Add AISVS 1.0 mappings
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
首先查看 MAPPING-READABLE-v2.md、new_cre_proposals_v2.csv 和 FORCED-MAPPING-RATIONALE-v2.md，并结合 OpenCRE 中现有的 ASVS 映射进行审查。将提议的 AISVS 映射和六个新的 CRE 与当前约定进行比较，然后寻求维护者对哪些提案和强制映射被接受的决定。当审查后的映射数据以及任何已批准的 CRE 添加都准备好纳入时，即表示完成。
由索引模型根据 Issue 内容生成。
描述
Hi!
Attached files have two alternative proposals of adding AISVS mappings to OpenCRE. This took longer than expected and for the same reason there are now several attachments.
At this point I have been looking at these too long and would appreciate maintainers second pair of eyes having a look at the proposals.
Attachment contents
| File | Purpose |
|---|---|
AISVS-1.0-OpenCRE-mapping-v2-CONSOLIDATED.xls |
The actual submission. CRE mapping template with AISVS columns appended. |
AISVS-1.0-OpenCRE-mapping-v2-CONSOLIDATED.csv |
Same data as CSV, for diffing. |
new_cre_proposals_v2.csv |
The 6 proposed new CREs: driving requirements, chapters, suggested parent, full text. |
MAPPING-READABLE-v2.md |
Full mapping as per-chapter tables, for review without a spreadsheet. |
AISVS-1.0-OpenCRE-mapping-v2-FORCED.xls |
Fallback variant with zero new CREs. |
AISVS-1.0-OpenCRE-mapping-v2-FORCED.csv |
Same as CSV again. |
FORCED-MAPPING-RATIONALE-v2.md |
What forcing the remaining gaps onto existing CREs costs. |
Conventions
Modelled after ASVS entries in OpenCRE:
OWASP AISVS|namehas the full requirement sentence (same way ASVS usessection).OWASP AISVS|idhas the native requirement ID, for example1.1.1.OWASP AISVS|hyperlinkis a section-level link into the chapter file. AISVS has no per-requirement anchors, same limitation as ASVS.OWASP AISVS|descriptionhas the AISVS level and my rough confidence rating, plus aforced: <rating>suffix on rows where the mapping was a substitute for reviewers to focus on where I wasn't that sure.
The 6 proposed new CREs
| Proposed CRE | Drives | Chapter |
|---|---|---|
| Agent action reversibility gating | 9.2.3, 9.2.4, 9.2.10 | C9 |
| Agent action approval integrity | 9.2.2, 9.2.8 | C9 |
| Agent tool capability declaration and enforcement | 9.3.3, 9.3.4 | C9 |
| Agent action chain non-repudiation | 9.4.2 | C9 |
| Token passthrough prohibition in AI tool servers | 10.2.7 | C10 |
| AI tool definition change detection | 10.4.8 | C10 |
All six are in the agentic-chapters (C9/C10) that postdate most standards currently in OpenCRE. Forcing any of these into an existing CRE creates just noise for users of CREs.
FORCED-MAPPING-RATIONALE-v2.md walks through each, but the short version is: least privilege does not express reversibility, privacy consent does not express canonicalised action parameters, an SDLC audit trail does not express cryptographic binding of a runtime chain, and OAuth revocation does not express confused-deputy prevention.
Deferred proposals
Following AISVS controls I decided to now intentionally force-fit rather than propose new CREs. Maintainer input is welcome on the deferred four.
| Withdrawn proposal | Now maps to | Fitness for mapping |
|---|---|---|
| AI compute environment attestation (4.1.3, 4.2.1, 4.2.3) | 347-352, 171-222, 307-507 |
strained |
| AI compute tenant isolation (5.3.2, 8.1.1) | 515-021, 273-600 |
wrong / strained |
| AI-generated content provenance marking (7.4.4) | 810-884 |
acceptable |
| AI input drift detection (12.3.1, 12.3.4) | 058-083, 418-853 |
acceptable / strained |
One of these (5.3.2 → 515-021 network isolation) is still a wrong forced fit: network isolation cannot stop GPU-memory side channels. I am flagging it here because withdrawing the proposal is a scoping decision, not a claim that the gap disappears. If a later CREs adds compute-isolation coverage, that mapping could be added.
new_cre_proposals_v2.csv
forced_mapping_v2.csv
MAPPING-READABLE-v2.md
FORCED-MAPPING-RATIONALE-v2.md
AISVS-1.0-OpenCRE-mapping-v2-FORCED.xls
AISVS-1.0-OpenCRE-mapping-v2-FORCED.csv
AISVS-1.0-OpenCRE-mapping-v2-CONSOLIDATED.xls
AISVS-1.0-OpenCRE-mapping-v2-CONSOLIDATED.csv
- 主要语言
- Python
- 星标
- 210
- 派生
- 167
- 平均合并
- 4 天 12 小时
- 30 天内合并 PR
- 28
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 提供 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
OWASP/OpenCRE 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
Map Analysis continues polling after a background job fails可能已有人在做 @amantebriwal4321 于 4 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 84/100
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 66/100
维护者通常 1 天内回复
-
MCP tools return "Internal MCP tool error." when OpenCRE is unreachable or times out可能已有人在做 @ShaanGS 于 23 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
find_node_by_name endpoint does not enforce MAX_ITEMS_PER_PAGE, allowing unbounded pagination queries`可能已有人在做 @Jeffy123-zhu 于 26 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 88/100
维护者通常 1 天内回复
相似的 Issue
-
Unknown stop ID in slow zone data crashes post formatting and skips the rest of that day's posts未关闭backend bug tm-new-volunteer
难度 2/5 1-3 小时 新手友好度 84/100
transitmatters/mbta-slow-zone-bot#81 · 1 条评论 ·
-
area:schema documentation
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
risk:high type:ci
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 64/100
spacetelescope/rdmt-spire#49 ·
维护者通常 1 天内回复