Skip to content

Commit

Permalink
Bump CWE dictionary to v4.12 (#859)
Browse files Browse the repository at this point in the history 
Signed-off-by: nscuro <[email protected]>
  • Loading branch information
@nscuro
nscuro authored Oct 20, 2023
1 parent 7979701 commit 24c6dcb
Show file tree
Hide file tree
Showing 2 changed files with 34 additions and 10 deletions.
34 changes: 29 additions & 5 deletions commons/src/main/java/org/hyades/common/cwe/CweDefinitions.java
View file
Original file line number Diff line number Diff line change
@@ -1,11 +1,10 @@
package org.hyades.common.cwe;

import jakarta.annotation.Generated;

import java.util.HashMap;
import java.util.Map;

@Generated(value = "generate-cwe-definitions.py", date = "2023-01-19T23:20:12.459921+00:00")
@Generated(value = "generate-cwe-definitions.py", date = "2023-10-19T14:14:49.874019+00:00")
final class CweDefinitions {

static final Map<Integer, String> DEFINITIONS = new HashMap<>();
Expand Down Expand Up @@ -163,6 +162,28 @@ final class CweDefinitions {
DEFINITIONS.put(1383, "ICS Operations (\u0026 Maintenance): Compliance/Conformance with Regulatory Requirements");
DEFINITIONS.put(1388, "Physical Access Issues and Concerns");
DEFINITIONS.put(139, "DEPRECATED: General Special Element Problems");
DEFINITIONS.put(1396, "Comprehensive Categorization: Access Control");
DEFINITIONS.put(1397, "Comprehensive Categorization: Comparison");
DEFINITIONS.put(1398, "Comprehensive Categorization: Component Interaction");
DEFINITIONS.put(1399, "Comprehensive Categorization: Memory Safety");
DEFINITIONS.put(1401, "Comprehensive Categorization: Concurrency");
DEFINITIONS.put(1402, "Comprehensive Categorization: Encryption");
DEFINITIONS.put(1403, "Comprehensive Categorization: Exposed Resource");
DEFINITIONS.put(1404, "Comprehensive Categorization: File Handling");
DEFINITIONS.put(1405, "Comprehensive Categorization: Improper Check or Handling of Exceptional Conditions");
DEFINITIONS.put(1406, "Comprehensive Categorization: Improper Input Validation");
DEFINITIONS.put(1407, "Comprehensive Categorization: Improper Neutralization");
DEFINITIONS.put(1408, "Comprehensive Categorization: Incorrect Calculation");
DEFINITIONS.put(1409, "Comprehensive Categorization: Injection");
DEFINITIONS.put(1410, "Comprehensive Categorization: Insufficient Control Flow Management");
DEFINITIONS.put(1411, "Comprehensive Categorization: Insufficient Verification of Data Authenticity");
DEFINITIONS.put(1412, "Comprehensive Categorization: Poor Coding Practices");
DEFINITIONS.put(1413, "Comprehensive Categorization: Protection Mechanism Failure");
DEFINITIONS.put(1414, "Comprehensive Categorization: Randomness");
DEFINITIONS.put(1415, "Comprehensive Categorization: Resource Control");
DEFINITIONS.put(1416, "Comprehensive Categorization: Resource Lifecycle Management");
DEFINITIONS.put(1417, "Comprehensive Categorization: Sensitive Information Exposure");
DEFINITIONS.put(1418, "Comprehensive Categorization: Violation of Secure Design Principles");
DEFINITIONS.put(16, "Configuration");
DEFINITIONS.put(169, "DEPRECATED: Technology-Specific Special Elements");
DEFINITIONS.put(17, "DEPRECATED: Code");
Expand Down Expand Up @@ -635,7 +656,7 @@ final class CweDefinitions {
DEFINITIONS.put(1321, "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)");
DEFINITIONS.put(1322, "Use of Blocking Code in Single-threaded, Non-blocking Context");
DEFINITIONS.put(1323, "Improper Management of Sensitive Trace Data");
DEFINITIONS.put(1324, "Sensitive Information Accessible by Physical Probing of JTAG Interface");
DEFINITIONS.put(1324, "DEPRECATED: Sensitive Information Accessible by Physical Probing of JTAG Interface");
DEFINITIONS.put(1325, "Improperly Controlled Sequential Memory Allocation");
DEFINITIONS.put(1326, "Missing Immutable Root of Trust in Hardware");
DEFINITIONS.put(1327, "Binding to an Unrestricted IP Address");
Expand All @@ -655,7 +676,7 @@ final class CweDefinitions {
DEFINITIONS.put(1342, "Information Exposure through Microarchitectural State after Transient Execution");
DEFINITIONS.put(135, "Incorrect Calculation of Multi-Byte String Length");
DEFINITIONS.put(1351, "Improper Handling of Hardware Behavior in Exceptionally Cold Environments");
DEFINITIONS.put(1357, "Reliance on Uncontrolled Component");
DEFINITIONS.put(1357, "Reliance on Insufficiently Trustworthy Component");
DEFINITIONS.put(138, "Improper Neutralization of Special Elements");
DEFINITIONS.put(1384, "Improper Handling of Physical or Environmental Conditions");
DEFINITIONS.put(1385, "Missing Origin Validation in WebSockets");
Expand All @@ -666,6 +687,7 @@ final class CweDefinitions {
DEFINITIONS.put(1392, "Use of Default Credentials");
DEFINITIONS.put(1393, "Use of Default Password");
DEFINITIONS.put(1394, "Use of Default Cryptographic Key");
DEFINITIONS.put(1395, "Dependency on Vulnerable Third-Party Component");
DEFINITIONS.put(14, "Compiler Removal of Code to Clear Buffers");
DEFINITIONS.put(140, "Improper Neutralization of Delimiters");
DEFINITIONS.put(141, "Improper Neutralization of Parameter/Argument Delimiters");
Expand Down Expand Up @@ -1044,7 +1066,7 @@ final class CweDefinitions {
DEFINITIONS.put(523, "Unprotected Transport of Credentials");
DEFINITIONS.put(524, "Use of Cache Containing Sensitive Information");
DEFINITIONS.put(525, "Use of Web Browser Cache Containing Sensitive Information");
DEFINITIONS.put(526, "Exposure of Sensitive Information Through Environmental Variables");
DEFINITIONS.put(526, "Cleartext Storage of Sensitive Information in an Environment Variable");
DEFINITIONS.put(527, "Exposure of Version-Control Repository to an Unauthorized Control Sphere");
DEFINITIONS.put(528, "Exposure of Core Dump File to an Unauthorized Control Sphere");
DEFINITIONS.put(529, "Exposure of Access Control List Files to an Unauthorized Control Sphere");
Expand Down Expand Up @@ -1375,6 +1397,8 @@ final class CweDefinitions {
DEFINITIONS.put(1350, "Weaknesses in the 2020 CWE Top 25 Most Dangerous Software Weaknesses");
DEFINITIONS.put(1358, "Weaknesses in SEI ETF Categories of Security Vulnerabilities in ICS");
DEFINITIONS.put(1387, "Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses");
DEFINITIONS.put(1400, "Comprehensive Categorization for Software Assurance Trends");
DEFINITIONS.put(1425, "Weaknesses in the 2023 CWE Top 25 Most Dangerous Software Weaknesses");
DEFINITIONS.put(2000, "Comprehensive CWE Dictionary");
DEFINITIONS.put(604, "Deprecated Entries");
DEFINITIONS.put(629, "Weaknesses in OWASP Top Ten (2007)");
Expand Down
10 changes: 5 additions & 5 deletions scripts/generate-cwe-definitions.py
100644 → 100755
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@

template = """package {{ package }};
import javax.annotation.Generated;
import jakarta.annotation.Generated;
import java.util.HashMap;
import java.util.Map;
Expand All @@ -38,20 +38,20 @@

if __name__ == "__main__":
arg_parser = ArgumentParser()
arg_parser.add_argument("-p", "--package", default="org.hyades.resolver", help="Package name")
arg_parser.add_argument("-p", "--package", default="org.hyades.common.cwe", help="Package name")
arg_parser.add_argument("-o", "--output", type=Path, required=True, help="Output file path")
args = arg_parser.parse_args()

with TemporaryFile(suffix=".zip") as tmp:
with requests.get("https://cwe.mitre.org/data/xml/cwec_latest.xml.zip") as res:
with requests.get("https://cwe.mitre.org/data/xml/cwec_v4.12.xml.zip") as res:
tmp.write(res.content)
tmp.seek(0)
with zipfile.ZipFile(tmp) as zip:
with zip.open("cwec_v4.9.xml") as dict_file:
with zip.open("cwec_v4.12.xml") as dict_file:
tree: ElementTree = parse_etree(dict_file)

tree_root = tree.getroot()
namespaces = {"cwe": "http://cwe.mitre.org/cwe-6"}
namespaces = {"cwe": "http://cwe.mitre.org/cwe-7"}
definitions: dict[int, str] = OrderedDict()


Expand Down

0 comments on commit 24c6dcb

Please sign in to comment.