Convert cwes list to markdown with fewer rows and columns #737

sei-renae · 2025-03-05T21:53:28Z

Resolves #529
Resolves #530
Resolves #713

The CWEs list on reference/decision_points/exploitation/#cwe-ids-for-poc has many rows wherein the 'Possible POC' = 'no'; therefore, these rows are irrelevant to Exploitation. In rows where 'Possible POC' = 'no', 'In NVD's CWE slice' is also always 'no' and information about the exploit is nan.
Furthermore, #529 describes a hypothetical list of CWEs, but was not updated after this list was obtained.

This PR cleans the CWEs list to that:

only rows with column 'Possible POC' = 'yes' are included, thus eliminating rows where column element is nan to resolve Empty csv columns print nan on github pages #713.
column 'In NVD's CWE slice' is removed because the answer is always 'yes'.
column CWE-ID is prefixed with 'CWE-' and hyperlinked to the corresponding CWE.
columns Tools and Links are merged as hyperlinks to the tools.
the need for side-scrolling is eliminated to resolve Eliminate need for side scrolling of CWE table in exploitation.md #530.
instead of a csv, this is a markdown file.

The new table will look like this:

The PR also updates the language described in SSVC/docs/topics/information_sources.md to resolve #529 .

…ide scrolling, add hyperlinks, and create a markdown version of the csv per issues 530 and 713.

sei-renae · 2025-03-06T13:25:05Z

I didn't find where the link checker failed - would appreciate a second set of eyes.

ahouseholder · 2025-03-06T19:14:01Z

docs/topics/information_sources.md

-Since CWE classifies clusters of related vulnerabilities, the community could likely curate a list of CWE-IDs for which this condition of well known exploit technique is satisfied.
-Once that list were curated, it could be used to automatically populate a CVE-ID as [*proof of concept*](../reference/decision_points/exploitation.md) if the CWE-ID of which it is an instance is on the list.
-Such a check could not be exhaustive, since there are other conditions that satisfy [*proof of concept*](../reference/decision_points/exploitation.md).
+We provide a non-exhaustive [list of CWE-IDs with known proofs of concept](../reference/decision_points/exploitation/#cwe-ids-for-poc). This is list is non-exhaustive becuase there are other conditions that satisfy [*proof of concept*](../reference/decision_points/exploitation.md).


link checker is choking on the first url in this line. I think it needs to end in exploitation.md#cwe-ids-for-poc instead

ahouseholder · 2025-03-06T19:19:03Z

I'd also request that this PR remove the data/csvs/cwe directory and the data/csvs/cwe/possible-cwe-with-poc-examples.csv file it contains. That way we can be clearer on where the canonical information resides (in the new markdown table already included in this PR).

… single source of truth.

…rsion of schema is available. (#760) * Convert cwes list to markdown with fewer rows and columns (#737) * Update verbiage because we have a list of CWE-IDs per issue 529. * Clean CWE-IDs list to only exploit_possible=yes, eliminate need for side scrolling, add hyperlinks, and create a markdown version of the csv per issues 530 and 713. * markdown lint * Fix broken link to cwe examples and remove cwe csvs file to enforce a single source of truth. * Make the linkchecker happy * Really fix links this time * Replace `Track*`/`Track *` with `Monitor` in CISA-based decision model (#738) * change type hints on OutcomeGroup class * black reformat * replace `Track *` with `Monitor` * carve a new version of CISA OutcomeGroup to reflect `Track *` -> `Monitor` * replace `Track*` with `Monitor` in json * replace CISA.json with Monitor outcome value * more substitutions * Revert "Replace `Track*`/`Track *` with `Monitor` in CISA-based decision mode…" (#741) This reverts commit a54f999. * Bump markdown-exec from 1.10.0 to 1.10.1 (#746) Bumps [markdown-exec](https://github.com/pawamoy/markdown-exec) from 1.10.0 to 1.10.1. - [Release notes](https://github.com/pawamoy/markdown-exec/releases) - [Changelog](https://github.com/pawamoy/markdown-exec/blob/main/CHANGELOG.md) - [Commits](pawamoy/markdown-exec@1.10.0...1.10.1) --- updated-dependencies: - dependency-name: markdown-exec dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump the mkdocs group with 6 updates (#747) Bumps the mkdocs group with 6 updates: | Package | From | To | | --- | --- | --- | | [mkdocs-bibtex](https://github.com/shyamd/mkdocs-bibtex) | `4.2.2` | `4.2.3` | | [mkdocs-include-markdown-plugin](https://github.com/mondeja/mkdocs-include-markdown-plugin) | `7.1.4` | `7.1.5` | | [mkdocs-material](https://github.com/squidfunk/mkdocs-material) | `9.6.7` | `9.6.9` | | [mkdocstrings](https://github.com/mkdocstrings/mkdocstrings) | `0.28.2` | `0.29.0` | | [mkdocstrings-python](https://github.com/mkdocstrings/python) | `1.16.2` | `1.16.5` | | [mkdocs-print-site-plugin](https://github.com/timvink/mkdocs-print-site-plugin) | `2.6.0` | `2.7.1` | Updates `mkdocs-bibtex` from 4.2.2 to 4.2.3 - [Release notes](https://github.com/shyamd/mkdocs-bibtex/releases) - [Commits](shyamd/mkdocs-bibtex@v4.2.2...v4.2.3) Updates `mkdocs-include-markdown-plugin` from 7.1.4 to 7.1.5 - [Release notes](https://github.com/mondeja/mkdocs-include-markdown-plugin/releases) - [Commits](mondeja/mkdocs-include-markdown-plugin@v7.1.4...v7.1.5) Updates `mkdocs-material` from 9.6.7 to 9.6.9 - [Release notes](https://github.com/squidfunk/mkdocs-material/releases) - [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG) - [Commits](squidfunk/mkdocs-material@9.6.7...9.6.9) Updates `mkdocstrings` from 0.28.2 to 0.29.0 - [Release notes](https://github.com/mkdocstrings/mkdocstrings/releases) - [Changelog](https://github.com/mkdocstrings/mkdocstrings/blob/main/CHANGELOG.md) - [Commits](mkdocstrings/mkdocstrings@0.28.2...0.29.0) Updates `mkdocstrings-python` from 1.16.2 to 1.16.5 - [Release notes](https://github.com/mkdocstrings/python/releases) - [Changelog](https://github.com/mkdocstrings/python/blob/main/CHANGELOG.md) - [Commits](mkdocstrings/python@1.16.2...1.16.5) Updates `mkdocs-print-site-plugin` from 2.6.0 to 2.7.1 - [Release notes](https://github.com/timvink/mkdocs-print-site-plugin/releases) - [Commits](timvink/mkdocs-print-site-plugin@v2.6.0...v2.7.1) --- updated-dependencies: - dependency-name: mkdocs-bibtex dependency-type: direct:production update-type: version-update:semver-patch dependency-group: mkdocs - dependency-name: mkdocs-include-markdown-plugin dependency-type: direct:production update-type: version-update:semver-patch dependency-group: mkdocs - dependency-name: mkdocs-material dependency-type: direct:production update-type: version-update:semver-patch dependency-group: mkdocs - dependency-name: mkdocstrings dependency-type: direct:production update-type: version-update:semver-minor dependency-group: mkdocs - dependency-name: mkdocstrings-python dependency-type: direct:production update-type: version-update:semver-patch dependency-group: mkdocs - dependency-name: mkdocs-print-site-plugin dependency-type: direct:production update-type: version-update:semver-minor dependency-group: mkdocs ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * add `mdlint_fix` target to Makefile (#744) * pin changed-files action to specific sha1 (#750) * Add NameSpace Enum (#749) * add a namespace Enum along with a pydantic dataclass validator to enforce it Valid = str in enum OR str.startswith("x_") * add validator to _Namespaced mixin class * refactor base classes to use NameSpace enum values * add optional "x_" prefix as valid namespace pattern * update unit tests * add docstrings * bump python test version to 3.12 * update the regex pattern for namespaces, add validation to pydantic field * refactor namespace validation methods * add unit tests * simplify regex to avoid inefficiencies * add length requirements to namespace patterns and fields * refactor regex again * add docstrings * add docs, update docstrings * Update Decision_Point-1-0-1.schema.json Modify Namespace information and examples as wel.. * Update Decision_Point-1-0-1.schema.json Matching x_custom/extension as examples for schema docs. * we shouldn't mention nciss yet as it's still a draft PR * missed an nciss --------- Co-authored-by: Vijay Sarvepalli <[email protected]> * Refactor SsvcDecisionPoint base class mixins (#743) * create a `_Valued` mixin * add `_Valued` mixin to base decision point class. Also reorder mixins to adjust default json output key order * update json examples to reflect new base class mixin ordering * add len() to _Valued mixin * add tests * Bump tj-actions/changed-files from 46.0.1 to 46.0.3 (#757) Bumps [tj-actions/changed-files](https://github.com/tj-actions/changed-files) from 46.0.1 to 46.0.3. - [Release notes](https://github.com/tj-actions/changed-files/releases) - [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md) - [Commits](tj-actions/changed-files@2f7c5bf...823fceb) --- updated-dependencies: - dependency-name: tj-actions/changed-files dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump markdown-exec from 1.10.1 to 1.10.2 (#756) Bumps [markdown-exec](https://github.com/pawamoy/markdown-exec) from 1.10.1 to 1.10.2. - [Release notes](https://github.com/pawamoy/markdown-exec/releases) - [Changelog](https://github.com/pawamoy/markdown-exec/blob/main/CHANGELOG.md) - [Commits](pawamoy/markdown-exec@1.10.1...1.10.2) --- updated-dependencies: - dependency-name: markdown-exec dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump mkdocstrings-python from 1.16.5 to 1.16.8 in the mkdocs group (#755) Bumps the mkdocs group with 1 update: [mkdocstrings-python](https://github.com/mkdocstrings/python). Updates `mkdocstrings-python` from 1.16.5 to 1.16.8 - [Release notes](https://github.com/mkdocstrings/python/releases) - [Changelog](https://github.com/mkdocstrings/python/blob/main/CHANGELOG.md) - [Commits](mkdocstrings/python@1.16.5...1.16.8) --- updated-dependencies: - dependency-name: mkdocstrings-python dependency-type: direct:production update-type: version-update:semver-patch dependency-group: mkdocs ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Allen D. Householder <[email protected]> Co-authored-by: sei-renae <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

sei-renae added 2 commits March 5, 2025 15:11

Update verbiage because we have a list of CWE-IDs per issue 529.

c7a2954

Clean CWE-IDs list to only exploit_possible=yes, eliminate need for s…

fe3adf2

…ide scrolling, add hyperlinks, and create a markdown version of the csv per issues 530 and 713.

markdown lint

8812f26

sei-renae marked this pull request as ready for review March 6, 2025 13:57

sei-renae requested review from ahouseholder, cgyarbrough, j--- and sei-vsarvepalli as code owners March 6, 2025 13:57

ahouseholder reviewed Mar 6, 2025

View reviewed changes

sei-renae added 2 commits March 6, 2025 15:47

Fix broken link to cwe examples and remove cwe csvs file to enforce a…

f596cbb

… single source of truth.

Make the linkchecker happy

758dfd3

sei-renae requested a review from ahouseholder March 6, 2025 20:54

ahouseholder approved these changes Mar 6, 2025

View reviewed changes

Really fix links this time

b4aa890

ahouseholder merged commit affa90f into CERTCC:main Mar 6, 2025
3 checks passed

sei-renae deleted the 713 branch March 6, 2025 21:21

ahouseholder added this to the 2025-03 milestone Mar 20, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Convert cwes list to markdown with fewer rows and columns #737

Convert cwes list to markdown with fewer rows and columns #737

Uh oh!

sei-renae commented Mar 5, 2025 •

edited

Loading

Uh oh!

sei-renae commented Mar 6, 2025

Uh oh!

ahouseholder Mar 6, 2025

Uh oh!

ahouseholder commented Mar 6, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Convert cwes list to markdown with fewer rows and columns #737

Convert cwes list to markdown with fewer rows and columns #737

Uh oh!

Conversation

sei-renae commented Mar 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sei-renae commented Mar 6, 2025

Uh oh!

ahouseholder Mar 6, 2025

Choose a reason for hiding this comment

Uh oh!

ahouseholder commented Mar 6, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sei-renae commented Mar 5, 2025 •

edited

Loading