Mapping: to more owasp resources

Link to resources such as https://owasp.org/www-community/attacks/Path_Traversal

Great idea! Shall we talk to the owasp board to make them linking to us mandatory or you'd rather we link manually to attacks?

@northdpole

@northdpole I think the board is keen to use OpenCRE and to unlock OWASP content. Making it mandatory perhaps to achieve a certain project status: that would help. So we could propose that. But it won't get that path traversal page in OpenCRE for example. We can bring this matter forward to them. Could you do this? I am already in contact with them a lot on the AI standardization stuff. I'm happy to (co) write the email.

Hi , I’d like to take this issue on. I have some familiarity with OWASP guidelines and best practices, and I can help map our current implementation to more OWASP resources for stronger security alignment.
Could you please assign this issue to me? I’ll make sure the mappings are well-documented and cross-referenced with the latest OWASP standards.

Can you please describe how you would do this? What is the outcome of this mapping?

…

On Wed, 12 Nov 2025, 08:36 Shreya Das, ***@***.***> wrote: *sd2604* left a comment (OWASP/OpenCRE#471) <#471 (comment)> Hi , I’d like to take this issue on. I have some familiarity with OWASP guidelines and best practices, and I can help map our current implementation to more OWASP resources for stronger security alignment. Could you please assign this issue to me? I’ll make sure the mappings are well-documented and cross-referenced with the latest OWASP standards. — Reply to this email directly, view it on GitHub <#471 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAMCRHRLHUTF2B6PLRWA5FD34LWR3AVCNFSM6AAAAACL3MSBJCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTKMRQGY3DQNJYHA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

@northdpole

Hi @northdpole,

Here’s my proposed incremental approach for #471:

Phase 1 – Foundation (small PR)

Introduce OWASP Attack pages (e.g. Path Traversal, SQL Injection) as external resources in OpenCRE, added manually.
This establishes OWASP attack documentation as a first-class citizen in the graph.

Phase 2 – Automated linking via CWE

Many OWASP Attack pages explicitly reference CWEs (e.g. Related CWEs: CWE-22).
I will parse these CWE references and automatically link the Attack node to the same CREs already linked to that CWE.
This avoids manual curation and leverages OpenCRE’s existing structure.

Phase 3 – Full parser (future / GSoC scope)

Extend this into a parser that pulls from OWASP/www-community (pages/attacks), extracts CWE IDs, and continuously syncs OWASP Attack content into OpenCRE.

Outcome

Users browsing a CRE (e.g. Input Validation) will naturally see relevant OWASP Attacks (e.g. Path Traversal) via shared CWE relationships.

I’ll start with Phase 1 and keep each step small and reviewable.

I've texted you on slack, this needs consideration, please do not open PRs on this particular topic without us having a chat, it's not simple :-)

@northdpole

I've texted you on slack, this needs consideration, please do not open PRs on this particular topic without us having a chat, it's not simple :-)

Thanks, @northdpole — understood 👍🏻
I’ll pause any PRs on this topic for now, and we can walk through it together .
I agree it’s not a simple area.

@northdpole

Hi @northdpole Sir, To help move this forward constructively, I’ve put together a phased design proposal and shared it with you on Slack to frame the broader approach and trade-offs.
I’m very open to revising the direction, scope, or assumptions based on your feedback, and I’m looking forward to iterating on the design together before any further implementation.
Thanks again for calling this out , I agree this needs careful thinking.