OWASP/OpenCRE

Input validation missing on import csv functionality

Open

#554 opened on Sep 18, 2024

View on GitHubContributor guide
 (8 comments) (0 reactions) (1 assignee)Python (116 forks)auto 404
GSOCenhancementgood first issue

Repository metrics

Stars
 (167 stars)
PR merge metrics
 (PR metrics pending)

Description

Issue

When importing a new standard, no validation is performed on the imported csv file, a generic non-descriptive "500 - Internal Server Error" is returned or new CREs are wrongfully injected.

More specifically, in the outlined case, if the format of "CRE 0" column is XX-XXX| instead of XXX-XXX|, a non-descriptive error is returned. Also, I noticed that if in the "<standard_name>|name" column the requirement's text is enclosed between three double quotes '"""', the csv is treated as valid and the whole row is entered as a new root CRE.

image

Contributor guide

Research direction
Inspect the CSV import functionality in the codebase, specifically the parsing and validation of the 'CRE 0' column. Trace how errors are handled when the format is incorrect, and investigate how triple double quotes in text are treated. Look for existing tests for the importer and any validation helpers.
Tech stack
python
Domain
backend
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GitPython
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
75