Verification Standard Maturity Requirements
      • -
    - and gain around 95% coverage of both. -difficultyOfImplementation: - knowledge: 4 - time: 4 - resources: 2 -usefulness: 4 -implementation: -- OWASP - ASVS -- OWASP MASVS -samm2: software-requirements|A|3 -iso27001-2017: -- hardening is not explicitly covered by ISO 27001 - too specific -- 13.1.3 -... diff --git a/data-new/Implementation/InfrastructureHardening/1/IsolatedNetworksForVirtualEnvironments.yaml b/data-new/Implementation/InfrastructureHardening/1/IsolatedNetworksForVirtualEnvironments.yaml deleted file mode 100755 index 8080a6946..000000000 --- a/data-new/Implementation/InfrastructureHardening/1/IsolatedNetworksForVirtualEnvironments.yaml +++ /dev/null @@ -1,23 +0,0 @@ ---- -id: IsolatedNetworksForVirtualEnvironments -title: Isolated networks for virtual environments -risk: Virtual environments in default settings are able to access other virtual environments - on the network stack. By using virtual machines, it is often possible to connect - to other virtual machines. By using docker, one bridge is used by default so that - all containers on one host can communicate with each other. -measure: The communication between virtual environments is controlled and regulated. -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 3 -usefulness: 5 -dependsOn: [] -implementation: -- istio -- bridges -- firewalls -samm2: o-environment-management|A|1 -iso27001-2017: -- virtual environments are not explicitly covered by ISO 27001 - too specific -- 13.1.3 -... diff --git a/data-new/Implementation/InfrastructureHardening/1/SimpleAccessControlForSystems.yaml b/data-new/Implementation/InfrastructureHardening/1/SimpleAccessControlForSystems.yaml deleted file mode 100755 index e20189515..000000000 --- a/data-new/Implementation/InfrastructureHardening/1/SimpleAccessControlForSystems.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: SimpleAccessControlForSystems -title: Simple access control for systems -risk: Attackers a gaining access to internal systems and application interfaces -measure: All internal systems are using simple authentication -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 3 -usefulness: 5 -dependsOn: -- Defined deployment process -implementation: HTTP-Basic Authentication, TLS, VPN -samm: EH1-B -samm2: o-environment-management|A|1 -iso27001-2017: -- 9.4.1 -... diff --git a/data-new/Implementation/InfrastructureHardening/1/UsageOfTestAndProductionEnvironments.yaml b/data-new/Implementation/InfrastructureHardening/1/UsageOfTestAndProductionEnvironments.yaml deleted file mode 100755 index 867980763..000000000 --- a/data-new/Implementation/InfrastructureHardening/1/UsageOfTestAndProductionEnvironments.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: UsageOfTestAndProductionEnvironments -title: Usage of test and production environments -risk: Security tests are not running regularly because test environments are missing -measure: A production and a production like envirnoment is used -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 5 -usefulness: 4 -dependsOn: -- Defined deployment process -samm2: o-environment-management|A|1 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- 12.1.4 -- 17.2.1 -... diff --git a/data-new/Implementation/InfrastructureHardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml b/data-new/Implementation/InfrastructureHardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml deleted file mode 100755 index 429be6f5d..000000000 --- a/data-new/Implementation/InfrastructureHardening/2/ApplicationsAreRunningInVirtualizedEnvironments.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -id: ApplicationsAreRunningInVirtualizedEnvironments -title: Applications are running in virtualized environments -risk: Through a vulnerability in one service on a server, the attacker gains access - to other services running on the same server. -measure: Applications are running in a dedicated and isolated virtualized environments. -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 5 -usefulness: 3 -samm2: o-environment-management|A|1 -iso27001-2017: -- virtual environments are not explicitly covered by ISO 27001 - too specific -- 13.1.3 -... diff --git a/data-new/Implementation/InfrastructureHardening/2/CheckingTheSourcesOfUsedLibraries.yaml b/data-new/Implementation/InfrastructureHardening/2/CheckingTheSourcesOfUsedLibraries.yaml deleted file mode 100755 index 75f7b9f17..000000000 --- a/data-new/Implementation/InfrastructureHardening/2/CheckingTheSourcesOfUsedLibraries.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: CheckingTheSourcesOfUsedLibraries -title: Checking the sources of used libraries -risk: Application and system libraries can have implementation flaws or deployment - flaws. -measure: Each libraries source is checked to have a trusted source. -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 1 -usefulness: 3 -samm: SA1-A -samm2: o-environment-management|A|1 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- 14.2.1 -- 14.2.5 -... diff --git a/data-new/Implementation/InfrastructureHardening/2/FilterOutgoingTraffic.yaml b/data-new/Implementation/InfrastructureHardening/2/FilterOutgoingTraffic.yaml deleted file mode 100755 index 71ceaedfa..000000000 --- a/data-new/Implementation/InfrastructureHardening/2/FilterOutgoingTraffic.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -id: FilterOutgoingTraffic -title: Filter outgoing traffic -risk: A compromised infrastructure component might try to send out stolen data. -measure: Having a whitelist and explizitly allowing egress traffic provides the ability - to stop unauthorized data leackage. -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 3 -usefulness: 2 -dependsOn: [] -implementation: -- Open Policy Agent -- firewalls -samm2: o-environment-management|A|1 -iso27001-2017: -- virtual environments are not explicitly covered by ISO 27001 - too specific -- 13.1.3 -... diff --git a/data-new/Implementation/InfrastructureHardening/2/TheClusterIsHardened.yaml b/data-new/Implementation/InfrastructureHardening/2/TheClusterIsHardened.yaml deleted file mode 100755 index f36108250..000000000 --- a/data-new/Implementation/InfrastructureHardening/2/TheClusterIsHardened.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -id: TheClusterIsHardened -title: The cluster is hardened -risk: Using default configurations for a cluster environment leads to potential risks. -measure: Harden cluster environments according to best practices. Level 1 and partiually - level 2 from hardening practices like 'CIS Kubernetes Bench for Security' should - considered. -difficultyOfImplementation: - knowledge: 4 - time: 3 - resources: 2 -usefulness: 4 -implementation: -- CIS Kubernetes Bench for Security -- CIS Docker Bench for Security -- 'For example for Containers: Deny running containers as root, deny using advanced - privileges, deny mounting of the hole filesystem, ...' -samm2: o-environment-management|A|1 -iso27001-2017: -- system hardening is not explicitly covered by ISO 27001 - too specific -- 13.1.3 -... diff --git a/data-new/Implementation/InfrastructureHardening/2/UsageOfSecurityByDefaultForComponents.yaml b/data-new/Implementation/InfrastructureHardening/2/UsageOfSecurityByDefaultForComponents.yaml deleted file mode 100755 index f33d5cd53..000000000 --- a/data-new/Implementation/InfrastructureHardening/2/UsageOfSecurityByDefaultForComponents.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -id: UsageOfSecurityByDefaultForComponents -title: Usage of security by default for components -risk: Components (images, libraries, applications) are not hardened. -measure: Hardening of components is important, specially for image on which other - teams base on. Hardening should be performed on the operation system and on the - services inside (e.g. Nginx or a Java-Application). -difficultyOfImplementation: - knowledge: 4 - time: 3 - resources: 1 -usefulness: 3 -implementation: 'For applications: Check default encoding, managing secrets, crypto, - authentication' -dependsOn: -- Defined build process -samm2: o-environment-management|A|1 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -... diff --git a/data-new/Implementation/InfrastructureHardening/2/VirtualEnvironmentsAreLimited.yaml b/data-new/Implementation/InfrastructureHardening/2/VirtualEnvironmentsAreLimited.yaml deleted file mode 100755 index 1b4946308..000000000 --- a/data-new/Implementation/InfrastructureHardening/2/VirtualEnvironmentsAreLimited.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -id: VirtualEnvironmentsAreLimited -title: Virtual environments are limited -risk: Denial of service (internally by an attacker or unintentionally by a bug) on - one service effects other services -measure: All virtual environments are using resource limits on hard disks, memory - and CPU -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 3 -usefulness: 3 -dependsOn: -- Applications are running in virtualized environments -samm2: o-environment-management|A|1 -iso27001-2017: -- virtual environments are not explicitly covered by ISO 27001 - too specific -- 12.1.3 -- 13.1.3 -- 17.2.1 -... diff --git a/data-new/Implementation/InfrastructureHardening/3/2Fa.yaml b/data-new/Implementation/InfrastructureHardening/3/2Fa.yaml deleted file mode 100755 index b9dfd7033..000000000 --- a/data-new/Implementation/InfrastructureHardening/3/2Fa.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -id: 2Fa -title: 2FA -risk: One factor authentication is more vulnerable to brute force attacks and is considered - less secure. -measure: Two factor authentication for all privileged accounts on systems and applications -difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 3 -usefulness: 4 -implementation: Smartcard, YubiKey, SMS, TOTP -samm2: TODO -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- 9.1.1 -- 9.4.2 -- 14.2.5 -... diff --git a/data-new/Implementation/InfrastructureHardening/3/ImmutableInfrastructure.yaml b/data-new/Implementation/InfrastructureHardening/3/ImmutableInfrastructure.yaml deleted file mode 100755 index 21532578b..000000000 --- a/data-new/Implementation/InfrastructureHardening/3/ImmutableInfrastructure.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -id: ImmutableInfrastructure -title: Immutable Infrastructure -risk: The availability of IT systems might be disturbed due to components failures -measure: Redundancies in the IT systems -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 -usefulness: 3 -dependsOn: -- Infrastructure as Code -- Usage of Semantic Versioning for components like - project images -implementation: Remove direct access to infrastructure -samm2: o-environment-management|A|1 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- 17.2.1 -... diff --git a/data-new/Implementation/InfrastructureHardening/3/InfrastructureAsCode.yaml b/data-new/Implementation/InfrastructureHardening/3/InfrastructureAsCode.yaml deleted file mode 100755 index 5aeb863bf..000000000 --- a/data-new/Implementation/InfrastructureHardening/3/InfrastructureAsCode.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -id: InfrastructureAsCode -title: Infrastructure as Code -risk: No tracking of changes in systems might lead to errors in the configuration. - In additions, it might lead to unauthorized changes. An examples is jenkins. -measure: Systems are setup by code. A full environment can be provisioned. In addition, - software like Jenkins 2 can be setup and configured in in code too. The code should - be stored in a version control system. -difficultyOfImplementation: - knowledge: 3 - time: 5 - resources: 4 -usefulness: 4 -implementation: GitOps, Ansible, Chef, Puppet, Jenkinsfile -samm2: o-environment-management|A|1 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- 12.1.1 -- 12.1.2 -... diff --git a/data-new/Implementation/InfrastructureHardening/3/RoleBasedAuthenticationAndAuthorization.yaml b/data-new/Implementation/InfrastructureHardening/3/RoleBasedAuthenticationAndAuthorization.yaml deleted file mode 100755 index 051637d92..000000000 --- a/data-new/Implementation/InfrastructureHardening/3/RoleBasedAuthenticationAndAuthorization.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -id: RoleBasedAuthenticationAndAuthorization -title: Role based authentication and authorization -risk: Everyone is able to get unauthorized access to information on systems or to - modify information unauthorized on systems. -measure: The usage of a (role based) access control helps to restrict system access - to authorized users. -difficultyOfImplementation: - knowledge: 2 - time: 3 - resources: 1 -usefulness: 3 -implementation: Directory Service, Plugins -dependsOn: -- Defined deployment process -- Defined build process -samm2: o-environment-management|A|1 -iso27001-2017: -- 9.4.1 -... diff --git a/data-new/Implementation/InfrastructureHardening/3/Versioning.yaml b/data-new/Implementation/InfrastructureHardening/3/Versioning.yaml deleted file mode 100755 index f89c2f32f..000000000 --- a/data-new/Implementation/InfrastructureHardening/3/Versioning.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -id: Versioning -title: versioning -risk: Changes to production systems can not be undone. -measure: versioning of artifacts related to production environments. For example Jenkins - configuration, docker images, system provisioning code. -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 3 -usefulness: 5 -dependsOn: -- Defined deployment process -samm2: o-environment-management|A|1 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- 12.1.1 -- 12.1.2 -- 14.2.2 -... diff --git a/data-new/Implementation/InfrastructureHardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml b/data-new/Implementation/InfrastructureHardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml deleted file mode 100755 index 76cf2a874..000000000 --- a/data-new/Implementation/InfrastructureHardening/4/LimitationOfSystemCallsInVirtualEnvironments.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -id: LimitationOfSystemCallsInVirtualEnvironments -title: Limitation of system calls in virtual environments -risk: System calls in virtual environments like docker can lead to privilege escalation. -measure: System calls in virtual environments like docker are audited and limited. -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 3 -usefulness: 5 -dependsOn: -- Applications are running in virtualized environments -implementation: seccomp, strace -samm2: o-environment-management|A|1 -iso27001-2017: -- system hardenong is not explicitly covered by ISO 27001 - too specific -... diff --git a/data-new/Implementation/InfrastructureHardening/4/Microservice-Architecture.yaml b/data-new/Implementation/InfrastructureHardening/4/Microservice-Architecture.yaml deleted file mode 100755 index dcfcafaee..000000000 --- a/data-new/Implementation/InfrastructureHardening/4/Microservice-Architecture.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -id: Microservice-Architecture -title: Microservice-Architecture -risk: Monolithic applications are hard to test. -measure: A microservice-architecture helps to have small components, which are more - easy to test. -difficultyOfImplementation: - knowledge: 4 - time: 5 - resources: 5 -usefulness: 3 -samm: SA2 -samm2: o-environment-management|A|1 -iso27001-2017: -- not explicitly covered by ISO 27001 -... diff --git a/data-new/Implementation/InfrastructureHardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml b/data-new/Implementation/InfrastructureHardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml deleted file mode 100755 index 3079e36bf..000000000 --- a/data-new/Implementation/InfrastructureHardening/4/ProductionNearEnvironmentsAreUsedByDevelopers.yaml +++ /dev/null @@ -1,23 +0,0 @@ ---- -id: ProductionNearEnvironmentsAreUsedByDevelopers -title: Production near environments are used by developers -risk: In case an errors occurs in production, the developer need to be able to create - a production near environment on a local development environment. -measure: Usage of infrastructure as code helps to create a production near environment. - The developer needs to be trained in order to setup a local development environment. - In addition, it should be possible to create production like test data. Often personal - identifiable information is anonymized in order to comply with data protection laws. -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 3 -usefulness: 4 -dependsOn: -- Defined deployment process -- Infrastructure as Code -samm: SA1 -samm2: o-environment-management|A|1 -iso27001-2017: -- 12.1.4 -- 17.2.1 -... diff --git a/data-new/Implementation/InfrastructureHardening/4/UsageOfAChaosMonkey.yaml b/data-new/Implementation/InfrastructureHardening/4/UsageOfAChaosMonkey.yaml deleted file mode 100755 index 9bb6b574f..000000000 --- a/data-new/Implementation/InfrastructureHardening/4/UsageOfAChaosMonkey.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: UsageOfAChaosMonkey -title: Usage of a chaos monkey -risk: Due to manuel changes on a system, they are not replaceable anymore. In case - of a crash it might happen that a planned redundant system is unavailable. In addition, - it is hard to replay manual changes. -measure: A randomized periodically shutdown of systems makes sure, that nobody will - perform manual changes to a system. -difficultyOfImplementation: - knowledge: 3 - time: 5 - resources: 5 -usefulness: 3 -samm2: o-environment-management|A|1 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- 17.1.3 -... diff --git a/data-new/InformationGathering/Logging/1/CentralizedSystemLogging.yaml b/data-new/InformationGathering/Logging/1/CentralizedSystemLogging.yaml deleted file mode 100755 index f9c254110..000000000 --- a/data-new/InformationGathering/Logging/1/CentralizedSystemLogging.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: CentralizedSystemLogging -title: Centralized system logging -risk: Local stored system logs can be unauthorized manipulated by attackers or might - be corrupt after an incident. In addition, it is hard to perform a aggregation of - logs. -measure: By using centralized logging logs are protected against unauthorized modification. -difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 -usefulness: 2 -implementation: rsyslog, Logstash -samm2: o-incident-management|A|1 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- 12.4.1 -... diff --git a/data-new/InformationGathering/Logging/1/LoggingOfSecurityEvents.yaml b/data-new/InformationGathering/Logging/1/LoggingOfSecurityEvents.yaml deleted file mode 100755 index 37128a518..000000000 --- a/data-new/InformationGathering/Logging/1/LoggingOfSecurityEvents.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: LoggingOfSecurityEvents -title: Logging of security events -risk: No track of security-relevant events makes it harder to analyse an incident. -measure: Security-relevant events like login/logout or creation, change, deletion - of users should be logged. -difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 -usefulness: 4 -dependsOn: -- PII logging concept -implementation: rsyslog, logstash, fluentd, bash -samm2: o-incident-management|A|1 -iso27001-2017: -- 12.4.1 -... diff --git a/data-new/InformationGathering/Logging/1/PiiLoggingConcept.yaml b/data-new/InformationGathering/Logging/1/PiiLoggingConcept.yaml deleted file mode 100755 index b5b8e1db2..000000000 --- a/data-new/InformationGathering/Logging/1/PiiLoggingConcept.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: PiiLoggingConcept -title: PII logging concept -risk: Personal identifiable information (PII) is logged and the law of GDPR is not - followed. -measure: A concept how to log PII is documented and applied. -difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 -usefulness: 1 -implementation: rsyslog, logstash, fluentd, bash -samm2: o-incident-management|A|1 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- 12.4.1 -- 18.1.1 -... diff --git a/data-new/InformationGathering/Logging/2/VisualizedLogging.yaml b/data-new/InformationGathering/Logging/2/VisualizedLogging.yaml deleted file mode 100755 index 584b483b2..000000000 --- a/data-new/InformationGathering/Logging/2/VisualizedLogging.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -id: VisualizedLogging -title: Visualized logging -risk: System and application protocols are not visualized properly which leads to - no or very limited logging assessment. Specially developers might have difficulty - to read applications logs with unusually tools like the Linux tool 'cat' -measure: Protocols are visualized in a simple to use real time monitoring system. - The GUI gives the ability to search for special attributes in the protocol. -difficultyOfImplementation: - knowledge: 1 - time: 3 - resources: 3 -usefulness: 4 -dependsOn: -- Centralized system logging -- Centralized application logging -implementation: ELK-Stack -samm2: o-incident-management|A|1 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- 12.4.1 -... diff --git a/data-new/InformationGathering/Logging/3/CentralizedApplicationLogging.yaml b/data-new/InformationGathering/Logging/3/CentralizedApplicationLogging.yaml deleted file mode 100755 index 02e1a22a3..000000000 --- a/data-new/InformationGathering/Logging/3/CentralizedApplicationLogging.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -id: CentralizedApplicationLogging -title: Centralized application logging -risk: Local stored logs can be unauthorized manipulated by attackers with system access - or might be corrupt after an incident. In addition, it is hard to perform an correlation - of logs. This leads attacks, which can be performed silently. -measure: A centralized logging system is used and applications logs (including application - exceptions) are shipped to it. -difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 -usefulness: 5 -dependsOn: -- Visualized logging -- Alerting -samm: SA2-B -samm2: o-incident-management|A|1 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- 12.4.1 -... diff --git a/data-new/InformationGathering/Logging/4/CorrelationOfSecurityEvents.yaml b/data-new/InformationGathering/Logging/4/CorrelationOfSecurityEvents.yaml deleted file mode 100755 index c1a1ce5ec..000000000 --- a/data-new/InformationGathering/Logging/4/CorrelationOfSecurityEvents.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -id: CorrelationOfSecurityEvents -title: Correlation of security events -risk: Detection of security related events with hints on different systems/tools/metrics - is not possible. -measure: Events are correlated on one system. For example the correlation and visualisation - of failed login attempts combined with successful login attempts. -difficultyOfImplementation: - knowledge: 4 - time: 4 - resources: 4 -usefulness: 3 -dependsOn: -- Visualized logging -- Alerting -samm2: o-incident-management|A|2 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- 12.4.1 -... diff --git a/data-new/InformationGathering/Monitoring/1/SimpleApplicationMetrics.yaml b/data-new/InformationGathering/Monitoring/1/SimpleApplicationMetrics.yaml deleted file mode 100755 index 841ae66e5..000000000 --- a/data-new/InformationGathering/Monitoring/1/SimpleApplicationMetrics.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -id: SimpleApplicationMetrics -title: Simple application metrics -risk: Attacks on an application are not recognized. -measure: Gathering of application metrics helps to identify incidents like brute force - attacks, login/logout. -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 -usefulness: 5 -implementation: Prometheus -samm2: o-incident-management|A|1 -iso27001-2017: -- 12.4.1 -... diff --git a/data-new/InformationGathering/Monitoring/1/SimpleSystemMetrics.yaml b/data-new/InformationGathering/Monitoring/1/SimpleSystemMetrics.yaml deleted file mode 100755 index b8f8fc024..000000000 --- a/data-new/InformationGathering/Monitoring/1/SimpleSystemMetrics.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: SimpleSystemMetrics -title: Simple system metrics -risk: Without simple metrics analysis of incidents are hard. In case an application - uses a lot of CPU from time to time, it is hard for a developer to find out the - source with linux commands. -measure: Gathering of system metrics helps to identify incidents and specially bottlenecks - like in CPU usage, memory usage and hard disk usage. -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 -usefulness: 5 -implementation: collectd -samm2: o-incident-management|A|1 -iso27001-2017: -- 12.1.3 -... diff --git a/data-new/InformationGathering/Monitoring/2/Alerting.yaml b/data-new/InformationGathering/Monitoring/2/Alerting.yaml deleted file mode 100755 index 0bcd3834c..000000000 --- a/data-new/InformationGathering/Monitoring/2/Alerting.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -id: Alerting -title: Alerting -risk: Incidents are discovered after they happend. -measure: | - Thresholds for metrics are set. In case the thresholds are reached, alarms are send out. Which should get attention due to the critically. -difficultyOfImplementation: - knowledge: 2 - time: 5 - resources: 5 -usefulness: 5 -dependsOn: -- Visualized metrics -samm2: o-operational-management|B|3 -samm: OE1-B -iso27001-2017: -- 16.1.2 -- 16.1.4 -- 12.1.4 -... diff --git a/data-new/InformationGathering/Monitoring/2/VisualizedMetrics.yaml b/data-new/InformationGathering/Monitoring/2/VisualizedMetrics.yaml deleted file mode 100755 index d35da9390..000000000 --- a/data-new/InformationGathering/Monitoring/2/VisualizedMetrics.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -id: VisualizedMetrics -title: Visualized metrics -risk: Not visualized metrics lead to restricted usage of metrics. -measure: Metrics are visualized in real time in a user friendly way. -difficultyOfImplementation: - knowledge: 1 - time: 2 - resources: 2 -usefulness: 3 -dependsOn: -- Simple application metrics -- Simple system metrics -samm2: o-incident-management|A|2 -iso27001-2017: -- 12.1.3 -... diff --git a/data-new/InformationGathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml b/data-new/InformationGathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml deleted file mode 100755 index 91215d076..000000000 --- a/data-new/InformationGathering/Monitoring/3/AdvancedAvailablityAndStabilityMetrics.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: AdvancedAvailablityAndStabilityMetrics -title: Advanced availablity and stability metrics -risk: Trends and advanced attacks are not detected. -measure: Advanced metrics are gathered in relation to availability and stability. - For example unplanned downtime's per year. -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 2 -usefulness: 4 -dependsOn: -- Simple application metrics -- Visualized metrics -samm2: o-incident-management|A|2 -iso27001-2017: -- 12.1.3 -... diff --git a/data-new/InformationGathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml b/data-new/InformationGathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml deleted file mode 100755 index b0d22f267..000000000 --- a/data-new/InformationGathering/Monitoring/3/AdvancedWebapplicationMetrics.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: AdvancedWebapplicationMetrics -title: Advanced webapplication metrics -risk: People are not looking into tests results. Vulnerabilities not recolonized, - even they are detected by tools. -measure: All defects from the dimension Test- and Verification are instrumented. -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 2 -usefulness: 4 -dependsOn: -- Simple application metrics -- Visualized metrics -samm2: o-incident-management|A|2 -iso27001-2017: -- 12.6.1 -... diff --git a/data-new/InformationGathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml b/data-new/InformationGathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml deleted file mode 100755 index 1093e99ac..000000000 --- a/data-new/InformationGathering/Monitoring/3/DeactivationOfUnusedMetrics.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -id: DeactivationOfUnusedMetrics -title: Deactivation of unused metrics -risk: High resources are used while gathering unused metrics. -measure: Deactivation of unused metrics helps to free resources. -difficultyOfImplementation: - knowledge: 2 - time: 5 - resources: 5 -usefulness: 5 -dependsOn: -- Visualized metrics -samm2: o-incident-management|A|1 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- 12.1.3 -... diff --git a/data-new/InformationGathering/Monitoring/3/GroupingOfMetrics.yaml b/data-new/InformationGathering/Monitoring/3/GroupingOfMetrics.yaml deleted file mode 100755 index 9e1fb6064..000000000 --- a/data-new/InformationGathering/Monitoring/3/GroupingOfMetrics.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -id: GroupingOfMetrics -title: Grouping of metrics -risk: The analysis of metrics takes long. -measure: Meaningful grouping of metrics helps to speed up analysis. -difficultyOfImplementation: - knowledge: 2 - time: 4 - resources: 2 -usefulness: 2 -samm2: o-incident-management|A|2 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- 12.1.3 -... diff --git a/data-new/InformationGathering/Monitoring/3/TargetedAlerting.yaml b/data-new/InformationGathering/Monitoring/3/TargetedAlerting.yaml deleted file mode 100755 index 38288dbe5..000000000 --- a/data-new/InformationGathering/Monitoring/3/TargetedAlerting.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -id: TargetedAlerting -title: Targeted alerting -risk: People are bored (ignorant) of incident alarm messages, as they are not responsible - to react. -measure: By the definition of target groups for incidents people are only getting - alarms for incidents they are in charge for. -difficultyOfImplementation: - knowledge: 2 - time: 5 - resources: 5 -usefulness: 5 -dependsOn: -- Alerting -samm: OE1-B -samm2: o-operational-management|B|3 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- 16.1.5 -... diff --git a/data-new/InformationGathering/Monitoring/4/CoverageAndControlMetrics.yaml b/data-new/InformationGathering/Monitoring/4/CoverageAndControlMetrics.yaml deleted file mode 100755 index 642266234..000000000 --- a/data-new/InformationGathering/Monitoring/4/CoverageAndControlMetrics.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -id: CoverageAndControlMetrics -title: Coverage and control metrics -risk: The effectiveness of configuration, patch and vulnerability management is unknown. -measure: "Usage of Coverage- and control-metrics to show the effectiveness of the - security program. Coverage is the degree in \n which a specific security - control for a specific target group is applied with all resources.\n The - control degree shows the actual application of security standards and security-guidelines. - Examples are gathering information on anti-virus, anti-rootkits, patch management, - server configuration and vulnerability management." -difficultyOfImplementation: - knowledge: 3 - time: 5 - resources: 2 -usefulness: 4 -dependsOn: -- Visualized metrics -implementation: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf -samm2: o-incident-management|A|2 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -... diff --git a/data-new/InformationGathering/Monitoring/4/DefenceMetrics.yaml b/data-new/InformationGathering/Monitoring/4/DefenceMetrics.yaml deleted file mode 100755 index 7f97831a3..000000000 --- a/data-new/InformationGathering/Monitoring/4/DefenceMetrics.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -id: DefenceMetrics -title: Defence metrics -risk: IDS/IPS systems like packet- or application-firewalls detect and prevent attacks. - It is not known how many attacks has been detected and blocked. -measure: | - Gathering of defence metrics like TCP/UDP sources enables to assume the geographic location of the request. - Assuming a Kubernetes cluster with an egress-traffic filter (e.g. IP/domain based), an alert might be send out in case of every violation. For ingress-traffic, alerting might not even be considered. -difficultyOfImplementation: - knowledge: 3 - time: 5 - resources: 2 -usefulness: 4 -dependsOn: -- Visualized metrics -- Filter outcoing traffic -samm2: o-incident-management|A|2 -iso27001-2017: -- 12.4.1 -- 13.1.1 -... diff --git a/data-new/InformationGathering/Monitoring/4/MetricsAreCombinedWithTests.yaml b/data-new/InformationGathering/Monitoring/4/MetricsAreCombinedWithTests.yaml deleted file mode 100755 index 17fa4840b..000000000 --- a/data-new/InformationGathering/Monitoring/4/MetricsAreCombinedWithTests.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -id: MetricsAreCombinedWithTests -title: Metrics are combined with tests -risk: Changes might cause high load due to programming errors. -measure: Metrics during tests helps to identify programming errors. -difficultyOfImplementation: - knowledge: 2 - time: 3 - resources: 2 -usefulness: 5 -dependsOn: -- Grouping of metrics -samm2: o-incident-management|A|2 -iso27001-2017: -- not explicitly covered by ISO 27001 -... diff --git a/data-new/InformationGathering/Monitoring/4/ScreensWithMetricVisualization.yaml b/data-new/InformationGathering/Monitoring/4/ScreensWithMetricVisualization.yaml deleted file mode 100755 index 576780c67..000000000 --- a/data-new/InformationGathering/Monitoring/4/ScreensWithMetricVisualization.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: ScreensWithMetricVisualization -title: Screens with metric visualization -risk: Security related information is discovered too late during an incident. -measure: By having an internal accessible screen with a security related dashboards - helps to visualize incidents. -difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 1 -usefulness: 5 -dependsOn: -- Grouping of metrics -samm2: o-incident-management|A|2 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- 16.1.5 -... diff --git a/data-new/TestAndVerification/ApplicationTests/2/SecurityUnitTestsForImportantComponents.yaml b/data-new/TestAndVerification/ApplicationTests/2/SecurityUnitTestsForImportantComponents.yaml deleted file mode 100755 index 803d5891b..000000000 --- a/data-new/TestAndVerification/ApplicationTests/2/SecurityUnitTestsForImportantComponents.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -id: SecurityUnitTestsForImportantComponents -title: Security unit tests for important components -risk: Vulnerabilities are rising due to code changes. -measure: Usage of unit tests to test important security related features like authentication - and authorization. -difficultyOfImplementation: - knowledge: 3 - time: 4 - resources: 2 -usefulness: 3 -comment: The integration of module tests takes place during development instead, it - highlights vulnerabilities in sub-routines, functions, modules, libraries etc. checked. -implementation: -- JUnit -- Karma -samm: ST2-B -samm2: v-security-testing|B|3 -iso27001-2017: -- 14.2.3 -- 14.2.8 -... diff --git a/data-new/TestAndVerification/ApplicationTests/3/SecurityIntegrationTestsForImportantComponents.yaml b/data-new/TestAndVerification/ApplicationTests/3/SecurityIntegrationTestsForImportantComponents.yaml deleted file mode 100755 index bfae9a0ff..000000000 --- a/data-new/TestAndVerification/ApplicationTests/3/SecurityIntegrationTestsForImportantComponents.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: SecurityIntegrationTestsForImportantComponents -title: Security integration tests for important components -risk: Vulnerabilities are rising due to code changes in a complex microservice environment. -measure: Implementation of essential security related integration tests. For example - for authentication and authorization. -difficultyOfImplementation: - knowledge: 3 - time: 4 - resources: 2 -usefulness: 2 -implementation: HttpUnit -samm: ST2-B -samm2: v-security-testing|B|3 -iso27001-2017: -- 14.2.3 -- 14.2.8 -... diff --git a/data-new/TestAndVerification/ApplicationTests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml b/data-new/TestAndVerification/ApplicationTests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml deleted file mode 100755 index 92e0a7104..000000000 --- a/data-new/TestAndVerification/ApplicationTests/4/HighCoverageOfSecurityRelatedModuleAndIntegrationTests.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: HighCoverageOfSecurityRelatedModuleAndIntegrationTests -title: High coverage of security related module and integration tests -risk: Vulnerabilities are rising due to code changes in a complex microservice environment - in not important components. -measure: Implementation of security related tests via unit tests and integration tests. - Including the test of libraries, in case the are not tested already. -difficultyOfImplementation: - knowledge: 5 - time: 5 - resources: 3 -usefulness: 3 -samm: ST2-B -samm2: v-security-testing|B|3 -iso27001-2017: -- 14.2.3 -- 14.2.8 -... diff --git a/data-new/TestAndVerification/ApplicationTests/4/SmokeTest.yaml b/data-new/TestAndVerification/ApplicationTests/4/SmokeTest.yaml deleted file mode 100755 index ebdcfb03c..000000000 --- a/data-new/TestAndVerification/ApplicationTests/4/SmokeTest.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -id: SmokeTest -title: Smoke Test -risk: During a deployment an error might happen which leads to non-availability of - the system, a part of the system or a feature. -measure: Integration tests are performed against the production environment after - each deployment. -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 -usefulness: 2 -implementation: "" -dependsOn: -- Defined deployment process -samm: ST2-B -samm2: v-security-testing|B|3 -iso27001-2017: -- 14.2.3 -- 14.2.8 -... diff --git a/data-new/TestAndVerification/Consolidation/1/DefinitionOfQualityGates.yaml b/data-new/TestAndVerification/Consolidation/1/DefinitionOfQualityGates.yaml deleted file mode 100755 index c4b2b4c5c..000000000 --- a/data-new/TestAndVerification/Consolidation/1/DefinitionOfQualityGates.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -id: DefinitionOfQualityGates -title: Definition of quality gates -risk: Improper examination of vulnerabilities leads to no visibility at all. -measure: Quality gates for found vulnerabilities are defined. In the start it is important - to not overload the security analyst, therefore the recommendation is to start with - alerting of high cirital vulnerabilities. -difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 -usefulness: 4 -samm: IR2-A -samm2: i-defect-management|A|2 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- 12.6.1 -- 16.1.4 -implementation: See other actions, e.g. "Treatment of defects with severity high". -... diff --git a/data-new/TestAndVerification/Consolidation/1/SimpleFalsePositiveTreatment.yaml b/data-new/TestAndVerification/Consolidation/1/SimpleFalsePositiveTreatment.yaml deleted file mode 100755 index 5516a410c..000000000 --- a/data-new/TestAndVerification/Consolidation/1/SimpleFalsePositiveTreatment.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -id: SimpleFalsePositiveTreatment -title: Simple false positive treatment -risk: As false positive occure during each test, all vulnerabilities might be ignored. -measure: False positives are suppressed so they will not show up on the next tests - again. Most security tools have the possibility to suppress false positives. A Vulnerability - Management System might be used. -difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 -usefulness: 4 -implementation: -- OWASP Defect Dojo -- Purify -samm: IR2-A -samm2: i-defect-management|A|2 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- 16.1.6 -... diff --git a/data-new/TestAndVerification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml b/data-new/TestAndVerification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml deleted file mode 100755 index 583fa2877..000000000 --- a/data-new/TestAndVerification/Consolidation/1/TreatmentOfDefectsWithSeverityHighOrHigher.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -id: TreatmentOfDefectsWithSeverityHighOrHigher -title: Treatment of defects with severity high or higher -risk: Vulnerabilities with severity high or higher are not visible. -measure: Vulnerabilities with severity high or higher are added to the quality gate. -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 -usefulness: 4 -comment: False positive analysis, specially for static analysis, is time consuming. -samm2: i-defect-management|B|2 -iso27001-2017: -- 16.1.4 -- 12.6.1 -... diff --git a/data-new/TestAndVerification/Consolidation/2/SimpleVisualizationOfDefects.yaml b/data-new/TestAndVerification/Consolidation/2/SimpleVisualizationOfDefects.yaml deleted file mode 100755 index 5b6218b0a..000000000 --- a/data-new/TestAndVerification/Consolidation/2/SimpleVisualizationOfDefects.yaml +++ /dev/null @@ -1,23 +0,0 @@ ---- -id: SimpleVisualizationOfDefects -title: Simple visualization of defects -risk: The security level of a component is not visible. Therefore, the motivation - to enhance the security is not give. -measure: Vulnerabilities are simple visualized. -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 -usefulness: 3 -implementation: -- OWASP Dependency Check Jenkins Plugin -- LogParser Jenkins Plugins -- OWASP Defect Dojo -- Purify -samm2: i-defect-management|B|1 -iso27001-2017: -- 16.1.4 -- 8.2.1 -- 8.2.2 -- 8.2.3 -... diff --git a/data-new/TestAndVerification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml b/data-new/TestAndVerification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml deleted file mode 100755 index 684dc36dc..000000000 --- a/data-new/TestAndVerification/Consolidation/3/IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess.yaml +++ /dev/null @@ -1,23 +0,0 @@ ---- -id: IntegrationOfVulnerabilityIssuesIntoTheDevelopmentProcess -title: Integration of vulnerability issues into the development process -risk: To read console output of the build server to search for vulnerabilities might - be difficult. Also, to check a vulnerability management system might not be a daily - task for a developer. -measure: Vulnerabilities are tracked in the teams issue system (e.g. jira). -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 -usefulness: 2 -implementation: 'At SAST (Static Application Security Testing): Server-side / client-side - teams can easily be recorded. With microservice architecture, individual microservices - can be used usually Teams. At DAST (Dynamic Application Security Testing): vulnerabilities - are classified and can be assigned to server-side and client-side teams.' -samm2: i-defect-management|B|2 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- 16.1.4 -- 16.1.5 -- 16.1.6 -... diff --git a/data-new/TestAndVerification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml b/data-new/TestAndVerification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml deleted file mode 100755 index baf3a9a44..000000000 --- a/data-new/TestAndVerification/Consolidation/3/TreatmentOfDefectsWithSeverityMiddle.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -id: TreatmentOfDefectsWithSeverityMiddle -title: Treatment of defects with severity middle -risk: Vulnerabilities with severity middle are not visible. -measure: Vulnerabilities with severity middle are added to the quality gate. -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 -usefulness: 3 -comment: False positive analysis, specially for static analysis, is time consuming. -samm2: i-defect-management|B|2 -iso27001-2017: -- 16.1.4 -- 12.6.1 -... diff --git a/data-new/TestAndVerification/Consolidation/4/AdvancedVisualizationOfDefects.yaml b/data-new/TestAndVerification/Consolidation/4/AdvancedVisualizationOfDefects.yaml deleted file mode 100755 index ace347b51..000000000 --- a/data-new/TestAndVerification/Consolidation/4/AdvancedVisualizationOfDefects.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -id: AdvancedVisualizationOfDefects -title: Advanced visualization of defects -risk: Correlation of the vulnerabilities of different tools to have an overview of - the the overall security level per component/project/team is not given. -measure: Findings are visualized per component/project/team. -difficultyOfImplementation: - knowledge: 2 - time: 4 - resources: 1 -usefulness: 2 -implementation: -- OWASP Defect Dojo -- Purify -samm2: defect-management|B|1 -iso27001-2017: -- 16.1.4 -- 8.2.1 -- 8.2.2 -- 8.2.3 -... diff --git a/data-new/TestAndVerification/Consolidation/4/ReproducibleDefectTickets.yaml b/data-new/TestAndVerification/Consolidation/4/ReproducibleDefectTickets.yaml deleted file mode 100755 index 0291e2f98..000000000 --- a/data-new/TestAndVerification/Consolidation/4/ReproducibleDefectTickets.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -id: ReproducibleDefectTickets -title: Reproducible defect tickets -risk: Vulnerability descriptions are hard to understand by staff from operations and - development. -measure: Vulnerabilities include the test procedure to give the staff from operations - and development the ability to reproduce vulnerabilities. This enhances the understanding - of vulnerabilities and therefore the fix have a higher quality. -difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 2 -usefulness: 2 -implementation: Mozilla Zest -samm2: i-defect-management|B|2 -iso27001-2017: -- 16.1.4 -- 8.2.1 -- 8.2.2 -- 8.2.3 -... diff --git a/data-new/TestAndVerification/Consolidation/4/TreatmentOfAllDefects.yaml b/data-new/TestAndVerification/Consolidation/4/TreatmentOfAllDefects.yaml deleted file mode 100755 index 723ed8049..000000000 --- a/data-new/TestAndVerification/Consolidation/4/TreatmentOfAllDefects.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -id: TreatmentOfAllDefects -title: Treatment of all defects -risk: Vulnerabilities with severity low are not visible. -measure: All vulnerabilities are added to the quality gate. -difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 1 -usefulness: 2 -samm2: i-defect-management|B|2 -iso27001-2017: -- 16.1.4 -- 12.6.1 -... diff --git a/data-new/TestAndVerification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml b/data-new/TestAndVerification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml deleted file mode 100755 index c20fc176a..000000000 --- a/data-new/TestAndVerification/Consolidation/4/UsageOfAVulnerabilityManagementSystem.yaml +++ /dev/null @@ -1,23 +0,0 @@ ---- -id: UsageOfAVulnerabilityManagementSystem -title: Usage of a vulnerability management system -risk: Maintenance of false positives in each tool enforces a high workload. In addition - a correlation of the same finding from different tools is not possible. -measure: Aggregation of vulnerabilities in one tool reduce the workload to mark false - positives. -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 2 -usefulness: 2 -implementation: -- OWASP Defect Dojo -- Purify -samm2: i-defect-management|B|1 -iso27001-2017: -- 12.6.1 -- 16.1.3 -- 16.1.4 -- 16.1.5 -- 16.1.6 -... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/1/SimpleScan.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/1/SimpleScan.yaml deleted file mode 100755 index 0b97d9611..000000000 --- a/data-new/TestAndVerification/DynamicDepthForApplications/1/SimpleScan.yaml +++ /dev/null @@ -1,24 +0,0 @@ ---- -id: SimpleScan -title: Simple Scan -risk: Deficient security tests are performed. Simple vulnerabilities are not detected - and missing security configurations (e.g. headers) are not set. Fast feedback is - not given. -measure: A simple scan is performed to get a security baseline. In case the test is - done in under 10 minutes, it should be part of the build and deployment process. -difficultyOfImplementation: - knowledge: 2 - time: 3 - resources: 1 -usefulness: 2 -dependsOn: -- Defined build process -samm: ST2 -implementation: -- OWASP Zap -- Arachni -samm2: v-security-testing|A|1 -iso27001-2017: -- 14.2.3 -- 14.2.8 -... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/2/CoverageOfClientSideDynamicComponents.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/2/CoverageOfClientSideDynamicComponents.yaml deleted file mode 100755 index 893a07a6b..000000000 --- a/data-new/TestAndVerification/DynamicDepthForApplications/2/CoverageOfClientSideDynamicComponents.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -id: CoverageOfClientSideDynamicComponents -title: Coverage of client side dynamic components -risk: Parts of the service are not covered during the scan, because JavaScript is - not getting executed. Therefore, the co -measure: Usage of a spider which executes dynamic content like JavaScript, e.g. via - Selenium. -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 1 -usefulness: 4 -dependsOn: -- Usage of different roles -samm: ST-2 -samm2: v-security-testing|A|2 -iso27001-2017: -- 14.2.3 -- 14.2.8 -implementation: Ajax Spider -... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/2/UsageOfDifferentRoles.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/2/UsageOfDifferentRoles.yaml deleted file mode 100755 index dbc433eb9..000000000 --- a/data-new/TestAndVerification/DynamicDepthForApplications/2/UsageOfDifferentRoles.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -id: UsageOfDifferentRoles -title: Usage of different roles -risk: Parts of the service are not covered during the scan, because a login is not - performed. -measure: Integration of authentication with all roles used in the service. -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 1 -usefulness: 2 -dependsOn: -- Simple Scan -samm2: v-security-testing|A|2 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- 14.2.3 -- 14.2.8 -... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfHiddenEndpoints.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfHiddenEndpoints.yaml deleted file mode 100755 index f76cf1108..000000000 --- a/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfHiddenEndpoints.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -id: CoverageOfHiddenEndpoints -title: Coverage of hidden endpoints -risk: Hidden endpoints of the service are not getting tracked. -measure: Hidden endpoints are getting detected and included in the vulnerability scan. -difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 1 -usefulness: 5 -implementation: cURL, OpenAPI -dependsOn: -- Usage of different roles -samm2: v-security-testing|A|2 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfMoreInputVectors.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfMoreInputVectors.yaml deleted file mode 100755 index fe3dfda45..000000000 --- a/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfMoreInputVectors.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -id: CoverageOfMoreInputVectors -title: Coverage of more input vectors -risk: Parts of the service are not covered. For example specially formatted or coded - parameters are not getting detected as parameter (e.g. parameters in REST-like URLs, - parameters in JSON-Format or base64-coded parameters). -measure: Special parameter and special encodings are defined, so that they get fuzzed - by the used vulnerability scanners. -difficultyOfImplementation: - knowledge: 5 - time: 5 - resources: 1 -usefulness: 4 -dependsOn: -- Usage of different roles -samm2: v-security-testing|A|2 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfSequentialOperations.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfSequentialOperations.yaml deleted file mode 100755 index bb4f23289..000000000 --- a/data-new/TestAndVerification/DynamicDepthForApplications/3/CoverageOfSequentialOperations.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -id: CoverageOfSequentialOperations -title: Coverage of sequential operations -risk: Sequential operations like workflows (e.g. login -> put products in the basket -measure: Sequential operations are defined and checked by the vulnerability scanner - in the defined order. -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 1 -usefulness: 5 -implementation: cURL -dependsOn: -- Usage of different roles -samm2: v-security-testing|A|2 -iso27001-2017: -- 14.2.8 -- 14.2.3 -... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/3/UsageOfMultipleScanners.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/3/UsageOfMultipleScanners.yaml deleted file mode 100755 index 733e7bf7f..000000000 --- a/data-new/TestAndVerification/DynamicDepthForApplications/3/UsageOfMultipleScanners.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -id: UsageOfMultipleScanners -title: Usage of multiple scanners -risk: Each vulnerability scanner has different opportunities. By using just one scanner, - some vulnerabilities might not be found. -measure: Usage of multiple spiders and scanner enhance the coverage and the vulnerabilities. -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 5 -usefulness: 1 -dependsOn: -- Usage of different roles -implementation: SecureCodeBox -samm2: v-security-testing|A|2 -iso27001-2017: -- 12.6.1 -- 14.2.5 -... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageAnalysis.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageAnalysis.yaml deleted file mode 100755 index a3ce5c0df..000000000 --- a/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageAnalysis.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -id: CoverageAnalysis -title: Coverage analysis -risk: Parts of the service are not still covered. -measure: Check that there are no missing paths in the application with coverage-tools. -difficultyOfImplementation: - knowledge: 4 - time: 5 - resources: 3 -usefulness: 4 -implementation: OWASP Code Pulse -samm2: v-security-testing|A|2 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- part of periodic review, PDCA -... diff --git a/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageOfServiceToServiceCommunication.yaml b/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageOfServiceToServiceCommunication.yaml deleted file mode 100755 index 0f4aba6aa..000000000 --- a/data-new/TestAndVerification/DynamicDepthForApplications/4/CoverageOfServiceToServiceCommunication.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -id: CoverageOfServiceToServiceCommunication -title: Coverage of service to service communication -risk: Service to service communication is not covered. -measure: Service to service communication is dumped and checked. -difficultyOfImplementation: - knowledge: 4 - time: 5 - resources: 2 -usefulness: 3 -dependsOn: -- Simple Scan -samm2: v-security-testing|A|2 -iso27001-2017: -- 14.2.3 -- 14.2.8 -... diff --git a/data-new/TestAndVerification/DynamicDepthForInfrastructure/1/TestForExposedServices.yaml b/data-new/TestAndVerification/DynamicDepthForInfrastructure/1/TestForExposedServices.yaml deleted file mode 100755 index 4e3419e7b..000000000 --- a/data-new/TestAndVerification/DynamicDepthForInfrastructure/1/TestForExposedServices.yaml +++ /dev/null @@ -1,23 +0,0 @@ ---- -id: TestForExposedServices -title: Test for exposed services -risk: Standard network segmentation and firewalling has not been performed, leading - to world open cluster management ports. -measure: With the help of tools the network configuration of unintenonal exposed cluster(s) - are tested. To identify clusters, all subdomains might need to be identified with - a tool like OWASP Amass to perform portscans based o the result. -difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 -usefulness: 3 -implementation: -- nmap -- OWASP Amass -samm: EH2-B -samm2: v-security-testing|A|1 -iso27001-2017: -- 13.1.3 -- 14.2.3 -- 14.2.8 -... diff --git a/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestNetworkSegmentation.yaml b/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestNetworkSegmentation.yaml deleted file mode 100755 index a2eb19a92..000000000 --- a/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestNetworkSegmentation.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -id: TestNetworkSegmentation -title: Test network segmentation -risk: Wrong or no network segmentation of pods makes it easyer for an attacker to - access a database and extract or modify data. -measure: Cluster interal test needs to be performed. Integration of fine granulated - network segmenation (also between pods in the same namespace). -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 -usefulness: 3 -implementation: netassert -dependendsOn: Segmented networks for virtual environments -samm2: v-security-testing|A|2 -iso27001-2017: -- 13.1.3 -- 14.2.3 -- 14.2.8 -... diff --git a/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml b/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml deleted file mode 100755 index bccc17b3f..000000000 --- a/data-new/TestAndVerification/DynamicDepthForInfrastructure/2/TestOfTheConfigurationOfCloudEnvironments.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -id: TestOfTheConfigurationOfCloudEnvironments -title: Test of the configuration of cloud environments -risk: Standard hardening practices for cloud environments are not performed leading - to vulnerabilities. -measure: With the help of tools the configuration of virtual environments are tested. -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 -usefulness: 4 -implementation: -- kube-hunter -- openVAS -samm: EH2-B -iso27001-2017: -- system hardening is not explicitly covered by ISO 27001 - too specific -- 12.6.1 -- 14.2.3 -- 14.2.8 -... diff --git a/data-new/TestAndVerification/DynamicDepthForInfrastructure/3/WeakPasswordTest.yaml b/data-new/TestAndVerification/DynamicDepthForInfrastructure/3/WeakPasswordTest.yaml deleted file mode 100755 index e3e701f28..000000000 --- a/data-new/TestAndVerification/DynamicDepthForInfrastructure/3/WeakPasswordTest.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -id: WeakPasswordTest -title: Weak password test -risk: Weak passwords in components like applications or systems, specially for privileged - accounts, lead to take over of that account. -measure: Automatic brute force attacks are performed. Specially the usage of standard - accounts like 'admin' and employee user-ids is recommended. -difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 1 -usefulness: 1 -implementation: HTC Hydra -samm2: v-security-testing|A|2 -iso27001-2017: -- 9.4.3 -... diff --git a/data-new/TestAndVerification/DynamicDepthForInfrastructure/4/LoadTests.yaml b/data-new/TestAndVerification/DynamicDepthForInfrastructure/4/LoadTests.yaml deleted file mode 100755 index e5636eeeb..000000000 --- a/data-new/TestAndVerification/DynamicDepthForInfrastructure/4/LoadTests.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -id: LoadTests -title: Load tests -risk: As it is unknown how many requests the systems and applications can serve, due - to an unexpected load the availability is disturbed. -measure: Load test against the production system or a production near system is performed. -difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 5 -usefulness: 3 -samm2: v-security-testing|A|1 -iso27001-2017: -- 12.1.3 -- 14.2.3 -- 14.2.8 -... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml b/data-new/TestAndVerification/StaticDepthForApplications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml deleted file mode 100755 index 60f856eee..000000000 --- a/data-new/TestAndVerification/StaticDepthForApplications/1/TestOfServerSideComponentsWithKnownVulnerabilities.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -id: TestOfServerSideComponentsWithKnownVulnerabilities -title: Test of server side components with known vulnerabilities -risk: Server side components might have vulnerabilities. -measure: Tests for known vulnerabilities in server side components (e.g. backend/middleware) - are performed. -difficultyOfImplementation: - knowledge: 1 - time: 2 - resources: 1 -usefulness: 5 -dependsOn: -- Defined build process -implementation: OWASP Dependency Check -samm: SA -samm2: v-security-testing|A|2 -iso27001-2017: -- 12.6.1 -... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/2/StaticAnalysisForImportantServerSideComponents.yaml b/data-new/TestAndVerification/StaticDepthForApplications/2/StaticAnalysisForImportantServerSideComponents.yaml deleted file mode 100755 index 763280417..000000000 --- a/data-new/TestAndVerification/StaticDepthForApplications/2/StaticAnalysisForImportantServerSideComponents.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -id: StaticAnalysisForImportantServerSideComponents -title: Static analysis for important server side components -risk: Important parts in the source code of the middleware have vulnerabilities. -measure: Usage of static analysis tools for important parts of the middleware are - used. Static analysis uses for example string matching algorithms and/or dataflow - analysis. -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 -usefulness: 4 -implementation: eslint, FindSecurityBugs, jsprime -dependsOn: -- Defined build process -samm2: v-security-testing|A|2 -iso27001-2017: -- 12.6.1 -... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/3/StaticAnalysisForImportantClientSideComponents.yaml b/data-new/TestAndVerification/StaticDepthForApplications/3/StaticAnalysisForImportantClientSideComponents.yaml deleted file mode 100755 index b7e8e1428..000000000 --- a/data-new/TestAndVerification/StaticDepthForApplications/3/StaticAnalysisForImportantClientSideComponents.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -id: StaticAnalysisForImportantClientSideComponents -title: Static analysis for important client side components -risk: Important parts in the source code of the frontend have vulnerabilities. -measure: Usage of static analysis tools for important parts of the frontend are used. - Static analysis uses for example string matching algorithms and/or dataflow analysis. -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 -usefulness: 3 -implementation: -- eslint -- FindSecurityBugs -- jsprime -- bdd-mobile-security-automation-framework -samm2: v-security-testing|A|2 -iso27001-2017: -- 12.6.1 -dependsOn: -- Defined build process -... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml b/data-new/TestAndVerification/StaticDepthForApplications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml deleted file mode 100755 index 8c368a1da..000000000 --- a/data-new/TestAndVerification/StaticDepthForApplications/3/TestOfClientSideComponentsWithKnownVulnerabilities.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -id: TestOfClientSideComponentsWithKnownVulnerabilities -title: Test of client side components with known vulnerabilities -risk: Client side components might have vulnerabilities. -measure: Tests for known vulnerabilities in components of the frontend are performed. -difficultyOfImplementation: - knowledge: 1 - time: 2 - resources: 1 -usefulness: 2 -dependsOn: -- Defined build process -implementation: -- retire.js -- npm audit -samm2: v-security-testing|A|2 -iso27001-2017: -- 12.6.1 -... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/4/ExclusionOfSourceCodeDuplicates.yaml b/data-new/TestAndVerification/StaticDepthForApplications/4/ExclusionOfSourceCodeDuplicates.yaml deleted file mode 100755 index cf37ab34c..000000000 --- a/data-new/TestAndVerification/StaticDepthForApplications/4/ExclusionOfSourceCodeDuplicates.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -id: ExclusionOfSourceCodeDuplicates -title: Exclusion of source code duplicates -risk: Duplicates in source code might influence the stability of the application. -measure: Automatic Detection and manual removal of duplicates in source code. -difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 -usefulness: 1 -implementation: PMD -dependsOn: -- Defined build process -samm2: v-security-testing|A|2 -iso27001-2017: -- not explicitly covered by ISO 27001 - too specific -- 14.2.1 -- 14.2.5 -... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllComponentsOrlibraries.yaml b/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllComponentsOrlibraries.yaml deleted file mode 100755 index af0b2824f..000000000 --- a/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllComponentsOrlibraries.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -id: StaticAnalysisForAllComponentsOrlibraries -title: Static analysis for all components/libraries -risk: Used components like libraries and legacy applications might have vulnerabilities -measure: Usage of a static analysis for all used components. -difficultyOfImplementation: - knowledge: 2 - time: 4 - resources: 2 -usefulness: 3 -dependsOn: -- Static analysis for important client side components -- Static analysis for important server side components -samm2: v-security-testing|A|2 -iso27001-2017: -- 12.6.1 -... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllSelfWrittenComponents.yaml b/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllSelfWrittenComponents.yaml deleted file mode 100755 index 55aad488a..000000000 --- a/data-new/TestAndVerification/StaticDepthForApplications/4/StaticAnalysisForAllSelfWrittenComponents.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -id: StaticAnalysisForAllSelfWrittenComponents -title: Static analysis for all self written components -risk: Parts in the source code of the frontend or middleware have vulnerabilities. -measure: Usage of static analysis tools for all parts of the middleware and frontend. - Static analysis uses for example string matching algorithms and/or dataflow analysis. -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 -usefulness: 4 -implementation: eslint, FindSecurityBugs, jsprime -dependsOn: -- Static analysis for important client side components -- Static analysis for important server side components -samm2: v-security-testing|A|2 -iso27001-2017: -- 12.6.1 -... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/4/StylisticAnalysis.yaml b/data-new/TestAndVerification/StaticDepthForApplications/4/StylisticAnalysis.yaml deleted file mode 100755 index e052d73f0..000000000 --- a/data-new/TestAndVerification/StaticDepthForApplications/4/StylisticAnalysis.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: StylisticAnalysis -title: Stylistic analysis -risk: False source code indenting might lead to vulnerabilities. -measure: Analysis of compliance to style guides of the source code ensures that source - code indenting rules are met. -difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 -usefulness: 1 -implementation: PMD -samm2: v-security-testing|A|2 -iso27001-2017: -- 12.6.1 -- 14.2.1 -- 14.2.5 -... diff --git a/data-new/TestAndVerification/StaticDepthForApplications/4/UsageOfMultipleAnalysers.yaml b/data-new/TestAndVerification/StaticDepthForApplications/4/UsageOfMultipleAnalysers.yaml deleted file mode 100755 index 439306bd8..000000000 --- a/data-new/TestAndVerification/StaticDepthForApplications/4/UsageOfMultipleAnalysers.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -id: UsageOfMultipleAnalysers -title: Usage of multiple analysers -risk: Each vulnerability analyser has different opportunities. By using just one analyser, - some vulnerabilities might not be found. -measure: Usage of multiple static tools to find more vulnerabilities. -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 5 -usefulness: 1 -samm2: v-security-testing|A|3 -iso27001-2017: -- 12.6.1 -- 14.2.1 -- 14.2.5 -dependsOn: -- Test of server side components with known vulnerabilities -- Test of client side components with known vulnerabilities -- Static analysis for all self written components -... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/1/StoredSecrets.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/1/StoredSecrets.yaml deleted file mode 100755 index 8e7a7cf3e..000000000 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/1/StoredSecrets.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -id: StoredSecrets -title: Stored Secrets -risk: Stored secrets in git history, in container images or directly in code shouldn't - exists because they might be read unauthorized. -measure: Test for secrets in code, container images and history -difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 2 -usefulness: 2 -implementation: -- truffleHog -- go-pillage-registries -samm2: v-security-testing|A|1 -iso27001-2017: -- vcs usage is not explicitly covered by ISO 27001 - too specific -- 9.4.3 -- 10.1.2 -... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestClusterDeploymentResources.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestClusterDeploymentResources.yaml deleted file mode 100755 index e2701e46f..000000000 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestClusterDeploymentResources.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -id: TestClusterDeploymentResources -title: Test cluster deployment resources -risk: The deployment configuration (e.g. kubernetes deployment resources) might contain - unsecured configurations. -measure: Test the deployment configuration for virtualized environments for unsecured - configurations. -difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 2 -usefulness: 3 -implementation: -- kubesec -samm2: v-security-testing|A|1 -iso27001-2017: -- system hardening is not explicitly covered by ISO 27001 - too specific -- 12.6.1 -- 14.2.3 -- 14.2.8 -... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestOfVirtualizedEnvironments.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestOfVirtualizedEnvironments.yaml deleted file mode 100755 index 258b104a3..000000000 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestOfVirtualizedEnvironments.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -id: TestOfVirtualizedEnvironments -title: Test of virtualized environments -risk: Virtualized environments (e.g. via Container Images) might contains unsecure - configurations. -measure: Test virtualized environments for unsecured configurations. -difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 2 -usefulness: 3 -implementation: -- Dive to inspect a container images -- Cluster Scanner (will be open sourced soon) to check different aspects -samm2: v-security-testing|A|1 -... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheClouldConfiguration.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheClouldConfiguration.yaml deleted file mode 100755 index 66feac6cd..000000000 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheClouldConfiguration.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -id: TestTheClouldConfiguration -title: Test the clould configuration -risk: Standard hardening practices for cloud environments are not performed leading - to vulnerabilities. -measure: With the help of tools the configuration of virtual environments are tested. -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 -usefulness: 4 -implementation: -- kube-bench -samm: EH2-B -samm2: v-security-testing|A|1 -iso27001-2017: -- system hardening is not explicitly covered by ISO 27001 - too specific -- 12.6.1 -- 14.2.3 -- 14.2.8 -... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml deleted file mode 100755 index 35c8473cb..000000000 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/2/TestTheDefinitionOfVirtualizedEnvironments.yaml +++ /dev/null @@ -1,23 +0,0 @@ ---- -id: TestTheDefinitionOfVirtualizedEnvironments -title: Test the definition of virtualized environments -risk: The definition of virtualized environments (e.g. via Dockerfile) might - contains unsecure configurations. -measure: Test the definition of virtualized environments for unsecured configurations. -difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 2 -usefulness: 3 -implementation: -- Dockerfile with hadolint -- Deployment with kube-score -samm2: v-security-testing|A|1 -iso27001-2017: -- system hardening, virtual environments are not explicitly covered by ISO 27001 - - too specific -- 12.6.1 -- 14.2.3 -- 14.2.8 -- 14.2.1 -... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForImageLifetime.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForImageLifetime.yaml deleted file mode 100755 index af82cbe8c..000000000 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForImageLifetime.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -id: CheckForImageLifetime -title: Check for image lifetime -risk: Old container images in production indicate that patch management is not performed - and therefore vulnerabilities might exists. -measure: Check the image age of containers in production. -difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 1 -usefulness: 2 -implementation: ~ -samm2: v-security-testing|A|1 -iso27001-2017: -- 12.6.1 -- 14.2.5 -... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForMalware.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForMalware.yaml deleted file mode 100755 index 384fb4959..000000000 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForMalware.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: CheckForMalware -title: Check for malware -risk: Third party might include malware. Ether due to the maintainer (e.g. typo squatting - of an image name and using the wrong image) or by an attacker on behalf of the maintainer - with stolen credentials. -measure: Check for malware in components (e.g. container images, VM baseline images, - libaries). -difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 -usefulness: 3 -implementation: ~ -samm2: v-security-testing|A|2 -iso27001-2017: -- 12.2.1 -... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForNewImageVersion.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForNewImageVersion.yaml deleted file mode 100755 index e9c1795ab..000000000 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/3/CheckForNewImageVersion.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -id: CheckForNewImageVersion -title: Check for new image version -risk: When a new version of an image is available, it might fixes security vulnerabilities. -measure: Check for new images of containers in production. -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 1 -usefulness: 2 -implementation: ~ -samm2: v-security-testing|A|2 -iso27001-2017: -- 12.6.1 -- 14.2.5 -- 12.2.1 -... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CheckForKnownVulnerabilities.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CheckForKnownVulnerabilities.yaml deleted file mode 100755 index 88cefaeb6..000000000 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CheckForKnownVulnerabilities.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -id: CheckForKnownVulnerabilities -title: Check for known vulnerabilities -risk: Known vulnerabilities in infrastructure components like container images might - get exploited. -measure: Check for known vulnerabilities -difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 1 -usefulness: 4 -implementation: -- https://github.com/aquasecurity/trivy -- Registries like quay, dockerhub provide (commercial) offerings, often not suiteable - for distroless images -samm2: v-security-testing|A|2 -iso27001-2017: -- 12.6.1 -... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml deleted file mode 100755 index 484ba0b62..000000000 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/4/CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -id: CorrelateKnownVulnerabilitiesInInfrastructureWithNewImageVersions -title: Correlate known vulnerabilities in infrastructure with new image versions -risk: TODO. -measure: TODO -difficultyOfImplementation: - knowledge: 2 - time: 5 - resources: 4 -usefulness: 1 -dependsOn: -- Usage of a maximum lifetime for images -implementation: -- Anchore.io -- Clair -- OpenSCAP -- Vuls -samm2: v-security-testing|A|1 -iso27001-2017: -- 12.6.1 -- 14.2.1 -... diff --git a/data-new/TestAndVerification/StaticDepthForInfrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml b/data-new/TestAndVerification/StaticDepthForInfrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml deleted file mode 100755 index 06dd279a8..000000000 --- a/data-new/TestAndVerification/StaticDepthForInfrastructure/4/TestOfInfrastructureComponentsForKnownVulnerabilities.yaml +++ /dev/null @@ -1,25 +0,0 @@ ---- -id: TestOfInfrastructureComponentsForKnownVulnerabilities -title: Test of infrastructure components for known vulnerabilities -risk: Infrastructure components might have vulnerabilities. -measure: Test for known vulnerabilities in infrastructure components. Often, the only - way to respond to known vulnerabilities in operating system packages is to accept - the risk and wait for a patch. As the patch needs to be applied fast when it is - available, this activity depends on 'Usage of a maximum life for images'. -difficultyOfImplementation: - knowledge: 2 - time: 5 - resources: 2 -usefulness: 1 -dependsOn: -- Usage of a maximum lifetime for images -implementation: -- Anchore.io -- Clair -- OpenSCAP -- Vuls -samm2: v-security-testing|A|1 -iso27001-2017: -- 12.6.1 -- 14.2.1 -... diff --git a/data-new/TestAndVerification/Test-Intensity/1/DefaultSettingsForIntensity.yaml b/data-new/TestAndVerification/Test-Intensity/1/DefaultSettingsForIntensity.yaml deleted file mode 100755 index e96f0022a..000000000 --- a/data-new/TestAndVerification/Test-Intensity/1/DefaultSettingsForIntensity.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -id: DefaultSettingsForIntensity -title: Default settings for intensity -risk: Time pressure and ignorance might lead to false predictions for the test intensity. -measure: The intensity of the used tools are not modified to safe time. -difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 -usefulness: 1 -samm2: v-security-testing|A|1 -iso27001-2017: -- 12.6.1 -- 14.2.1 -- 14.2.5 -... diff --git a/data-new/TestAndVerification/Test-Intensity/1/HighTestIntensity.yaml b/data-new/TestAndVerification/Test-Intensity/1/HighTestIntensity.yaml deleted file mode 100755 index 2a824a242..000000000 --- a/data-new/TestAndVerification/Test-Intensity/1/HighTestIntensity.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -id: HighTestIntensity -title: High test intensity -risk: A too small intensity or a too high confidence might lead to not visible vulnerabilities. -measure: A deep scan with high test intensity and a low confidence threshold is performed. -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 5 -usefulness: 3 -samm2: v-security-testing|A|2 -iso27001-2017: -- 12.6.1 -- 14.2.1 -- 14.2.5 -... diff --git a/data-new/TestAndVerification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml b/data-new/TestAndVerification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml deleted file mode 100755 index c290d21e5..000000000 --- a/data-new/TestAndVerification/Test-Intensity/2/DeactivatingOfUnneededTests.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -id: DeactivatingOfUnneededTests -title: Deactivating of unneeded tests -risk: As tools cover a wide range of different vulnerability tests, they might not - match the used components. Therefore, they need more time and resources as they - need and the feedback loops takes too much time. -measure: Unneeded tests are deactivated. For example in case the service is using - a Mongo database and no mysql database, the dynamic scan doesn't need to test for - sql injections. -difficultyOfImplementation: - knowledge: 2 - time: 3 - resources: 1 -usefulness: 1 -samm2: v-security-testing|A|2 -iso27001-2017: -- 12.6.1 -- 14.2.1 -- 14.2.5 -... diff --git a/data-new/TestAndVerification/Test-Intensity/2/RegularTests.yaml b/data-new/TestAndVerification/Test-Intensity/2/RegularTests.yaml deleted file mode 100755 index 8d793e3d6..000000000 --- a/data-new/TestAndVerification/Test-Intensity/2/RegularTests.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -id: RegularTests -title: Regular tests -risk: After pushing source code to the version control system, any delay in receiving - feedback on defects makes them harder for the developer to remediate. -measure: On each push and/or at given intervals automatic security tests are performed. -difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 -usefulness: 2 -implementation: "" -samm2: i-secure-build|A|3 -iso27001-2017: -- 14.2.3 -- 14.2.8 -- 14.2.9 -... diff --git a/data-new/TestAndVerification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml b/data-new/TestAndVerification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml deleted file mode 100755 index 84aa2effd..000000000 --- a/data-new/TestAndVerification/Test-Intensity/3/CreationAndApplicationOfATestingConcept.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -id: CreationAndApplicationOfATestingConcept -title: Creation and application of a testing concept -risk: Scans might use a too small or too high test intensity. -measure: A testing concept considering the amount of time per scan/intensity is created - and applied. A dynamic analysis needs more time than a static analysis. The dynamic - scan, depending on the test intensity might be performed on every commit, every - night, every week or once in a month. -difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 3 -usefulness: 2 -samm2: v-security-testing|A|2 -iso27001-2017: -- 14.2.2 -- 14.2.3 -- 14.2.1 -- 14.2.5 -- 12.6.1 -... diff --git a/newFolder-Migration-2021.php b/newFolder-Migration-2021.php index ee9fcb865..35ad18ba0 100644 --- a/newFolder-Migration-2021.php +++ b/newFolder-Migration-2021.php @@ -23,27 +23,28 @@ function readYaml($file) $newElements = $elements; ksort($newElements); $dimensions[$dimensionName][$subDimensionName] = $newElements; + foreach($elements as $elementName => $element) { - $dimensionIdWithSpace = mb_convert_case($dimensionName, MB_CASE_TITLE); - $dimensionId = str_replace(" ", "", $dimensionIdWithSpace); - $subDimensionId = str_replace(" ", "",mb_convert_case($subDimensionName, MB_CASE_TITLE)); - $folder = "data-new/$dimensionId/$subDimensionId/" . $element['level'] . "/"; - //echo $folder; - mkdir($folder, 755, true); - unset($element['level']); // level from folder + //unset($element['level']); // level from folder $idWithSpace=mb_convert_case($elementName, MB_CASE_TITLE); $idSanitized = str_replace("/", "Or", $idWithSpace); $id = str_replace(" ", "", $idSanitized); - $filePath = $folder . $id . ".yaml"; $element = array('id' => $id) + array('title' => $elementName) + $element; // Add properties to the top $element['id'] = $id; - $yamlContent = yaml_emit ( $element ); - - file_put_contents($filePath, $yamlContent); - } - + $dimensionIdWithSpace = mb_convert_case($dimensionName, MB_CASE_TITLE); + $dimensionId = str_replace(" ", "", $dimensionIdWithSpace); + $subDimensionId = str_replace(" ", "",mb_convert_case($subDimensionName, MB_CASE_TITLE)); + $folder = "data-new/$dimensionId/"; + //echo $folder; + mkdir($folder, 755, true); + + $filePath = $folder . $subDimensionId . ".yaml"; + echo $filePath; + $yamlContent = yaml_emit(array($subDimensionName => $elements)); + + file_put_contents($filePath, $yamlContent); } } diff --git a/startDocker.bash b/startDocker.bash index 0d0dbb04c..7afe9f817 100755 --- a/startDocker.bash +++ b/startDocker.bash @@ -1,5 +1,6 @@ #!/bin/bash docker build -t wurstbrot/dsomm:latest . docker rm -f dsomm || true -docker run --rm -p 81:80 -v "$PWD":/var/www/html --name dsomm wurstbrot/dsomm +docker run --rm -p 81:80 --name dsomm wurstbrot/dsomm +#docker run --rm -p 81:80 -v "$PWD":/var/www/html --name dsomm wurstbrot/dsomm diff --git a/vendor/autoload.php b/vendor/autoload.php deleted file mode 100644 index 45bdcba99..000000000 --- a/vendor/autoload.php +++ /dev/null @@ -1,7 +0,0 @@ - - * Jordi Boggiano - * - * For the full copyright and license information, please view the LICENSE - * file that was distributed with this source code. - */ - -namespace Composer\Autoload; - -/** - * ClassLoader implements a PSR-0, PSR-4 and classmap class loader. - * - * $loader = new \Composer\Autoload\ClassLoader(); - * - * // register classes with namespaces - * $loader->add('Symfony\Component', __DIR__.'/component'); - * $loader->add('Symfony', __DIR__.'/framework'); - * - * // activate the autoloader - * $loader->register(); - * - * // to enable searching the include path (eg. for PEAR packages) - * $loader->setUseIncludePath(true); - * - * In this example, if you try to use a class in the Symfony\Component - * namespace or one of its children (Symfony\Component\Console for instance), - * the autoloader will first look for the class under the component/ - * directory, and it will then fallback to the framework/ directory if not - * found before giving up. - * - * This class is loosely based on the Symfony UniversalClassLoader. - * - * @author Fabien Potencier - * @author Jordi Boggiano - * @see http://www.php-fig.org/psr/psr-0/ - * @see http://www.php-fig.org/psr/psr-4/ - */ -class ClassLoader -{ - // PSR-4 - private $prefixLengthsPsr4 = array(); - private $prefixDirsPsr4 = array(); - private $fallbackDirsPsr4 = array(); - - // PSR-0 - private $prefixesPsr0 = array(); - private $fallbackDirsPsr0 = array(); - - private $useIncludePath = false; - private $classMap = array(); - private $classMapAuthoritative = false; - private $missingClasses = array(); - private $apcuPrefix; - - public function getPrefixes() - { - if (!empty($this->prefixesPsr0)) { - return call_user_func_array('array_merge', $this->prefixesPsr0); - } - - return array(); - } - - public function getPrefixesPsr4() - { - return $this->prefixDirsPsr4; - } - - public function getFallbackDirs() - { - return $this->fallbackDirsPsr0; - } - - public function getFallbackDirsPsr4() - { - return $this->fallbackDirsPsr4; - } - - public function getClassMap() - { - return $this->classMap; - } - - /** - * @param array $classMap Class to filename map - */ - public function addClassMap(array $classMap) - { - if ($this->classMap) { - $this->classMap = array_merge($this->classMap, $classMap); - } else { - $this->classMap = $classMap; - } - } - - /** - * Registers a set of PSR-0 directories for a given prefix, either - * appending or prepending to the ones previously set for this prefix. - * - * @param string $prefix The prefix - * @param array|string $paths The PSR-0 root directories - * @param bool $prepend Whether to prepend the directories - */ - public function add($prefix, $paths, $prepend = false) - { - if (!$prefix) { - if ($prepend) { - $this->fallbackDirsPsr0 = array_merge( - (array) $paths, - $this->fallbackDirsPsr0 - ); - } else { - $this->fallbackDirsPsr0 = array_merge( - $this->fallbackDirsPsr0, - (array) $paths - ); - } - - return; - } - - $first = $prefix[0]; - if (!isset($this->prefixesPsr0[$first][$prefix])) { - $this->prefixesPsr0[$first][$prefix] = (array) $paths; - - return; - } - if ($prepend) { - $this->prefixesPsr0[$first][$prefix] = array_merge( - (array) $paths, - $this->prefixesPsr0[$first][$prefix] - ); - } else { - $this->prefixesPsr0[$first][$prefix] = array_merge( - $this->prefixesPsr0[$first][$prefix], - (array) $paths - ); - } - } - - /** - * Registers a set of PSR-4 directories for a given namespace, either - * appending or prepending to the ones previously set for this namespace. - * - * @param string $prefix The prefix/namespace, with trailing '\\' - * @param array|string $paths The PSR-4 base directories - * @param bool $prepend Whether to prepend the directories - * - * @throws \InvalidArgumentException - */ - public function addPsr4($prefix, $paths, $prepend = false) - { - if (!$prefix) { - // Register directories for the root namespace. - if ($prepend) { - $this->fallbackDirsPsr4 = array_merge( - (array) $paths, - $this->fallbackDirsPsr4 - ); - } else { - $this->fallbackDirsPsr4 = array_merge( - $this->fallbackDirsPsr4, - (array) $paths - ); - } - } elseif (!isset($this->prefixDirsPsr4[$prefix])) { - // Register directories for a new namespace. - $length = strlen($prefix); - if ('\\' !== $prefix[$length - 1]) { - throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator."); - } - $this->prefixLengthsPsr4[$prefix[0]][$prefix] = $length; - $this->prefixDirsPsr4[$prefix] = (array) $paths; - } elseif ($prepend) { - // Prepend directories for an already registered namespace. - $this->prefixDirsPsr4[$prefix] = array_merge( - (array) $paths, - $this->prefixDirsPsr4[$prefix] - ); - } else { - // Append directories for an already registered namespace. - $this->prefixDirsPsr4[$prefix] = array_merge( - $this->prefixDirsPsr4[$prefix], - (array) $paths - ); - } - } - - /** - * Registers a set of PSR-0 directories for a given prefix, - * replacing any others previously set for this prefix. - * - * @param string $prefix The prefix - * @param array|string $paths The PSR-0 base directories - */ - public function set($prefix, $paths) - { - if (!$prefix) { - $this->fallbackDirsPsr0 = (array) $paths; - } else { - $this->prefixesPsr0[$prefix[0]][$prefix] = (array) $paths; - } - } - - /** - * Registers a set of PSR-4 directories for a given namespace, - * replacing any others previously set for this namespace. - * - * @param string $prefix The prefix/namespace, with trailing '\\' - * @param array|string $paths The PSR-4 base directories - * - * @throws \InvalidArgumentException - */ - public function setPsr4($prefix, $paths) - { - if (!$prefix) { - $this->fallbackDirsPsr4 = (array) $paths; - } else { - $length = strlen($prefix); - if ('\\' !== $prefix[$length - 1]) { - throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator."); - } - $this->prefixLengthsPsr4[$prefix[0]][$prefix] = $length; - $this->prefixDirsPsr4[$prefix] = (array) $paths; - } - } - - /** - * Turns on searching the include path for class files. - * - * @param bool $useIncludePath - */ - public function setUseIncludePath($useIncludePath) - { - $this->useIncludePath = $useIncludePath; - } - - /** - * Can be used to check if the autoloader uses the include path to check - * for classes. - * - * @return bool - */ - public function getUseIncludePath() - { - return $this->useIncludePath; - } - - /** - * Turns off searching the prefix and fallback directories for classes - * that have not been registered with the class map. - * - * @param bool $classMapAuthoritative - */ - public function setClassMapAuthoritative($classMapAuthoritative) - { - $this->classMapAuthoritative = $classMapAuthoritative; - } - - /** - * Should class lookup fail if not found in the current class map? - * - * @return bool - */ - public function isClassMapAuthoritative() - { - return $this->classMapAuthoritative; - } - - /** - * APCu prefix to use to cache found/not-found classes, if the extension is enabled. - * - * @param string|null $apcuPrefix - */ - public function setApcuPrefix($apcuPrefix) - { - $this->apcuPrefix = function_exists('apcu_fetch') && filter_var(ini_get('apc.enabled'), FILTER_VALIDATE_BOOLEAN) ? $apcuPrefix : null; - } - - /** - * The APCu prefix in use, or null if APCu caching is not enabled. - * - * @return string|null - */ - public function getApcuPrefix() - { - return $this->apcuPrefix; - } - - /** - * Registers this instance as an autoloader. - * - * @param bool $prepend Whether to prepend the autoloader or not - */ - public function register($prepend = false) - { - spl_autoload_register(array($this, 'loadClass'), true, $prepend); - } - - /** - * Unregisters this instance as an autoloader. - */ - public function unregister() - { - spl_autoload_unregister(array($this, 'loadClass')); - } - - /** - * Loads the given class or interface. - * - * @param string $class The name of the class - * @return bool|null True if loaded, null otherwise - */ - public function loadClass($class) - { - if ($file = $this->findFile($class)) { - includeFile($file); - - return true; - } - } - - /** - * Finds the path to the file where the class is defined. - * - * @param string $class The name of the class - * - * @return string|false The path if found, false otherwise - */ - public function findFile($class) - { - // class map lookup - if (isset($this->classMap[$class])) { - return $this->classMap[$class]; - } - if ($this->classMapAuthoritative || isset($this->missingClasses[$class])) { - return false; - } - if (null !== $this->apcuPrefix) { - $file = apcu_fetch($this->apcuPrefix.$class, $hit); - if ($hit) { - return $file; - } - } - - $file = $this->findFileWithExtension($class, '.php'); - - // Search for Hack files if we are running on HHVM - if (false === $file && defined('HHVM_VERSION')) { - $file = $this->findFileWithExtension($class, '.hh'); - } - - if (null !== $this->apcuPrefix) { - apcu_add($this->apcuPrefix.$class, $file); - } - - if (false === $file) { - // Remember that this class does not exist. - $this->missingClasses[$class] = true; - } - - return $file; - } - - private function findFileWithExtension($class, $ext) - { - // PSR-4 lookup - $logicalPathPsr4 = strtr($class, '\\', DIRECTORY_SEPARATOR) . $ext; - - $first = $class[0]; - if (isset($this->prefixLengthsPsr4[$first])) { - $subPath = $class; - while (false !== $lastPos = strrpos($subPath, '\\')) { - $subPath = substr($subPath, 0, $lastPos); - $search = $subPath . '\\'; - if (isset($this->prefixDirsPsr4[$search])) { - $pathEnd = DIRECTORY_SEPARATOR . substr($logicalPathPsr4, $lastPos + 1); - foreach ($this->prefixDirsPsr4[$search] as $dir) { - if (file_exists($file = $dir . $pathEnd)) { - return $file; - } - } - } - } - } - - // PSR-4 fallback dirs - foreach ($this->fallbackDirsPsr4 as $dir) { - if (file_exists($file = $dir . DIRECTORY_SEPARATOR . $logicalPathPsr4)) { - return $file; - } - } - - // PSR-0 lookup - if (false !== $pos = strrpos($class, '\\')) { - // namespaced class name - $logicalPathPsr0 = substr($logicalPathPsr4, 0, $pos + 1) - . strtr(substr($logicalPathPsr4, $pos + 1), '_', DIRECTORY_SEPARATOR); - } else { - // PEAR-like class name - $logicalPathPsr0 = strtr($class, '_', DIRECTORY_SEPARATOR) . $ext; - } - - if (isset($this->prefixesPsr0[$first])) { - foreach ($this->prefixesPsr0[$first] as $prefix => $dirs) { - if (0 === strpos($class, $prefix)) { - foreach ($dirs as $dir) { - if (file_exists($file = $dir . DIRECTORY_SEPARATOR . $logicalPathPsr0)) { - return $file; - } - } - } - } - } - - // PSR-0 fallback dirs - foreach ($this->fallbackDirsPsr0 as $dir) { - if (file_exists($file = $dir . DIRECTORY_SEPARATOR . $logicalPathPsr0)) { - return $file; - } - } - - // PSR-0 include paths. - if ($this->useIncludePath && $file = stream_resolve_include_path($logicalPathPsr0)) { - return $file; - } - - return false; - } -} - -/** - * Scope isolated include. - * - * Prevents access to $this/self from included files. - */ -function includeFile($file) -{ - include $file; -} diff --git a/vendor/composer/LICENSE b/vendor/composer/LICENSE deleted file mode 100644 index 62ecfd8d0..000000000 --- a/vendor/composer/LICENSE +++ /dev/null @@ -1,19 +0,0 @@ -Copyright (c) Nils Adermann, Jordi Boggiano - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is furnished -to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -THE SOFTWARE. diff --git a/vendor/composer/autoload_classmap.php b/vendor/composer/autoload_classmap.php deleted file mode 100644 index 7a91153b0..000000000 --- a/vendor/composer/autoload_classmap.php +++ /dev/null @@ -1,9 +0,0 @@ - $vendorDir . '/symfony/deprecation-contracts/function.php', - '320cde22f66dd4f5d3fd621d3e88b98f' => $vendorDir . '/symfony/polyfill-ctype/bootstrap.php', -); diff --git a/vendor/composer/autoload_namespaces.php b/vendor/composer/autoload_namespaces.php deleted file mode 100644 index 67a4ae415..000000000 --- a/vendor/composer/autoload_namespaces.php +++ /dev/null @@ -1,11 +0,0 @@ - array($vendorDir . '/erusev/parsedown-extra'), - 'Parsedown' => array($vendorDir . '/erusev/parsedown'), -); diff --git a/vendor/composer/autoload_psr4.php b/vendor/composer/autoload_psr4.php deleted file mode 100644 index 65ce31d9f..000000000 --- a/vendor/composer/autoload_psr4.php +++ /dev/null @@ -1,12 +0,0 @@ - array($vendorDir . '/symfony/polyfill-ctype'), - 'Symfony\\Component\\Yaml\\' => array($vendorDir . '/symfony/yaml'), - 'Mni\\FrontYAML\\' => array($vendorDir . '/mnapoli/front-yaml/src'), -); diff --git a/vendor/composer/autoload_real.php b/vendor/composer/autoload_real.php deleted file mode 100644 index b907d34d9..000000000 --- a/vendor/composer/autoload_real.php +++ /dev/null @@ -1,73 +0,0 @@ -= 50600 && !defined('HHVM_VERSION') && (!function_exists('zend_loader_file_encoded') || !zend_loader_file_encoded()); - if ($useStaticLoader) { - require_once __DIR__ . '/autoload_static.php'; - - call_user_func(\Composer\Autoload\ComposerStaticInit27b4a40ab3e3fe0b78d1d3bc398ce110::getInitializer($loader)); - } else { - $map = require __DIR__ . '/autoload_namespaces.php'; - foreach ($map as $namespace => $path) { - $loader->set($namespace, $path); - } - - $map = require __DIR__ . '/autoload_psr4.php'; - foreach ($map as $namespace => $path) { - $loader->setPsr4($namespace, $path); - } - - $classMap = require __DIR__ . '/autoload_classmap.php'; - if ($classMap) { - $loader->addClassMap($classMap); - } - } - - $loader->register(true); - - if ($useStaticLoader) { - $includeFiles = Composer\Autoload\ComposerStaticInit27b4a40ab3e3fe0b78d1d3bc398ce110::$files; - } else { - $includeFiles = require __DIR__ . '/autoload_files.php'; - } - foreach ($includeFiles as $fileIdentifier => $file) { - composerRequire27b4a40ab3e3fe0b78d1d3bc398ce110($fileIdentifier, $file); - } - - return $loader; - } -} - -function composerRequire27b4a40ab3e3fe0b78d1d3bc398ce110($fileIdentifier, $file) -{ - if (empty($GLOBALS['__composer_autoload_files'][$fileIdentifier])) { - require $file; - - $GLOBALS['__composer_autoload_files'][$fileIdentifier] = true; - } -} diff --git a/vendor/composer/autoload_static.php b/vendor/composer/autoload_static.php deleted file mode 100644 index a685ec6f1..000000000 --- a/vendor/composer/autoload_static.php +++ /dev/null @@ -1,64 +0,0 @@ - __DIR__ . '/..' . '/symfony/deprecation-contracts/function.php', - '320cde22f66dd4f5d3fd621d3e88b98f' => __DIR__ . '/..' . '/symfony/polyfill-ctype/bootstrap.php', - ); - - public static $prefixLengthsPsr4 = array ( - 'S' => - array ( - 'Symfony\\Polyfill\\Ctype\\' => 23, - 'Symfony\\Component\\Yaml\\' => 23, - ), - 'M' => - array ( - 'Mni\\FrontYAML\\' => 14, - ), - ); - - public static $prefixDirsPsr4 = array ( - 'Symfony\\Polyfill\\Ctype\\' => - array ( - 0 => __DIR__ . '/..' . '/symfony/polyfill-ctype', - ), - 'Symfony\\Component\\Yaml\\' => - array ( - 0 => __DIR__ . '/..' . '/symfony/yaml', - ), - 'Mni\\FrontYAML\\' => - array ( - 0 => __DIR__ . '/..' . '/mnapoli/front-yaml/src', - ), - ); - - public static $prefixesPsr0 = array ( - 'P' => - array ( - 'ParsedownExtra' => - array ( - 0 => __DIR__ . '/..' . '/erusev/parsedown-extra', - ), - 'Parsedown' => - array ( - 0 => __DIR__ . '/..' . '/erusev/parsedown', - ), - ), - ); - - public static function getInitializer(ClassLoader $loader) - { - return \Closure::bind(function () use ($loader) { - $loader->prefixLengthsPsr4 = ComposerStaticInit27b4a40ab3e3fe0b78d1d3bc398ce110::$prefixLengthsPsr4; - $loader->prefixDirsPsr4 = ComposerStaticInit27b4a40ab3e3fe0b78d1d3bc398ce110::$prefixDirsPsr4; - $loader->prefixesPsr0 = ComposerStaticInit27b4a40ab3e3fe0b78d1d3bc398ce110::$prefixesPsr0; - - }, null, ClassLoader::class); - } -} diff --git a/vendor/composer/installed.json b/vendor/composer/installed.json deleted file mode 100644 index 61c0e35b3..000000000 --- a/vendor/composer/installed.json +++ /dev/null @@ -1,354 +0,0 @@ -[ - { - "name": "erusev/parsedown", - "version": "1.7.4", - "version_normalized": "1.7.4.0", - "source": { - "type": "git", - "url": "https://github.com/erusev/parsedown.git", - "reference": "cb17b6477dfff935958ba01325f2e8a2bfa6dab3" - }, - "dist": { - "type": "zip", - "url": "https://api.github.com/repos/erusev/parsedown/zipball/cb17b6477dfff935958ba01325f2e8a2bfa6dab3", - "reference": "cb17b6477dfff935958ba01325f2e8a2bfa6dab3", - "shasum": "" - }, - "require": { - "ext-mbstring": "*", - "php": ">=5.3.0" - }, - "require-dev": { - "phpunit/phpunit": "^4.8.35" - }, - "time": "2019-12-30T22:54:17+00:00", - "type": "library", - "installation-source": "dist", - "autoload": { - "psr-0": { - "Parsedown": "" - } - }, - "notification-url": "https://packagist.org/downloads/", - "license": [ - "MIT" - ], - "authors": [ - { - "name": "Emanuil Rusev", - "email": "hello@erusev.com", - "homepage": "http://erusev.com" - } - ], - "description": "Parser for Markdown.", - "homepage": "http://parsedown.org", - "keywords": [ - "markdown", - "parser" - ] - }, - { - "name": "erusev/parsedown-extra", - "version": "0.8.1", - "version_normalized": "0.8.1.0", - "source": { - "type": "git", - "url": "https://github.com/erusev/parsedown-extra.git", - "reference": "91ac3ff98f0cea243bdccc688df43810f044dcef" - }, - "dist": { - "type": "zip", - "url": "https://api.github.com/repos/erusev/parsedown-extra/zipball/91ac3ff98f0cea243bdccc688df43810f044dcef", - "reference": "91ac3ff98f0cea243bdccc688df43810f044dcef", - "shasum": "" - }, - "require": { - "erusev/parsedown": "^1.7.4" - }, - "require-dev": { - "phpunit/phpunit": "^4.8.35" - }, - "time": "2019-12-30T23:20:37+00:00", - "type": "library", - "installation-source": "dist", - "autoload": { - "psr-0": { - "ParsedownExtra": "" - } - }, - "notification-url": "https://packagist.org/downloads/", - "license": [ - "MIT" - ], - "authors": [ - { - "name": "Emanuil Rusev", - "email": "hello@erusev.com", - "homepage": "http://erusev.com" - } - ], - "description": "An extension of Parsedown that adds support for Markdown Extra.", - "homepage": "https://github.com/erusev/parsedown-extra", - "keywords": [ - "markdown", - "markdown extra", - "parsedown", - "parser" - ] - }, - { - "name": "mnapoli/front-yaml", - "version": "1.8.0", - "version_normalized": "1.8.0.0", - "source": { - "type": "git", - "url": "https://github.com/mnapoli/FrontYAML.git", - "reference": "76baa8ca538e111bfe53ac49c6a512ec5ea2bf54" - }, - "dist": { - "type": "zip", - "url": "https://api.github.com/repos/mnapoli/FrontYAML/zipball/76baa8ca538e111bfe53ac49c6a512ec5ea2bf54", - "reference": "76baa8ca538e111bfe53ac49c6a512ec5ea2bf54", - "shasum": "" - }, - "require": { - "erusev/parsedown": "~1.0", - "php": ">=7.3", - "symfony/yaml": "~2.1|^3.0|^4.0|^5.0" - }, - "require-dev": { - "league/commonmark": "~1.4", - "phpunit/phpunit": "^9.4" - }, - "time": "2020-12-04T10:52:19+00:00", - "type": "library", - "installation-source": "dist", - "autoload": { - "psr-4": { - "Mni\\FrontYAML\\": "src/" - } - }, - "notification-url": "https://packagist.org/downloads/", - "license": [ - "MIT" - ] - }, - { - "name": "symfony/deprecation-contracts", - "version": "v2.2.0", - "version_normalized": "2.2.0.0", - "source": { - "type": "git", - "url": "https://github.com/symfony/deprecation-contracts.git", - "reference": "5fa56b4074d1ae755beb55617ddafe6f5d78f665" - }, - "dist": { - "type": "zip", - "url": "https://api.github.com/repos/symfony/deprecation-contracts/zipball/5fa56b4074d1ae755beb55617ddafe6f5d78f665", - "reference": "5fa56b4074d1ae755beb55617ddafe6f5d78f665", - "shasum": "" - }, - "require": { - "php": ">=7.1" - }, - "time": "2020-09-07T11:33:47+00:00", - "type": "library", - "extra": { - "branch-alias": { - "dev-master": "2.2-dev" - }, - "thanks": { - "name": "symfony/contracts", - "url": "https://github.com/symfony/contracts" - } - }, - "installation-source": "dist", - "autoload": { - "files": [ - "function.php" - ] - }, - "notification-url": "https://packagist.org/downloads/", - "license": [ - "MIT" - ], - "authors": [ - { - "name": "Nicolas Grekas", - "email": "p@tchwork.com" - }, - { - "name": "Symfony Community", - "homepage": "https://symfony.com/contributors" - } - ], - "description": "A generic function and convention to trigger deprecation notices", - "homepage": "https://symfony.com", - "funding": [ - { - "url": "https://symfony.com/sponsor", - "type": "custom" - }, - { - "url": "https://github.com/fabpot", - "type": "github" - }, - { - "url": "https://tidelift.com/funding/github/packagist/symfony/symfony", - "type": "tidelift" - } - ] - }, - { - "name": "symfony/polyfill-ctype", - "version": "v1.22.0", - "version_normalized": "1.22.0.0", - "source": { - "type": "git", - "url": "https://github.com/symfony/polyfill-ctype.git", - "reference": "c6c942b1ac76c82448322025e084cadc56048b4e" - }, - "dist": { - "type": "zip", - "url": "https://api.github.com/repos/symfony/polyfill-ctype/zipball/c6c942b1ac76c82448322025e084cadc56048b4e", - "reference": "c6c942b1ac76c82448322025e084cadc56048b4e", - "shasum": "" - }, - "require": { - "php": ">=7.1" - }, - "suggest": { - "ext-ctype": "For best performance" - }, - "time": "2021-01-07T16:49:33+00:00", - "type": "library", - "extra": { - "branch-alias": { - "dev-main": "1.22-dev" - }, - "thanks": { - "name": "symfony/polyfill", - "url": "https://github.com/symfony/polyfill" - } - }, - "installation-source": "dist", - "autoload": { - "psr-4": { - "Symfony\\Polyfill\\Ctype\\": "" - }, - "files": [ - "bootstrap.php" - ] - }, - "notification-url": "https://packagist.org/downloads/", - "license": [ - "MIT" - ], - "authors": [ - { - "name": "Gert de Pagter", - "email": "BackEndTea@gmail.com" - }, - { - "name": "Symfony Community", - "homepage": "https://symfony.com/contributors" - } - ], - "description": "Symfony polyfill for ctype functions", - "homepage": "https://symfony.com", - "keywords": [ - "compatibility", - "ctype", - "polyfill", - "portable" - ], - "funding": [ - { - "url": "https://symfony.com/sponsor", - "type": "custom" - }, - { - "url": "https://github.com/fabpot", - "type": "github" - }, - { - "url": "https://tidelift.com/funding/github/packagist/symfony/symfony", - "type": "tidelift" - } - ] - }, - { - "name": "symfony/yaml", - "version": "v5.2.3", - "version_normalized": "5.2.3.0", - "source": { - "type": "git", - "url": "https://github.com/symfony/yaml.git", - "reference": "338cddc6d74929f6adf19ca5682ac4b8e109cdb0" - }, - "dist": { - "type": "zip", - "url": "https://api.github.com/repos/symfony/yaml/zipball/338cddc6d74929f6adf19ca5682ac4b8e109cdb0", - "reference": "338cddc6d74929f6adf19ca5682ac4b8e109cdb0", - "shasum": "" - }, - "require": { - "php": ">=7.2.5", - "symfony/deprecation-contracts": "^2.1", - "symfony/polyfill-ctype": "~1.8" - }, - "conflict": { - "symfony/console": "<4.4" - }, - "require-dev": { - "symfony/console": "^4.4|^5.0" - }, - "suggest": { - "symfony/console": "For validating YAML files using the lint command" - }, - "time": "2021-02-03T04:42:09+00:00", - "bin": [ - "Resources/bin/yaml-lint" - ], - "type": "library", - "installation-source": "dist", - "autoload": { - "psr-4": { - "Symfony\\Component\\Yaml\\": "" - }, - "exclude-from-classmap": [ - "/Tests/" - ] - }, - "notification-url": "https://packagist.org/downloads/", - "license": [ - "MIT" - ], - "authors": [ - { - "name": "Fabien Potencier", - "email": "fabien@symfony.com" - }, - { - "name": "Symfony Community", - "homepage": "https://symfony.com/contributors" - } - ], - "description": "Loads and dumps YAML files", - "homepage": "https://symfony.com", - "funding": [ - { - "url": "https://symfony.com/sponsor", - "type": "custom" - }, - { - "url": "https://github.com/fabpot", - "type": "github" - }, - { - "url": "https://tidelift.com/funding/github/packagist/symfony/symfony", - "type": "tidelift" - } - ] - } -] diff --git a/vendor/erusev/parsedown-extra/.travis.yml b/vendor/erusev/parsedown-extra/.travis.yml deleted file mode 100644 index d0b48f88f..000000000 --- a/vendor/erusev/parsedown-extra/.travis.yml +++ /dev/null @@ -1,30 +0,0 @@ -language: php - -dist: trusty -sudo: false - -matrix: - include: - - php: 5.3 - dist: precise - - php: 5.4 - - php: 5.5 - - php: 5.6 - - php: 7.0 - - php: 7.1 - - php: 7.2 - - php: 7.3 - - php: 7.4 - - php: nightly - fast_finish: true - allow_failures: - - php: nightly - - php: hhvm-nightly - -install: - - composer install --prefer-source - -script: - - vendor/bin/phpunit - - vendor/bin/phpunit vendor/erusev/parsedown/test/CommonMarkTestWeak.php || true - - '[ -z "$TRAVIS_TAG" ] || [ "$TRAVIS_TAG" == "$(php -r "require(\"ParsedownExtra.php\"); echo ParsedownExtra::version;")" ]' diff --git a/vendor/erusev/parsedown-extra/LICENSE.txt b/vendor/erusev/parsedown-extra/LICENSE.txt deleted file mode 100644 index baca86f5b..000000000 --- a/vendor/erusev/parsedown-extra/LICENSE.txt +++ /dev/null @@ -1,20 +0,0 @@ -The MIT License (MIT) - -Copyright (c) 2013 Emanuil Rusev, erusev.com - -Permission is hereby granted, free of charge, to any person obtaining a copy of -this software and associated documentation files (the "Software"), to deal in -the Software without restriction, including without limitation the rights to -use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of -the Software, and to permit persons to whom the Software is furnished to do so, -subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS -FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR -COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER -IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN -CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/ParsedownExtra.php b/vendor/erusev/parsedown-extra/ParsedownExtra.php deleted file mode 100644 index 632ba84f6..000000000 --- a/vendor/erusev/parsedown-extra/ParsedownExtra.php +++ /dev/null @@ -1,538 +0,0 @@ -BlockTypes[':'] []= 'DefinitionList'; - $this->BlockTypes['*'] []= 'Abbreviation'; - - # identify footnote definitions before reference definitions - array_unshift($this->BlockTypes['['], 'Footnote'); - - # identify footnote markers before before links - array_unshift($this->InlineTypes['['], 'FootnoteMarker'); - } - - # - # ~ - - function text($text) - { - $markup = parent::text($text); - - # merge consecutive dl elements - - $markup = preg_replace('/<\/dl>\s+
    \s+/', '', $markup); - - # add footnotes - - if (isset($this->DefinitionData['Footnote'])) - { - $Element = $this->buildFootnoteElement(); - - $markup .= "\n" . $this->element($Element); - } - - return $markup; - } - - # - # Blocks - # - - # - # Abbreviation - - protected function blockAbbreviation($Line) - { - if (preg_match('/^\*\[(.+?)\]:[ ]*(.+?)[ ]*$/', $Line['text'], $matches)) - { - $this->DefinitionData['Abbreviation'][$matches[1]] = $matches[2]; - - $Block = array( - 'hidden' => true, - ); - - return $Block; - } - } - - # - # Footnote - - protected function blockFootnote($Line) - { - if (preg_match('/^\[\^(.+?)\]:[ ]?(.*)$/', $Line['text'], $matches)) - { - $Block = array( - 'label' => $matches[1], - 'text' => $matches[2], - 'hidden' => true, - ); - - return $Block; - } - } - - protected function blockFootnoteContinue($Line, $Block) - { - if ($Line['text'][0] === '[' and preg_match('/^\[\^(.+?)\]:/', $Line['text'])) - { - return; - } - - if (isset($Block['interrupted'])) - { - if ($Line['indent'] >= 4) - { - $Block['text'] .= "\n\n" . $Line['text']; - - return $Block; - } - } - else - { - $Block['text'] .= "\n" . $Line['text']; - - return $Block; - } - } - - protected function blockFootnoteComplete($Block) - { - $this->DefinitionData['Footnote'][$Block['label']] = array( - 'text' => $Block['text'], - 'count' => null, - 'number' => null, - ); - - return $Block; - } - - # - # Definition List - - protected function blockDefinitionList($Line, $Block) - { - if ( ! isset($Block) or isset($Block['type'])) - { - return; - } - - $Element = array( - 'name' => 'dl', - 'handler' => 'elements', - 'text' => array(), - ); - - $terms = explode("\n", $Block['element']['text']); - - foreach ($terms as $term) - { - $Element['text'] []= array( - 'name' => 'dt', - 'handler' => 'line', - 'text' => $term, - ); - } - - $Block['element'] = $Element; - - $Block = $this->addDdElement($Line, $Block); - - return $Block; - } - - protected function blockDefinitionListContinue($Line, array $Block) - { - if ($Line['text'][0] === ':') - { - $Block = $this->addDdElement($Line, $Block); - - return $Block; - } - else - { - if (isset($Block['interrupted']) and $Line['indent'] === 0) - { - return; - } - - if (isset($Block['interrupted'])) - { - $Block['dd']['handler'] = 'text'; - $Block['dd']['text'] .= "\n\n"; - - unset($Block['interrupted']); - } - - $text = substr($Line['body'], min($Line['indent'], 4)); - - $Block['dd']['text'] .= "\n" . $text; - - return $Block; - } - } - - # - # Header - - protected function blockHeader($Line) - { - $Block = parent::blockHeader($Line); - - if (! isset($Block)) { - return null; - } - - if (preg_match('/[ #]*{('.$this->regexAttribute.'+)}[ ]*$/', $Block['element']['text'], $matches, PREG_OFFSET_CAPTURE)) - { - $attributeString = $matches[1][0]; - - $Block['element']['attributes'] = $this->parseAttributeData($attributeString); - - $Block['element']['text'] = substr($Block['element']['text'], 0, $matches[0][1]); - } - - return $Block; - } - - # - # Markup - - protected function blockMarkupComplete($Block) - { - if ( ! isset($Block['void'])) - { - $Block['markup'] = $this->processTag($Block['markup']); - } - - return $Block; - } - - # - # Setext - - protected function blockSetextHeader($Line, array $Block = null) - { - $Block = parent::blockSetextHeader($Line, $Block); - - if (! isset($Block)) { - return null; - } - - if (preg_match('/[ ]*{('.$this->regexAttribute.'+)}[ ]*$/', $Block['element']['text'], $matches, PREG_OFFSET_CAPTURE)) - { - $attributeString = $matches[1][0]; - - $Block['element']['attributes'] = $this->parseAttributeData($attributeString); - - $Block['element']['text'] = substr($Block['element']['text'], 0, $matches[0][1]); - } - - return $Block; - } - - # - # Inline Elements - # - - # - # Footnote Marker - - protected function inlineFootnoteMarker($Excerpt) - { - if (preg_match('/^\[\^(.+?)\]/', $Excerpt['text'], $matches)) - { - $name = $matches[1]; - - if ( ! isset($this->DefinitionData['Footnote'][$name])) - { - return; - } - - $this->DefinitionData['Footnote'][$name]['count'] ++; - - if ( ! isset($this->DefinitionData['Footnote'][$name]['number'])) - { - $this->DefinitionData['Footnote'][$name]['number'] = ++ $this->footnoteCount; # » & - } - - $Element = array( - 'name' => 'sup', - 'attributes' => array('id' => 'fnref'.$this->DefinitionData['Footnote'][$name]['count'].':'.$name), - 'handler' => 'element', - 'text' => array( - 'name' => 'a', - 'attributes' => array('href' => '#fn:'.$name, 'class' => 'footnote-ref'), - 'text' => $this->DefinitionData['Footnote'][$name]['number'], - ), - ); - - return array( - 'extent' => strlen($matches[0]), - 'element' => $Element, - ); - } - } - - private $footnoteCount = 0; - - # - # Link - - protected function inlineLink($Excerpt) - { - $Link = parent::inlineLink($Excerpt); - - if (! isset($Link)) { - return null; - } - - $remainder = substr($Excerpt['text'], $Link['extent']); - - if (preg_match('/^[ ]*{('.$this->regexAttribute.'+)}/', $remainder, $matches)) - { - $Link['element']['attributes'] += $this->parseAttributeData($matches[1]); - - $Link['extent'] += strlen($matches[0]); - } - - return $Link; - } - - # - # ~ - # - - protected function unmarkedText($text) - { - $text = parent::unmarkedText($text); - - if (isset($this->DefinitionData['Abbreviation'])) - { - foreach ($this->DefinitionData['Abbreviation'] as $abbreviation => $meaning) - { - $pattern = '/\b'.preg_quote($abbreviation, '/').'\b/'; - - $text = preg_replace($pattern, ''.$abbreviation.'', $text); - } - } - - return $text; - } - - # - # Util Methods - # - - protected function addDdElement(array $Line, array $Block) - { - $text = substr($Line['text'], 1); - $text = trim($text); - - unset($Block['dd']); - - $Block['dd'] = array( - 'name' => 'dd', - 'handler' => 'line', - 'text' => $text, - ); - - if (isset($Block['interrupted'])) - { - $Block['dd']['handler'] = 'text'; - - unset($Block['interrupted']); - } - - $Block['element']['text'] []= & $Block['dd']; - - return $Block; - } - - protected function buildFootnoteElement() - { - $Element = array( - 'name' => 'div', - 'attributes' => array('class' => 'footnotes'), - 'handler' => 'elements', - 'text' => array( - array( - 'name' => 'hr', - ), - array( - 'name' => 'ol', - 'handler' => 'elements', - 'text' => array(), - ), - ), - ); - - uasort($this->DefinitionData['Footnote'], 'self::sortFootnotes'); - - foreach ($this->DefinitionData['Footnote'] as $definitionId => $DefinitionData) - { - if ( ! isset($DefinitionData['number'])) - { - continue; - } - - $text = $DefinitionData['text']; - - $text = parent::text($text); - - $numbers = range(1, $DefinitionData['count']); - - $backLinksMarkup = ''; - - foreach ($numbers as $number) - { - $backLinksMarkup .= ' ↩'; - } - - $backLinksMarkup = substr($backLinksMarkup, 1); - - if (substr($text, - 4) === '

    ') - { - $backLinksMarkup = ' '.$backLinksMarkup; - - $text = substr_replace($text, $backLinksMarkup.'

    ', - 4); - } - else - { - $text .= "\n".'

    '.$backLinksMarkup.'

    '; - } - - $Element['text'][1]['text'] []= array( - 'name' => 'li', - 'attributes' => array('id' => 'fn:'.$definitionId), - 'rawHtml' => "\n".$text."\n", - ); - } - - return $Element; - } - - # ~ - - protected function parseAttributeData($attributeString) - { - $Data = array(); - - $attributes = preg_split('/[ ]+/', $attributeString, - 1, PREG_SPLIT_NO_EMPTY); - - foreach ($attributes as $attribute) - { - if ($attribute[0] === '#') - { - $Data['id'] = substr($attribute, 1); - } - else # "." - { - $classes []= substr($attribute, 1); - } - } - - if (isset($classes)) - { - $Data['class'] = implode(' ', $classes); - } - - return $Data; - } - - # ~ - - protected function processTag($elementMarkup) # recursive - { - # http://stackoverflow.com/q/1148928/200145 - libxml_use_internal_errors(true); - - $DOMDocument = new DOMDocument; - - # http://stackoverflow.com/q/11309194/200145 - $elementMarkup = mb_convert_encoding($elementMarkup, 'HTML-ENTITIES', 'UTF-8'); - - # http://stackoverflow.com/q/4879946/200145 - $DOMDocument->loadHTML($elementMarkup); - $DOMDocument->removeChild($DOMDocument->doctype); - $DOMDocument->replaceChild($DOMDocument->firstChild->firstChild->firstChild, $DOMDocument->firstChild); - - $elementText = ''; - - if ($DOMDocument->documentElement->getAttribute('markdown') === '1') - { - foreach ($DOMDocument->documentElement->childNodes as $Node) - { - $elementText .= $DOMDocument->saveHTML($Node); - } - - $DOMDocument->documentElement->removeAttribute('markdown'); - - $elementText = "\n".$this->text($elementText)."\n"; - } - else - { - foreach ($DOMDocument->documentElement->childNodes as $Node) - { - $nodeMarkup = $DOMDocument->saveHTML($Node); - - if ($Node instanceof DOMElement and ! in_array($Node->nodeName, $this->textLevelElements)) - { - $elementText .= $this->processTag($nodeMarkup); - } - else - { - $elementText .= $nodeMarkup; - } - } - } - - # because we don't want for markup to get encoded - $DOMDocument->documentElement->nodeValue = 'placeholder\x1A'; - - $markup = $DOMDocument->saveHTML($DOMDocument->documentElement); - $markup = str_replace('placeholder\x1A', $elementText, $markup); - - return $markup; - } - - # ~ - - protected function sortFootnotes($A, $B) # callback - { - return $A['number'] - $B['number']; - } - - # - # Fields - # - - protected $regexAttribute = '(?:[#.][-\w]+[ ]*)'; -} diff --git a/vendor/erusev/parsedown-extra/README.md b/vendor/erusev/parsedown-extra/README.md deleted file mode 100644 index cee4b5430..000000000 --- a/vendor/erusev/parsedown-extra/README.md +++ /dev/null @@ -1,31 +0,0 @@ -> You might also like [Caret](http://caret.io?ref=parsedown) - our Markdown editor for the Desktop. - -## Parsedown Extra - -[![Build Status](https://img.shields.io/travis/erusev/parsedown-extra/master.svg?style=flat-square)](https://travis-ci.org/erusev/parsedown-extra) - -An extension of [Parsedown](http://parsedown.org) that adds support for [Markdown Extra](https://michelf.ca/projects/php-markdown/extra/). - -[See Demo](http://parsedown.org/extra/) - -### Installation - -Include both `Parsedown.php` and `ParsedownExtra.php` or install [the composer package](https://packagist.org/packages/erusev/parsedown-extra). - -### Example - -``` php -$Extra = new ParsedownExtra(); - -echo $Extra->text('# Header {.sth}'); # prints:

    Header

    -``` - -### Questions - -**Who uses Parsedown Extra?** - -[October CMS](http://octobercms.com/), [Bolt CMS](http://bolt.cm/), [Kirby CMS](http://getkirby.com/), [Grav CMS](http://getgrav.org/), [Statamic CMS](http://www.statamic.com/) and [more](https://www.versioneye.com/php/erusev:parsedown-extra/references). - -**How can I help?** - -Use it, star it, share it and in case you feel generous, [donate some money](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=528P3NZQMP8N2). diff --git a/vendor/erusev/parsedown-extra/composer.json b/vendor/erusev/parsedown-extra/composer.json deleted file mode 100644 index 317d14729..000000000 --- a/vendor/erusev/parsedown-extra/composer.json +++ /dev/null @@ -1,33 +0,0 @@ -{ - "name": "erusev/parsedown-extra", - "description": "An extension of Parsedown that adds support for Markdown Extra.", - "keywords": ["markdown", "markdown extra", "parser", "parsedown"], - "homepage": "https://github.com/erusev/parsedown-extra", - "type": "library", - "license": "MIT", - "authors": [ - { - "name": "Emanuil Rusev", - "email": "hello@erusev.com", - "homepage": "http://erusev.com" - } - ], - "require": { - "erusev/parsedown": "^1.7.4" - }, - "require-dev": { - "phpunit/phpunit": "^4.8.35" - }, - "autoload": { - "psr-0": {"ParsedownExtra": ""} - }, - "autoload-dev": { - "psr-0": { - "TestParsedown": "test/", - "ParsedownExtraTest": "test/", - "ParsedownTest": "vendor/erusev/parsedown/test/", - "CommonMarkTest": "vendor/erusev/parsedown/test/", - "CommonMarkTestWeak": "vendor/erusev/parsedown/test/" - } - } -} diff --git a/vendor/erusev/parsedown-extra/phpunit.xml.dist b/vendor/erusev/parsedown-extra/phpunit.xml.dist deleted file mode 100644 index 29880b567..000000000 --- a/vendor/erusev/parsedown-extra/phpunit.xml.dist +++ /dev/null @@ -1,8 +0,0 @@ - - - - - test/ParsedownExtraTest.php - - - diff --git a/vendor/erusev/parsedown-extra/test/ParsedownExtraTest.php b/vendor/erusev/parsedown-extra/test/ParsedownExtraTest.php deleted file mode 100644 index d2a6d23cc..000000000 --- a/vendor/erusev/parsedown-extra/test/ParsedownExtraTest.php +++ /dev/null @@ -1,11 +0,0 @@ -textLevelElements; - } -} diff --git a/vendor/erusev/parsedown-extra/test/data/abbreviation.html b/vendor/erusev/parsedown-extra/test/data/abbreviation.html deleted file mode 100644 index 9b3a45c40..000000000 --- a/vendor/erusev/parsedown-extra/test/data/abbreviation.html +++ /dev/null @@ -1,3 +0,0 @@ -

    The HTML specification -is maintained by the W3C. -The abbreviation ML is contained in the abbreviation HTML.

    \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/abbreviation.md b/vendor/erusev/parsedown-extra/test/data/abbreviation.md deleted file mode 100644 index 4ac8f8842..000000000 --- a/vendor/erusev/parsedown-extra/test/data/abbreviation.md +++ /dev/null @@ -1,7 +0,0 @@ -The HTML specification -is maintained by the W3C. -The abbreviation ML is contained in the abbreviation HTML. - -*[HTML]: Hyper Text Markup Language -*[W3C]: World Wide Web Consortium -*[ML]: Markup Language \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/compound_footnote.html b/vendor/erusev/parsedown-extra/test/data/compound_footnote.html deleted file mode 100644 index 1a3848fd0..000000000 --- a/vendor/erusev/parsedown-extra/test/data/compound_footnote.html +++ /dev/null @@ -1,18 +0,0 @@ -

    footnote 1 and another one 2

    -
    -
    -
      -
    1. -

      line 1 -line 2

      -
      -

      quote

      -
      -

      another paragraph ↩

      -
      2. -
    2. -

      paragraph

      -

      another paragraph ↩

      -
      3. -
    -
    \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/compound_footnote.md b/vendor/erusev/parsedown-extra/test/data/compound_footnote.md deleted file mode 100644 index 5bca3c788..000000000 --- a/vendor/erusev/parsedown-extra/test/data/compound_footnote.md +++ /dev/null @@ -1,14 +0,0 @@ -footnote [^1] and another one [^2] - -[^1]: line 1 - line 2 - - > quote - - another paragraph - -[^2]: - paragraph - - another paragraph - \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/definition_list.html b/vendor/erusev/parsedown-extra/test/data/definition_list.html deleted file mode 100644 index 2567dc1c4..000000000 --- a/vendor/erusev/parsedown-extra/test/data/definition_list.html +++ /dev/null @@ -1,17 +0,0 @@ -
    -
    Term 1
    -
    one
    -
    two -extra line
    -
    Term 2
    -

    lazy -line

    -

    multiple

    -

    paragraphs

    -

    nested

    -
    code block
    -
    -

    quote -block

    -
    -
    \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/definition_list.md b/vendor/erusev/parsedown-extra/test/data/definition_list.md deleted file mode 100644 index ec0ee03f3..000000000 --- a/vendor/erusev/parsedown-extra/test/data/definition_list.md +++ /dev/null @@ -1,20 +0,0 @@ -Term 1 -: one -: two - extra line - -Term 2 - -: lazy -line - -: multiple - - paragraphs - -: nested - - code block - - > quote - > block \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/footnote.html b/vendor/erusev/parsedown-extra/test/data/footnote.html deleted file mode 100644 index d0ba76ce9..000000000 --- a/vendor/erusev/parsedown-extra/test/data/footnote.html +++ /dev/null @@ -1,20 +0,0 @@ -

    first 1 second 2.

    -

    first 3 second 4.

    -

    second time 1

    -
    -
    -
      -
    1. -

      one ↩ ↩

      -
      2. -
    2. -

      two ↩

      -
      3. -
    3. -

      one ↩

      -
      4. -
    4. -

      two ↩

      -
      5. -
    -
    \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/footnote.md b/vendor/erusev/parsedown-extra/test/data/footnote.md deleted file mode 100644 index 07d70103f..000000000 --- a/vendor/erusev/parsedown-extra/test/data/footnote.md +++ /dev/null @@ -1,11 +0,0 @@ -first [^1] second [^2]. - -[^1]: one -[^2]: two - -first [^a] second [^b]. - -[^a]: one -[^b]: two - -second time [^1] \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/markdown_inside_markup.html b/vendor/erusev/parsedown-extra/test/data/markdown_inside_markup.html deleted file mode 100644 index 27da259f5..000000000 --- a/vendor/erusev/parsedown-extra/test/data/markdown_inside_markup.html +++ /dev/null @@ -1,25 +0,0 @@ -
    -

    markdown

    -

    This is another paragraph. It contains inline markup.

    -
    -_no markdown_ -
    -
    -
    -
    -

    markdown

    -
    -

    markdown

    -
    -
    -
    -
    -_no markdown_ -
    -

    markdown

    -
    -
    -
    -
    -_no markdown_ -
    \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/markdown_inside_markup.md b/vendor/erusev/parsedown-extra/test/data/markdown_inside_markup.md deleted file mode 100644 index dbb85d66f..000000000 --- a/vendor/erusev/parsedown-extra/test/data/markdown_inside_markup.md +++ /dev/null @@ -1,32 +0,0 @@ -
    -_markdown_ - -This is another paragraph. It contains inline markup. -
    -_no markdown_ -
    -
    - ---- - -
    -_markdown_ -
    -_markdown_ -
    -
    - ---- - -
    -_no markdown_ -
    -_markdown_ -
    -
    - ---- - -
    -_no markdown_ -
    \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/special_attributes.html b/vendor/erusev/parsedown-extra/test/data/special_attributes.html deleted file mode 100644 index cafa31109..000000000 --- a/vendor/erusev/parsedown-extra/test/data/special_attributes.html +++ /dev/null @@ -1,6 +0,0 @@ -

    Header 1

    -

    Header 2

    -

    The Site

    -

    The Site

    -

    link

    -

    \ No newline at end of file diff --git a/vendor/erusev/parsedown-extra/test/data/special_attributes.md b/vendor/erusev/parsedown-extra/test/data/special_attributes.md deleted file mode 100644 index 01f29fc97..000000000 --- a/vendor/erusev/parsedown-extra/test/data/special_attributes.md +++ /dev/null @@ -1,12 +0,0 @@ -Header 1 {#header1} -======== - -## Header 2 ## {#header2} - -## The Site ## {.main} - -## The Site ## {.main .shine #the-site} - -[link](http://parsedown.org) {.primary #link .upper-case} - -![logo](/md.png) {#logo .big} \ No newline at end of file diff --git a/vendor/erusev/parsedown/LICENSE.txt b/vendor/erusev/parsedown/LICENSE.txt deleted file mode 100644 index 8e7c764d1..000000000 --- a/vendor/erusev/parsedown/LICENSE.txt +++ /dev/null @@ -1,20 +0,0 @@ -The MIT License (MIT) - -Copyright (c) 2013-2018 Emanuil Rusev, erusev.com - -Permission is hereby granted, free of charge, to any person obtaining a copy of -this software and associated documentation files (the "Software"), to deal in -the Software without restriction, including without limitation the rights to -use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of -the Software, and to permit persons to whom the Software is furnished to do so, -subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS -FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR -COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER -IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN -CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/vendor/erusev/parsedown/Parsedown.php b/vendor/erusev/parsedown/Parsedown.php deleted file mode 100644 index 1b9d6d5bc..000000000 --- a/vendor/erusev/parsedown/Parsedown.php +++ /dev/null @@ -1,1712 +0,0 @@ -DefinitionData = array(); - - # standardize line breaks - $text = str_replace(array("\r\n", "\r"), "\n", $text); - - # remove surrounding line breaks - $text = trim($text, "\n"); - - # split text into lines - $lines = explode("\n", $text); - - # iterate through lines to identify blocks - $markup = $this->lines($lines); - - # trim line breaks - $markup = trim($markup, "\n"); - - return $markup; - } - - # - # Setters - # - - function setBreaksEnabled($breaksEnabled) - { - $this->breaksEnabled = $breaksEnabled; - - return $this; - } - - protected $breaksEnabled; - - function setMarkupEscaped($markupEscaped) - { - $this->markupEscaped = $markupEscaped; - - return $this; - } - - protected $markupEscaped; - - function setUrlsLinked($urlsLinked) - { - $this->urlsLinked = $urlsLinked; - - return $this; - } - - protected $urlsLinked = true; - - function setSafeMode($safeMode) - { - $this->safeMode = (bool) $safeMode; - - return $this; - } - - protected $safeMode; - - protected $safeLinksWhitelist = array( - 'http://', - 'https://', - 'ftp://', - 'ftps://', - 'mailto:', - 'data:image/png;base64,', - 'data:image/gif;base64,', - 'data:image/jpeg;base64,', - 'irc:', - 'ircs:', - 'git:', - 'ssh:', - 'news:', - 'steam:', - ); - - # - # Lines - # - - protected $BlockTypes = array( - '#' => array('Header'), - '*' => array('Rule', 'List'), - '+' => array('List'), - '-' => array('SetextHeader', 'Table', 'Rule', 'List'), - '0' => array('List'), - '1' => array('List'), - '2' => array('List'), - '3' => array('List'), - '4' => array('List'), - '5' => array('List'), - '6' => array('List'), - '7' => array('List'), - '8' => array('List'), - '9' => array('List'), - ':' => array('Table'), - '<' => array('Comment', 'Markup'), - '=' => array('SetextHeader'), - '>' => array('Quote'), - '[' => array('Reference'), - '_' => array('Rule'), - '`' => array('FencedCode'), - '|' => array('Table'), - '~' => array('FencedCode'), - ); - - # ~ - - protected $unmarkedBlockTypes = array( - 'Code', - ); - - # - # Blocks - # - - protected function lines(array $lines) - { - $CurrentBlock = null; - - foreach ($lines as $line) - { - if (chop($line) === '') - { - if (isset($CurrentBlock)) - { - $CurrentBlock['interrupted'] = true; - } - - continue; - } - - if (strpos($line, "\t") !== false) - { - $parts = explode("\t", $line); - - $line = $parts[0]; - - unset($parts[0]); - - foreach ($parts as $part) - { - $shortage = 4 - mb_strlen($line, 'utf-8') % 4; - - $line .= str_repeat(' ', $shortage); - $line .= $part; - } - } - - $indent = 0; - - while (isset($line[$indent]) and $line[$indent] === ' ') - { - $indent ++; - } - - $text = $indent > 0 ? substr($line, $indent) : $line; - - # ~ - - $Line = array('body' => $line, 'indent' => $indent, 'text' => $text); - - # ~ - - if (isset($CurrentBlock['continuable'])) - { - $Block = $this->{'block'.$CurrentBlock['type'].'Continue'}($Line, $CurrentBlock); - - if (isset($Block)) - { - $CurrentBlock = $Block; - - continue; - } - else - { - if ($this->isBlockCompletable($CurrentBlock['type'])) - { - $CurrentBlock = $this->{'block'.$CurrentBlock['type'].'Complete'}($CurrentBlock); - } - } - } - - # ~ - - $marker = $text[0]; - - # ~ - - $blockTypes = $this->unmarkedBlockTypes; - - if (isset($this->BlockTypes[$marker])) - { - foreach ($this->BlockTypes[$marker] as $blockType) - { - $blockTypes []= $blockType; - } - } - - # - # ~ - - foreach ($blockTypes as $blockType) - { - $Block = $this->{'block'.$blockType}($Line, $CurrentBlock); - - if (isset($Block)) - { - $Block['type'] = $blockType; - - if ( ! isset($Block['identified'])) - { - $Blocks []= $CurrentBlock; - - $Block['identified'] = true; - } - - if ($this->isBlockContinuable($blockType)) - { - $Block['continuable'] = true; - } - - $CurrentBlock = $Block; - - continue 2; - } - } - - # ~ - - if (isset($CurrentBlock) and ! isset($CurrentBlock['type']) and ! isset($CurrentBlock['interrupted'])) - { - $CurrentBlock['element']['text'] .= "\n".$text; - } - else - { - $Blocks []= $CurrentBlock; - - $CurrentBlock = $this->paragraph($Line); - - $CurrentBlock['identified'] = true; - } - } - - # ~ - - if (isset($CurrentBlock['continuable']) and $this->isBlockCompletable($CurrentBlock['type'])) - { - $CurrentBlock = $this->{'block'.$CurrentBlock['type'].'Complete'}($CurrentBlock); - } - - # ~ - - $Blocks []= $CurrentBlock; - - unset($Blocks[0]); - - # ~ - - $markup = ''; - - foreach ($Blocks as $Block) - { - if (isset($Block['hidden'])) - { - continue; - } - - $markup .= "\n"; - $markup .= isset($Block['markup']) ? $Block['markup'] : $this->element($Block['element']); - } - - $markup .= "\n"; - - # ~ - - return $markup; - } - - protected function isBlockContinuable($Type) - { - return method_exists($this, 'block'.$Type.'Continue'); - } - - protected function isBlockCompletable($Type) - { - return method_exists($this, 'block'.$Type.'Complete'); - } - - # - # Code - - protected function blockCode($Line, $Block = null) - { - if (isset($Block) and ! isset($Block['type']) and ! isset($Block['interrupted'])) - { - return; - } - - if ($Line['indent'] >= 4) - { - $text = substr($Line['body'], 4); - - $Block = array( - 'element' => array( - 'name' => 'pre', - 'handler' => 'element', - 'text' => array( - 'name' => 'code', - 'text' => $text, - ), - ), - ); - - return $Block; - } - } - - protected function blockCodeContinue($Line, $Block) - { - if ($Line['indent'] >= 4) - { - if (isset($Block['interrupted'])) - { - $Block['element']['text']['text'] .= "\n"; - - unset($Block['interrupted']); - } - - $Block['element']['text']['text'] .= "\n"; - - $text = substr($Line['body'], 4); - - $Block['element']['text']['text'] .= $text; - - return $Block; - } - } - - protected function blockCodeComplete($Block) - { - $text = $Block['element']['text']['text']; - - $Block['element']['text']['text'] = $text; - - return $Block; - } - - # - # Comment - - protected function blockComment($Line) - { - if ($this->markupEscaped or $this->safeMode) - { - return; - } - - if (isset($Line['text'][3]) and $Line['text'][3] === '-' and $Line['text'][2] === '-' and $Line['text'][1] === '!') - { - $Block = array( - 'markup' => $Line['body'], - ); - - if (preg_match('/-->$/', $Line['text'])) - { - $Block['closed'] = true; - } - - return $Block; - } - } - - protected function blockCommentContinue($Line, array $Block) - { - if (isset($Block['closed'])) - { - return; - } - - $Block['markup'] .= "\n" . $Line['body']; - - if (preg_match('/-->$/', $Line['text'])) - { - $Block['closed'] = true; - } - - return $Block; - } - - # - # Fenced Code - - protected function blockFencedCode($Line) - { - if (preg_match('/^['.$Line['text'][0].']{3,}[ ]*([^`]+)?[ ]*$/', $Line['text'], $matches)) - { - $Element = array( - 'name' => 'code', - 'text' => '', - ); - - if (isset($matches[1])) - { - /** - * https://www.w3.org/TR/2011/WD-html5-20110525/elements.html#classes - * Every HTML element may have a class attribute specified. - * The attribute, if specified, must have a value that is a set - * of space-separated tokens representing the various classes - * that the element belongs to. - * [...] - * The space characters, for the purposes of this specification, - * are U+0020 SPACE, U+0009 CHARACTER TABULATION (tab), - * U+000A LINE FEED (LF), U+000C FORM FEED (FF), and - * U+000D CARRIAGE RETURN (CR). - */ - $language = substr($matches[1], 0, strcspn($matches[1], " \t\n\f\r")); - - $class = 'language-'.$language; - - $Element['attributes'] = array( - 'class' => $class, - ); - } - - $Block = array( - 'char' => $Line['text'][0], - 'element' => array( - 'name' => 'pre', - 'handler' => 'element', - 'text' => $Element, - ), - ); - - return $Block; - } - } - - protected function blockFencedCodeContinue($Line, $Block) - { - if (isset($Block['complete'])) - { - return; - } - - if (isset($Block['interrupted'])) - { - $Block['element']['text']['text'] .= "\n"; - - unset($Block['interrupted']); - } - - if (preg_match('/^'.$Block['char'].'{3,}[ ]*$/', $Line['text'])) - { - $Block['element']['text']['text'] = substr($Block['element']['text']['text'], 1); - - $Block['complete'] = true; - - return $Block; - } - - $Block['element']['text']['text'] .= "\n".$Line['body']; - - return $Block; - } - - protected function blockFencedCodeComplete($Block) - { - $text = $Block['element']['text']['text']; - - $Block['element']['text']['text'] = $text; - - return $Block; - } - - # - # Header - - protected function blockHeader($Line) - { - if (isset($Line['text'][1])) - { - $level = 1; - - while (isset($Line['text'][$level]) and $Line['text'][$level] === '#') - { - $level ++; - } - - if ($level > 6) - { - return; - } - - $text = trim($Line['text'], '# '); - - $Block = array( - 'element' => array( - 'name' => 'h' . min(6, $level), - 'text' => $text, - 'handler' => 'line', - ), - ); - - return $Block; - } - } - - # - # List - - protected function blockList($Line) - { - list($name, $pattern) = $Line['text'][0] <= '-' ? array('ul', '[*+-]') : array('ol', '[0-9]+[.]'); - - if (preg_match('/^('.$pattern.'[ ]+)(.*)/', $Line['text'], $matches)) - { - $Block = array( - 'indent' => $Line['indent'], - 'pattern' => $pattern, - 'element' => array( - 'name' => $name, - 'handler' => 'elements', - ), - ); - - if($name === 'ol') - { - $listStart = stristr($matches[0], '.', true); - - if($listStart !== '1') - { - $Block['element']['attributes'] = array('start' => $listStart); - } - } - - $Block['li'] = array( - 'name' => 'li', - 'handler' => 'li', - 'text' => array( - $matches[2], - ), - ); - - $Block['element']['text'] []= & $Block['li']; - - return $Block; - } - } - - protected function blockListContinue($Line, array $Block) - { - if ($Block['indent'] === $Line['indent'] and preg_match('/^'.$Block['pattern'].'(?:[ ]+(.*)|$)/', $Line['text'], $matches)) - { - if (isset($Block['interrupted'])) - { - $Block['li']['text'] []= ''; - - $Block['loose'] = true; - - unset($Block['interrupted']); - } - - unset($Block['li']); - - $text = isset($matches[1]) ? $matches[1] : ''; - - $Block['li'] = array( - 'name' => 'li', - 'handler' => 'li', - 'text' => array( - $text, - ), - ); - - $Block['element']['text'] []= & $Block['li']; - - return $Block; - } - - if ($Line['text'][0] === '[' and $this->blockReference($Line)) - { - return $Block; - } - - if ( ! isset($Block['interrupted'])) - { - $text = preg_replace('/^[ ]{0,4}/', '', $Line['body']); - - $Block['li']['text'] []= $text; - - return $Block; - } - - if ($Line['indent'] > 0) - { - $Block['li']['text'] []= ''; - - $text = preg_replace('/^[ ]{0,4}/', '', $Line['body']); - - $Block['li']['text'] []= $text; - - unset($Block['interrupted']); - - return $Block; - } - } - - protected function blockListComplete(array $Block) - { - if (isset($Block['loose'])) - { - foreach ($Block['element']['text'] as &$li) - { - if (end($li['text']) !== '') - { - $li['text'] []= ''; - } - } - } - - return $Block; - } - - # - # Quote - - protected function blockQuote($Line) - { - if (preg_match('/^>[ ]?(.*)/', $Line['text'], $matches)) - { - $Block = array( - 'element' => array( - 'name' => 'blockquote', - 'handler' => 'lines', - 'text' => (array) $matches[1], - ), - ); - - return $Block; - } - } - - protected function blockQuoteContinue($Line, array $Block) - { - if ($Line['text'][0] === '>' and preg_match('/^>[ ]?(.*)/', $Line['text'], $matches)) - { - if (isset($Block['interrupted'])) - { - $Block['element']['text'] []= ''; - - unset($Block['interrupted']); - } - - $Block['element']['text'] []= $matches[1]; - - return $Block; - } - - if ( ! isset($Block['interrupted'])) - { - $Block['element']['text'] []= $Line['text']; - - return $Block; - } - } - - # - # Rule - - protected function blockRule($Line) - { - if (preg_match('/^(['.$Line['text'][0].'])([ ]*\1){2,}[ ]*$/', $Line['text'])) - { - $Block = array( - 'element' => array( - 'name' => 'hr' - ), - ); - - return $Block; - } - } - - # - # Setext - - protected function blockSetextHeader($Line, array $Block = null) - { - if ( ! isset($Block) or isset($Block['type']) or isset($Block['interrupted'])) - { - return; - } - - if (chop($Line['text'], $Line['text'][0]) === '') - { - $Block['element']['name'] = $Line['text'][0] === '=' ? 'h1' : 'h2'; - - return $Block; - } - } - - # - # Markup - - protected function blockMarkup($Line) - { - if ($this->markupEscaped or $this->safeMode) - { - return; - } - - if (preg_match('/^<(\w[\w-]*)(?:[ ]*'.$this->regexHtmlAttribute.')*[ ]*(\/)?>/', $Line['text'], $matches)) - { - $element = strtolower($matches[1]); - - if (in_array($element, $this->textLevelElements)) - { - return; - } - - $Block = array( - 'name' => $matches[1], - 'depth' => 0, - 'markup' => $Line['text'], - ); - - $length = strlen($matches[0]); - - $remainder = substr($Line['text'], $length); - - if (trim($remainder) === '') - { - if (isset($matches[2]) or in_array($matches[1], $this->voidElements)) - { - $Block['closed'] = true; - - $Block['void'] = true; - } - } - else - { - if (isset($matches[2]) or in_array($matches[1], $this->voidElements)) - { - return; - } - - if (preg_match('/<\/'.$matches[1].'>[ ]*$/i', $remainder)) - { - $Block['closed'] = true; - } - } - - return $Block; - } - } - - protected function blockMarkupContinue($Line, array $Block) - { - if (isset($Block['closed'])) - { - return; - } - - if (preg_match('/^<'.$Block['name'].'(?:[ ]*'.$this->regexHtmlAttribute.')*[ ]*>/i', $Line['text'])) # open - { - $Block['depth'] ++; - } - - if (preg_match('/(.*?)<\/'.$Block['name'].'>[ ]*$/i', $Line['text'], $matches)) # close - { - if ($Block['depth'] > 0) - { - $Block['depth'] --; - } - else - { - $Block['closed'] = true; - } - } - - if (isset($Block['interrupted'])) - { - $Block['markup'] .= "\n"; - - unset($Block['interrupted']); - } - - $Block['markup'] .= "\n".$Line['body']; - - return $Block; - } - - # - # Reference - - protected function blockReference($Line) - { - if (preg_match('/^\[(.+?)\]:[ ]*?(?:[ ]+["\'(](.+)["\')])?[ ]*$/', $Line['text'], $matches)) - { - $id = strtolower($matches[1]); - - $Data = array( - 'url' => $matches[2], - 'title' => null, - ); - - if (isset($matches[3])) - { - $Data['title'] = $matches[3]; - } - - $this->DefinitionData['Reference'][$id] = $Data; - - $Block = array( - 'hidden' => true, - ); - - return $Block; - } - } - - # - # Table - - protected function blockTable($Line, array $Block = null) - { - if ( ! isset($Block) or isset($Block['type']) or isset($Block['interrupted'])) - { - return; - } - - if (strpos($Block['element']['text'], '|') !== false and chop($Line['text'], ' -:|') === '') - { - $alignments = array(); - - $divider = $Line['text']; - - $divider = trim($divider); - $divider = trim($divider, '|'); - - $dividerCells = explode('|', $divider); - - foreach ($dividerCells as $dividerCell) - { - $dividerCell = trim($dividerCell); - - if ($dividerCell === '') - { - continue; - } - - $alignment = null; - - if ($dividerCell[0] === ':') - { - $alignment = 'left'; - } - - if (substr($dividerCell, - 1) === ':') - { - $alignment = $alignment === 'left' ? 'center' : 'right'; - } - - $alignments []= $alignment; - } - - # ~ - - $HeaderElements = array(); - - $header = $Block['element']['text']; - - $header = trim($header); - $header = trim($header, '|'); - - $headerCells = explode('|', $header); - - foreach ($headerCells as $index => $headerCell) - { - $headerCell = trim($headerCell); - - $HeaderElement = array( - 'name' => 'th', - 'text' => $headerCell, - 'handler' => 'line', - ); - - if (isset($alignments[$index])) - { - $alignment = $alignments[$index]; - - $HeaderElement['attributes'] = array( - 'style' => 'text-align: '.$alignment.';', - ); - } - - $HeaderElements []= $HeaderElement; - } - - # ~ - - $Block = array( - 'alignments' => $alignments, - 'identified' => true, - 'element' => array( - 'name' => 'table', - 'handler' => 'elements', - ), - ); - - $Block['element']['text'] []= array( - 'name' => 'thead', - 'handler' => 'elements', - ); - - $Block['element']['text'] []= array( - 'name' => 'tbody', - 'handler' => 'elements', - 'text' => array(), - ); - - $Block['element']['text'][0]['text'] []= array( - 'name' => 'tr', - 'handler' => 'elements', - 'text' => $HeaderElements, - ); - - return $Block; - } - } - - protected function blockTableContinue($Line, array $Block) - { - if (isset($Block['interrupted'])) - { - return; - } - - if ($Line['text'][0] === '|' or strpos($Line['text'], '|')) - { - $Elements = array(); - - $row = $Line['text']; - - $row = trim($row); - $row = trim($row, '|'); - - preg_match_all('/(?:(\\\\[|])|[^|`]|`[^`]+`|`)+/', $row, $matches); - - foreach ($matches[0] as $index => $cell) - { - $cell = trim($cell); - - $Element = array( - 'name' => 'td', - 'handler' => 'line', - 'text' => $cell, - ); - - if (isset($Block['alignments'][$index])) - { - $Element['attributes'] = array( - 'style' => 'text-align: '.$Block['alignments'][$index].';', - ); - } - - $Elements []= $Element; - } - - $Element = array( - 'name' => 'tr', - 'handler' => 'elements', - 'text' => $Elements, - ); - - $Block['element']['text'][1]['text'] []= $Element; - - return $Block; - } - } - - # - # ~ - # - - protected function paragraph($Line) - { - $Block = array( - 'element' => array( - 'name' => 'p', - 'text' => $Line['text'], - 'handler' => 'line', - ), - ); - - return $Block; - } - - # - # Inline Elements - # - - protected $InlineTypes = array( - '"' => array('SpecialCharacter'), - '!' => array('Image'), - '&' => array('SpecialCharacter'), - '*' => array('Emphasis'), - ':' => array('Url'), - '<' => array('UrlTag', 'EmailTag', 'Markup', 'SpecialCharacter'), - '>' => array('SpecialCharacter'), - '[' => array('Link'), - '_' => array('Emphasis'), - '`' => array('Code'), - '~' => array('Strikethrough'), - '\\' => array('EscapeSequence'), - ); - - # ~ - - protected $inlineMarkerList = '!"*_&[:<>`~\\'; - - # - # ~ - # - - public function line($text, $nonNestables=array()) - { - $markup = ''; - - # $excerpt is based on the first occurrence of a marker - - while ($excerpt = strpbrk($text, $this->inlineMarkerList)) - { - $marker = $excerpt[0]; - - $markerPosition = strpos($text, $marker); - - $Excerpt = array('text' => $excerpt, 'context' => $text); - - foreach ($this->InlineTypes[$marker] as $inlineType) - { - # check to see if the current inline type is nestable in the current context - - if ( ! empty($nonNestables) and in_array($inlineType, $nonNestables)) - { - continue; - } - - $Inline = $this->{'inline'.$inlineType}($Excerpt); - - if ( ! isset($Inline)) - { - continue; - } - - # makes sure that the inline belongs to "our" marker - - if (isset($Inline['position']) and $Inline['position'] > $markerPosition) - { - continue; - } - - # sets a default inline position - - if ( ! isset($Inline['position'])) - { - $Inline['position'] = $markerPosition; - } - - # cause the new element to 'inherit' our non nestables - - foreach ($nonNestables as $non_nestable) - { - $Inline['element']['nonNestables'][] = $non_nestable; - } - - # the text that comes before the inline - $unmarkedText = substr($text, 0, $Inline['position']); - - # compile the unmarked text - $markup .= $this->unmarkedText($unmarkedText); - - # compile the inline - $markup .= isset($Inline['markup']) ? $Inline['markup'] : $this->element($Inline['element']); - - # remove the examined text - $text = substr($text, $Inline['position'] + $Inline['extent']); - - continue 2; - } - - # the marker does not belong to an inline - - $unmarkedText = substr($text, 0, $markerPosition + 1); - - $markup .= $this->unmarkedText($unmarkedText); - - $text = substr($text, $markerPosition + 1); - } - - $markup .= $this->unmarkedText($text); - - return $markup; - } - - # - # ~ - # - - protected function inlineCode($Excerpt) - { - $marker = $Excerpt['text'][0]; - - if (preg_match('/^('.$marker.'+)[ ]*(.+?)[ ]*(? strlen($matches[0]), - 'element' => array( - 'name' => 'code', - 'text' => $text, - ), - ); - } - } - - protected function inlineEmailTag($Excerpt) - { - if (strpos($Excerpt['text'], '>') !== false and preg_match('/^<((mailto:)?\S+?@\S+?)>/i', $Excerpt['text'], $matches)) - { - $url = $matches[1]; - - if ( ! isset($matches[2])) - { - $url = 'mailto:' . $url; - } - - return array( - 'extent' => strlen($matches[0]), - 'element' => array( - 'name' => 'a', - 'text' => $matches[1], - 'attributes' => array( - 'href' => $url, - ), - ), - ); - } - } - - protected function inlineEmphasis($Excerpt) - { - if ( ! isset($Excerpt['text'][1])) - { - return; - } - - $marker = $Excerpt['text'][0]; - - if ($Excerpt['text'][1] === $marker and preg_match($this->StrongRegex[$marker], $Excerpt['text'], $matches)) - { - $emphasis = 'strong'; - } - elseif (preg_match($this->EmRegex[$marker], $Excerpt['text'], $matches)) - { - $emphasis = 'em'; - } - else - { - return; - } - - return array( - 'extent' => strlen($matches[0]), - 'element' => array( - 'name' => $emphasis, - 'handler' => 'line', - 'text' => $matches[1], - ), - ); - } - - protected function inlineEscapeSequence($Excerpt) - { - if (isset($Excerpt['text'][1]) and in_array($Excerpt['text'][1], $this->specialCharacters)) - { - return array( - 'markup' => $Excerpt['text'][1], - 'extent' => 2, - ); - } - } - - protected function inlineImage($Excerpt) - { - if ( ! isset($Excerpt['text'][1]) or $Excerpt['text'][1] !== '[') - { - return; - } - - $Excerpt['text']= substr($Excerpt['text'], 1); - - $Link = $this->inlineLink($Excerpt); - - if ($Link === null) - { - return; - } - - $Inline = array( - 'extent' => $Link['extent'] + 1, - 'element' => array( - 'name' => 'img', - 'attributes' => array( - 'src' => $Link['element']['attributes']['href'], - 'alt' => $Link['element']['text'], - ), - ), - ); - - $Inline['element']['attributes'] += $Link['element']['attributes']; - - unset($Inline['element']['attributes']['href']); - - return $Inline; - } - - protected function inlineLink($Excerpt) - { - $Element = array( - 'name' => 'a', - 'handler' => 'line', - 'nonNestables' => array('Url', 'Link'), - 'text' => null, - 'attributes' => array( - 'href' => null, - 'title' => null, - ), - ); - - $extent = 0; - - $remainder = $Excerpt['text']; - - if (preg_match('/\[((?:[^][]++|(?R))*+)\]/', $remainder, $matches)) - { - $Element['text'] = $matches[1]; - - $extent += strlen($matches[0]); - - $remainder = substr($remainder, $extent); - } - else - { - return; - } - - if (preg_match('/^[(]\s*+((?:[^ ()]++|[(][^ )]+[)])++)(?:[ ]+("[^"]*"|\'[^\']*\'))?\s*[)]/', $remainder, $matches)) - { - $Element['attributes']['href'] = $matches[1]; - - if (isset($matches[2])) - { - $Element['attributes']['title'] = substr($matches[2], 1, - 1); - } - - $extent += strlen($matches[0]); - } - else - { - if (preg_match('/^\s*\[(.*?)\]/', $remainder, $matches)) - { - $definition = strlen($matches[1]) ? $matches[1] : $Element['text']; - $definition = strtolower($definition); - - $extent += strlen($matches[0]); - } - else - { - $definition = strtolower($Element['text']); - } - - if ( ! isset($this->DefinitionData['Reference'][$definition])) - { - return; - } - - $Definition = $this->DefinitionData['Reference'][$definition]; - - $Element['attributes']['href'] = $Definition['url']; - $Element['attributes']['title'] = $Definition['title']; - } - - return array( - 'extent' => $extent, - 'element' => $Element, - ); - } - - protected function inlineMarkup($Excerpt) - { - if ($this->markupEscaped or $this->safeMode or strpos($Excerpt['text'], '>') === false) - { - return; - } - - if ($Excerpt['text'][1] === '/' and preg_match('/^<\/\w[\w-]*[ ]*>/s', $Excerpt['text'], $matches)) - { - return array( - 'markup' => $matches[0], - 'extent' => strlen($matches[0]), - ); - } - - if ($Excerpt['text'][1] === '!' and preg_match('/^/s', $Excerpt['text'], $matches)) - { - return array( - 'markup' => $matches[0], - 'extent' => strlen($matches[0]), - ); - } - - if ($Excerpt['text'][1] !== ' ' and preg_match('/^<\w[\w-]*(?:[ ]*'.$this->regexHtmlAttribute.')*[ ]*\/?>/s', $Excerpt['text'], $matches)) - { - return array( - 'markup' => $matches[0], - 'extent' => strlen($matches[0]), - ); - } - } - - protected function inlineSpecialCharacter($Excerpt) - { - if ($Excerpt['text'][0] === '&' and ! preg_match('/^&#?\w+;/', $Excerpt['text'])) - { - return array( - 'markup' => '&', - 'extent' => 1, - ); - } - - $SpecialCharacter = array('>' => 'gt', '<' => 'lt', '"' => 'quot'); - - if (isset($SpecialCharacter[$Excerpt['text'][0]])) - { - return array( - 'markup' => '&'.$SpecialCharacter[$Excerpt['text'][0]].';', - 'extent' => 1, - ); - } - } - - protected function inlineStrikethrough($Excerpt) - { - if ( ! isset($Excerpt['text'][1])) - { - return; - } - - if ($Excerpt['text'][1] === '~' and preg_match('/^~~(?=\S)(.+?)(?<=\S)~~/', $Excerpt['text'], $matches)) - { - return array( - 'extent' => strlen($matches[0]), - 'element' => array( - 'name' => 'del', - 'text' => $matches[1], - 'handler' => 'line', - ), - ); - } - } - - protected function inlineUrl($Excerpt) - { - if ($this->urlsLinked !== true or ! isset($Excerpt['text'][2]) or $Excerpt['text'][2] !== '/') - { - return; - } - - if (preg_match('/\bhttps?:[\/]{2}[^\s<]+\b\/*/ui', $Excerpt['context'], $matches, PREG_OFFSET_CAPTURE)) - { - $url = $matches[0][0]; - - $Inline = array( - 'extent' => strlen($matches[0][0]), - 'position' => $matches[0][1], - 'element' => array( - 'name' => 'a', - 'text' => $url, - 'attributes' => array( - 'href' => $url, - ), - ), - ); - - return $Inline; - } - } - - protected function inlineUrlTag($Excerpt) - { - if (strpos($Excerpt['text'], '>') !== false and preg_match('/^<(\w+:\/{2}[^ >]+)>/i', $Excerpt['text'], $matches)) - { - $url = $matches[1]; - - return array( - 'extent' => strlen($matches[0]), - 'element' => array( - 'name' => 'a', - 'text' => $url, - 'attributes' => array( - 'href' => $url, - ), - ), - ); - } - } - - # ~ - - protected function unmarkedText($text) - { - if ($this->breaksEnabled) - { - $text = preg_replace('/[ ]*\n/', "
    \n", $text); - } - else - { - $text = preg_replace('/(?:[ ][ ]+|[ ]*\\\\)\n/', "
    \n", $text); - $text = str_replace(" \n", "\n", $text); - } - - return $text; - } - - # - # Handlers - # - - protected function element(array $Element) - { - if ($this->safeMode) - { - $Element = $this->sanitiseElement($Element); - } - - $markup = '<'.$Element['name']; - - if (isset($Element['attributes'])) - { - foreach ($Element['attributes'] as $name => $value) - { - if ($value === null) - { - continue; - } - - $markup .= ' '.$name.'="'.self::escape($value).'"'; - } - } - - $permitRawHtml = false; - - if (isset($Element['text'])) - { - $text = $Element['text']; - } - // very strongly consider an alternative if you're writing an - // extension - elseif (isset($Element['rawHtml'])) - { - $text = $Element['rawHtml']; - $allowRawHtmlInSafeMode = isset($Element['allowRawHtmlInSafeMode']) && $Element['allowRawHtmlInSafeMode']; - $permitRawHtml = !$this->safeMode || $allowRawHtmlInSafeMode; - } - - if (isset($text)) - { - $markup .= '>'; - - if (!isset($Element['nonNestables'])) - { - $Element['nonNestables'] = array(); - } - - if (isset($Element['handler'])) - { - $markup .= $this->{$Element['handler']}($text, $Element['nonNestables']); - } - elseif (!$permitRawHtml) - { - $markup .= self::escape($text, true); - } - else - { - $markup .= $text; - } - - $markup .= ''; - } - else - { - $markup .= ' />'; - } - - return $markup; - } - - protected function elements(array $Elements) - { - $markup = ''; - - foreach ($Elements as $Element) - { - $markup .= "\n" . $this->element($Element); - } - - $markup .= "\n"; - - return $markup; - } - - # ~ - - protected function li($lines) - { - $markup = $this->lines($lines); - - $trimmedMarkup = trim($markup); - - if ( ! in_array('', $lines) and substr($trimmedMarkup, 0, 3) === '

    ') - { - $markup = $trimmedMarkup; - $markup = substr($markup, 3); - - $position = strpos($markup, "

    "); - - $markup = substr_replace($markup, '', $position, 4); - } - - return $markup; - } - - # - # Deprecated Methods - # - - function parse($text) - { - $markup = $this->text($text); - - return $markup; - } - - protected function sanitiseElement(array $Element) - { - static $goodAttribute = '/^[a-zA-Z0-9][a-zA-Z0-9-_]*+$/'; - static $safeUrlNameToAtt = array( - 'a' => 'href', - 'img' => 'src', - ); - - if (isset($safeUrlNameToAtt[$Element['name']])) - { - $Element = $this->filterUnsafeUrlInAttribute($Element, $safeUrlNameToAtt[$Element['name']]); - } - - if ( ! empty($Element['attributes'])) - { - foreach ($Element['attributes'] as $att => $val) - { - # filter out badly parsed attribute - if ( ! preg_match($goodAttribute, $att)) - { - unset($Element['attributes'][$att]); - } - # dump onevent attribute - elseif (self::striAtStart($att, 'on')) - { - unset($Element['attributes'][$att]); - } - } - } - - return $Element; - } - - protected function filterUnsafeUrlInAttribute(array $Element, $attribute) - { - foreach ($this->safeLinksWhitelist as $scheme) - { - if (self::striAtStart($Element['attributes'][$attribute], $scheme)) - { - return $Element; - } - } - - $Element['attributes'][$attribute] = str_replace(':', '%3A', $Element['attributes'][$attribute]); - - return $Element; - } - - # - # Static Methods - # - - protected static function escape($text, $allowQuotes = false) - { - return htmlspecialchars($text, $allowQuotes ? ENT_NOQUOTES : ENT_QUOTES, 'UTF-8'); - } - - protected static function striAtStart($string, $needle) - { - $len = strlen($needle); - - if ($len > strlen($string)) - { - return false; - } - else - { - return strtolower(substr($string, 0, $len)) === strtolower($needle); - } - } - - static function instance($name = 'default') - { - if (isset(self::$instances[$name])) - { - return self::$instances[$name]; - } - - $instance = new static(); - - self::$instances[$name] = $instance; - - return $instance; - } - - private static $instances = array(); - - # - # Fields - # - - protected $DefinitionData; - - # - # Read-Only - - protected $specialCharacters = array( - '\\', '`', '*', '_', '{', '}', '[', ']', '(', ')', '>', '#', '+', '-', '.', '!', '|', - ); - - protected $StrongRegex = array( - '*' => '/^[*]{2}((?:\\\\\*|[^*]|[*][^*]*[*])+?)[*]{2}(?![*])/s', - '_' => '/^__((?:\\\\_|[^_]|_[^_]*_)+?)__(?!_)/us', - ); - - protected $EmRegex = array( - '*' => '/^[*]((?:\\\\\*|[^*]|[*][*][^*]+?[*][*])+?)[*](?![*])/s', - '_' => '/^_((?:\\\\_|[^_]|__[^_]*__)+?)_(?!_)\b/us', - ); - - protected $regexHtmlAttribute = '[a-zA-Z_:][\w:.-]*(?:\s*=\s*(?:[^"\'=<>`\s]+|"[^"]*"|\'[^\']*\'))?'; - - protected $voidElements = array( - 'area', 'base', 'br', 'col', 'command', 'embed', 'hr', 'img', 'input', 'link', 'meta', 'param', 'source', - ); - - protected $textLevelElements = array( - 'a', 'br', 'bdo', 'abbr', 'blink', 'nextid', 'acronym', 'basefont', - 'b', 'em', 'big', 'cite', 'small', 'spacer', 'listing', - 'i', 'rp', 'del', 'code', 'strike', 'marquee', - 'q', 'rt', 'ins', 'font', 'strong', - 's', 'tt', 'kbd', 'mark', - 'u', 'xm', 'sub', 'nobr', - 'sup', 'ruby', - 'var', 'span', - 'wbr', 'time', - ); -} diff --git a/vendor/erusev/parsedown/README.md b/vendor/erusev/parsedown/README.md deleted file mode 100644 index b5d9ed2ee..000000000 --- a/vendor/erusev/parsedown/README.md +++ /dev/null @@ -1,86 +0,0 @@ -> I also make [Caret](https://caret.io?ref=parsedown) - a Markdown editor for Mac and PC. - -## Parsedown - -[![Build Status](https://img.shields.io/travis/erusev/parsedown/master.svg?style=flat-square)](https://travis-ci.org/erusev/parsedown) - - -Better Markdown Parser in PHP - -[Demo](http://parsedown.org/demo) | -[Benchmarks](http://parsedown.org/speed) | -[Tests](http://parsedown.org/tests/) | -[Documentation](https://github.com/erusev/parsedown/wiki/) - -### Features - -* One File -* No Dependencies -* Super Fast -* Extensible -* [GitHub flavored](https://help.github.com/articles/github-flavored-markdown) -* Tested in 5.3 to 7.1 and in HHVM -* [Markdown Extra extension](https://github.com/erusev/parsedown-extra) - -### Installation - -Include `Parsedown.php` or install [the composer package](https://packagist.org/packages/erusev/parsedown). - -### Example - -``` php -$Parsedown = new Parsedown(); - -echo $Parsedown->text('Hello _Parsedown_!'); # prints:

    Hello Parsedown!

    -``` - -More examples in [the wiki](https://github.com/erusev/parsedown/wiki/) and in [this video tutorial](http://youtu.be/wYZBY8DEikI). - -### Security - -Parsedown is capable of escaping user-input within the HTML that it generates. Additionally Parsedown will apply sanitisation to additional scripting vectors (such as scripting link destinations) that are introduced by the markdown syntax itself. - -To tell Parsedown that it is processing untrusted user-input, use the following: -```php -$parsedown = new Parsedown; -$parsedown->setSafeMode(true); -``` - -If instead, you wish to allow HTML within untrusted user-input, but still want output to be free from XSS it is recommended that you make use of a HTML sanitiser that allows HTML tags to be whitelisted, like [HTML Purifier](http://htmlpurifier.org/). - -In both cases you should strongly consider employing defence-in-depth measures, like [deploying a Content-Security-Policy](https://scotthelme.co.uk/content-security-policy-an-introduction/) (a browser security feature) so that your page is likely to be safe even if an attacker finds a vulnerability in one of the first lines of defence above. - -#### Security of Parsedown Extensions - -Safe mode does not necessarily yield safe results when using extensions to Parsedown. Extensions should be evaluated on their own to determine their specific safety against XSS. - -### Escaping HTML -> ⚠️  **WARNING:** This method isn't safe from XSS! - -If you wish to escape HTML **in trusted input**, you can use the following: -```php -$parsedown = new Parsedown; -$parsedown->setMarkupEscaped(true); -``` - -Beware that this still allows users to insert unsafe scripting vectors, such as links like `[xss](javascript:alert%281%29)`. - -### Questions - -**How does Parsedown work?** - -It tries to read Markdown like a human. First, it looks at the lines. It’s interested in how the lines start. This helps it recognise blocks. It knows, for example, that if a line starts with a `-` then perhaps it belongs to a list. Once it recognises the blocks, it continues to the content. As it reads, it watches out for special characters. This helps it recognise inline elements (or inlines). - -We call this approach "line based". We believe that Parsedown is the first Markdown parser to use it. Since the release of Parsedown, other developers have used the same approach to develop other Markdown parsers in PHP and in other languages. - -**Is it compliant with CommonMark?** - -It passes most of the CommonMark tests. Most of the tests that don't pass deal with cases that are quite uncommon. Still, as CommonMark matures, compliance should improve. - -**Who uses it?** - -[Laravel Framework](https://laravel.com/), [Bolt CMS](http://bolt.cm/), [Grav CMS](http://getgrav.org/), [Herbie CMS](http://www.getherbie.org/), [Kirby CMS](http://getkirby.com/), [October CMS](http://octobercms.com/), [Pico CMS](http://picocms.org), [Statamic CMS](http://www.statamic.com/), [phpDocumentor](http://www.phpdoc.org/), [RaspberryPi.org](http://www.raspberrypi.org/), [Symfony demo](https://github.com/symfony/symfony-demo) and [more](https://packagist.org/packages/erusev/parsedown/dependents). - -**How can I help?** - -Use it, star it, share it and if you feel generous, [donate](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=528P3NZQMP8N2). diff --git a/vendor/erusev/parsedown/composer.json b/vendor/erusev/parsedown/composer.json deleted file mode 100644 index f8b40f8ce..000000000 --- a/vendor/erusev/parsedown/composer.json +++ /dev/null @@ -1,33 +0,0 @@ -{ - "name": "erusev/parsedown", - "description": "Parser for Markdown.", - "keywords": ["markdown", "parser"], - "homepage": "http://parsedown.org", - "type": "library", - "license": "MIT", - "authors": [ - { - "name": "Emanuil Rusev", - "email": "hello@erusev.com", - "homepage": "http://erusev.com" - } - ], - "require": { - "php": ">=5.3.0", - "ext-mbstring": "*" - }, - "require-dev": { - "phpunit/phpunit": "^4.8.35" - }, - "autoload": { - "psr-0": {"Parsedown": ""} - }, - "autoload-dev": { - "psr-0": { - "TestParsedown": "test/", - "ParsedownTest": "test/", - "CommonMarkTest": "test/", - "CommonMarkTestWeak": "test/" - } - } -} diff --git a/vendor/mnapoli/front-yaml/.gitattributes b/vendor/mnapoli/front-yaml/.gitattributes deleted file mode 100644 index a50492955..000000000 --- a/vendor/mnapoli/front-yaml/.gitattributes +++ /dev/null @@ -1,5 +0,0 @@ -# Auto detect text files and perform LF normalization -* text=auto - -tests/ export-ignore -.travis.yml export-ignore diff --git a/vendor/mnapoli/front-yaml/.gitignore b/vendor/mnapoli/front-yaml/.gitignore deleted file mode 100644 index 051d91512..000000000 --- a/vendor/mnapoli/front-yaml/.gitignore +++ /dev/null @@ -1,5 +0,0 @@ -vendor/* -composer.phar -composer.lock - -.phpunit.result.cache \ No newline at end of file diff --git a/vendor/mnapoli/front-yaml/LICENSE b/vendor/mnapoli/front-yaml/LICENSE deleted file mode 100644 index 472effa5a..000000000 --- a/vendor/mnapoli/front-yaml/LICENSE +++ /dev/null @@ -1,18 +0,0 @@ -FrontYAML - -Copyright (C) 2014 Matthieu Napoli - -Permission is hereby granted, free of charge, to any person obtaining a copy of this software and -associated documentation files (the "Software"), to deal in the Software without restriction, -including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, -and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, -subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all copies or substantial -portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT -NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. -IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, -WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE -SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/vendor/mnapoli/front-yaml/README.md b/vendor/mnapoli/front-yaml/README.md deleted file mode 100644 index aaee30788..000000000 --- a/vendor/mnapoli/front-yaml/README.md +++ /dev/null @@ -1,86 +0,0 @@ -# FrontYAML - -An implementation of YAML Front matter for PHP. Can parse the YAML *and* the Markdown. - -[![Build Status](https://travis-ci.org/mnapoli/FrontYAML.png?branch=master)](https://travis-ci.org/mnapoli/FrontYAML) -[![Total Downloads](https://poser.pugx.org/mnapoli/front-yaml/downloads.svg)](https://packagist.org/packages/mnapoli/front-yaml) - -## Installation - -Require the project with Composer: - -``` -composer require mnapoli/front-yaml -``` - -## Usage - -```php -$parser = new Mni\FrontYAML\Parser(); - -$document = $parser->parse($str); - -$yaml = $document->getYAML(); -$html = $document->getContent(); -``` - -If you don't want the Markdown to be parsed (maybe because it is not Markdown): - -```php -$document = $parser->parse($str, false); -``` - -## Example - -The following file: - -```markdown ---- -foo: bar ---- -This is **strong**. -``` - -Will give: - -```php -var_export($document->getYAML()); -// array("foo" => "bar") - -var_export($document->getContent()); -// "

    This is strong

    " -``` - -## YAML and Markdown parsers - -```php -$parser = new Mni\FrontYAML\Parser($yamlParser, $markdownParser); -``` - -This library uses dependency injection and abstraction to allow you to provide your own YAML or Markdown parser. - -```php -interface YAMLParser -{ - public function parse($yaml); -} -``` - -FrontYAML uses by default [Symfony's YAML parser](http://symfony.com/doc/current/components/yaml/introduction.html). - -```php -interface MarkdownParser -{ - public function parse($markdown); -} -``` - -FrontYAML uses by default [Parsedown Markdown parser](http://parsedown.org/). - -An adapter to [League CommonMark](https://github.com/thephpleague/commonmark) is also included (you need to require the `league/commonmark` though): - -```php -use \Mni\FrontYAML\Bridge\CommonMark\CommonMarkParser; - -$parser = new Mni\FrontYAML\Parser(null, new CommonMarkParser()); -``` diff --git a/vendor/mnapoli/front-yaml/composer.json b/vendor/mnapoli/front-yaml/composer.json deleted file mode 100644 index 05fa5de82..000000000 --- a/vendor/mnapoli/front-yaml/composer.json +++ /dev/null @@ -1,23 +0,0 @@ -{ - "name": "mnapoli/front-yaml", - "license": "MIT", - "autoload": { - "psr-4": { - "Mni\\FrontYAML\\": "src/" - } - }, - "autoload-dev": { - "psr-4": { - "Mni\\FrontYAML\\Test\\": "tests/" - } - }, - "require": { - "php": ">=7.3", - "symfony/yaml": "~2.1|^3.0|^4.0|^5.0", - "erusev/parsedown": "~1.0" - }, - "require-dev": { - "phpunit/phpunit": "^9.4", - "league/commonmark": "~1.4" - } -} diff --git a/vendor/mnapoli/front-yaml/phpunit.xml.dist b/vendor/mnapoli/front-yaml/phpunit.xml.dist deleted file mode 100644 index 93a96e8a0..000000000 --- a/vendor/mnapoli/front-yaml/phpunit.xml.dist +++ /dev/null @@ -1,21 +0,0 @@ - - - - - - - ./tests/ - - - - diff --git a/vendor/mnapoli/front-yaml/src/Bridge/CommonMark/CommonMarkParser.php b/vendor/mnapoli/front-yaml/src/Bridge/CommonMark/CommonMarkParser.php deleted file mode 100644 index b4c7c3c76..000000000 --- a/vendor/mnapoli/front-yaml/src/Bridge/CommonMark/CommonMarkParser.php +++ /dev/null @@ -1,33 +0,0 @@ - - */ -class CommonMarkParser implements MarkdownParser -{ - public function __construct(CommonMarkConverter $commonMarkConverter = null) - { - $this->parser = $commonMarkConverter ?: new CommonMarkConverter(); - } - - /** - * {@inheritdoc} - */ - public function parse($markdown) - { - return $this->parser->convertToHtml($markdown); - } -} diff --git a/vendor/mnapoli/front-yaml/src/Bridge/Parsedown/ParsedownParser.php b/vendor/mnapoli/front-yaml/src/Bridge/Parsedown/ParsedownParser.php deleted file mode 100644 index 9f9ff2d3c..000000000 --- a/vendor/mnapoli/front-yaml/src/Bridge/Parsedown/ParsedownParser.php +++ /dev/null @@ -1,33 +0,0 @@ - - */ -class ParsedownParser implements MarkdownParser -{ - public function __construct(Parsedown $parsedown = null) - { - $this->parser = $parsedown ?: new Parsedown(); - } - - /** - * {@inheritdoc} - */ - public function parse($markdown) - { - return $this->parser->parse($markdown); - } -} diff --git a/vendor/mnapoli/front-yaml/src/Bridge/Symfony/SymfonyYAMLParser.php b/vendor/mnapoli/front-yaml/src/Bridge/Symfony/SymfonyYAMLParser.php deleted file mode 100644 index ce1c7268d..000000000 --- a/vendor/mnapoli/front-yaml/src/Bridge/Symfony/SymfonyYAMLParser.php +++ /dev/null @@ -1,38 +0,0 @@ - - */ -class SymfonyYAMLParser implements YAMLParser -{ - /** - * @var Parser - */ - private $parser; - - public function __construct() - { - $this->parser = new Parser(); - } - - /** - * {@inheritdoc} - */ - public function parse($yaml) - { - return $this->parser->parse($yaml); - } -} diff --git a/vendor/mnapoli/front-yaml/src/Document.php b/vendor/mnapoli/front-yaml/src/Document.php deleted file mode 100644 index 9fdf5a0c3..000000000 --- a/vendor/mnapoli/front-yaml/src/Document.php +++ /dev/null @@ -1,53 +0,0 @@ - - */ -class Document -{ - /** - * @var mixed - */ - private $yaml; - - /** - * @var string - */ - private $content; - - /** - * @param mixed $yaml YAML content. - * @param string $content Content of the document. - */ - public function __construct($yaml, $content) - { - $this->yaml = $yaml; - $this->content = $content; - } - - /** - * @return mixed YAML content. - */ - public function getYAML() - { - return $this->yaml; - } - - /** - * @return string Content of the document. - */ - public function getContent() - { - return $this->content; - } -} diff --git a/vendor/mnapoli/front-yaml/src/Markdown/MarkdownParser.php b/vendor/mnapoli/front-yaml/src/Markdown/MarkdownParser.php deleted file mode 100644 index 1e3c1c2d0..000000000 --- a/vendor/mnapoli/front-yaml/src/Markdown/MarkdownParser.php +++ /dev/null @@ -1,26 +0,0 @@ - - */ -interface MarkdownParser -{ - /** - * Parses a Markdown string to HTML. - * - * @param string $markdown Markdown document. - * - * @return string HTML document. - */ - public function parse($markdown); -} diff --git a/vendor/mnapoli/front-yaml/src/Parser.php b/vendor/mnapoli/front-yaml/src/Parser.php deleted file mode 100644 index 3a2c6738a..000000000 --- a/vendor/mnapoli/front-yaml/src/Parser.php +++ /dev/null @@ -1,84 +0,0 @@ - - */ -class Parser -{ - /** - * @var YAMLParser - */ - private $yamlParser; - - /** - * @var MarkdownParser - */ - private $markdownParser; - - /** - * @var array - */ - private $startSep; - - /** - * @var array - */ - private $endSep; - - public function __construct( - YAMLParser $yamlParser = null, - MarkdownParser $markdownParser = null, - $startSep = '---', - $endSep = '---' - ) { - $this->yamlParser = $yamlParser ?: new SymfonyYAMLParser(); - $this->markdownParser = $markdownParser ?: new ParsedownParser(); - $this->startSep = array_filter((array) $startSep, 'is_string') ?: array('---'); - $this->endSep = array_filter((array) $endSep, 'is_string') ?: array('---'); - } - - /** - * Parse a string containing the YAML front matter and the markdown. - * - * @param string $str - * @param bool $parseMarkdown Should the Markdown be turned into HTML? - * - * @return Document - */ - public function parse($str, $parseMarkdown = true) - { - $yaml = null; - - $quote = function ($str) { - return preg_quote($str, "~"); - }; - - $regex = '~^(' - .implode('|', array_map($quote, $this->startSep)) # $matches[1] start separator - ."){1}[\r\n|\n]*(.*?)[\r\n|\n]+(" # $matches[2] between separators - .implode('|', array_map($quote, $this->endSep)) # $matches[3] end separator - ."){1}[\r\n|\n]*(.*)$~s"; # $matches[4] document content - - if (preg_match($regex, $str, $matches) === 1) { // There is a Front matter - $yaml = trim($matches[2]) !== '' ? $this->yamlParser->parse(trim($matches[2])) : null; - $str = ltrim($matches[4]); - } - - return new Document($yaml, $parseMarkdown ? $this->markdownParser->parse($str) : $str); - } -} diff --git a/vendor/mnapoli/front-yaml/src/YAML/YAMLParser.php b/vendor/mnapoli/front-yaml/src/YAML/YAMLParser.php deleted file mode 100644 index 49df86b66..000000000 --- a/vendor/mnapoli/front-yaml/src/YAML/YAMLParser.php +++ /dev/null @@ -1,26 +0,0 @@ - - */ -interface YAMLParser -{ - /** - * Parses a YAML string. - * - * @param string $yaml - * - * @return mixed - */ - public function parse($yaml); -} diff --git a/vendor/symfony/deprecation-contracts/.gitignore b/vendor/symfony/deprecation-contracts/.gitignore deleted file mode 100644 index c49a5d8df..000000000 --- a/vendor/symfony/deprecation-contracts/.gitignore +++ /dev/null @@ -1,3 +0,0 @@ -vendor/ -composer.lock -phpunit.xml diff --git a/vendor/symfony/deprecation-contracts/CHANGELOG.md b/vendor/symfony/deprecation-contracts/CHANGELOG.md deleted file mode 100644 index e9847779b..000000000 --- a/vendor/symfony/deprecation-contracts/CHANGELOG.md +++ /dev/null @@ -1,5 +0,0 @@ -CHANGELOG -========= - -The changelog is maintained for all Symfony contracts at the following URL: -https://github.com/symfony/contracts/blob/master/CHANGELOG.md diff --git a/vendor/symfony/deprecation-contracts/LICENSE b/vendor/symfony/deprecation-contracts/LICENSE deleted file mode 100644 index 5593b1d84..000000000 --- a/vendor/symfony/deprecation-contracts/LICENSE +++ /dev/null @@ -1,19 +0,0 @@ -Copyright (c) 2020 Fabien Potencier - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is furnished -to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -THE SOFTWARE. diff --git a/vendor/symfony/deprecation-contracts/README.md b/vendor/symfony/deprecation-contracts/README.md deleted file mode 100644 index 4957933a6..000000000 --- a/vendor/symfony/deprecation-contracts/README.md +++ /dev/null @@ -1,26 +0,0 @@ -Symfony Deprecation Contracts -============================= - -A generic function and convention to trigger deprecation notices. - -This package provides a single global function named `trigger_deprecation()` that triggers silenced deprecation notices. - -By using a custom PHP error handler such as the one provided by the Symfony ErrorHandler component, -the triggered deprecations can be caught and logged for later discovery, both on dev and prod environments. - -The function requires at least 3 arguments: - - the name of the Composer package that is triggering the deprecation - - the version of the package that introduced the deprecation - - the message of the deprecation - - more arguments can be provided: they will be inserted in the message using `printf()` formatting - -Example: -```php -trigger_deprecation('symfony/blockchain', '8.9', 'Using "%s" is deprecated, use "%s" instead.', 'bitcoin', 'fabcoin'); -``` - -This will generate the following message: -`Since symfony/blockchain 8.9: Using "bitcoin" is deprecated, use "fabcoin" instead.` - -While not necessarily recommended, the deprecation notices can be completely ignored by declaring an empty -`function trigger_deprecation() {}` in your application. diff --git a/vendor/symfony/deprecation-contracts/composer.json b/vendor/symfony/deprecation-contracts/composer.json deleted file mode 100644 index 052541cce..000000000 --- a/vendor/symfony/deprecation-contracts/composer.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "name": "symfony/deprecation-contracts", - "type": "library", - "description": "A generic function and convention to trigger deprecation notices", - "homepage": "https://symfony.com", - "license": "MIT", - "authors": [ - { - "name": "Nicolas Grekas", - "email": "p@tchwork.com" - }, - { - "name": "Symfony Community", - "homepage": "https://symfony.com/contributors" - } - ], - "require": { - "php": ">=7.1" - }, - "autoload": { - "files": [ - "function.php" - ] - }, - "minimum-stability": "dev", - "extra": { - "branch-alias": { - "dev-master": "2.2-dev" - }, - "thanks": { - "name": "symfony/contracts", - "url": "https://github.com/symfony/contracts" - } - } -} diff --git a/vendor/symfony/deprecation-contracts/function.php b/vendor/symfony/deprecation-contracts/function.php deleted file mode 100644 index d4371504a..000000000 --- a/vendor/symfony/deprecation-contracts/function.php +++ /dev/null @@ -1,27 +0,0 @@ - - * - * For the full copyright and license information, please view the LICENSE - * file that was distributed with this source code. - */ - -if (!function_exists('trigger_deprecation')) { - /** - * Triggers a silenced deprecation notice. - * - * @param string $package The name of the Composer package that is triggering the deprecation - * @param string $version The version of the package that introduced the deprecation - * @param string $message The message of the deprecation - * @param mixed ...$args Values to insert in the message using printf() formatting - * - * @author Nicolas Grekas - */ - function trigger_deprecation(string $package, string $version, string $message, ...$args): void - { - @trigger_error(($package || $version ? "Since $package $version: " : '').($args ? vsprintf($message, $args) : $message), \E_USER_DEPRECATED); - } -} diff --git a/vendor/symfony/polyfill-ctype/Ctype.php b/vendor/symfony/polyfill-ctype/Ctype.php deleted file mode 100644 index 58414dc73..000000000 --- a/vendor/symfony/polyfill-ctype/Ctype.php +++ /dev/null @@ -1,227 +0,0 @@ - - * - * For the full copyright and license information, please view the LICENSE - * file that was distributed with this source code. - */ - -namespace Symfony\Polyfill\Ctype; - -/** - * Ctype implementation through regex. - * - * @internal - * - * @author Gert de Pagter - */ -final class Ctype -{ - /** - * Returns TRUE if every character in text is either a letter or a digit, FALSE otherwise. - * - * @see https://php.net/ctype-alnum - * - * @param string|int $text - * - * @return bool - */ - public static function ctype_alnum($text) - { - $text = self::convert_int_to_char_for_ctype($text); - - return \is_string($text) && '' !== $text && !preg_match('/[^A-Za-z0-9]/', $text); - } - - /** - * Returns TRUE if every character in text is a letter, FALSE otherwise. - * - * @see https://php.net/ctype-alpha - * - * @param string|int $text - * - * @return bool - */ - public static function ctype_alpha($text) - { - $text = self::convert_int_to_char_for_ctype($text); - - return \is_string($text) && '' !== $text && !preg_match('/[^A-Za-z]/', $text); - } - - /** - * Returns TRUE if every character in text is a control character from the current locale, FALSE otherwise. - * - * @see https://php.net/ctype-cntrl - * - * @param string|int $text - * - * @return bool - */ - public static function ctype_cntrl($text) - { - $text = self::convert_int_to_char_for_ctype($text); - - return \is_string($text) && '' !== $text && !preg_match('/[^\x00-\x1f\x7f]/', $text); - } - - /** - * Returns TRUE if every character in the string text is a decimal digit, FALSE otherwise. - * - * @see https://php.net/ctype-digit - * - * @param string|int $text - * - * @return bool - */ - public static function ctype_digit($text) - { - $text = self::convert_int_to_char_for_ctype($text); - - return \is_string($text) && '' !== $text && !preg_match('/[^0-9]/', $text); - } - - /** - * Returns TRUE if every character in text is printable and actually creates visible output (no white space), FALSE otherwise. - * - * @see https://php.net/ctype-graph - * - * @param string|int $text - * - * @return bool - */ - public static function ctype_graph($text) - { - $text = self::convert_int_to_char_for_ctype($text); - - return \is_string($text) && '' !== $text && !preg_match('/[^!-~]/', $text); - } - - /** - * Returns TRUE if every character in text is a lowercase letter. - * - * @see https://php.net/ctype-lower - * - * @param string|int $text - * - * @return bool - */ - public static function ctype_lower($text) - { - $text = self::convert_int_to_char_for_ctype($text); - - return \is_string($text) && '' !== $text && !preg_match('/[^a-z]/', $text); - } - - /** - * Returns TRUE if every character in text will actually create output (including blanks). Returns FALSE if text contains control characters or characters that do not have any output or control function at all. - * - * @see https://php.net/ctype-print - * - * @param string|int $text - * - * @return bool - */ - public static function ctype_print($text) - { - $text = self::convert_int_to_char_for_ctype($text); - - return \is_string($text) && '' !== $text && !preg_match('/[^ -~]/', $text); - } - - /** - * Returns TRUE if every character in text is printable, but neither letter, digit or blank, FALSE otherwise. - * - * @see https://php.net/ctype-punct - * - * @param string|int $text - * - * @return bool - */ - public static function ctype_punct($text) - { - $text = self::convert_int_to_char_for_ctype($text); - - return \is_string($text) && '' !== $text && !preg_match('/[^!-\/\:-@\[-`\{-~]/', $text); - } - - /** - * Returns TRUE if every character in text creates some sort of white space, FALSE otherwise. Besides the blank character this also includes tab, vertical tab, line feed, carriage return and form feed characters. - * - * @see https://php.net/ctype-space - * - * @param string|int $text - * - * @return bool - */ - public static function ctype_space($text) - { - $text = self::convert_int_to_char_for_ctype($text); - - return \is_string($text) && '' !== $text && !preg_match('/[^\s]/', $text); - } - - /** - * Returns TRUE if every character in text is an uppercase letter. - * - * @see https://php.net/ctype-upper - * - * @param string|int $text - * - * @return bool - */ - public static function ctype_upper($text) - { - $text = self::convert_int_to_char_for_ctype($text); - - return \is_string($text) && '' !== $text && !preg_match('/[^A-Z]/', $text); - } - - /** - * Returns TRUE if every character in text is a hexadecimal 'digit', that is a decimal digit or a character from [A-Fa-f] , FALSE otherwise. - * - * @see https://php.net/ctype-xdigit - * - * @param string|int $text - * - * @return bool - */ - public static function ctype_xdigit($text) - { - $text = self::convert_int_to_char_for_ctype($text); - - return \is_string($text) && '' !== $text && !preg_match('/[^A-Fa-f0-9]/', $text); - } - - /** - * Converts integers to their char versions according to normal ctype behaviour, if needed. - * - * If an integer between -128 and 255 inclusive is provided, - * it is interpreted as the ASCII value of a single character - * (negative values have 256 added in order to allow characters in the Extended ASCII range). - * Any other integer is interpreted as a string containing the decimal digits of the integer. - * - * @param string|int $int - * - * @return mixed - */ - private static function convert_int_to_char_for_ctype($int) - { - if (!\is_int($int)) { - return $int; - } - - if ($int < -128 || $int > 255) { - return (string) $int; - } - - if ($int < 0) { - $int += 256; - } - - return \chr($int); - } -} diff --git a/vendor/symfony/polyfill-ctype/LICENSE b/vendor/symfony/polyfill-ctype/LICENSE deleted file mode 100644 index 3f853aaf3..000000000 --- a/vendor/symfony/polyfill-ctype/LICENSE +++ /dev/null @@ -1,19 +0,0 @@ -Copyright (c) 2018-2019 Fabien Potencier - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is furnished -to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -THE SOFTWARE. diff --git a/vendor/symfony/polyfill-ctype/README.md b/vendor/symfony/polyfill-ctype/README.md deleted file mode 100644 index 8add1ab00..000000000 --- a/vendor/symfony/polyfill-ctype/README.md +++ /dev/null @@ -1,12 +0,0 @@ -Symfony Polyfill / Ctype -======================== - -This component provides `ctype_*` functions to users who run php versions without the ctype extension. - -More information can be found in the -[main Polyfill README](https://github.com/symfony/polyfill/blob/master/README.md). - -License -======= - -This library is released under the [MIT license](LICENSE). diff --git a/vendor/symfony/polyfill-ctype/bootstrap.php b/vendor/symfony/polyfill-ctype/bootstrap.php deleted file mode 100644 index d54524b31..000000000 --- a/vendor/symfony/polyfill-ctype/bootstrap.php +++ /dev/null @@ -1,50 +0,0 @@ - - * - * For the full copyright and license information, please view the LICENSE - * file that was distributed with this source code. - */ - -use Symfony\Polyfill\Ctype as p; - -if (\PHP_VERSION_ID >= 80000) { - return require __DIR__.'/bootstrap80.php'; -} - -if (!function_exists('ctype_alnum')) { - function ctype_alnum($text) { return p\Ctype::ctype_alnum($text); } -} -if (!function_exists('ctype_alpha')) { - function ctype_alpha($text) { return p\Ctype::ctype_alpha($text); } -} -if (!function_exists('ctype_cntrl')) { - function ctype_cntrl($text) { return p\Ctype::ctype_cntrl($text); } -} -if (!function_exists('ctype_digit')) { - function ctype_digit($text) { return p\Ctype::ctype_digit($text); } -} -if (!function_exists('ctype_graph')) { - function ctype_graph($text) { return p\Ctype::ctype_graph($text); } -} -if (!function_exists('ctype_lower')) { - function ctype_lower($text) { return p\Ctype::ctype_lower($text); } -} -if (!function_exists('ctype_print')) { - function ctype_print($text) { return p\Ctype::ctype_print($text); } -} -if (!function_exists('ctype_punct')) { - function ctype_punct($text) { return p\Ctype::ctype_punct($text); } -} -if (!function_exists('ctype_space')) { - function ctype_space($text) { return p\Ctype::ctype_space($text); } -} -if (!function_exists('ctype_upper')) { - function ctype_upper($text) { return p\Ctype::ctype_upper($text); } -} -if (!function_exists('ctype_xdigit')) { - function ctype_xdigit($text) { return p\Ctype::ctype_xdigit($text); } -} diff --git a/vendor/symfony/polyfill-ctype/bootstrap80.php b/vendor/symfony/polyfill-ctype/bootstrap80.php deleted file mode 100644 index ab2f8611d..000000000 --- a/vendor/symfony/polyfill-ctype/bootstrap80.php +++ /dev/null @@ -1,46 +0,0 @@ - - * - * For the full copyright and license information, please view the LICENSE - * file that was distributed with this source code. - */ - -use Symfony\Polyfill\Ctype as p; - -if (!function_exists('ctype_alnum')) { - function ctype_alnum(mixed $text): bool { return p\Ctype::ctype_alnum($text); } -} -if (!function_exists('ctype_alpha')) { - function ctype_alpha(mixed $text): bool { return p\Ctype::ctype_alpha($text); } -} -if (!function_exists('ctype_cntrl')) { - function ctype_cntrl(mixed $text): bool { return p\Ctype::ctype_cntrl($text); } -} -if (!function_exists('ctype_digit')) { - function ctype_digit(mixed $text): bool { return p\Ctype::ctype_digit($text); } -} -if (!function_exists('ctype_graph')) { - function ctype_graph(mixed $text): bool { return p\Ctype::ctype_graph($text); } -} -if (!function_exists('ctype_lower')) { - function ctype_lower(mixed $text): bool { return p\Ctype::ctype_lower($text); } -} -if (!function_exists('ctype_print')) { - function ctype_print(mixed $text): bool { return p\Ctype::ctype_print($text); } -} -if (!function_exists('ctype_punct')) { - function ctype_punct(mixed $text): bool { return p\Ctype::ctype_punct($text); } -} -if (!function_exists('ctype_space')) { - function ctype_space(mixed $text): bool { return p\Ctype::ctype_space($text); } -} -if (!function_exists('ctype_upper')) { - function ctype_upper(mixed $text): bool { return p\Ctype::ctype_upper($text); } -} -if (!function_exists('ctype_xdigit')) { - function ctype_xdigit(mixed $text): bool { return p\Ctype::ctype_xdigit($text); } -} diff --git a/vendor/symfony/polyfill-ctype/composer.json b/vendor/symfony/polyfill-ctype/composer.json deleted file mode 100644 index 995978c0a..000000000 --- a/vendor/symfony/polyfill-ctype/composer.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "name": "symfony/polyfill-ctype", - "type": "library", - "description": "Symfony polyfill for ctype functions", - "keywords": ["polyfill", "compatibility", "portable", "ctype"], - "homepage": "https://symfony.com", - "license": "MIT", - "authors": [ - { - "name": "Gert de Pagter", - "email": "BackEndTea@gmail.com" - }, - { - "name": "Symfony Community", - "homepage": "https://symfony.com/contributors" - } - ], - "require": { - "php": ">=7.1" - }, - "autoload": { - "psr-4": { "Symfony\\Polyfill\\Ctype\\": "" }, - "files": [ "bootstrap.php" ] - }, - "suggest": { - "ext-ctype": "For best performance" - }, - "minimum-stability": "dev", - "extra": { - "branch-alias": { - "dev-main": "1.22-dev" - }, - "thanks": { - "name": "symfony/polyfill", - "url": "https://github.com/symfony/polyfill" - } - } -} diff --git a/vendor/symfony/yaml/CHANGELOG.md b/vendor/symfony/yaml/CHANGELOG.md deleted file mode 100644 index d4f2b5d78..000000000 --- a/vendor/symfony/yaml/CHANGELOG.md +++ /dev/null @@ -1,224 +0,0 @@ -CHANGELOG -========= - -5.1.0 ------ - - * Added support for parsing numbers prefixed with `0o` as octal numbers. - * Deprecated support for parsing numbers starting with `0` as octal numbers. They will be parsed as strings as of Symfony 6.0. Prefix numbers with `0o` - so that they are parsed as octal numbers. - - Before: - - ```yaml - Yaml::parse('072'); - ``` - - After: - - ```yaml - Yaml::parse('0o72'); - ``` - - * Added `yaml-lint` binary. - * Deprecated using the `!php/object` and `!php/const` tags without a value. - -5.0.0 ------ - - * Removed support for mappings inside multi-line strings. - * removed support for implicit STDIN usage in the `lint:yaml` command, use `lint:yaml -` (append a dash) instead to make it explicit. - -4.4.0 ------ - - * Added support for parsing the inline notation spanning multiple lines. - * Added support to dump `null` as `~` by using the `Yaml::DUMP_NULL_AS_TILDE` flag. - * deprecated accepting STDIN implicitly when using the `lint:yaml` command, use `lint:yaml -` (append a dash) instead to make it explicit. - -4.3.0 ------ - - * Using a mapping inside a multi-line string is deprecated and will throw a `ParseException` in 5.0. - -4.2.0 ------ - - * added support for multiple files or directories in `LintCommand` - -4.0.0 ------ - - * The behavior of the non-specific tag `!` is changed and now forces - non-evaluating your values. - * complex mappings will throw a `ParseException` - * support for the comma as a group separator for floats has been dropped, use - the underscore instead - * support for the `!!php/object` tag has been dropped, use the `!php/object` - tag instead - * duplicate mapping keys throw a `ParseException` - * non-string mapping keys throw a `ParseException`, use the `Yaml::PARSE_KEYS_AS_STRINGS` - flag to cast them to strings - * `%` at the beginning of an unquoted string throw a `ParseException` - * mappings with a colon (`:`) that is not followed by a whitespace throw a - `ParseException` - * the `Dumper::setIndentation()` method has been removed - * being able to pass boolean options to the `Yaml::parse()`, `Yaml::dump()`, - `Parser::parse()`, and `Dumper::dump()` methods to configure the behavior of - the parser and dumper is no longer supported, pass bitmask flags instead - * the constructor arguments of the `Parser` class have been removed - * the `Inline` class is internal and no longer part of the BC promise - * removed support for the `!str` tag, use the `!!str` tag instead - * added support for tagged scalars. - - ```yml - Yaml::parse('!foo bar', Yaml::PARSE_CUSTOM_TAGS); - // returns TaggedValue('foo', 'bar'); - ``` - -3.4.0 ------ - - * added support for parsing YAML files using the `Yaml::parseFile()` or `Parser::parseFile()` method - - * the `Dumper`, `Parser`, and `Yaml` classes are marked as final - - * Deprecated the `!php/object:` tag which will be replaced by the - `!php/object` tag (without the colon) in 4.0. - - * Deprecated the `!php/const:` tag which will be replaced by the - `!php/const` tag (without the colon) in 4.0. - - * Support for the `!str` tag is deprecated, use the `!!str` tag instead. - - * Deprecated using the non-specific tag `!` as its behavior will change in 4.0. - It will force non-evaluating your values in 4.0. Use plain integers or `!!float` instead. - -3.3.0 ------ - - * Starting an unquoted string with a question mark followed by a space is - deprecated and will throw a `ParseException` in Symfony 4.0. - - * Deprecated support for implicitly parsing non-string mapping keys as strings. - Mapping keys that are no strings will lead to a `ParseException` in Symfony - 4.0. Use quotes to opt-in for keys to be parsed as strings. - - Before: - - ```php - $yaml = << new A(), 'bar' => 1], 0, 0, Yaml::DUMP_EXCEPTION_ON_INVALID_TYPE | Yaml::DUMP_OBJECT); - ``` - -3.0.0 ------ - - * Yaml::parse() now throws an exception when a blackslash is not escaped - in double-quoted strings - -2.8.0 ------ - - * Deprecated usage of a colon in an unquoted mapping value - * Deprecated usage of @, \`, | and > at the beginning of an unquoted string - * When surrounding strings with double-quotes, you must now escape `\` characters. Not - escaping those characters (when surrounded by double-quotes) is deprecated. - - Before: - - ```yml - class: "Foo\Var" - ``` - - After: - - ```yml - class: "Foo\\Var" - ``` - -2.1.0 ------ - - * Yaml::parse() does not evaluate loaded files as PHP files by default - anymore (call Yaml::enablePhpParsing() to get back the old behavior) diff --git a/vendor/symfony/yaml/Command/LintCommand.php b/vendor/symfony/yaml/Command/LintCommand.php deleted file mode 100644 index 83f36a938..000000000 --- a/vendor/symfony/yaml/Command/LintCommand.php +++ /dev/null @@ -1,248 +0,0 @@ - - * - * For the full copyright and license information, please view the LICENSE - * file that was distributed with this source code. - */ - -namespace Symfony\Component\Yaml\Command; - -use Symfony\Component\Console\Command\Command; -use Symfony\Component\Console\Exception\InvalidArgumentException; -use Symfony\Component\Console\Exception\RuntimeException; -use Symfony\Component\Console\Input\InputArgument; -use Symfony\Component\Console\Input\InputInterface; -use Symfony\Component\Console\Input\InputOption; -use Symfony\Component\Console\Output\OutputInterface; -use Symfony\Component\Console\Style\SymfonyStyle; -use Symfony\Component\Yaml\Exception\ParseException; -use Symfony\Component\Yaml\Parser; -use Symfony\Component\Yaml\Yaml; - -/** - * Validates YAML files syntax and outputs encountered errors. - * - * @author Grégoire Pineau - * @author Robin Chalas - */ -class LintCommand extends Command -{ - protected static $defaultName = 'lint:yaml'; - - private $parser; - private $format; - private $displayCorrectFiles; - private $directoryIteratorProvider; - private $isReadableProvider; - - public function __construct(string $name = null, callable $directoryIteratorProvider = null, callable $isReadableProvider = null) - { - parent::__construct($name); - - $this->directoryIteratorProvider = $directoryIteratorProvider; - $this->isReadableProvider = $isReadableProvider; - } - - /** - * {@inheritdoc} - */ - protected function configure() - { - $this - ->setDescription('Lints a file and outputs encountered errors') - ->addArgument('filename', InputArgument::IS_ARRAY, 'A file, a directory or "-" for reading from STDIN') - ->addOption('format', null, InputOption::VALUE_REQUIRED, 'The output format', 'txt') - ->addOption('parse-tags', null, InputOption::VALUE_NONE, 'Parse custom tags') - ->setHelp(<<%command.name% command lints a YAML file and outputs to STDOUT -the first encountered syntax error. - -You can validates YAML contents passed from STDIN: - - cat filename | php %command.full_name% - - -You can also validate the syntax of a file: - - php %command.full_name% filename - -Or of a whole directory: - - php %command.full_name% dirname - php %command.full_name% dirname --format=json - -EOF - ) - ; - } - - protected function execute(InputInterface $input, OutputInterface $output) - { - $io = new SymfonyStyle($input, $output); - $filenames = (array) $input->getArgument('filename'); - $this->format = $input->getOption('format'); - $this->displayCorrectFiles = $output->isVerbose(); - $flags = $input->getOption('parse-tags') ? Yaml::PARSE_CUSTOM_TAGS : 0; - - if (['-'] === $filenames) { - return $this->display($io, [$this->validate(file_get_contents('php://stdin'), $flags)]); - } - - if (!$filenames) { - throw new RuntimeException('Please provide a filename or pipe file content to STDIN.'); - } - - $filesInfo = []; - foreach ($filenames as $filename) { - if (!$this->isReadable($filename)) { - throw new RuntimeException(sprintf('File or directory "%s" is not readable.', $filename)); - } - - foreach ($this->getFiles($filename) as $file) { - $filesInfo[] = $this->validate(file_get_contents($file), $flags, $file); - } - } - - return $this->display($io, $filesInfo); - } - - private function validate(string $content, int $flags, string $file = null) - { - $prevErrorHandler = set_error_handler(function ($level, $message, $file, $line) use (&$prevErrorHandler) { - if (\E_USER_DEPRECATED === $level) { - throw new ParseException($message, $this->getParser()->getRealCurrentLineNb() + 1); - } - - return $prevErrorHandler ? $prevErrorHandler($level, $message, $file, $line) : false; - }); - - try { - $this->getParser()->parse($content, Yaml::PARSE_CONSTANT | $flags); - } catch (ParseException $e) { - return ['file' => $file, 'line' => $e->getParsedLine(), 'valid' => false, 'message' => $e->getMessage()]; - } finally { - restore_error_handler(); - } - - return ['file' => $file, 'valid' => true]; - } - - private function display(SymfonyStyle $io, array $files): int - { - switch ($this->format) { - case 'txt': - return $this->displayTxt($io, $files); - case 'json': - return $this->displayJson($io, $files); - default: - throw new InvalidArgumentException(sprintf('The format "%s" is not supported.', $this->format)); - } - } - - private function displayTxt(SymfonyStyle $io, array $filesInfo): int - { - $countFiles = \count($filesInfo); - $erroredFiles = 0; - $suggestTagOption = false; - - foreach ($filesInfo as $info) { - if ($info['valid'] && $this->displayCorrectFiles) { - $io->comment('OK'.($info['file'] ? sprintf(' in %s', $info['file']) : '')); - } elseif (!$info['valid']) { - ++$erroredFiles; - $io->text(' ERROR '.($info['file'] ? sprintf(' in %s', $info['file']) : '')); - $io->text(sprintf(' >> %s', $info['message'])); - - if (false !== strpos($info['message'], 'PARSE_CUSTOM_TAGS')) { - $suggestTagOption = true; - } - } - } - - if (0 === $erroredFiles) { - $io->success(sprintf('All %d YAML files contain valid syntax.', $countFiles)); - } else { - $io->warning(sprintf('%d YAML files have valid syntax and %d contain errors.%s', $countFiles - $erroredFiles, $erroredFiles, $suggestTagOption ? ' Use the --parse-tags option if you want parse custom tags.' : '')); - } - - return min($erroredFiles, 1); - } - - private function displayJson(SymfonyStyle $io, array $filesInfo): int - { - $errors = 0; - - array_walk($filesInfo, function (&$v) use (&$errors) { - $v['file'] = (string) $v['file']; - if (!$v['valid']) { - ++$errors; - } - - if (isset($v['message']) && false !== strpos($v['message'], 'PARSE_CUSTOM_TAGS')) { - $v['message'] .= ' Use the --parse-tags option if you want parse custom tags.'; - } - }); - - $io->writeln(json_encode($filesInfo, \JSON_PRETTY_PRINT | \JSON_UNESCAPED_SLASHES)); - - return min($errors, 1); - } - - private function getFiles(string $fileOrDirectory): iterable - { - if (is_file($fileOrDirectory)) { - yield new \SplFileInfo($fileOrDirectory); - - return; - } - - foreach ($this->getDirectoryIterator($fileOrDirectory) as $file) { - if (!\in_array($file->getExtension(), ['yml', 'yaml'])) { - continue; - } - - yield $file; - } - } - - private function getParser(): Parser - { - if (!$this->parser) { - $this->parser = new Parser(); - } - - return $this->parser; - } - - private function getDirectoryIterator(string $directory): iterable - { - $default = function ($directory) { - return new \RecursiveIteratorIterator( - new \RecursiveDirectoryIterator($directory, \FilesystemIterator::SKIP_DOTS | \FilesystemIterator::FOLLOW_SYMLINKS), - \RecursiveIteratorIterator::LEAVES_ONLY - ); - }; - - if (null !== $this->directoryIteratorProvider) { - return ($this->directoryIteratorProvider)($directory, $default); - } - - return $default($directory); - } - - private function isReadable(string $fileOrDirectory): bool - { - $default = function ($fileOrDirectory) { - return is_readable($fileOrDirectory); - }; - - if (null !== $this->isReadableProvider) { - return ($this->isReadableProvider)($fileOrDirectory, $default); - } - - return $default($fileOrDirectory); - } -} diff --git a/vendor/symfony/yaml/Dumper.php b/vendor/symfony/yaml/Dumper.php deleted file mode 100644 index dcb104ccf..000000000 --- a/vendor/symfony/yaml/Dumper.php +++ /dev/null @@ -1,142 +0,0 @@ - - * - * For the full copyright and license information, please view the LICENSE - * file that was distributed with this source code. - */ - -namespace Symfony\Component\Yaml; - -use Symfony\Component\Yaml\Tag\TaggedValue; - -/** - * Dumper dumps PHP variables to YAML strings. - * - * @author Fabien Potencier - * - * @final - */ -class Dumper -{ - /** - * The amount of spaces to use for indentation of nested nodes. - * - * @var int - */ - protected $indentation; - - public function __construct(int $indentation = 4) - { - if ($indentation < 1) { - throw new \InvalidArgumentException('The indentation must be greater than zero.'); - } - - $this->indentation = $indentation; - } - - /** - * Dumps a PHP value to YAML. - * - * @param mixed $input The PHP value - * @param int $inline The level where you switch to inline YAML - * @param int $indent The level of indentation (used internally) - * @param int $flags A bit field of Yaml::DUMP_* constants to customize the dumped YAML string - * - * @return string The YAML representation of the PHP value - */ - public function dump($input, int $inline = 0, int $indent = 0, int $flags = 0): string - { - $output = ''; - $prefix = $indent ? str_repeat(' ', $indent) : ''; - $dumpObjectAsInlineMap = true; - - if (Yaml::DUMP_OBJECT_AS_MAP & $flags && ($input instanceof \ArrayObject || $input instanceof \stdClass)) { - $dumpObjectAsInlineMap = empty((array) $input); - } - - if ($inline <= 0 || (!\is_array($input) && !$input instanceof TaggedValue && $dumpObjectAsInlineMap) || empty($input)) { - $output .= $prefix.Inline::dump($input, $flags); - } else { - $dumpAsMap = Inline::isHash($input); - - foreach ($input as $key => $value) { - if ('' !== $output && "\n" !== $output[-1]) { - $output .= "\n"; - } - - if (Yaml::DUMP_MULTI_LINE_LITERAL_BLOCK & $flags && \is_string($value) && false !== strpos($value, "\n") && false === strpos($value, "\r")) { - // If the first line starts with a space character, the spec requires a blockIndicationIndicator - // http://www.yaml.org/spec/1.2/spec.html#id2793979 - $blockIndentationIndicator = (' ' === substr($value, 0, 1)) ? (string) $this->indentation : ''; - - if (isset($value[-2]) && "\n" === $value[-2] && "\n" === $value[-1]) { - $blockChompingIndicator = '+'; - } elseif ("\n" === $value[-1]) { - $blockChompingIndicator = ''; - } else { - $blockChompingIndicator = '-'; - } - - $output .= sprintf('%s%s%s |%s%s', $prefix, $dumpAsMap ? Inline::dump($key, $flags).':' : '-', '', $blockIndentationIndicator, $blockChompingIndicator); - - foreach (explode("\n", $value) as $row) { - if ('' === $row) { - $output .= "\n"; - } else { - $output .= sprintf("\n%s%s%s", $prefix, str_repeat(' ', $this->indentation), $row); - } - } - - continue; - } - - if ($value instanceof TaggedValue) { - $output .= sprintf('%s%s !%s', $prefix, $dumpAsMap ? Inline::dump($key, $flags).':' : '-', $value->getTag()); - - if (Yaml::DUMP_MULTI_LINE_LITERAL_BLOCK & $flags && \is_string($value->getValue()) && false !== strpos($value->getValue(), "\n") && false === strpos($value->getValue(), "\r\n")) { - // If the first line starts with a space character, the spec requires a blockIndicationIndicator - // http://www.yaml.org/spec/1.2/spec.html#id2793979 - $blockIndentationIndicator = (' ' === substr($value->getValue(), 0, 1)) ? (string) $this->indentation : ''; - $output .= sprintf(' |%s', $blockIndentationIndicator); - - foreach (explode("\n", $value->getValue()) as $row) { - $output .= sprintf("\n%s%s%s", $prefix, str_repeat(' ', $this->indentation), $row); - } - - continue; - } - - if ($inline - 1 <= 0 || null === $value->getValue() || is_scalar($value->getValue())) { - $output .= ' '.$this->dump($value->getValue(), $inline - 1, 0, $flags)."\n"; - } else { - $output .= "\n"; - $output .= $this->dump($value->getValue(), $inline - 1, $dumpAsMap ? $indent + $this->indentation : $indent + 2, $flags); - } - - continue; - } - - $dumpObjectAsInlineMap = true; - - if (Yaml::DUMP_OBJECT_AS_MAP & $flags && ($value instanceof \ArrayObject || $value instanceof \stdClass)) { - $dumpObjectAsInlineMap = empty((array) $value); - } - - $willBeInlined = $inline - 1 <= 0 || !\is_array($value) && $dumpObjectAsInlineMap || empty($value); - - $output .= sprintf('%s%s%s%s', - $prefix, - $dumpAsMap ? Inline::dump($key, $flags).':' : '-', - $willBeInlined ? ' ' : "\n", - $this->dump($value, $inline - 1, $willBeInlined ? 0 : $indent + $this->indentation, $flags) - ).($willBeInlined ? "\n" : ''); - } - } - - return $output; - } -} diff --git a/vendor/symfony/yaml/Escaper.php b/vendor/symfony/yaml/Escaper.php deleted file mode 100644 index 9b809df87..000000000 --- a/vendor/symfony/yaml/Escaper.php +++ /dev/null @@ -1,103 +0,0 @@ - - * - * For the full copyright and license information, please view the LICENSE - * file that was distributed with this source code. - */ - -namespace Symfony\Component\Yaml; - -/** - * Escaper encapsulates escaping rules for single and double-quoted - * YAML strings. - * - * @author Matthew Lewinski - * - * @internal - */ -class Escaper -{ - // Characters that would cause a dumped string to require double quoting. - public const REGEX_CHARACTER_TO_ESCAPE = "[\\x00-\\x1f]|\x7f|\xc2\x85|\xc2\xa0|\xe2\x80\xa8|\xe2\x80\xa9"; - - // Mapping arrays for escaping a double quoted string. The backslash is - // first to ensure proper escaping because str_replace operates iteratively - // on the input arrays. This ordering of the characters avoids the use of strtr, - // which performs more slowly. - private const ESCAPEES = ['\\', '\\\\', '\\"', '"', - "\x00", "\x01", "\x02", "\x03", "\x04", "\x05", "\x06", "\x07", - "\x08", "\x09", "\x0a", "\x0b", "\x0c", "\x0d", "\x0e", "\x0f", - "\x10", "\x11", "\x12", "\x13", "\x14", "\x15", "\x16", "\x17", - "\x18", "\x19", "\x1a", "\x1b", "\x1c", "\x1d", "\x1e", "\x1f", - "\x7f", - "\xc2\x85", "\xc2\xa0", "\xe2\x80\xa8", "\xe2\x80\xa9", - ]; - private const ESCAPED = ['\\\\', '\\"', '\\\\', '\\"', - '\\0', '\\x01', '\\x02', '\\x03', '\\x04', '\\x05', '\\x06', '\\a', - '\\b', '\\t', '\\n', '\\v', '\\f', '\\r', '\\x0e', '\\x0f', - '\\x10', '\\x11', '\\x12', '\\x13', '\\x14', '\\x15', '\\x16', '\\x17', - '\\x18', '\\x19', '\\x1a', '\\e', '\\x1c', '\\x1d', '\\x1e', '\\x1f', - '\\x7f', - '\\N', '\\_', '\\L', '\\P', - ]; - - /** - * Determines if a PHP value would require double quoting in YAML. - * - * @param string $value A PHP value - * - * @return bool True if the value would require double quotes - */ - public static function requiresDoubleQuoting(string $value): bool - { - return 0 < preg_match('/'.self::REGEX_CHARACTER_TO_ESCAPE.'/u', $value); - } - - /** - * Escapes and surrounds a PHP value with double quotes. - * - * @param string $value A PHP value - * - * @return string The quoted, escaped string - */ - public static function escapeWithDoubleQuotes(string $value): string - { - return sprintf('"%s"', str_replace(self::ESCAPEES, self::ESCAPED, $value)); - } - - /** - * Determines if a PHP value would require single quoting in YAML. - * - * @param string $value A PHP value - * - * @return bool True if the value would require single quotes - */ - public static function requiresSingleQuoting(string $value): bool - { - // Determines if a PHP value is entirely composed of a value that would - // require single quoting in YAML. - if (\in_array(strtolower($value), ['null', '~', 'true', 'false', 'y', 'n', 'yes', 'no', 'on', 'off'])) { - return true; - } - - // Determines if the PHP value contains any single characters that would - // cause it to require single quoting in YAML. - return 0 < preg_match('/[ \s \' " \: \{ \} \[ \] , & \* \# \?] | \A[ \- ? | < > = ! % @ ` \p{Zs}]/xu', $value); - } - - /** - * Escapes and surrounds a PHP value with single quotes. - * - * @param string $value A PHP value - * - * @return string The quoted, escaped string - */ - public static function escapeWithSingleQuotes(string $value): string - { - return sprintf("'%s'", str_replace('\'', '\'\'', $value)); - } -} diff --git a/vendor/symfony/yaml/Exception/DumpException.php b/vendor/symfony/yaml/Exception/DumpException.php deleted file mode 100644 index cce972f24..000000000 --- a/vendor/symfony/yaml/Exception/DumpException.php +++ /dev/null @@ -1,21 +0,0 @@ - - * - * For the full copyright and license information, please view the LICENSE - * file that was distributed with this source code. - */ - -namespace Symfony\Component\Yaml\Exception; - -/** - * Exception class thrown when an error occurs during dumping. - * - * @author Fabien Potencier - */ -class DumpException extends RuntimeException -{ -} diff --git a/vendor/symfony/yaml/Exception/ExceptionInterface.php b/vendor/symfony/yaml/Exception/ExceptionInterface.php deleted file mode 100644 index 909131684..000000000 --- a/vendor/symfony/yaml/Exception/ExceptionInterface.php +++ /dev/null @@ -1,21 +0,0 @@ - - * - * For the full copyright and license information, please view the LICENSE - * file that was distributed with this source code. - */ - -namespace Symfony\Component\Yaml\Exception; - -/** - * Exception interface for all exceptions thrown by the component. - * - * @author Fabien Potencier - */ -interface ExceptionInterface extends \Throwable -{ -} diff --git a/vendor/symfony/yaml/Exception/ParseException.php b/vendor/symfony/yaml/Exception/ParseException.php deleted file mode 100644 index 20b918929..000000000 --- a/vendor/symfony/yaml/Exception/ParseException.php +++ /dev/null @@ -1,133 +0,0 @@ - - * - * For the full copyright and license information, please view the LICENSE - * file that was distributed with this source code. - */ - -namespace Symfony\Component\Yaml\Exception; - -/** - * Exception class thrown when an error occurs during parsing. - * - * @author Fabien Potencier - */ -class ParseException extends RuntimeException -{ - private $parsedFile; - private $parsedLine; - private $snippet; - private $rawMessage; - - /** - * @param string $message The error message - * @param int $parsedLine The line where the error occurred - * @param string|null $snippet The snippet of code near the problem - * @param string|null $parsedFile The file name where the error occurred - * @param \Exception|null $previous The previous exception - */ - public function __construct(string $message, int $parsedLine = -1, string $snippet = null, string $parsedFile = null, \Throwable $previous = null) - { - $this->parsedFile = $parsedFile; - $this->parsedLine = $parsedLine; - $this->snippet = $snippet; - $this->rawMessage = $message; - - $this->updateRepr(); - - parent::__construct($this->message, 0, $previous); - } - - /** - * Gets the snippet of code near the error. - * - * @return string The snippet of code - */ - public function getSnippet() - { - return $this->snippet; - } - - /** - * Sets the snippet of code near the error. - */ - public function setSnippet(string $snippet) - { - $this->snippet = $snippet; - - $this->updateRepr(); - } - - /** - * Gets the filename where the error occurred. - * - * This method returns null if a string is parsed. - * - * @return string The filename - */ - public function getParsedFile() - { - return $this->parsedFile; - } - - /** - * Sets the filename where the error occurred. - */ - public function setParsedFile(string $parsedFile) - { - $this->parsedFile = $parsedFile; - - $this->updateRepr(); - } - - /** - * Gets the line where the error occurred. - * - * @return int The file line - */ - public function getParsedLine() - { - return $this->parsedLine; - } - - /** - * Sets the line where the error occurred. - */ - public function setParsedLine(int $parsedLine) - { - $this->parsedLine = $parsedLine; - - $this->updateRepr(); - } - - private function updateRepr() - { - $this->message = $this->rawMessage; - - $dot = false; - if ('.' === substr($this->message, -1)) { - $this->message = substr($this->message, 0, -1); - $dot = true; - } - - if (null !== $this->parsedFile) { - $this->message .= sprintf(' in %s', json_encode($this->parsedFile, \JSON_UNESCAPED_SLASHES | \JSON_UNESCAPED_UNICODE)); - } - - if ($this->parsedLine >= 0) { - $this->message .= sprintf(' at line %d', $this->parsedLine); - } - - if ($this->snippet) { - $this->message .= sprintf(' (near "%s")', $this->snippet); - } - - if ($dot) { - $this->message .= '.'; - } - } -} diff --git a/vendor/symfony/yaml/Exception/RuntimeException.php b/vendor/symfony/yaml/Exception/RuntimeException.php deleted file mode 100644 index 3f36b73be..000000000 --- a/vendor/symfony/yaml/Exception/RuntimeException.php +++ /dev/null @@ -1,21 +0,0 @@ - - * - * For the full copyright and license information, please view the LICENSE - * file that was distributed with this source code. - */ - -namespace Symfony\Component\Yaml\Exception; - -/** - * Exception class thrown when an error occurs during parsing. - * - * @author Romain Neutron - */ -class RuntimeException extends \RuntimeException implements ExceptionInterface -{ -} diff --git a/vendor/symfony/yaml/Inline.php b/vendor/symfony/yaml/Inline.php deleted file mode 100644 index fe1028787..000000000 --- a/vendor/symfony/yaml/Inline.php +++ /dev/null @@ -1,794 +0,0 @@ - - * - * For the full copyright and license information, please view the LICENSE - * file that was distributed with this source code. - */ - -namespace Symfony\Component\Yaml; - -use Symfony\Component\Yaml\Exception\DumpException; -use Symfony\Component\Yaml\Exception\ParseException; -use Symfony\Component\Yaml\Tag\TaggedValue; - -/** - * Inline implements a YAML parser/dumper for the YAML inline syntax. - * - * @author Fabien Potencier - * - * @internal - */ -class Inline -{ - public const REGEX_QUOTED_STRING = '(?:"([^"\\\\]*+(?:\\\\.[^"\\\\]*+)*+)"|\'([^\']*+(?:\'\'[^\']*+)*+)\')'; - - public static $parsedLineNumber = -1; - public static $parsedFilename; - - private static $exceptionOnInvalidType = false; - private static $objectSupport = false; - private static $objectForMap = false; - private static $constantSupport = false; - - public static function initialize(int $flags, int $parsedLineNumber = null, string $parsedFilename = null) - { - self::$exceptionOnInvalidType = (bool) (Yaml::PARSE_EXCEPTION_ON_INVALID_TYPE & $flags); - self::$objectSupport = (bool) (Yaml::PARSE_OBJECT & $flags); - self::$objectForMap = (bool) (Yaml::PARSE_OBJECT_FOR_MAP & $flags); - self::$constantSupport = (bool) (Yaml::PARSE_CONSTANT & $flags); - self::$parsedFilename = $parsedFilename; - - if (null !== $parsedLineNumber) { - self::$parsedLineNumber = $parsedLineNumber; - } - } - - /** - * Converts a YAML string to a PHP value. - * - * @param string $value A YAML string - * @param int $flags A bit field of PARSE_* constants to customize the YAML parser behavior - * @param array $references Mapping of variable names to values - * - * @return mixed A PHP value - * - * @throws ParseException - */ - public static function parse(string $value = null, int $flags = 0, array $references = []) - { - self::initialize($flags); - - $value = trim($value); - - if ('' === $value) { - return ''; - } - - if (2 /* MB_OVERLOAD_STRING */ & (int) ini_get('mbstring.func_overload')) { - $mbEncoding = mb_internal_encoding(); - mb_internal_encoding('ASCII'); - } - - try { - $i = 0; - $tag = self::parseTag($value, $i, $flags); - switch ($value[$i]) { - case '[': - $result = self::parseSequence($value, $flags, $i, $references); - ++$i; - break; - case '{': - $result = self::parseMapping($value, $flags, $i, $references); - ++$i; - break; - default: - $result = self::parseScalar($value, $flags, null, $i, null === $tag, $references); - } - - // some comments are allowed at the end - if (preg_replace('/\s*#.*$/A', '', substr($value, $i))) { - throw new ParseException(sprintf('Unexpected characters near "%s".', substr($value, $i)), self::$parsedLineNumber + 1, $value, self::$parsedFilename); - } - - if (null !== $tag && '' !== $tag) { - return new TaggedValue($tag, $result); - } - - return $result; - } finally { - if (isset($mbEncoding)) { - mb_internal_encoding($mbEncoding); - } - } - } - - /** - * Dumps a given PHP variable to a YAML string. - * - * @param mixed $value The PHP variable to convert - * @param int $flags A bit field of Yaml::DUMP_* constants to customize the dumped YAML string - * - * @return string The YAML string representing the PHP value - * - * @throws DumpException When trying to dump PHP resource - */ - public static function dump($value, int $flags = 0): string - { - switch (true) { - case \is_resource($value): - if (Yaml::DUMP_EXCEPTION_ON_INVALID_TYPE & $flags) { - throw new DumpException(sprintf('Unable to dump PHP resources in a YAML file ("%s").', get_resource_type($value))); - } - - return self::dumpNull($flags); - case $value instanceof \DateTimeInterface: - return $value->format('c'); - case \is_object($value): - if ($value instanceof TaggedValue) { - return '!'.$value->getTag().' '.self::dump($value->getValue(), $flags); - } - - if (Yaml::DUMP_OBJECT & $flags) { - return '!php/object '.self::dump(serialize($value)); - } - - if (Yaml::DUMP_OBJECT_AS_MAP & $flags && ($value instanceof \stdClass || $value instanceof \ArrayObject)) { - $output = []; - - foreach ($value as $key => $val) { - $output[] = sprintf('%s: %s', self::dump($key, $flags), self::dump($val, $flags)); - } - - return sprintf('{ %s }', implode(', ', $output)); - } - - if (Yaml::DUMP_EXCEPTION_ON_INVALID_TYPE & $flags) { - throw new DumpException('Object support when dumping a YAML file has been disabled.'); - } - - return self::dumpNull($flags); - case \is_array($value): - return self::dumpArray($value, $flags); - case null === $value: - return self::dumpNull($flags); - case true === $value: - return 'true'; - case false === $value: - return 'false'; - case ctype_digit($value): - return \is_string($value) ? "'$value'" : (int) $value; - case is_numeric($value) && false === strpos($value, "\f") && false === strpos($value, "\n") && false === strpos($value, "\r") && false === strpos($value, "\t") && false === strpos($value, "\v"): - $locale = setlocale(\LC_NUMERIC, 0); - if (false !== $locale) { - setlocale(\LC_NUMERIC, 'C'); - } - if (\is_float($value)) { - $repr = (string) $value; - if (is_infinite($value)) { - $repr = str_ireplace('INF', '.Inf', $repr); - } elseif (floor($value) == $value && $repr == $value) { - // Preserve float data type since storing a whole number will result in integer value. - $repr = '!!float '.$repr; - } - } else { - $repr = \is_string($value) ? "'$value'" : (string) $value; - } - if (false !== $locale) { - setlocale(\LC_NUMERIC, $locale); - } - - return $repr; - case '' == $value: - return "''"; - case self::isBinaryString($value): - return '!!binary '.base64_encode($value); - case Escaper::requiresDoubleQuoting($value): - return Escaper::escapeWithDoubleQuotes($value); - case Escaper::requiresSingleQuoting($value): - case Parser::preg_match('{^[0-9]+[_0-9]*$}', $value): - case Parser::preg_match(self::getHexRegex(), $value): - case Parser::preg_match(self::getTimestampRegex(), $value): - return Escaper::escapeWithSingleQuotes($value); - default: - return $value; - } - } - - /** - * Check if given array is hash or just normal indexed array. - * - * @param array|\ArrayObject|\stdClass $value The PHP array or array-like object to check - * - * @return bool true if value is hash array, false otherwise - */ - public static function isHash($value): bool - { - if ($value instanceof \stdClass || $value instanceof \ArrayObject) { - return true; - } - - $expectedKey = 0; - - foreach ($value as $key => $val) { - if ($key !== $expectedKey++) { - return true; - } - } - - return false; - } - - /** - * Dumps a PHP array to a YAML string. - * - * @param array $value The PHP array to dump - * @param int $flags A bit field of Yaml::DUMP_* constants to customize the dumped YAML string - * - * @return string The YAML string representing the PHP array - */ - private static function dumpArray(array $value, int $flags): string - { - // array - if (($value || Yaml::DUMP_EMPTY_ARRAY_AS_SEQUENCE & $flags) && !self::isHash($value)) { - $output = []; - foreach ($value as $val) { - $output[] = self::dump($val, $flags); - } - - return sprintf('[%s]', implode(', ', $output)); - } - - // hash - $output = []; - foreach ($value as $key => $val) { - $output[] = sprintf('%s: %s', self::dump($key, $flags), self::dump($val, $flags)); - } - - return sprintf('{ %s }', implode(', ', $output)); - } - - private static function dumpNull(int $flags): string - { - if (Yaml::DUMP_NULL_AS_TILDE & $flags) { - return '~'; - } - - return 'null'; - } - - /** - * Parses a YAML scalar. - * - * @return mixed - * - * @throws ParseException When malformed inline YAML string is parsed - */ - public static function parseScalar(string $scalar, int $flags = 0, array $delimiters = null, int &$i = 0, bool $evaluate = true, array $references = []) - { - if (\in_array($scalar[$i], ['"', "'"], true)) { - // quoted scalar - $output = self::parseQuotedScalar($scalar, $i); - - if (null !== $delimiters) { - $tmp = ltrim(substr($scalar, $i), " \n"); - if ('' === $tmp) { - throw new ParseException(sprintf('Unexpected end of line, expected one of "%s".', implode('', $delimiters)), self::$parsedLineNumber + 1, $scalar, self::$parsedFilename); - } - if (!\in_array($tmp[0], $delimiters)) { - throw new ParseException(sprintf('Unexpected characters (%s).', substr($scalar, $i)), self::$parsedLineNumber + 1, $scalar, self::$parsedFilename); - } - } - } else { - // "normal" string - if (!$delimiters) { - $output = substr($scalar, $i); - $i += \strlen($output); - - // remove comments - if (Parser::preg_match('/[ \t]+#/', $output, $match, \PREG_OFFSET_CAPTURE)) { - $output = substr($output, 0, $match[0][1]); - } - } elseif (Parser::preg_match('/^(.*?)('.implode('|', $delimiters).')/', substr($scalar, $i), $match)) { - $output = $match[1]; - $i += \strlen($output); - $output = trim($output); - } else { - throw new ParseException(sprintf('Malformed inline YAML string: "%s".', $scalar), self::$parsedLineNumber + 1, null, self::$parsedFilename); - } - - // a non-quoted string cannot start with @ or ` (reserved) nor with a scalar indicator (| or >) - if ($output && ('@' === $output[0] || '`' === $output[0] || '|' === $output[0] || '>' === $output[0] || '%' === $output[0])) { - throw new ParseException(sprintf('The reserved indicator "%s" cannot start a plain scalar; you need to quote the scalar.', $output[0]), self::$parsedLineNumber + 1, $output, self::$parsedFilename); - } - - if ($evaluate) { - $output = self::evaluateScalar($output, $flags, $references); - } - } - - return $output; - } - - /** - * Parses a YAML quoted scalar. - * - * @throws ParseException When malformed inline YAML string is parsed - */ - private static function parseQuotedScalar(string $scalar, int &$i): string - { - if (!Parser::preg_match('/'.self::REGEX_QUOTED_STRING.'/Au', substr($scalar, $i), $match)) { - throw new ParseException(sprintf('Malformed inline YAML string: "%s".', substr($scalar, $i)), self::$parsedLineNumber + 1, $scalar, self::$parsedFilename); - } - - $output = substr($match[0], 1, -1); - - $unescaper = new Unescaper(); - if ('"' == $scalar[$i]) { - $output = $unescaper->unescapeDoubleQuotedString($output); - } else { - $output = $unescaper->unescapeSingleQuotedString($output); - } - - $i += \strlen($match[0]); - - return $output; - } - - /** - * Parses a YAML sequence. - * - * @throws ParseException When malformed inline YAML string is parsed - */ - private static function parseSequence(string $sequence, int $flags, int &$i = 0, array $references = []): array - { - $output = []; - $len = \strlen($sequence); - ++$i; - - // [foo, bar, ...] - while ($i < $len) { - if (']' === $sequence[$i]) { - return $output; - } - if (',' === $sequence[$i] || ' ' === $sequence[$i]) { - ++$i; - - continue; - } - - $tag = self::parseTag($sequence, $i, $flags); - switch ($sequence[$i]) { - case '[': - // nested sequence - $value = self::parseSequence($sequence, $flags, $i, $references); - break; - case '{': - // nested mapping - $value = self::parseMapping($sequence, $flags, $i, $references); - break; - default: - $isQuoted = \in_array($sequence[$i], ['"', "'"], true); - $value = self::parseScalar($sequence, $flags, [',', ']'], $i, null === $tag, $references); - - // the value can be an array if a reference has been resolved to an array var - if (\is_string($value) && !$isQuoted && false !== strpos($value, ': ')) { - // embedded mapping? - try { - $pos = 0; - $value = self::parseMapping('{'.$value.'}', $flags, $pos, $references); - } catch (\InvalidArgumentException $e) { - // no, it's not - } - } - - --$i; - } - - if (null !== $tag && '' !== $tag) { - $value = new TaggedValue($tag, $value); - } - - $output[] = $value; - - ++$i; - } - - throw new ParseException(sprintf('Malformed inline YAML string: "%s".', $sequence), self::$parsedLineNumber + 1, null, self::$parsedFilename); - } - - /** - * Parses a YAML mapping. - * - * @return array|\stdClass - * - * @throws ParseException When malformed inline YAML string is parsed - */ - private static function parseMapping(string $mapping, int $flags, int &$i = 0, array $references = []) - { - $output = []; - $len = \strlen($mapping); - ++$i; - $allowOverwrite = false; - - // {foo: bar, bar:foo, ...} - while ($i < $len) { - switch ($mapping[$i]) { - case ' ': - case ',': - case "\n": - ++$i; - continue 2; - case '}': - if (self::$objectForMap) { - return (object) $output; - } - - return $output; - } - - // key - $offsetBeforeKeyParsing = $i; - $isKeyQuoted = \in_array($mapping[$i], ['"', "'"], true); - $key = self::parseScalar($mapping, $flags, [':', ' '], $i, false, []); - - if ($offsetBeforeKeyParsing === $i) { - throw new ParseException('Missing mapping key.', self::$parsedLineNumber + 1, $mapping); - } - - if ('!php/const' === $key) { - $key .= ' '.self::parseScalar($mapping, $flags, [':'], $i, false, []); - $key = self::evaluateScalar($key, $flags); - } - - if (false === $i = strpos($mapping, ':', $i)) { - break; - } - - if (!$isKeyQuoted) { - $evaluatedKey = self::evaluateScalar($key, $flags, $references); - - if ('' !== $key && $evaluatedKey !== $key && !\is_string($evaluatedKey) && !\is_int($evaluatedKey)) { - throw new ParseException('Implicit casting of incompatible mapping keys to strings is not supported. Quote your evaluable mapping keys instead.', self::$parsedLineNumber + 1, $mapping); - } - } - - if (!$isKeyQuoted && (!isset($mapping[$i + 1]) || !\in_array($mapping[$i + 1], [' ', ',', '[', ']', '{', '}', "\n"], true))) { - throw new ParseException('Colons must be followed by a space or an indication character (i.e. " ", ",", "[", "]", "{", "}").', self::$parsedLineNumber + 1, $mapping); - } - - if ('<<' === $key) { - $allowOverwrite = true; - } - - while ($i < $len) { - if (':' === $mapping[$i] || ' ' === $mapping[$i] || "\n" === $mapping[$i]) { - ++$i; - - continue; - } - - $tag = self::parseTag($mapping, $i, $flags); - switch ($mapping[$i]) { - case '[': - // nested sequence - $value = self::parseSequence($mapping, $flags, $i, $references); - // Spec: Keys MUST be unique; first one wins. - // Parser cannot abort this mapping earlier, since lines - // are processed sequentially. - // But overwriting is allowed when a merge node is used in current block. - if ('<<' === $key) { - foreach ($value as $parsedValue) { - $output += $parsedValue; - } - } elseif ($allowOverwrite || !isset($output[$key])) { - if (null !== $tag) { - $output[$key] = new TaggedValue($tag, $value); - } else { - $output[$key] = $value; - } - } elseif (isset($output[$key])) { - throw new ParseException(sprintf('Duplicate key "%s" detected.', $key), self::$parsedLineNumber + 1, $mapping); - } - break; - case '{': - // nested mapping - $value = self::parseMapping($mapping, $flags, $i, $references); - // Spec: Keys MUST be unique; first one wins. - // Parser cannot abort this mapping earlier, since lines - // are processed sequentially. - // But overwriting is allowed when a merge node is used in current block. - if ('<<' === $key) { - $output += $value; - } elseif ($allowOverwrite || !isset($output[$key])) { - if (null !== $tag) { - $output[$key] = new TaggedValue($tag, $value); - } else { - $output[$key] = $value; - } - } elseif (isset($output[$key])) { - throw new ParseException(sprintf('Duplicate key "%s" detected.', $key), self::$parsedLineNumber + 1, $mapping); - } - break; - default: - $value = self::parseScalar($mapping, $flags, [',', '}', "\n"], $i, null === $tag, $references); - // Spec: Keys MUST be unique; first one wins. - // Parser cannot abort this mapping earlier, since lines - // are processed sequentially. - // But overwriting is allowed when a merge node is used in current block. - if ('<<' === $key) { - $output += $value; - } elseif ($allowOverwrite || !isset($output[$key])) { - if (null !== $tag) { - $output[$key] = new TaggedValue($tag, $value); - } else { - $output[$key] = $value; - } - } elseif (isset($output[$key])) { - throw new ParseException(sprintf('Duplicate key "%s" detected.', $key), self::$parsedLineNumber + 1, $mapping); - } - --$i; - } - ++$i; - - continue 2; - } - } - - throw new ParseException(sprintf('Malformed inline YAML string: "%s".', $mapping), self::$parsedLineNumber + 1, null, self::$parsedFilename); - } - - /** - * Evaluates scalars and replaces magic values. - * - * @return mixed The evaluated YAML string - * - * @throws ParseException when object parsing support was disabled and the parser detected a PHP object or when a reference could not be resolved - */ - private static function evaluateScalar(string $scalar, int $flags, array $references = []) - { - $scalar = trim($scalar); - - if ('*' === ($scalar[0] ?? '')) { - if (false !== $pos = strpos($scalar, '#')) { - $value = substr($scalar, 1, $pos - 2); - } else { - $value = substr($scalar, 1); - } - - // an unquoted * - if (false === $value || '' === $value) { - throw new ParseException('A reference must contain at least one character.', self::$parsedLineNumber + 1, $value, self::$parsedFilename); - } - - if (!\array_key_exists($value, $references)) { - throw new ParseException(sprintf('Reference "%s" does not exist.', $value), self::$parsedLineNumber + 1, $value, self::$parsedFilename); - } - - return $references[$value]; - } - - $scalarLower = strtolower($scalar); - - switch (true) { - case 'null' === $scalarLower: - case '' === $scalar: - case '~' === $scalar: - return null; - case 'true' === $scalarLower: - return true; - case 'false' === $scalarLower: - return false; - case '!' === $scalar[0]: - switch (true) { - case 0 === strncmp($scalar, '!!str ', 6): - return (string) substr($scalar, 6); - case 0 === strncmp($scalar, '! ', 2): - return substr($scalar, 2); - case 0 === strncmp($scalar, '!php/object', 11): - if (self::$objectSupport) { - if (!isset($scalar[12])) { - trigger_deprecation('symfony/yaml', '5.1', 'Using the !php/object tag without a value is deprecated.'); - - return false; - } - - return unserialize(self::parseScalar(substr($scalar, 12))); - } - - if (self::$exceptionOnInvalidType) { - throw new ParseException('Object support when parsing a YAML file has been disabled.', self::$parsedLineNumber + 1, $scalar, self::$parsedFilename); - } - - return null; - case 0 === strncmp($scalar, '!php/const', 10): - if (self::$constantSupport) { - if (!isset($scalar[11])) { - trigger_deprecation('symfony/yaml', '5.1', 'Using the !php/const tag without a value is deprecated.'); - - return ''; - } - - $i = 0; - if (\defined($const = self::parseScalar(substr($scalar, 11), 0, null, $i, false))) { - return \constant($const); - } - - throw new ParseException(sprintf('The constant "%s" is not defined.', $const), self::$parsedLineNumber + 1, $scalar, self::$parsedFilename); - } - if (self::$exceptionOnInvalidType) { - throw new ParseException(sprintf('The string "%s" could not be parsed as a constant. Did you forget to pass the "Yaml::PARSE_CONSTANT" flag to the parser?', $scalar), self::$parsedLineNumber + 1, $scalar, self::$parsedFilename); - } - - return null; - case 0 === strncmp($scalar, '!!float ', 8): - return (float) substr($scalar, 8); - case 0 === strncmp($scalar, '!!binary ', 9): - return self::evaluateBinaryScalar(substr($scalar, 9)); - default: - throw new ParseException(sprintf('The string "%s" could not be parsed as it uses an unsupported built-in tag.', $scalar), self::$parsedLineNumber, $scalar, self::$parsedFilename); - } - // no break - case preg_match('/^(?:\+|-)?0o(?P[0-7_]++)$/', $scalar, $matches): - $value = str_replace('_', '', $matches['value']); - - if ('-' === $scalar[0]) { - return -octdec($value); - } else { - return octdec($value); - } - - // Optimize for returning strings. - // no break - case \in_array($scalar[0], ['+', '-', '.'], true) || is_numeric($scalar[0]): - if (Parser::preg_match('{^[+-]?[0-9][0-9_]*$}', $scalar)) { - $scalar = str_replace('_', '', (string) $scalar); - } - - switch (true) { - case ctype_digit($scalar): - if (preg_match('/^0[0-7]+$/', $scalar)) { - trigger_deprecation('symfony/yaml', '5.1', 'Support for parsing numbers prefixed with 0 as octal numbers. They will be parsed as strings as of 6.0.'); - - return octdec($scalar); - } - - $cast = (int) $scalar; - - return ($scalar === (string) $cast) ? $cast : $scalar; - case '-' === $scalar[0] && ctype_digit(substr($scalar, 1)): - if (preg_match('/^-0[0-7]+$/', $scalar)) { - trigger_deprecation('symfony/yaml', '5.1', 'Support for parsing numbers prefixed with 0 as octal numbers. They will be parsed as strings as of 6.0.'); - - return -octdec(substr($scalar, 1)); - } - - $cast = (int) $scalar; - - return ($scalar === (string) $cast) ? $cast : $scalar; - case is_numeric($scalar): - case Parser::preg_match(self::getHexRegex(), $scalar): - $scalar = str_replace('_', '', $scalar); - - return '0x' === $scalar[0].$scalar[1] ? hexdec($scalar) : (float) $scalar; - case '.inf' === $scalarLower: - case '.nan' === $scalarLower: - return -log(0); - case '-.inf' === $scalarLower: - return log(0); - case Parser::preg_match('/^(-|\+)?[0-9][0-9_]*(\.[0-9_]+)?$/', $scalar): - return (float) str_replace('_', '', $scalar); - case Parser::preg_match(self::getTimestampRegex(), $scalar): - if (Yaml::PARSE_DATETIME & $flags) { - // When no timezone is provided in the parsed date, YAML spec says we must assume UTC. - return new \DateTime($scalar, new \DateTimeZone('UTC')); - } - - $timeZone = date_default_timezone_get(); - date_default_timezone_set('UTC'); - $time = strtotime($scalar); - date_default_timezone_set($timeZone); - - return $time; - } - } - - return (string) $scalar; - } - - private static function parseTag(string $value, int &$i, int $flags): ?string - { - if ('!' !== $value[$i]) { - return null; - } - - $tagLength = strcspn($value, " \t\n[]{},", $i + 1); - $tag = substr($value, $i + 1, $tagLength); - - $nextOffset = $i + $tagLength + 1; - $nextOffset += strspn($value, ' ', $nextOffset); - - if ('' === $tag && (!isset($value[$nextOffset]) || \in_array($value[$nextOffset], [']', '}', ','], true))) { - throw new ParseException(sprintf('Using the unquoted scalar value "!" is not supported. You must quote it.', $value), self::$parsedLineNumber + 1, $value, self::$parsedFilename); - } - - // Is followed by a scalar and is a built-in tag - if ('' !== $tag && (!isset($value[$nextOffset]) || !\in_array($value[$nextOffset], ['[', '{'], true)) && ('!' === $tag[0] || 'str' === $tag || 'php/const' === $tag || 'php/object' === $tag)) { - // Manage in {@link self::evaluateScalar()} - return null; - } - - $i = $nextOffset; - - // Built-in tags - if ('' !== $tag && '!' === $tag[0]) { - throw new ParseException(sprintf('The built-in tag "!%s" is not implemented.', $tag), self::$parsedLineNumber + 1, $value, self::$parsedFilename); - } - - if ('' !== $tag && !isset($value[$i])) { - throw new ParseException(sprintf('Missing value for tag "%s".', $tag), self::$parsedLineNumber + 1, $value, self::$parsedFilename); - } - - if ('' === $tag || Yaml::PARSE_CUSTOM_TAGS & $flags) { - return $tag; - } - - throw new ParseException(sprintf('Tags support is not enabled. Enable the "Yaml::PARSE_CUSTOM_TAGS" flag to use "!%s".', $tag), self::$parsedLineNumber + 1, $value, self::$parsedFilename); - } - - public static function evaluateBinaryScalar(string $scalar): string - { - $parsedBinaryData = self::parseScalar(preg_replace('/\s/', '', $scalar)); - - if (0 !== (\strlen($parsedBinaryData) % 4)) { - throw new ParseException(sprintf('The normalized base64 encoded data (data without whitespace characters) length must be a multiple of four (%d bytes given).', \strlen($parsedBinaryData)), self::$parsedLineNumber + 1, $scalar, self::$parsedFilename); - } - - if (!Parser::preg_match('#^[A-Z0-9+/]+={0,2}$#i', $parsedBinaryData)) { - throw new ParseException(sprintf('The base64 encoded data (%s) contains invalid characters.', $parsedBinaryData), self::$parsedLineNumber + 1, $scalar, self::$parsedFilename); - } - - return base64_decode($parsedBinaryData, true); - } - - private static function isBinaryString(string $value): bool - { - return !preg_match('//u', $value) || preg_match('/[^\x00\x07-\x0d\x1B\x20-\xff]/', $value); - } - - /** - * Gets a regex that matches a YAML date. - * - * @return string The regular expression - * - * @see http://www.yaml.org/spec/1.2/spec.html#id2761573 - */ - private static function getTimestampRegex(): string - { - return <<[0-9][0-9][0-9][0-9]) - -(?P[0-9][0-9]?) - -(?P[0-9][0-9]?) - (?:(?:[Tt]|[ \t]+) - (?P[0-9][0-9]?) - :(?P[0-9][0-9]) - :(?P[0-9][0-9]) - (?:\.(?P[0-9]*))? - (?:[ \t]*(?PZ|(?P[-+])(?P[0-9][0-9]?) - (?::(?P[0-9][0-9]))?))?)? - $~x -EOF; - } - - /** - * Gets a regex that matches a YAML number in hexadecimal notation. - */ - private static function getHexRegex(): string - { - return '~^0x[0-9a-f_]++$~i'; - } -} diff --git a/vendor/symfony/yaml/LICENSE b/vendor/symfony/yaml/LICENSE deleted file mode 100644 index 9ff2d0d63..000000000 --- a/vendor/symfony/yaml/LICENSE +++ /dev/null @@ -1,19 +0,0 @@ -Copyright (c) 2004-2021 Fabien Potencier - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is furnished -to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -THE SOFTWARE. diff --git a/vendor/symfony/yaml/Parser.php b/vendor/symfony/yaml/Parser.php deleted file mode 100644 index 8a76b4880..000000000 --- a/vendor/symfony/yaml/Parser.php +++ /dev/null @@ -1,1308 +0,0 @@ - - * - * For the full copyright and license information, please view the LICENSE - * file that was distributed with this source code. - */ - -namespace Symfony\Component\Yaml; - -use Symfony\Component\Yaml\Exception\ParseException; -use Symfony\Component\Yaml\Tag\TaggedValue; - -/** - * Parser parses YAML strings to convert them to PHP arrays. - * - * @author Fabien Potencier - * - * @final - */ -class Parser -{ - public const TAG_PATTERN = '(?P![\w!.\/:-]+)'; - public const BLOCK_SCALAR_HEADER_PATTERN = '(?P\||>)(?P\+|\-|\d+|\+\d+|\-\d+|\d+\+|\d+\-)?(?P +#.*)?'; - - private $filename; - private $offset = 0; - private $numberOfParsedLines = 0; - private $totalNumberOfLines; - private $lines = []; - private $currentLineNb = -1; - private $currentLine = ''; - private $refs = []; - private $skippedLineNumbers = []; - private $locallySkippedLineNumbers = []; - private $refsBeingParsed = []; - - /** - * Parses a YAML file into a PHP value. - * - * @param string $filename The path to the YAML file to be parsed - * @param int $flags A bit field of PARSE_* constants to customize the YAML parser behavior - * - * @return mixed The YAML converted to a PHP value - * - * @throws ParseException If the file could not be read or the YAML is not valid - */ - public function parseFile(string $filename, int $flags = 0) - { - if (!is_file($filename)) { - throw new ParseException(sprintf('File "%s" does not exist.', $filename)); - } - - if (!is_readable($filename)) { - throw new ParseException(sprintf('File "%s" cannot be read.', $filename)); - } - - $this->filename = $filename; - - try { - return $this->parse(file_get_contents($filename), $flags); - } finally { - $this->filename = null; - } - } - - /** - * Parses a YAML string to a PHP value. - * - * @param string $value A YAML string - * @param int $flags A bit field of PARSE_* constants to customize the YAML parser behavior - * - * @return mixed A PHP value - * - * @throws ParseException If the YAML is not valid - */ - public function parse(string $value, int $flags = 0) - { - if (false === preg_match('//u', $value)) { - throw new ParseException('The YAML value does not appear to be valid UTF-8.', -1, null, $this->filename); - } - - $this->refs = []; - - $mbEncoding = null; - - if (2 /* MB_OVERLOAD_STRING */ & (int) ini_get('mbstring.func_overload')) { - $mbEncoding = mb_internal_encoding(); - mb_internal_encoding('UTF-8'); - } - - try { - $data = $this->doParse($value, $flags); - } finally { - if (null !== $mbEncoding) { - mb_internal_encoding($mbEncoding); - } - $this->lines = []; - $this->currentLine = ''; - $this->numberOfParsedLines = 0; - $this->refs = []; - $this->skippedLineNumbers = []; - $this->locallySkippedLineNumbers = []; - $this->totalNumberOfLines = null; - } - - return $data; - } - - private function doParse(string $value, int $flags) - { - $this->currentLineNb = -1; - $this->currentLine = ''; - $value = $this->cleanup($value); - $this->lines = explode("\n", $value); - $this->numberOfParsedLines = \count($this->lines); - $this->locallySkippedLineNumbers = []; - - if (null === $this->totalNumberOfLines) { - $this->totalNumberOfLines = $this->numberOfParsedLines; - } - - if (!$this->moveToNextLine()) { - return null; - } - - $data = []; - $context = null; - $allowOverwrite = false; - - while ($this->isCurrentLineEmpty()) { - if (!$this->moveToNextLine()) { - return null; - } - } - - // Resolves the tag and returns if end of the document - if (null !== ($tag = $this->getLineTag($this->currentLine, $flags, false)) && !$this->moveToNextLine()) { - return new TaggedValue($tag, ''); - } - - do { - if ($this->isCurrentLineEmpty()) { - continue; - } - - // tab? - if ("\t" === $this->currentLine[0]) { - throw new ParseException('A YAML file cannot contain tabs as indentation.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); - } - - Inline::initialize($flags, $this->getRealCurrentLineNb(), $this->filename); - - $isRef = $mergeNode = false; - if ('-' === $this->currentLine[0] && self::preg_match('#^\-((?P\s+)(?P.+))?$#u', rtrim($this->currentLine), $values)) { - if ($context && 'mapping' == $context) { - throw new ParseException('You cannot define a sequence item when in a mapping.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); - } - $context = 'sequence'; - - if (isset($values['value']) && '&' === $values['value'][0] && self::preg_match('#^&(?P[^ ]+) *(?P.*)#u', $values['value'], $matches)) { - $isRef = $matches['ref']; - $this->refsBeingParsed[] = $isRef; - $values['value'] = $matches['value']; - } - - if (isset($values['value'][1]) && '?' === $values['value'][0] && ' ' === $values['value'][1]) { - throw new ParseException('Complex mappings are not supported.', $this->getRealCurrentLineNb() + 1, $this->currentLine); - } - - // array - if (!isset($values['value']) || '' == trim($values['value'], ' ') || 0 === strpos(ltrim($values['value'], ' '), '#')) { - $data[] = $this->parseBlock($this->getRealCurrentLineNb() + 1, $this->getNextEmbedBlock(null, true) ?? '', $flags); - } elseif (null !== $subTag = $this->getLineTag(ltrim($values['value'], ' '), $flags)) { - $data[] = new TaggedValue( - $subTag, - $this->parseBlock($this->getRealCurrentLineNb() + 1, $this->getNextEmbedBlock(null, true), $flags) - ); - } else { - if ( - isset($values['leadspaces']) - && ( - '!' === $values['value'][0] - || self::preg_match('#^(?P'.Inline::REGEX_QUOTED_STRING.'|[^ \'"\{\[].*?) *\:(\s+(?P.+?))?\s*$#u', $this->trimTag($values['value']), $matches) - ) - ) { - // this is a compact notation element, add to next block and parse - $block = $values['value']; - if ($this->isNextLineIndented()) { - $block .= "\n".$this->getNextEmbedBlock($this->getCurrentLineIndentation() + \strlen($values['leadspaces']) + 1); - } - - $data[] = $this->parseBlock($this->getRealCurrentLineNb(), $block, $flags); - } else { - $data[] = $this->parseValue($values['value'], $flags, $context); - } - } - if ($isRef) { - $this->refs[$isRef] = end($data); - array_pop($this->refsBeingParsed); - } - } elseif ( - self::preg_match('#^(?P(?:![^\s]++\s++)?(?:'.Inline::REGEX_QUOTED_STRING.'|(?:!?!php/const:)?[^ \'"\[\{!].*?)) *\:( ++(?P.+))?$#u', rtrim($this->currentLine), $values) - && (false === strpos($values['key'], ' #') || \in_array($values['key'][0], ['"', "'"])) - ) { - if ($context && 'sequence' == $context) { - throw new ParseException('You cannot define a mapping item when in a sequence.', $this->currentLineNb + 1, $this->currentLine, $this->filename); - } - $context = 'mapping'; - - try { - $key = Inline::parseScalar($values['key']); - } catch (ParseException $e) { - $e->setParsedLine($this->getRealCurrentLineNb() + 1); - $e->setSnippet($this->currentLine); - - throw $e; - } - - if (!\is_string($key) && !\is_int($key)) { - throw new ParseException(sprintf('%s keys are not supported. Quote your evaluable mapping keys instead.', is_numeric($key) ? 'Numeric' : 'Non-string'), $this->getRealCurrentLineNb() + 1, $this->currentLine); - } - - // Convert float keys to strings, to avoid being converted to integers by PHP - if (\is_float($key)) { - $key = (string) $key; - } - - if ('<<' === $key && (!isset($values['value']) || '&' !== $values['value'][0] || !self::preg_match('#^&(?P[^ ]+)#u', $values['value'], $refMatches))) { - $mergeNode = true; - $allowOverwrite = true; - if (isset($values['value'][0]) && '*' === $values['value'][0]) { - $refName = substr(rtrim($values['value']), 1); - if (!\array_key_exists($refName, $this->refs)) { - if (false !== $pos = array_search($refName, $this->refsBeingParsed, true)) { - throw new ParseException(sprintf('Circular reference [%s, %s] detected for reference "%s".', implode(', ', \array_slice($this->refsBeingParsed, $pos)), $refName, $refName), $this->currentLineNb + 1, $this->currentLine, $this->filename); - } - - throw new ParseException(sprintf('Reference "%s" does not exist.', $refName), $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); - } - - $refValue = $this->refs[$refName]; - - if (Yaml::PARSE_OBJECT_FOR_MAP & $flags && $refValue instanceof \stdClass) { - $refValue = (array) $refValue; - } - - if (!\is_array($refValue)) { - throw new ParseException('YAML merge keys used with a scalar value instead of an array.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); - } - - $data += $refValue; // array union - } else { - if (isset($values['value']) && '' !== $values['value']) { - $value = $values['value']; - } else { - $value = $this->getNextEmbedBlock(); - } - $parsed = $this->parseBlock($this->getRealCurrentLineNb() + 1, $value, $flags); - - if (Yaml::PARSE_OBJECT_FOR_MAP & $flags && $parsed instanceof \stdClass) { - $parsed = (array) $parsed; - } - - if (!\is_array($parsed)) { - throw new ParseException('YAML merge keys used with a scalar value instead of an array.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); - } - - if (isset($parsed[0])) { - // If the value associated with the merge key is a sequence, then this sequence is expected to contain mapping nodes - // and each of these nodes is merged in turn according to its order in the sequence. Keys in mapping nodes earlier - // in the sequence override keys specified in later mapping nodes. - foreach ($parsed as $parsedItem) { - if (Yaml::PARSE_OBJECT_FOR_MAP & $flags && $parsedItem instanceof \stdClass) { - $parsedItem = (array) $parsedItem; - } - - if (!\is_array($parsedItem)) { - throw new ParseException('Merge items must be arrays.', $this->getRealCurrentLineNb() + 1, $parsedItem, $this->filename); - } - - $data += $parsedItem; // array union - } - } else { - // If the value associated with the key is a single mapping node, each of its key/value pairs is inserted into the - // current mapping, unless the key already exists in it. - $data += $parsed; // array union - } - } - } elseif ('<<' !== $key && isset($values['value']) && '&' === $values['value'][0] && self::preg_match('#^&(?P[^ ]++) *+(?P.*)#u', $values['value'], $matches)) { - $isRef = $matches['ref']; - $this->refsBeingParsed[] = $isRef; - $values['value'] = $matches['value']; - } - - $subTag = null; - if ($mergeNode) { - // Merge keys - } elseif (!isset($values['value']) || '' === $values['value'] || '#' === ($values['value'][0] ?? '') || (null !== $subTag = $this->getLineTag($values['value'], $flags)) || '<<' === $key) { - // hash - // if next line is less indented or equal, then it means that the current value is null - if (!$this->isNextLineIndented() && !$this->isNextLineUnIndentedCollection()) { - // Spec: Keys MUST be unique; first one wins. - // But overwriting is allowed when a merge node is used in current block. - if ($allowOverwrite || !isset($data[$key])) { - if (null !== $subTag) { - $data[$key] = new TaggedValue($subTag, ''); - } else { - $data[$key] = null; - } - } else { - throw new ParseException(sprintf('Duplicate key "%s" detected.', $key), $this->getRealCurrentLineNb() + 1, $this->currentLine); - } - } else { - // remember the parsed line number here in case we need it to provide some contexts in error messages below - $realCurrentLineNbKey = $this->getRealCurrentLineNb(); - $value = $this->parseBlock($this->getRealCurrentLineNb() + 1, $this->getNextEmbedBlock(), $flags); - if ('<<' === $key) { - $this->refs[$refMatches['ref']] = $value; - - if (Yaml::PARSE_OBJECT_FOR_MAP & $flags && $value instanceof \stdClass) { - $value = (array) $value; - } - - $data += $value; - } elseif ($allowOverwrite || !isset($data[$key])) { - // Spec: Keys MUST be unique; first one wins. - // But overwriting is allowed when a merge node is used in current block. - if (null !== $subTag) { - $data[$key] = new TaggedValue($subTag, $value); - } else { - $data[$key] = $value; - } - } else { - throw new ParseException(sprintf('Duplicate key "%s" detected.', $key), $realCurrentLineNbKey + 1, $this->currentLine); - } - } - } else { - $value = $this->parseValue(rtrim($values['value']), $flags, $context); - // Spec: Keys MUST be unique; first one wins. - // But overwriting is allowed when a merge node is used in current block. - if ($allowOverwrite || !isset($data[$key])) { - $data[$key] = $value; - } else { - throw new ParseException(sprintf('Duplicate key "%s" detected.', $key), $this->getRealCurrentLineNb() + 1, $this->currentLine); - } - } - if ($isRef) { - $this->refs[$isRef] = $data[$key]; - array_pop($this->refsBeingParsed); - } - } elseif ('"' === $this->currentLine[0] || "'" === $this->currentLine[0]) { - if (null !== $context) { - throw new ParseException('Unable to parse.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); - } - - try { - return Inline::parse($this->lexInlineQuotedString(), $flags, $this->refs); - } catch (ParseException $e) { - $e->setParsedLine($this->getRealCurrentLineNb() + 1); - $e->setSnippet($this->currentLine); - - throw $e; - } - } elseif ('{' === $this->currentLine[0]) { - if (null !== $context) { - throw new ParseException('Unable to parse.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); - } - - try { - $parsedMapping = Inline::parse($this->lexInlineMapping(), $flags, $this->refs); - - while ($this->moveToNextLine()) { - if (!$this->isCurrentLineEmpty()) { - throw new ParseException('Unable to parse.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); - } - } - - return $parsedMapping; - } catch (ParseException $e) { - $e->setParsedLine($this->getRealCurrentLineNb() + 1); - $e->setSnippet($this->currentLine); - - throw $e; - } - } elseif ('[' === $this->currentLine[0]) { - if (null !== $context) { - throw new ParseException('Unable to parse.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); - } - - try { - $parsedSequence = Inline::parse($this->lexInlineSequence(), $flags, $this->refs); - - while ($this->moveToNextLine()) { - if (!$this->isCurrentLineEmpty()) { - throw new ParseException('Unable to parse.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); - } - } - - return $parsedSequence; - } catch (ParseException $e) { - $e->setParsedLine($this->getRealCurrentLineNb() + 1); - $e->setSnippet($this->currentLine); - - throw $e; - } - } else { - // multiple documents are not supported - if ('---' === $this->currentLine) { - throw new ParseException('Multiple documents are not supported.', $this->currentLineNb + 1, $this->currentLine, $this->filename); - } - - if ($deprecatedUsage = (isset($this->currentLine[1]) && '?' === $this->currentLine[0] && ' ' === $this->currentLine[1])) { - throw new ParseException('Complex mappings are not supported.', $this->getRealCurrentLineNb() + 1, $this->currentLine); - } - - // 1-liner optionally followed by newline(s) - if (\is_string($value) && $this->lines[0] === trim($value)) { - try { - $value = Inline::parse($this->lines[0], $flags, $this->refs); - } catch (ParseException $e) { - $e->setParsedLine($this->getRealCurrentLineNb() + 1); - $e->setSnippet($this->currentLine); - - throw $e; - } - - return $value; - } - - // try to parse the value as a multi-line string as a last resort - if (0 === $this->currentLineNb) { - $previousLineWasNewline = false; - $previousLineWasTerminatedWithBackslash = false; - $value = ''; - - foreach ($this->lines as $line) { - $trimmedLine = trim($line); - if ('#' === ($trimmedLine[0] ?? '')) { - continue; - } - // If the indentation is not consistent at offset 0, it is to be considered as a ParseError - if (0 === $this->offset && !$deprecatedUsage && isset($line[0]) && ' ' === $line[0]) { - throw new ParseException('Unable to parse.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); - } - - if (false !== strpos($line, ': ')) { - throw new ParseException('Mapping values are not allowed in multi-line blocks.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); - } - - if ('' === $trimmedLine) { - $value .= "\n"; - } elseif (!$previousLineWasNewline && !$previousLineWasTerminatedWithBackslash) { - $value .= ' '; - } - - if ('' !== $trimmedLine && '\\' === $line[-1]) { - $value .= ltrim(substr($line, 0, -1)); - } elseif ('' !== $trimmedLine) { - $value .= $trimmedLine; - } - - if ('' === $trimmedLine) { - $previousLineWasNewline = true; - $previousLineWasTerminatedWithBackslash = false; - } elseif ('\\' === $line[-1]) { - $previousLineWasNewline = false; - $previousLineWasTerminatedWithBackslash = true; - } else { - $previousLineWasNewline = false; - $previousLineWasTerminatedWithBackslash = false; - } - } - - try { - return Inline::parse(trim($value)); - } catch (ParseException $e) { - // fall-through to the ParseException thrown below - } - } - - throw new ParseException('Unable to parse.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); - } - } while ($this->moveToNextLine()); - - if (null !== $tag) { - $data = new TaggedValue($tag, $data); - } - - if (Yaml::PARSE_OBJECT_FOR_MAP & $flags && 'mapping' === $context && !\is_object($data)) { - $object = new \stdClass(); - - foreach ($data as $key => $value) { - $object->$key = $value; - } - - $data = $object; - } - - return empty($data) ? null : $data; - } - - private function parseBlock(int $offset, string $yaml, int $flags) - { - $skippedLineNumbers = $this->skippedLineNumbers; - - foreach ($this->locallySkippedLineNumbers as $lineNumber) { - if ($lineNumber < $offset) { - continue; - } - - $skippedLineNumbers[] = $lineNumber; - } - - $parser = new self(); - $parser->offset = $offset; - $parser->totalNumberOfLines = $this->totalNumberOfLines; - $parser->skippedLineNumbers = $skippedLineNumbers; - $parser->refs = &$this->refs; - $parser->refsBeingParsed = $this->refsBeingParsed; - - return $parser->doParse($yaml, $flags); - } - - /** - * Returns the current line number (takes the offset into account). - * - * @internal - * - * @return int The current line number - */ - public function getRealCurrentLineNb(): int - { - $realCurrentLineNumber = $this->currentLineNb + $this->offset; - - foreach ($this->skippedLineNumbers as $skippedLineNumber) { - if ($skippedLineNumber > $realCurrentLineNumber) { - break; - } - - ++$realCurrentLineNumber; - } - - return $realCurrentLineNumber; - } - - /** - * Returns the current line indentation. - * - * @return int The current line indentation - */ - private function getCurrentLineIndentation(): int - { - if (' ' !== ($this->currentLine[0] ?? '')) { - return 0; - } - - return \strlen($this->currentLine) - \strlen(ltrim($this->currentLine, ' ')); - } - - /** - * Returns the next embed block of YAML. - * - * @param int|null $indentation The indent level at which the block is to be read, or null for default - * @param bool $inSequence True if the enclosing data structure is a sequence - * - * @return string A YAML string - * - * @throws ParseException When indentation problem are detected - */ - private function getNextEmbedBlock(int $indentation = null, bool $inSequence = false): string - { - $oldLineIndentation = $this->getCurrentLineIndentation(); - - if (!$this->moveToNextLine()) { - return ''; - } - - if (null === $indentation) { - $newIndent = null; - $movements = 0; - - do { - $EOF = false; - - // empty and comment-like lines do not influence the indentation depth - if ($this->isCurrentLineEmpty() || $this->isCurrentLineComment()) { - $EOF = !$this->moveToNextLine(); - - if (!$EOF) { - ++$movements; - } - } else { - $newIndent = $this->getCurrentLineIndentation(); - } - } while (!$EOF && null === $newIndent); - - for ($i = 0; $i < $movements; ++$i) { - $this->moveToPreviousLine(); - } - - $unindentedEmbedBlock = $this->isStringUnIndentedCollectionItem(); - - if (!$this->isCurrentLineEmpty() && 0 === $newIndent && !$unindentedEmbedBlock) { - throw new ParseException('Indentation problem.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); - } - } else { - $newIndent = $indentation; - } - - $data = []; - if ($this->getCurrentLineIndentation() >= $newIndent) { - $data[] = substr($this->currentLine, $newIndent); - } elseif ($this->isCurrentLineEmpty() || $this->isCurrentLineComment()) { - $data[] = $this->currentLine; - } else { - $this->moveToPreviousLine(); - - return ''; - } - - if ($inSequence && $oldLineIndentation === $newIndent && isset($data[0][0]) && '-' === $data[0][0]) { - // the previous line contained a dash but no item content, this line is a sequence item with the same indentation - // and therefore no nested list or mapping - $this->moveToPreviousLine(); - - return ''; - } - - $isItUnindentedCollection = $this->isStringUnIndentedCollectionItem(); - $isItComment = $this->isCurrentLineComment(); - - while ($this->moveToNextLine()) { - if ($isItComment && !$isItUnindentedCollection) { - $isItUnindentedCollection = $this->isStringUnIndentedCollectionItem(); - $isItComment = $this->isCurrentLineComment(); - } - - $indent = $this->getCurrentLineIndentation(); - - if ($isItUnindentedCollection && !$this->isCurrentLineEmpty() && !$this->isStringUnIndentedCollectionItem() && $newIndent === $indent) { - $this->moveToPreviousLine(); - break; - } - - if ($this->isCurrentLineBlank()) { - $data[] = substr($this->currentLine, $newIndent); - continue; - } - - if ($indent >= $newIndent) { - $data[] = substr($this->currentLine, $newIndent); - } elseif ($this->isCurrentLineComment()) { - $data[] = $this->currentLine; - } elseif (0 == $indent) { - $this->moveToPreviousLine(); - - break; - } else { - throw new ParseException('Indentation problem.', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename); - } - } - - return implode("\n", $data); - } - - private function hasMoreLines(): bool - { - return (\count($this->lines) - 1) > $this->currentLineNb; - } - - /** - * Moves the parser to the next line. - */ - private function moveToNextLine(): bool - { - if ($this->currentLineNb >= $this->numberOfParsedLines - 1) { - return false; - } - - $this->currentLine = $this->lines[++$this->currentLineNb]; - - return true; - } - - /** - * Moves the parser to the previous line. - */ - private function moveToPreviousLine(): bool - { - if ($this->currentLineNb < 1) { - return false; - } - - $this->currentLine = $this->lines[--$this->currentLineNb]; - - return true; - } - - /** - * Parses a YAML value. - * - * @param string $value A YAML value - * @param int $flags A bit field of PARSE_* constants to customize the YAML parser behavior - * @param string $context The parser context (either sequence or mapping) - * - * @return mixed A PHP value - * - * @throws ParseException When reference does not exist - */ - private function parseValue(string $value, int $flags, string $context) - { - if ('*' === ($value[0] ?? '')) { - if (false !== $pos = strpos($value, '#')) { - $value = substr($value, 1, $pos - 2); - } else { - $value = substr($value, 1); - } - - if (!\array_key_exists($value, $this->refs)) { - if (false !== $pos = array_search($value, $this->refsBeingParsed, true)) { - throw new ParseException(sprintf('Circular reference [%s, %s] detected for reference "%s".', implode(', ', \array_slice($this->refsBeingParsed, $pos)), $value, $value), $this->currentLineNb + 1, $this->currentLine, $this->filename); - } - - throw new ParseException(sprintf('Reference "%s" does not exist.', $value), $this->currentLineNb + 1, $this->currentLine, $this->filename); - } - - return $this->refs[$value]; - } - - if (\in_array($value[0], ['!', '|', '>'], true) && self::preg_match('/^(?:'.self::TAG_PATTERN.' +)?'.self::BLOCK_SCALAR_HEADER_PATTERN.'$/', $value, $matches)) { - $modifiers = $matches['modifiers'] ?? ''; - - $data = $this->parseBlockScalar($matches['separator'], preg_replace('#\d+#', '', $modifiers), abs((int) $modifiers)); - - if ('' !== $matches['tag'] && '!' !== $matches['tag']) { - if ('!!binary' === $matches['tag']) { - return Inline::evaluateBinaryScalar($data); - } - - return new TaggedValue(substr($matches['tag'], 1), $data); - } - - return $data; - } - - try { - if ('' !== $value && '{' === $value[0]) { - $cursor = \strlen(rtrim($this->currentLine)) - \strlen(rtrim($value)); - - return Inline::parse($this->lexInlineMapping($cursor), $flags, $this->refs); - } elseif ('' !== $value && '[' === $value[0]) { - $cursor = \strlen(rtrim($this->currentLine)) - \strlen(rtrim($value)); - - return Inline::parse($this->lexInlineSequence($cursor), $flags, $this->refs); - } - - switch ($value[0] ?? '') { - case '"': - case "'": - $cursor = \strlen(rtrim($this->currentLine)) - \strlen(rtrim($value)); - $parsedValue = Inline::parse($this->lexInlineQuotedString($cursor), $flags, $this->refs); - - if (isset($this->currentLine[$cursor]) && preg_replace('/\s*(#.*)?$/A', '', substr($this->currentLine, $cursor))) { - throw new ParseException(sprintf('Unexpected characters near "%s".', substr($this->currentLine, $cursor))); - } - - return $parsedValue; - default: - $lines = []; - - while ($this->moveToNextLine()) { - // unquoted strings end before the first unindented line - if (0 === $this->getCurrentLineIndentation()) { - $this->moveToPreviousLine(); - - break; - } - - $lines[] = trim($this->currentLine); - } - - for ($i = 0, $linesCount = \count($lines), $previousLineBlank = false; $i < $linesCount; ++$i) { - if ('' === $lines[$i]) { - $value .= "\n"; - $previousLineBlank = true; - } elseif ($previousLineBlank) { - $value .= $lines[$i]; - $previousLineBlank = false; - } else { - $value .= ' '.$lines[$i]; - $previousLineBlank = false; - } - } - - Inline::$parsedLineNumber = $this->getRealCurrentLineNb(); - - $parsedValue = Inline::parse($value, $flags, $this->refs); - - if ('mapping' === $context && \is_string($parsedValue) && '"' !== $value[0] && "'" !== $value[0] && '[' !== $value[0] && '{' !== $value[0] && '!' !== $value[0] && false !== strpos($parsedValue, ': ')) { - throw new ParseException('A colon cannot be used in an unquoted mapping value.', $this->getRealCurrentLineNb() + 1, $value, $this->filename); - } - - return $parsedValue; - } - } catch (ParseException $e) { - $e->setParsedLine($this->getRealCurrentLineNb() + 1); - $e->setSnippet($this->currentLine); - - throw $e; - } - } - - /** - * Parses a block scalar. - * - * @param string $style The style indicator that was used to begin this block scalar (| or >) - * @param string $chomping The chomping indicator that was used to begin this block scalar (+ or -) - * @param int $indentation The indentation indicator that was used to begin this block scalar - */ - private function parseBlockScalar(string $style, string $chomping = '', int $indentation = 0): string - { - $notEOF = $this->moveToNextLine(); - if (!$notEOF) { - return ''; - } - - $isCurrentLineBlank = $this->isCurrentLineBlank(); - $blockLines = []; - - // leading blank lines are consumed before determining indentation - while ($notEOF && $isCurrentLineBlank) { - // newline only if not EOF - if ($notEOF = $this->moveToNextLine()) { - $blockLines[] = ''; - $isCurrentLineBlank = $this->isCurrentLineBlank(); - } - } - - // determine indentation if not specified - if (0 === $indentation) { - $currentLineLength = \strlen($this->currentLine); - - for ($i = 0; $i < $currentLineLength && ' ' === $this->currentLine[$i]; ++$i) { - ++$indentation; - } - } - - if ($indentation > 0) { - $pattern = sprintf('/^ {%d}(.*)$/', $indentation); - - while ( - $notEOF && ( - $isCurrentLineBlank || - self::preg_match($pattern, $this->currentLine, $matches) - ) - ) { - if ($isCurrentLineBlank && \strlen($this->currentLine) > $indentation) { - $blockLines[] = substr($this->currentLine, $indentation); - } elseif ($isCurrentLineBlank) { - $blockLines[] = ''; - } else { - $blockLines[] = $matches[1]; - } - - // newline only if not EOF - if ($notEOF = $this->moveToNextLine()) { - $isCurrentLineBlank = $this->isCurrentLineBlank(); - } - } - } elseif ($notEOF) { - $blockLines[] = ''; - } - - if ($notEOF) { - $blockLines[] = ''; - $this->moveToPreviousLine(); - } elseif (!$notEOF && !$this->isCurrentLineLastLineInDocument()) { - $blockLines[] = ''; - } - - // folded style - if ('>' === $style) { - $text = ''; - $previousLineIndented = false; - $previousLineBlank = false; - - for ($i = 0, $blockLinesCount = \count($blockLines); $i < $blockLinesCount; ++$i) { - if ('' === $blockLines[$i]) { - $text .= "\n"; - $previousLineIndented = false; - $previousLineBlank = true; - } elseif (' ' === $blockLines[$i][0]) { - $text .= "\n".$blockLines[$i]; - $previousLineIndented = true; - $previousLineBlank = false; - } elseif ($previousLineIndented) { - $text .= "\n".$blockLines[$i]; - $previousLineIndented = false; - $previousLineBlank = false; - } elseif ($previousLineBlank || 0 === $i) { - $text .= $blockLines[$i]; - $previousLineIndented = false; - $previousLineBlank = false; - } else { - $text .= ' '.$blockLines[$i]; - $previousLineIndented = false; - $previousLineBlank = false; - } - } - } else { - $text = implode("\n", $blockLines); - } - - // deal with trailing newlines - if ('' === $chomping) { - $text = preg_replace('/\n+$/', "\n", $text); - } elseif ('-' === $chomping) { - $text = preg_replace('/\n+$/', '', $text); - } - - return $text; - } - - /** - * Returns true if the next line is indented. - * - * @return bool Returns true if the next line is indented, false otherwise - */ - private function isNextLineIndented(): bool - { - $currentIndentation = $this->getCurrentLineIndentation(); - $movements = 0; - - do { - $EOF = !$this->moveToNextLine(); - - if (!$EOF) { - ++$movements; - } - } while (!$EOF && ($this->isCurrentLineEmpty() || $this->isCurrentLineComment())); - - if ($EOF) { - return false; - } - - $ret = $this->getCurrentLineIndentation() > $currentIndentation; - - for ($i = 0; $i < $movements; ++$i) { - $this->moveToPreviousLine(); - } - - return $ret; - } - - /** - * Returns true if the current line is blank or if it is a comment line. - * - * @return bool Returns true if the current line is empty or if it is a comment line, false otherwise - */ - private function isCurrentLineEmpty(): bool - { - return $this->isCurrentLineBlank() || $this->isCurrentLineComment(); - } - - /** - * Returns true if the current line is blank. - * - * @return bool Returns true if the current line is blank, false otherwise - */ - private function isCurrentLineBlank(): bool - { - return '' === $this->currentLine || '' === trim($this->currentLine, ' '); - } - - /** - * Returns true if the current line is a comment line. - * - * @return bool Returns true if the current line is a comment line, false otherwise - */ - private function isCurrentLineComment(): bool - { - //checking explicitly the first char of the trim is faster than loops or strpos - $ltrimmedLine = '' !== $this->currentLine && ' ' === $this->currentLine[0] ? ltrim($this->currentLine, ' ') : $this->currentLine; - - return '' !== $ltrimmedLine && '#' === $ltrimmedLine[0]; - } - - private function isCurrentLineLastLineInDocument(): bool - { - return ($this->offset + $this->currentLineNb) >= ($this->totalNumberOfLines - 1); - } - - /** - * Cleanups a YAML string to be parsed. - * - * @param string $value The input YAML string - * - * @return string A cleaned up YAML string - */ - private function cleanup(string $value): string - { - $value = str_replace(["\r\n", "\r"], "\n", $value); - - // strip YAML header - $count = 0; - $value = preg_replace('#^\%YAML[: ][\d\.]+.*\n#u', '', $value, -1, $count); - $this->offset += $count; - - // remove leading comments - $trimmedValue = preg_replace('#^(\#.*?\n)+#s', '', $value, -1, $count); - if (1 === $count) { - // items have been removed, update the offset - $this->offset += substr_count($value, "\n") - substr_count($trimmedValue, "\n"); - $value = $trimmedValue; - } - - // remove start of the document marker (---) - $trimmedValue = preg_replace('#^\-\-\-.*?\n#s', '', $value, -1, $count); - if (1 === $count) { - // items have been removed, update the offset - $this->offset += substr_count($value, "\n") - substr_count($trimmedValue, "\n"); - $value = $trimmedValue; - - // remove end of the document marker (...) - $value = preg_replace('#\.\.\.\s*$#', '', $value); - } - - return $value; - } - - /** - * Returns true if the next line starts unindented collection. - * - * @return bool Returns true if the next line starts unindented collection, false otherwise - */ - private function isNextLineUnIndentedCollection(): bool - { - $currentIndentation = $this->getCurrentLineIndentation(); - $movements = 0; - - do { - $EOF = !$this->moveToNextLine(); - - if (!$EOF) { - ++$movements; - } - } while (!$EOF && ($this->isCurrentLineEmpty() || $this->isCurrentLineComment())); - - if ($EOF) { - return false; - } - - $ret = $this->getCurrentLineIndentation() === $currentIndentation && $this->isStringUnIndentedCollectionItem(); - - for ($i = 0; $i < $movements; ++$i) { - $this->moveToPreviousLine(); - } - - return $ret; - } - - /** - * Returns true if the string is un-indented collection item. - * - * @return bool Returns true if the string is un-indented collection item, false otherwise - */ - private function isStringUnIndentedCollectionItem(): bool - { - return 0 === strncmp($this->currentLine, '- ', 2) || '-' === rtrim($this->currentLine); - } - - /** - * A local wrapper for "preg_match" which will throw a ParseException if there - * is an internal error in the PCRE engine. - * - * This avoids us needing to check for "false" every time PCRE is used - * in the YAML engine - * - * @throws ParseException on a PCRE internal error - * - * @see preg_last_error() - * - * @internal - */ - public static function preg_match(string $pattern, string $subject, array &$matches = null, int $flags = 0, int $offset = 0): int - { - if (false === $ret = preg_match($pattern, $subject, $matches, $flags, $offset)) { - switch (preg_last_error()) { - case \PREG_INTERNAL_ERROR: - $error = 'Internal PCRE error.'; - break; - case \PREG_BACKTRACK_LIMIT_ERROR: - $error = 'pcre.backtrack_limit reached.'; - break; - case \PREG_RECURSION_LIMIT_ERROR: - $error = 'pcre.recursion_limit reached.'; - break; - case \PREG_BAD_UTF8_ERROR: - $error = 'Malformed UTF-8 data.'; - break; - case \PREG_BAD_UTF8_OFFSET_ERROR: - $error = 'Offset doesn\'t correspond to the begin of a valid UTF-8 code point.'; - break; - default: - $error = 'Error.'; - } - - throw new ParseException($error); - } - - return $ret; - } - - /** - * Trim the tag on top of the value. - * - * Prevent values such as "!foo {quz: bar}" to be considered as - * a mapping block. - */ - private function trimTag(string $value): string - { - if ('!' === $value[0]) { - return ltrim(substr($value, 1, strcspn($value, " \r\n", 1)), ' '); - } - - return $value; - } - - private function getLineTag(string $value, int $flags, bool $nextLineCheck = true): ?string - { - if ('' === $value || '!' !== $value[0] || 1 !== self::preg_match('/^'.self::TAG_PATTERN.' *( +#.*)?$/', $value, $matches)) { - return null; - } - - if ($nextLineCheck && !$this->isNextLineIndented()) { - return null; - } - - $tag = substr($matches['tag'], 1); - - // Built-in tags - if ($tag && '!' === $tag[0]) { - throw new ParseException(sprintf('The built-in tag "!%s" is not implemented.', $tag), $this->getRealCurrentLineNb() + 1, $value, $this->filename); - } - - if (Yaml::PARSE_CUSTOM_TAGS & $flags) { - return $tag; - } - - throw new ParseException(sprintf('Tags support is not enabled. You must use the flag "Yaml::PARSE_CUSTOM_TAGS" to use "%s".', $matches['tag']), $this->getRealCurrentLineNb() + 1, $value, $this->filename); - } - - private function lexInlineQuotedString(int &$cursor = 0): string - { - $quotation = $this->currentLine[$cursor]; - $value = $quotation; - ++$cursor; - - $previousLineWasNewline = true; - $previousLineWasTerminatedWithBackslash = false; - $lineNumber = 0; - - do { - if (++$lineNumber > 1) { - $cursor += strspn($this->currentLine, ' ', $cursor); - } - - if ($this->isCurrentLineBlank()) { - $value .= "\n"; - } elseif (!$previousLineWasNewline && !$previousLineWasTerminatedWithBackslash) { - $value .= ' '; - } - - for (; \strlen($this->currentLine) > $cursor; ++$cursor) { - switch ($this->currentLine[$cursor]) { - case '\\': - if ("'" === $quotation) { - $value .= '\\'; - } elseif (isset($this->currentLine[++$cursor])) { - $value .= '\\'.$this->currentLine[$cursor]; - } - - break; - case $quotation: - ++$cursor; - - if ("'" === $quotation && isset($this->currentLine[$cursor]) && "'" === $this->currentLine[$cursor]) { - $value .= "''"; - break; - } - - return $value.$quotation; - default: - $value .= $this->currentLine[$cursor]; - } - } - - if ($this->isCurrentLineBlank()) { - $previousLineWasNewline = true; - $previousLineWasTerminatedWithBackslash = false; - } elseif ('\\' === $this->currentLine[-1]) { - $previousLineWasNewline = false; - $previousLineWasTerminatedWithBackslash = true; - } else { - $previousLineWasNewline = false; - $previousLineWasTerminatedWithBackslash = false; - } - - if ($this->hasMoreLines()) { - $cursor = 0; - } - } while ($this->moveToNextLine()); - - throw new ParseException('Malformed inline YAML string'); - } - - private function lexUnquotedString(int &$cursor): string - { - $offset = $cursor; - $cursor += strcspn($this->currentLine, '[]{},: ', $cursor); - - return substr($this->currentLine, $offset, $cursor - $offset); - } - - private function lexInlineMapping(int &$cursor = 0): string - { - return $this->lexInlineStructure($cursor, '}'); - } - - private function lexInlineSequence(int &$cursor = 0): string - { - return $this->lexInlineStructure($cursor, ']'); - } - - private function lexInlineStructure(int &$cursor, string $closingTag): string - { - $value = $this->currentLine[$cursor]; - ++$cursor; - - do { - $this->consumeWhitespaces($cursor); - - while (isset($this->currentLine[$cursor])) { - switch ($this->currentLine[$cursor]) { - case '"': - case "'": - $value .= $this->lexInlineQuotedString($cursor); - break; - case ':': - case ',': - $value .= $this->currentLine[$cursor]; - ++$cursor; - break; - case '{': - $value .= $this->lexInlineMapping($cursor); - break; - case '[': - $value .= $this->lexInlineSequence($cursor); - break; - case $closingTag: - $value .= $this->currentLine[$cursor]; - ++$cursor; - - return $value; - case '#': - break 2; - default: - $value .= $this->lexUnquotedString($cursor); - } - - if ($this->consumeWhitespaces($cursor)) { - $value .= ' '; - } - } - - if ($this->hasMoreLines()) { - $cursor = 0; - } - } while ($this->moveToNextLine()); - - throw new ParseException('Malformed inline YAML string'); - } - - private function consumeWhitespaces(int &$cursor): bool - { - $whitespacesConsumed = 0; - - do { - $whitespaceOnlyTokenLength = strspn($this->currentLine, ' ', $cursor); - $whitespacesConsumed += $whitespaceOnlyTokenLength; - $cursor += $whitespaceOnlyTokenLength; - - if (isset($this->currentLine[$cursor])) { - return 0 < $whitespacesConsumed; - } - - if ($this->hasMoreLines()) { - $cursor = 0; - } - } while ($this->moveToNextLine()); - - return 0 < $whitespacesConsumed; - } -} diff --git a/vendor/symfony/yaml/README.md b/vendor/symfony/yaml/README.md deleted file mode 100644 index b914e7836..000000000 --- a/vendor/symfony/yaml/README.md +++ /dev/null @@ -1,13 +0,0 @@ -Yaml Component -============== - -The Yaml component loads and dumps YAML files. - -Resources ---------- - - * [Documentation](https://symfony.com/doc/current/components/yaml.html) - * [Contributing](https://symfony.com/doc/current/contributing/index.html) - * [Report issues](https://github.com/symfony/symfony/issues) and - [send Pull Requests](https://github.com/symfony/symfony/pulls) - in the [main Symfony repository](https://github.com/symfony/symfony) diff --git a/vendor/symfony/yaml/Resources/bin/yaml-lint b/vendor/symfony/yaml/Resources/bin/yaml-lint deleted file mode 100755 index 0ad73d714..000000000 --- a/vendor/symfony/yaml/Resources/bin/yaml-lint +++ /dev/null @@ -1,45 +0,0 @@ -#!/usr/bin/env php - - * - * For the full copyright and license information, please view the LICENSE - * file that was distributed with this source code. - */ - -/** - * Runs the Yaml lint command. - * - * @author Jan Schädlich - */ - -use Symfony\Component\Console\Application; -use Symfony\Component\Yaml\Command\LintCommand; - -function includeIfExists(string $file): bool -{ - return file_exists($file) && include $file; -} - -if ( - !includeIfExists(__DIR__ . '/../../../../autoload.php') && - !includeIfExists(__DIR__ . '/../../vendor/autoload.php') && - !includeIfExists(__DIR__ . '/../../../../../../vendor/autoload.php') -) { - fwrite(STDERR, 'Install dependencies using Composer.'.PHP_EOL); - exit(1); -} - -if (!class_exists(Application::class)) { - fwrite(STDERR, 'You need the "symfony/console" component in order to run the Yaml linter.'.PHP_EOL); - exit(1); -} - -(new Application())->add($command = new LintCommand()) - ->getApplication() - ->setDefaultCommand($command->getName(), true) - ->run() -; diff --git a/vendor/symfony/yaml/Tag/TaggedValue.php b/vendor/symfony/yaml/Tag/TaggedValue.php deleted file mode 100644 index 4ea340613..000000000 --- a/vendor/symfony/yaml/Tag/TaggedValue.php +++ /dev/null @@ -1,38 +0,0 @@ - - * - * For the full copyright and license information, please view the LICENSE - * file that was distributed with this source code. - */ - -namespace Symfony\Component\Yaml\Tag; - -/** - * @author Nicolas Grekas - * @author Guilhem N. - */ -final class TaggedValue -{ - private $tag; - private $value; - - public function __construct(string $tag, $value) - { - $this->tag = $tag; - $this->value = $value; - } - - public function getTag(): string - { - return $this->tag; - } - - public function getValue() - { - return $this->value; - } -} diff --git a/vendor/symfony/yaml/Unescaper.php b/vendor/symfony/yaml/Unescaper.php deleted file mode 100644 index 6bdf216ae..000000000 --- a/vendor/symfony/yaml/Unescaper.php +++ /dev/null @@ -1,138 +0,0 @@ - - * - * For the full copyright and license information, please view the LICENSE - * file that was distributed with this source code. - */ - -namespace Symfony\Component\Yaml; - -use Symfony\Component\Yaml\Exception\ParseException; - -/** - * Unescaper encapsulates unescaping rules for single and double-quoted - * YAML strings. - * - * @author Matthew Lewinski - * - * @internal - */ -class Unescaper -{ - /** - * Regex fragment that matches an escaped character in a double quoted string. - */ - public const REGEX_ESCAPED_CHARACTER = '\\\\(x[0-9a-fA-F]{2}|u[0-9a-fA-F]{4}|U[0-9a-fA-F]{8}|.)'; - - /** - * Unescapes a single quoted string. - * - * @param string $value A single quoted string - * - * @return string The unescaped string - */ - public function unescapeSingleQuotedString(string $value): string - { - return str_replace('\'\'', '\'', $value); - } - - /** - * Unescapes a double quoted string. - * - * @param string $value A double quoted string - * - * @return string The unescaped string - */ - public function unescapeDoubleQuotedString(string $value): string - { - $callback = function ($match) { - return $this->unescapeCharacter($match[0]); - }; - - // evaluate the string - return preg_replace_callback('/'.self::REGEX_ESCAPED_CHARACTER.'/u', $callback, $value); - } - - /** - * Unescapes a character that was found in a double-quoted string. - * - * @param string $value An escaped character - * - * @return string The unescaped character - */ - private function unescapeCharacter(string $value): string - { - switch ($value[1]) { - case '0': - return "\x0"; - case 'a': - return "\x7"; - case 'b': - return "\x8"; - case 't': - return "\t"; - case "\t": - return "\t"; - case 'n': - return "\n"; - case 'v': - return "\xB"; - case 'f': - return "\xC"; - case 'r': - return "\r"; - case 'e': - return "\x1B"; - case ' ': - return ' '; - case '"': - return '"'; - case '/': - return '/'; - case '\\': - return '\\'; - case 'N': - // U+0085 NEXT LINE - return "\xC2\x85"; - case '_': - // U+00A0 NO-BREAK SPACE - return "\xC2\xA0"; - case 'L': - // U+2028 LINE SEPARATOR - return "\xE2\x80\xA8"; - case 'P': - // U+2029 PARAGRAPH SEPARATOR - return "\xE2\x80\xA9"; - case 'x': - return self::utf8chr(hexdec(substr($value, 2, 2))); - case 'u': - return self::utf8chr(hexdec(substr($value, 2, 4))); - case 'U': - return self::utf8chr(hexdec(substr($value, 2, 8))); - default: - throw new ParseException(sprintf('Found unknown escape character "%s".', $value)); - } - } - - /** - * Get the UTF-8 character for the given code point. - */ - private static function utf8chr(int $c): string - { - if (0x80 > $c %= 0x200000) { - return \chr($c); - } - if (0x800 > $c) { - return \chr(0xC0 | $c >> 6).\chr(0x80 | $c & 0x3F); - } - if (0x10000 > $c) { - return \chr(0xE0 | $c >> 12).\chr(0x80 | $c >> 6 & 0x3F).\chr(0x80 | $c & 0x3F); - } - - return \chr(0xF0 | $c >> 18).\chr(0x80 | $c >> 12 & 0x3F).\chr(0x80 | $c >> 6 & 0x3F).\chr(0x80 | $c & 0x3F); - } -} diff --git a/vendor/symfony/yaml/Yaml.php b/vendor/symfony/yaml/Yaml.php deleted file mode 100644 index 4fea47f9a..000000000 --- a/vendor/symfony/yaml/Yaml.php +++ /dev/null @@ -1,102 +0,0 @@ - - * - * For the full copyright and license information, please view the LICENSE - * file that was distributed with this source code. - */ - -namespace Symfony\Component\Yaml; - -use Symfony\Component\Yaml\Exception\ParseException; - -/** - * Yaml offers convenience methods to load and dump YAML. - * - * @author Fabien Potencier - * - * @final - */ -class Yaml -{ - public const DUMP_OBJECT = 1; - public const PARSE_EXCEPTION_ON_INVALID_TYPE = 2; - public const PARSE_OBJECT = 4; - public const PARSE_OBJECT_FOR_MAP = 8; - public const DUMP_EXCEPTION_ON_INVALID_TYPE = 16; - public const PARSE_DATETIME = 32; - public const DUMP_OBJECT_AS_MAP = 64; - public const DUMP_MULTI_LINE_LITERAL_BLOCK = 128; - public const PARSE_CONSTANT = 256; - public const PARSE_CUSTOM_TAGS = 512; - public const DUMP_EMPTY_ARRAY_AS_SEQUENCE = 1024; - public const DUMP_NULL_AS_TILDE = 2048; - - /** - * Parses a YAML file into a PHP value. - * - * Usage: - * - * $array = Yaml::parseFile('config.yml'); - * print_r($array); - * - * @param string $filename The path to the YAML file to be parsed - * @param int $flags A bit field of PARSE_* constants to customize the YAML parser behavior - * - * @return mixed The YAML converted to a PHP value - * - * @throws ParseException If the file could not be read or the YAML is not valid - */ - public static function parseFile(string $filename, int $flags = 0) - { - $yaml = new Parser(); - - return $yaml->parseFile($filename, $flags); - } - - /** - * Parses YAML into a PHP value. - * - * Usage: - * - * $array = Yaml::parse(file_get_contents('config.yml')); - * print_r($array); - * - * - * @param string $input A string containing YAML - * @param int $flags A bit field of PARSE_* constants to customize the YAML parser behavior - * - * @return mixed The YAML converted to a PHP value - * - * @throws ParseException If the YAML is not valid - */ - public static function parse(string $input, int $flags = 0) - { - $yaml = new Parser(); - - return $yaml->parse($input, $flags); - } - - /** - * Dumps a PHP value to a YAML string. - * - * The dump method, when supplied with an array, will do its best - * to convert the array into friendly YAML. - * - * @param mixed $input The PHP value - * @param int $inline The level where you switch to inline YAML - * @param int $indent The amount of spaces to use for indentation of nested nodes - * @param int $flags A bit field of DUMP_* constants to customize the dumped YAML string - * - * @return string A YAML string representing the original PHP value - */ - public static function dump($input, int $inline = 2, int $indent = 4, int $flags = 0): string - { - $yaml = new Dumper($indent); - - return $yaml->dump($input, $inline, 0, $flags); - } -} diff --git a/vendor/symfony/yaml/composer.json b/vendor/symfony/yaml/composer.json deleted file mode 100644 index 4aca5c85b..000000000 --- a/vendor/symfony/yaml/composer.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "name": "symfony/yaml", - "type": "library", - "description": "Loads and dumps YAML files", - "keywords": [], - "homepage": "https://symfony.com", - "license": "MIT", - "authors": [ - { - "name": "Fabien Potencier", - "email": "fabien@symfony.com" - }, - { - "name": "Symfony Community", - "homepage": "https://symfony.com/contributors" - } - ], - "require": { - "php": ">=7.2.5", - "symfony/deprecation-contracts": "^2.1", - "symfony/polyfill-ctype": "~1.8" - }, - "require-dev": { - "symfony/console": "^4.4|^5.0" - }, - "conflict": { - "symfony/console": "<4.4" - }, - "suggest": { - "symfony/console": "For validating YAML files using the lint command" - }, - "autoload": { - "psr-4": { "Symfony\\Component\\Yaml\\": "" }, - "exclude-from-classmap": [ - "/Tests/" - ] - }, - "bin": [ - "Resources/bin/yaml-lint" - ], - "minimum-stability": "dev" -}