proposal: merge 12.3.6 to 10.3.2

[elarlang]

Related requirements:

#	Description	L1	L2	L3	CWE
12.3.6	Verify that the application does not include and execute functionality from untrusted sources, such as unverified content distribution networks, JavaScript libraries, node npm libraries, or server-side DLLs.		✓	✓	829
10.3.2	[MODIFIED] Verify that the application only loads or executes code, modules, content or plugins from sources not under the application's direct control/protection if it employs integrity protections, such as code signing.	✓	✓	✓	829

Proposal: merge 12.3.6 to 10.3.2

[jmanico]

Agreed

[tghosth]

Waiting for #1427

[tghosth]

@set-reminder 3 weeks @tghosth to look at this

[octo-reminder]

⏰ Reminder
Wednesday, January 18, 2023 12:00 AM (GMT+01:00)

@tghosth to look at this

[octo-reminder]

🔔 @tghosth

@tghosth to look at this

[jmanico]

For 12.3.6, we often need to load javascript from different domains in browser-based apps for page load performance. Sub-resource Integrity can help this be done safely. So if we don't have it already, I'd suggest we add it as an exception for 12.3.6 - as is 12.3.6 is too strict.

[randomstuff]

[MODIFIED] Verify that the application only loads or executes code, modules, content or plugins from sources not under the application's direct control/protection if it employs integrity protections, such as code signing.

Would it be clearer to say:

[MODIFIED] Verify that the application employs integrity protections, such as code signing when it loads or executes code, modules, content or plugins from sources not under the application's direct control/protection.

[jmanico]

I propose we kill them both. Third party library issues covers this, and the SRI requirement covers external JS libraries.

[jmanico]

And just so we keep some of this I suggest we modify 10.6.2 a little to include transitive dependencies.

10.6.2	[MODIFIED] Verify that third party components and all of their transitive dependencies are being included from the expected repository, whether that is internally owned or an external source, and that there is no risk of a dependency confusion attack.	✓	✓	✓	427

[jmanico]

It looks like we are going to PR.

12.3.6 is already covered by 50.6.1 so 12.3.6 can go away.
10.3.2 can also go away, and just to make sure we preserve that knowledge we are going to make a small change to 10.6.2 to include transitive dependencies.

[ImanSharaf]

We have 50.6.1 and we can remove 12.3.6

#	Description	L1	L2	L3	CWE
50.6.1	[MODIFIED, MOVED FROM 14.2.3] Verify that if client-side assets, such as JavaScript libraries, CSS or web fonts, are hosted externally on a Content Delivery Network (CDN) or external provider, Subresource Integrity (SRI) is used to validate the integrity of the asset.	✓	✓	✓	829

[tghosth]

For the PR:

12.3.6 deleted as duplicate of 50.6.1.

10.3.2 deleted merged into 10.6.2.

10.6.2 make the relevant change.

@ImanSharaf