From 0cf8f326ae614c3eb232b780ba63a072d351ce5c Mon Sep 17 00:00:00 2001 From: bornunique911 Date: Wed, 1 Jul 2026 18:28:17 +0530 Subject: [PATCH 1/5] feat: add standalone OWASP Kubernetes importers --- application/cmd/cre_main.py | 18 ++++ ...owasp_kubernetes_top10_2022_parser_test.py | 45 ++++++++ ...owasp_kubernetes_top10_2025_parser_test.py | 102 ++++++++++++++++++ .../data/owasp_kubernetes_top10_2022.json | 62 +++++++++++ .../data/owasp_kubernetes_top10_2025.json | 72 +++++++++++++ .../parsers/owasp_kubernetes_top10_2022.py | 49 +++++++++ .../parsers/owasp_kubernetes_top10_2025.py | 78 ++++++++++++++ cre.py | 10 ++ 8 files changed, 436 insertions(+) create mode 100644 application/tests/owasp_kubernetes_top10_2022_parser_test.py create mode 100644 application/tests/owasp_kubernetes_top10_2025_parser_test.py create mode 100644 application/utils/external_project_parsers/data/owasp_kubernetes_top10_2022.json create mode 100644 application/utils/external_project_parsers/data/owasp_kubernetes_top10_2025.json create mode 100644 application/utils/external_project_parsers/parsers/owasp_kubernetes_top10_2022.py create mode 100644 application/utils/external_project_parsers/parsers/owasp_kubernetes_top10_2025.py diff --git a/application/cmd/cre_main.py b/application/cmd/cre_main.py index 82b892c7a..c1df5424b 100644 --- a/application/cmd/cre_main.py +++ b/application/cmd/cre_main.py @@ -976,6 +976,24 @@ def run(args: argparse.Namespace) -> None: # pragma: no cover BaseParser().register_resource( secure_headers.SecureHeaders, db_connection_str=args.cache_file ) + if args.owasp_kubernetes_top10_2022_in: + from application.utils.external_project_parsers.parsers import ( + owasp_kubernetes_top10_2022, + ) + + BaseParser().register_resource( + owasp_kubernetes_top10_2022.OwaspKubernetesTop10_2022, + db_connection_str=args.cache_file, + ) + if args.owasp_kubernetes_top10_2025_in: + from application.utils.external_project_parsers.parsers import ( + owasp_kubernetes_top10_2025, + ) + + BaseParser().register_resource( + owasp_kubernetes_top10_2025.OwaspKubernetesTop10_2025, + db_connection_str=args.cache_file, + ) if args.pci_dss_4_in: from application.utils.external_project_parsers.parsers import pci_dss diff --git a/application/tests/owasp_kubernetes_top10_2022_parser_test.py b/application/tests/owasp_kubernetes_top10_2022_parser_test.py new file mode 100644 index 000000000..a0c657c14 --- /dev/null +++ b/application/tests/owasp_kubernetes_top10_2022_parser_test.py @@ -0,0 +1,45 @@ +import unittest + +from application import create_app, sqla # type: ignore +from application.database import db +from application.defs import cre_defs as defs +from application.prompt_client import prompt_client +from application.utils.external_project_parsers.parsers import ( + owasp_kubernetes_top10_2022, +) + + +class TestOwaspKubernetesTop10_2022Parser(unittest.TestCase): + def tearDown(self) -> None: + sqla.session.remove() + sqla.drop_all() + self.app_context.pop() + + def setUp(self) -> None: + self.app = create_app(mode="test") + self.app_context = self.app.app_context() + self.app_context.push() + sqla.create_all() + self.collection = db.Node_collection() + + def test_parse(self) -> None: + for cre_id, name in [ + ("233-748", "Configuration hardening"), + ("486-813", "Configuration"), + ("053-751", "Force build pipeline to check outdated/insecure components"), + ]: + self.collection.add_cre(defs.CRE(id=cre_id, name=name, description="")) + + result = owasp_kubernetes_top10_2022.OwaspKubernetesTop10_2022().parse( + self.collection, prompt_client.PromptHandler(database=self.collection) + ) + + entries = result.results["OWASP Kubernetes Top Ten 2022"] + self.assertEqual(10, len(entries)) + self.assertEqual("K01", entries[0].sectionID) + self.assertEqual("Insecure Workload Configurations", entries[0].section) + self.assertEqual( + ["233-748", "486-813"], [link.document.id for link in entries[0].links] + ) + self.assertEqual("K10", entries[-1].sectionID) + self.assertEqual(["053-751"], [link.document.id for link in entries[-1].links]) diff --git a/application/tests/owasp_kubernetes_top10_2025_parser_test.py b/application/tests/owasp_kubernetes_top10_2025_parser_test.py new file mode 100644 index 000000000..d0a46c26b --- /dev/null +++ b/application/tests/owasp_kubernetes_top10_2025_parser_test.py @@ -0,0 +1,102 @@ +import unittest +import tempfile +from pathlib import Path + +from application import create_app, sqla # type: ignore +from application.database import db +from application.defs import cre_defs as defs +from application.prompt_client import prompt_client +from application.utils.external_project_parsers.parsers import ( + owasp_kubernetes_top10_2025, +) + + +class TestOwaspKubernetesTop10_2025Parser(unittest.TestCase): + def tearDown(self) -> None: + sqla.session.remove() + sqla.drop_all() + self.app_context.pop() + + def setUp(self) -> None: + self.app = create_app(mode="test") + self.app_context = self.app.app_context() + self.app_context.push() + sqla.create_all() + self.collection = db.Node_collection() + + def test_parse(self) -> None: + for cre_id, name in [ + ("233-748", "Configuration hardening"), + ("486-813", "Configuration"), + ("148-420", "Log integrity"), + ("402-706", "Log relevant"), + ("843-841", "Log discretely"), + ]: + self.collection.add_cre(defs.CRE(id=cre_id, name=name, description="")) + + result = owasp_kubernetes_top10_2025.OwaspKubernetesTop10_2025().parse( + self.collection, prompt_client.PromptHandler(database=self.collection) + ) + + entries = result.results["OWASP Kubernetes Top Ten 2025 (Draft)"] + self.assertEqual(10, len(entries)) + self.assertEqual("K01", entries[0].sectionID) + self.assertEqual("Insecure Workload Configurations", entries[0].section) + self.assertEqual( + ["233-748", "486-813"], [link.document.id for link in entries[0].links] + ) + self.assertEqual("K10", entries[-1].sectionID) + self.assertEqual( + ["148-420", "402-706", "843-841"], + [link.document.id for link in entries[-1].links], + ) + + def test_parse_falls_back_to_2022_mapping_when_2025_links_missing(self) -> None: + self.collection.add_cre( + defs.CRE(id="148-420", name="Log integrity", description="") + ) + + with tempfile.TemporaryDirectory() as tmpdir: + tmp_path = Path(tmpdir) + current_file = tmp_path / "k8s_2025.json" + fallback_file = tmp_path / "k8s_2022.json" + current_file.write_text( + """ +[ + { + "section_id": "K10", + "section": "Inadequate Logging And Monitoring", + "hyperlink": "https://example.com/k10", + "cre_ids": ["999-999"], + "fallback_section_ids": ["K05"] + } +] + """.strip(), + encoding="utf-8", + ) + fallback_file.write_text( + """ +[ + { + "section_id": "K05", + "section": "Inadequate Logging and Monitoring", + "hyperlink": "https://example.com/k05", + "cre_ids": ["148-420"] + } +] + """.strip(), + encoding="utf-8", + ) + + parser = owasp_kubernetes_top10_2025.OwaspKubernetesTop10_2025() + parser.data_file = current_file + parser.fallback_data_file = fallback_file + + result = parser.parse( + self.collection, + prompt_client.PromptHandler(database=self.collection), + ) + + entries = result.results["OWASP Kubernetes Top Ten 2025 (Draft)"] + self.assertEqual(1, len(entries)) + self.assertEqual(["148-420"], [link.document.id for link in entries[0].links]) diff --git a/application/utils/external_project_parsers/data/owasp_kubernetes_top10_2022.json b/application/utils/external_project_parsers/data/owasp_kubernetes_top10_2022.json new file mode 100644 index 000000000..c4eb3d6fd --- /dev/null +++ b/application/utils/external_project_parsers/data/owasp_kubernetes_top10_2022.json @@ -0,0 +1,62 @@ +[ + { + "section_id": "K01", + "section": "Insecure Workload Configurations", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K01-insecure-workload-configurations", + "cre_ids": ["233-748", "486-813"] + }, + { + "section_id": "K02", + "section": "Supply Chain Vulnerabilities", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K02-supply-chain-vulnerabilities", + "cre_ids": ["613-285", "613-287"] + }, + { + "section_id": "K03", + "section": "Overly Permissive RBAC Configurations", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K03-overly-permissive-rbac-configurations", + "cre_ids": ["128-128", "724-770"] + }, + { + "section_id": "K04", + "section": "Lack of Centralized Policy Enforcement", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K04-lack-of-centralized-policy-enforcement", + "cre_ids": ["117-371"] + }, + { + "section_id": "K05", + "section": "Inadequate Logging and Monitoring", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K05-inadequate-logging-and-monitoring", + "cre_ids": ["058-083", "148-420", "402-706", "843-841"] + }, + { + "section_id": "K06", + "section": "Broken Authentication Mechanisms", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K06-broken-authentication-mechanisms", + "cre_ids": ["177-260", "586-842", "633-428"] + }, + { + "section_id": "K07", + "section": "Missing Network Segmentation Controls", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K07-missing-network-segmentation-controls", + "cre_ids": ["132-146", "467-784", "515-021"] + }, + { + "section_id": "K08", + "section": "Secrets Management Failures", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K08-secrets-management-failures", + "cre_ids": ["340-375", "774-888", "813-610"] + }, + { + "section_id": "K09", + "section": "Misconfigured Cluster Components", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K09-misconfigured-cluster-components", + "cre_ids": ["233-748", "486-813"] + }, + { + "section_id": "K10", + "section": "Outdated and Vulnerable Kubernetes Components", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K10-outdated-and-vulnerable-kubernetes-components", + "cre_ids": ["053-751", "715-334", "863-521"] + } +] diff --git a/application/utils/external_project_parsers/data/owasp_kubernetes_top10_2025.json b/application/utils/external_project_parsers/data/owasp_kubernetes_top10_2025.json new file mode 100644 index 000000000..c55afb059 --- /dev/null +++ b/application/utils/external_project_parsers/data/owasp_kubernetes_top10_2025.json @@ -0,0 +1,72 @@ +[ + { + "section_id": "K01", + "section": "Insecure Workload Configurations", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", + "cre_ids": ["233-748", "486-813"], + "fallback_section_ids": ["K01"] + }, + { + "section_id": "K02", + "section": "Overly Permissive Authorization Configurations", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", + "cre_ids": ["128-128", "724-770"], + "fallback_section_ids": ["K03"] + }, + { + "section_id": "K03", + "section": "Secrets Management Failures", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", + "cre_ids": ["340-375", "774-888", "813-610"], + "fallback_section_ids": ["K08"] + }, + { + "section_id": "K04", + "section": "Lack Of Cluster Level Policy Enforcement", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", + "cre_ids": ["117-371"], + "fallback_section_ids": ["K04"] + }, + { + "section_id": "K05", + "section": "Missing Network Segmentation Controls", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", + "cre_ids": ["132-146", "467-784", "515-021"], + "fallback_section_ids": ["K07"] + }, + { + "section_id": "K06", + "section": "Overly Exposed Kubernetes Components", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", + "cre_ids": ["152-725", "640-364"], + "fallback_section_ids": ["K09"] + }, + { + "section_id": "K07", + "section": "Misconfigured And Vulnerable Cluster Components", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", + "cre_ids": ["053-751", "233-748", "486-813", "715-334"], + "fallback_section_ids": ["K09", "K10"] + }, + { + "section_id": "K08", + "section": "Cluster To Cloud Lateral Movement", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", + "cre_ids": ["132-146", "640-364", "724-770"], + "fallback_section_ids": ["K03", "K07"] + }, + { + "section_id": "K09", + "section": "Broken Authentication Mechanisms", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", + "cre_ids": ["177-260", "586-842", "633-428"], + "fallback_section_ids": ["K06"] + }, + { + "section_id": "K10", + "section": "Inadequate Logging And Monitoring", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", + "cre_ids": ["058-083", "148-420", "402-706", "843-841"], + "fallback_section_ids": ["K05"] + } +] diff --git a/application/utils/external_project_parsers/parsers/owasp_kubernetes_top10_2022.py b/application/utils/external_project_parsers/parsers/owasp_kubernetes_top10_2022.py new file mode 100644 index 000000000..9d3822ab7 --- /dev/null +++ b/application/utils/external_project_parsers/parsers/owasp_kubernetes_top10_2022.py @@ -0,0 +1,49 @@ +import json +from pathlib import Path + +from application.database import db +from application.defs import cre_defs as defs +from application.prompt_client import prompt_client +from application.utils.external_project_parsers.base_parser_defs import ( + ParseResult, + ParserInterface, +) + + +class OwaspKubernetesTop10_2022(ParserInterface): + name = "OWASP Kubernetes Top Ten 2022" + data_file = ( + Path(__file__).resolve().parent.parent + / "data" + / "owasp_kubernetes_top10_2022.json" + ) + + def parse(self, cache: db.Node_collection, ph: prompt_client.PromptHandler): + with self.data_file.open("r", encoding="utf-8") as handle: + raw_entries = json.load(handle) + + entries = [] + for entry in raw_entries: + standard = defs.Standard( + name=self.name, + sectionID=entry["section_id"], + section=entry["section"], + hyperlink=entry["hyperlink"], + ) + for cre_id in entry.get("cre_ids", []): + cres = cache.get_CREs(external_id=cre_id) + if not cres: + continue + standard.add_link( + defs.Link( + ltype=defs.LinkTypes.LinkedTo, + document=cres[0].shallow_copy(), + ) + ) + entries.append(standard) + + return ParseResult( + results={self.name: entries}, + calculate_gap_analysis=False, + calculate_embeddings=False, + ) diff --git a/application/utils/external_project_parsers/parsers/owasp_kubernetes_top10_2025.py b/application/utils/external_project_parsers/parsers/owasp_kubernetes_top10_2025.py new file mode 100644 index 000000000..31deed8da --- /dev/null +++ b/application/utils/external_project_parsers/parsers/owasp_kubernetes_top10_2025.py @@ -0,0 +1,78 @@ +import json +from pathlib import Path + +from application.database import db +from application.defs import cre_defs as defs +from application.prompt_client import prompt_client +from application.utils.external_project_parsers.base_parser_defs import ( + ParseResult, + ParserInterface, +) + + +class OwaspKubernetesTop10_2025(ParserInterface): + name = "OWASP Kubernetes Top Ten 2025 (Draft)" + data_file = ( + Path(__file__).resolve().parent.parent + / "data" + / "owasp_kubernetes_top10_2025.json" + ) + fallback_data_file = ( + Path(__file__).resolve().parent.parent + / "data" + / "owasp_kubernetes_top10_2022.json" + ) + + def parse(self, cache: db.Node_collection, ph: prompt_client.PromptHandler): + with self.data_file.open("r", encoding="utf-8") as handle: + raw_entries = json.load(handle) + with self.fallback_data_file.open("r", encoding="utf-8") as handle: + fallback_entries = { + entry["section_id"]: entry for entry in json.load(handle) + } + + entries = [] + for entry in raw_entries: + standard = defs.Standard( + name=self.name, + sectionID=entry["section_id"], + section=entry["section"], + hyperlink=entry["hyperlink"], + ) + linked_cre_ids = [] + for cre_id in entry.get("cre_ids", []): + cres = cache.get_CREs(external_id=cre_id) + if not cres: + continue + linked_cre_ids.append(cre_id) + standard.add_link( + defs.Link( + ltype=defs.LinkTypes.LinkedTo, + document=cres[0].shallow_copy(), + ) + ) + if not linked_cre_ids: + for section_id in entry.get("fallback_section_ids", []): + fallback_entry = fallback_entries.get(section_id) + if not fallback_entry: + continue + for cre_id in fallback_entry.get("cre_ids", []): + if cre_id in linked_cre_ids: + continue + cres = cache.get_CREs(external_id=cre_id) + if not cres: + continue + linked_cre_ids.append(cre_id) + standard.add_link( + defs.Link( + ltype=defs.LinkTypes.LinkedTo, + document=cres[0].shallow_copy(), + ) + ) + entries.append(standard) + + return ParseResult( + results={self.name: entries}, + calculate_gap_analysis=False, + calculate_embeddings=False, + ) diff --git a/cre.py b/cre.py index 5cbe86ae5..5187e6ab7 100644 --- a/cre.py +++ b/cre.py @@ -168,6 +168,16 @@ def main() -> None: action="store_true", help="import owasp secure headers", ) + parser.add_argument( + "--owasp_kubernetes_top10_2022_in", + action="store_true", + help="import OWASP Kubernetes Top Ten 2022", + ) + parser.add_argument( + "--owasp_kubernetes_top10_2025_in", + action="store_true", + help="import OWASP Kubernetes Top Ten 2025 draft", + ) parser.add_argument( "--pci_dss_3_2_in", action="store_true", From 5e5fd23a0e9f762740c98ea7e8a2549dc9ad81e0 Mon Sep 17 00:00:00 2001 From: bornunique911 Date: Fri, 7 Aug 2026 17:57:42 +0530 Subject: [PATCH 2/5] refactor: update data file paths for OWASP Kubernetes Top Ten parsers and remove outdated JSON files --- .../owasp_kubernetes_top10_2025.json | 26 ++++--- .../data/owasp_kubernetes_top10_2022.json | 62 ---------------- .../data/owasp_kubernetes_top10_2025.json | 72 ------------------- .../parsers/owasp_kubernetes_top10_2022.py | 6 +- .../parsers/owasp_kubernetes_top10_2025.py | 12 ++-- 5 files changed, 24 insertions(+), 154 deletions(-) delete mode 100644 application/utils/external_project_parsers/data/owasp_kubernetes_top10_2022.json delete mode 100644 application/utils/external_project_parsers/data/owasp_kubernetes_top10_2025.json diff --git a/application/tests/fixtures/owasp_mappings/owasp_kubernetes_top10_2025.json b/application/tests/fixtures/owasp_mappings/owasp_kubernetes_top10_2025.json index c55afb059..d6546e26f 100644 --- a/application/tests/fixtures/owasp_mappings/owasp_kubernetes_top10_2025.json +++ b/application/tests/fixtures/owasp_mappings/owasp_kubernetes_top10_2025.json @@ -2,70 +2,68 @@ { "section_id": "K01", "section": "Insecure Workload Configurations", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", - "cre_ids": ["233-748", "486-813"], - "fallback_section_ids": ["K01"] + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K01-Insecure-Workload-Configurations.html", + "cre_ids": ["233-748", "486-813"] }, { "section_id": "K02", "section": "Overly Permissive Authorization Configurations", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K02-Overly-Permissive-Authorization-Configurations.html", "cre_ids": ["128-128", "724-770"], "fallback_section_ids": ["K03"] }, { "section_id": "K03", "section": "Secrets Management Failures", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K03-Secrets-Management-Failures.html", "cre_ids": ["340-375", "774-888", "813-610"], "fallback_section_ids": ["K08"] }, { "section_id": "K04", "section": "Lack Of Cluster Level Policy Enforcement", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", - "cre_ids": ["117-371"], - "fallback_section_ids": ["K04"] + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K04-Lack-Of-Cluster-Level-Policy-Enforcement.html", + "cre_ids": ["117-371"] }, { "section_id": "K05", "section": "Missing Network Segmentation Controls", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K05-Missing-Network-Segmentation-Controls.html", "cre_ids": ["132-146", "467-784", "515-021"], "fallback_section_ids": ["K07"] }, { "section_id": "K06", "section": "Overly Exposed Kubernetes Components", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K06-Overly-Exposed-Kubernetes-Components.html", "cre_ids": ["152-725", "640-364"], "fallback_section_ids": ["K09"] }, { "section_id": "K07", "section": "Misconfigured And Vulnerable Cluster Components", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K07-Misconfigured-And-Vulnerable-Cluster-Components.html", "cre_ids": ["053-751", "233-748", "486-813", "715-334"], "fallback_section_ids": ["K09", "K10"] }, { "section_id": "K08", "section": "Cluster To Cloud Lateral Movement", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K08-Cluster-To-Cloud-Lateral-Movement.html", "cre_ids": ["132-146", "640-364", "724-770"], "fallback_section_ids": ["K03", "K07"] }, { "section_id": "K09", "section": "Broken Authentication Mechanisms", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K09-Broken-Authentication-Mechanisms.html", "cre_ids": ["177-260", "586-842", "633-428"], "fallback_section_ids": ["K06"] }, { "section_id": "K10", "section": "Inadequate Logging And Monitoring", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", + "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K10-Inadequate-Logging-And-Monitoring.html", "cre_ids": ["058-083", "148-420", "402-706", "843-841"], "fallback_section_ids": ["K05"] } diff --git a/application/utils/external_project_parsers/data/owasp_kubernetes_top10_2022.json b/application/utils/external_project_parsers/data/owasp_kubernetes_top10_2022.json deleted file mode 100644 index c4eb3d6fd..000000000 --- a/application/utils/external_project_parsers/data/owasp_kubernetes_top10_2022.json +++ /dev/null @@ -1,62 +0,0 @@ -[ - { - "section_id": "K01", - "section": "Insecure Workload Configurations", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K01-insecure-workload-configurations", - "cre_ids": ["233-748", "486-813"] - }, - { - "section_id": "K02", - "section": "Supply Chain Vulnerabilities", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K02-supply-chain-vulnerabilities", - "cre_ids": ["613-285", "613-287"] - }, - { - "section_id": "K03", - "section": "Overly Permissive RBAC Configurations", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K03-overly-permissive-rbac-configurations", - "cre_ids": ["128-128", "724-770"] - }, - { - "section_id": "K04", - "section": "Lack of Centralized Policy Enforcement", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K04-lack-of-centralized-policy-enforcement", - "cre_ids": ["117-371"] - }, - { - "section_id": "K05", - "section": "Inadequate Logging and Monitoring", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K05-inadequate-logging-and-monitoring", - "cre_ids": ["058-083", "148-420", "402-706", "843-841"] - }, - { - "section_id": "K06", - "section": "Broken Authentication Mechanisms", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K06-broken-authentication-mechanisms", - "cre_ids": ["177-260", "586-842", "633-428"] - }, - { - "section_id": "K07", - "section": "Missing Network Segmentation Controls", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K07-missing-network-segmentation-controls", - "cre_ids": ["132-146", "467-784", "515-021"] - }, - { - "section_id": "K08", - "section": "Secrets Management Failures", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K08-secrets-management-failures", - "cre_ids": ["340-375", "774-888", "813-610"] - }, - { - "section_id": "K09", - "section": "Misconfigured Cluster Components", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K09-misconfigured-cluster-components", - "cre_ids": ["233-748", "486-813"] - }, - { - "section_id": "K10", - "section": "Outdated and Vulnerable Kubernetes Components", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K10-outdated-and-vulnerable-kubernetes-components", - "cre_ids": ["053-751", "715-334", "863-521"] - } -] diff --git a/application/utils/external_project_parsers/data/owasp_kubernetes_top10_2025.json b/application/utils/external_project_parsers/data/owasp_kubernetes_top10_2025.json deleted file mode 100644 index c55afb059..000000000 --- a/application/utils/external_project_parsers/data/owasp_kubernetes_top10_2025.json +++ /dev/null @@ -1,72 +0,0 @@ -[ - { - "section_id": "K01", - "section": "Insecure Workload Configurations", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", - "cre_ids": ["233-748", "486-813"], - "fallback_section_ids": ["K01"] - }, - { - "section_id": "K02", - "section": "Overly Permissive Authorization Configurations", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", - "cre_ids": ["128-128", "724-770"], - "fallback_section_ids": ["K03"] - }, - { - "section_id": "K03", - "section": "Secrets Management Failures", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", - "cre_ids": ["340-375", "774-888", "813-610"], - "fallback_section_ids": ["K08"] - }, - { - "section_id": "K04", - "section": "Lack Of Cluster Level Policy Enforcement", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", - "cre_ids": ["117-371"], - "fallback_section_ids": ["K04"] - }, - { - "section_id": "K05", - "section": "Missing Network Segmentation Controls", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", - "cre_ids": ["132-146", "467-784", "515-021"], - "fallback_section_ids": ["K07"] - }, - { - "section_id": "K06", - "section": "Overly Exposed Kubernetes Components", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", - "cre_ids": ["152-725", "640-364"], - "fallback_section_ids": ["K09"] - }, - { - "section_id": "K07", - "section": "Misconfigured And Vulnerable Cluster Components", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", - "cre_ids": ["053-751", "233-748", "486-813", "715-334"], - "fallback_section_ids": ["K09", "K10"] - }, - { - "section_id": "K08", - "section": "Cluster To Cloud Lateral Movement", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", - "cre_ids": ["132-146", "640-364", "724-770"], - "fallback_section_ids": ["K03", "K07"] - }, - { - "section_id": "K09", - "section": "Broken Authentication Mechanisms", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", - "cre_ids": ["177-260", "586-842", "633-428"], - "fallback_section_ids": ["K06"] - }, - { - "section_id": "K10", - "section": "Inadequate Logging And Monitoring", - "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/", - "cre_ids": ["058-083", "148-420", "402-706", "843-841"], - "fallback_section_ids": ["K05"] - } -] diff --git a/application/utils/external_project_parsers/parsers/owasp_kubernetes_top10_2022.py b/application/utils/external_project_parsers/parsers/owasp_kubernetes_top10_2022.py index 9d3822ab7..cfd3f3894 100644 --- a/application/utils/external_project_parsers/parsers/owasp_kubernetes_top10_2022.py +++ b/application/utils/external_project_parsers/parsers/owasp_kubernetes_top10_2022.py @@ -13,8 +13,10 @@ class OwaspKubernetesTop10_2022(ParserInterface): name = "OWASP Kubernetes Top Ten 2022" data_file = ( - Path(__file__).resolve().parent.parent - / "data" + Path(__file__).resolve().parents[3] + / "tests" + / "fixtures" + / "owasp_mappings" / "owasp_kubernetes_top10_2022.json" ) diff --git a/application/utils/external_project_parsers/parsers/owasp_kubernetes_top10_2025.py b/application/utils/external_project_parsers/parsers/owasp_kubernetes_top10_2025.py index 31deed8da..cd3a09336 100644 --- a/application/utils/external_project_parsers/parsers/owasp_kubernetes_top10_2025.py +++ b/application/utils/external_project_parsers/parsers/owasp_kubernetes_top10_2025.py @@ -13,13 +13,17 @@ class OwaspKubernetesTop10_2025(ParserInterface): name = "OWASP Kubernetes Top Ten 2025 (Draft)" data_file = ( - Path(__file__).resolve().parent.parent - / "data" + Path(__file__).resolve().parents[3] + / "tests" + / "fixtures" + / "owasp_mappings" / "owasp_kubernetes_top10_2025.json" ) fallback_data_file = ( - Path(__file__).resolve().parent.parent - / "data" + Path(__file__).resolve().parents[3] + / "tests" + / "fixtures" + / "owasp_mappings" / "owasp_kubernetes_top10_2022.json" ) From 0affe866494d5ffb00c583c3bf7e2b9bdb1c0f74 Mon Sep 17 00:00:00 2001 From: bornunique911 Date: Fri, 7 Aug 2026 18:12:21 +0530 Subject: [PATCH 3/5] fix: update OWASP Kubernetes Top Ten parser to 2025 version --- application/cmd/cre_main.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/application/cmd/cre_main.py b/application/cmd/cre_main.py index c1df5424b..9bb5bf047 100644 --- a/application/cmd/cre_main.py +++ b/application/cmd/cre_main.py @@ -976,13 +976,13 @@ def run(args: argparse.Namespace) -> None: # pragma: no cover BaseParser().register_resource( secure_headers.SecureHeaders, db_connection_str=args.cache_file ) - if args.owasp_kubernetes_top10_2022_in: + if args.owasp_kubernetes_top10_2025_in: from application.utils.external_project_parsers.parsers import ( - owasp_kubernetes_top10_2022, + owasp_kubernetes_top10_2025, ) BaseParser().register_resource( - owasp_kubernetes_top10_2022.OwaspKubernetesTop10_2022, + owasp_kubernetes_top10_2025.OwaspKubernetesTop10_2025, db_connection_str=args.cache_file, ) if args.owasp_kubernetes_top10_2025_in: From 78ca54289ccb22f1dfe3c0de1818e57e2742d793 Mon Sep 17 00:00:00 2001 From: bornunique911 Date: Fri, 7 Aug 2026 18:18:41 +0530 Subject: [PATCH 4/5] feat: update OWASP Kubernetes importers to include 2022 version and streamline registration process --- application/cmd/cre_main.py | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/application/cmd/cre_main.py b/application/cmd/cre_main.py index 9bb5bf047..219539382 100644 --- a/application/cmd/cre_main.py +++ b/application/cmd/cre_main.py @@ -26,6 +26,10 @@ from application.utils import db_backend from application.utils import gap_analysis from application.utils import cres_csv_export +from application.utils.external_project_parsers.parsers import ( + owasp_kubernetes_top10_2022, + owasp_kubernetes_top10_2025, +) if TYPE_CHECKING: from application.prompt_client import prompt_client as prompt_client @@ -976,13 +980,13 @@ def run(args: argparse.Namespace) -> None: # pragma: no cover BaseParser().register_resource( secure_headers.SecureHeaders, db_connection_str=args.cache_file ) - if args.owasp_kubernetes_top10_2025_in: + if args.owasp_kubernetes_top10_2022_in: from application.utils.external_project_parsers.parsers import ( - owasp_kubernetes_top10_2025, + owasp_kubernetes_top10_2022, ) BaseParser().register_resource( - owasp_kubernetes_top10_2025.OwaspKubernetesTop10_2025, + owasp_kubernetes_top10_2022.OwaspKubernetesTop10_2022, db_connection_str=args.cache_file, ) if args.owasp_kubernetes_top10_2025_in: @@ -1022,7 +1026,18 @@ def run(args: argparse.Namespace) -> None: # pragma: no cover # /end individual resource importing if args.import_external_projects: - BaseParser().call_importers(db_connection_str=args.cache_file) + # Create a single parser instance and register the Kubernetes parsers unconditionally + # so they are included in the batch discovery flow. + parser = BaseParser() + parser.register_resource( + owasp_kubernetes_top10_2022.OwaspKubernetesTop10_2022, + db_connection_str=args.cache_file, + ) + parser.register_resource( + owasp_kubernetes_top10_2025.OwaspKubernetesTop10_2025, + db_connection_str=args.cache_file, + ) + parser.call_importers(db_connection_str=args.cache_file) if getattr(args, "regenerate_embeddings", False): regenerate_embeddings(args.cache_file) @@ -1283,4 +1298,4 @@ def populate_neo4j_db(cache: str): else: logger.warning( f"Populating neo4j DB: database.neo_db is None, skipping population" - ) + ) \ No newline at end of file From fb9ced2d0b5ddec6288a43af23ef6960b126d5c6 Mon Sep 17 00:00:00 2001 From: bornunique911 Date: Fri, 7 Aug 2026 18:25:39 +0530 Subject: [PATCH 5/5] fix: add missing newline at end of file in cre_main.py --- application/cmd/cre_main.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/application/cmd/cre_main.py b/application/cmd/cre_main.py index 219539382..cc0ff000d 100644 --- a/application/cmd/cre_main.py +++ b/application/cmd/cre_main.py @@ -1298,4 +1298,4 @@ def populate_neo4j_db(cache: str): else: logger.warning( f"Populating neo4j DB: database.neo_db is None, skipping population" - ) \ No newline at end of file + )