Skip to content

Commit 5fa2656

Browse files
rdmuellerrdmueller
authored
Merge pull request #131 from LLM-Coding/copilot/add-owasp-top-10-anchor
Add OWASP Top 10 semantic anchor (EN + DE)
2 parents 3867dde + a442a4c commit 5fa2656

File tree

6 files changed

+153
-5
lines changed

6 files changed

+153
-5
lines changed

‎docs/anchors/owasp-top-10.adoc‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
= OWASP Top 10
2+
:categories: testing-quality
3+
:roles: software-developer, software-architect, qa-engineer, devops-engineer, consultant, team-lead
4+
:related: regulated-environment, iec-61508-sil-levels
5+
:proponents: OWASP Foundation
6+
:tags: security, web-security, vulnerabilities, risk, appsec, owasp
7+
8+
[%collapsible]
9+
====
10+
Full Name:: OWASP Top 10 Web Application Security Risks
11+
12+
Also known as:: OWASP Top Ten, Web Application Security Top 10
13+
14+
[discrete]
15+
== *Core Concepts*:
16+
17+
A01 – Broken Access Control:: Failure to enforce restrictions on what authenticated users can do; most prevalent web application risk
18+
19+
A02 – Cryptographic Failures:: Sensitive data exposed due to weak or absent encryption; previously called "Sensitive Data Exposure"
20+
21+
A03 – Injection:: Untrusted data sent to an interpreter as part of a command or query (SQL, OS, LDAP injection)
22+
23+
A04 – Insecure Design:: Missing or ineffective security controls resulting from flawed design and threat modeling
24+
25+
A05 – Security Misconfiguration:: Insecure default settings, incomplete configurations, open cloud storage, verbose error messages
26+
27+
A06 – Vulnerable and Outdated Components:: Use of components (libraries, frameworks) with known vulnerabilities
28+
29+
A07 – Identification and Authentication Failures:: Weaknesses in authentication, session management, and credential handling
30+
31+
A08 – Software and Data Integrity Failures:: Code and infrastructure that does not protect against integrity violations (e.g., insecure deserialization, CI/CD tampering)
32+
33+
A09 – Security Logging and Monitoring Failures:: Insufficient logging, detection, and response to breaches
34+
35+
A10 – Server-Side Request Forgery (SSRF):: Server fetches remote resources from attacker-controlled URLs without validation
36+
37+
38+
Key Proponent:: OWASP Foundation (https://owasp.org/Top10/, first published 2003, current edition 2021)
39+
40+
[discrete]
41+
== *When to Use*:
42+
43+
* Performing security risk assessments on web applications
44+
* Establishing secure coding guidelines and developer training programs
45+
* Conducting threat modeling and security design reviews
46+
* Prioritizing security findings during code reviews and penetration tests
47+
* Defining acceptance criteria for security requirements
48+
* Auditing third-party or open-source components for known vulnerabilities
49+
50+
[discrete]
51+
== *Related Anchors*:
52+
53+
* <<regulated-environment,Regulated Environment>>
54+
* <<iec-61508-sil-levels,IEC 61508 SIL Levels>>
55+
====

‎docs/anchors/owasp-top-10.de.adoc‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
= OWASP Top 10
2+
:categories: testing-quality
3+
:roles: software-developer, software-architect, qa-engineer, devops-engineer, consultant, team-lead
4+
:related: regulated-environment, iec-61508-sil-levels
5+
:proponents: OWASP Foundation
6+
:tags: security, web-security, vulnerabilities, risk, appsec, owasp
7+
8+
[%collapsible]
9+
====
10+
Vollständiger Name:: OWASP Top 10 Web-Anwendungs-Sicherheitsrisiken
11+
12+
Auch bekannt als:: OWASP Top Ten, Web Application Security Top 10
13+
14+
[discrete]
15+
== *Kernkonzepte*:
16+
17+
A01 – Fehlerhafte Zugriffskontrolle:: Unzureichende Durchsetzung von Einschränkungen für authentifizierte Benutzer; häufigste Schwachstelle in Webanwendungen
18+
19+
A02 – Kryptographische Fehler:: Offenlegung sensibler Daten durch schwache oder fehlende Verschlüsselung; früher als „Sensitive Data Exposure" bekannt
20+
21+
A03 – Injection:: Einschleusen nicht vertrauenswürdiger Daten in einen Interpreter (SQL-, OS-, LDAP-Injection)
22+
23+
A04 – Unsicheres Design:: Fehlende oder ineffektive Sicherheitsmaßnahmen durch fehlerhaftes Design und unzureichendes Threat Modeling
24+
25+
A05 – Sicherheitsfehlkonfiguration:: Unsichere Standardeinstellungen, unvollständige Konfigurationen, offener Cloud-Speicher, zu ausführliche Fehlermeldungen
26+
27+
A06 – Veraltete und anfällige Komponenten:: Einsatz von Bibliotheken, Frameworks oder Komponenten mit bekannten Schwachstellen
28+
29+
A07 – Fehler bei Identifizierung und Authentifizierung:: Schwächen bei Authentifizierung, Session-Management und Credential-Verwaltung
30+
31+
A08 – Fehler bei Software- und Datenintegrität:: Fehlende Absicherung gegen Integritätsverletzungen (z. B. unsichere Deserialisierung, Manipulation der CI/CD-Pipeline)
32+
33+
A09 – Unzureichendes Sicherheits-Logging und -Monitoring:: Mangelnde Protokollierung, Erkennung und Reaktion auf Sicherheitsvorfälle
34+
35+
A10 – Server-Side Request Forgery (SSRF):: Server ruft externe Ressourcen von angreiferkontrollierten URLs ab, ohne diese zu validieren
36+
37+
38+
Schlüsselvertreter:: OWASP Foundation (https://owasp.org/Top10/, erstmals 2003 veröffentlicht, aktuelle Ausgabe 2021)
39+
40+
[discrete]
41+
== *Wann zu verwenden*:
42+
43+
* Durchführung von Sicherheitsrisikobewertungen für Webanwendungen
44+
* Erstellung von Richtlinien für sicheres Programmieren und Entwicklerschulungen
45+
* Durchführung von Threat Modeling und sicherheitsorientierten Design-Reviews
46+
* Priorisierung von Sicherheitsbefunden bei Code-Reviews und Penetrationstests
47+
* Definition von Abnahmekriterien für Sicherheitsanforderungen
48+
* Prüfung von Drittanbieter- oder Open-Source-Komponenten auf bekannte Schwachstellen
49+
50+
[discrete]
51+
== *Verwandte Anker*:
52+
53+
* <<regulated-environment,Reguliertes Umfeld>>
54+
* <<iec-61508-sil-levels,IEC 61508 SIL-Stufen>>
55+
====

‎website/public/data/anchors.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -625,6 +625,37 @@
625625
"tags": [],
626626
"filePath": "docs/anchors/nelson-rules.adoc"
627627
},
628+
{
629+
"id": "owasp-top-10",
630+
"title": "OWASP Top 10",
631+
"categories": [
632+
"testing-quality"
633+
],
634+
"roles": [
635+
"software-developer",
636+
"software-architect",
637+
"qa-engineer",
638+
"devops-engineer",
639+
"consultant",
640+
"team-lead"
641+
],
642+
"related": [
643+
"regulated-environment",
644+
"iec-61508-sil-levels"
645+
],
646+
"proponents": [
647+
"OWASP Foundation"
648+
],
649+
"tags": [
650+
"security",
651+
"web-security",
652+
"vulnerabilities",
653+
"risk",
654+
"appsec",
655+
"owasp"
656+
],
657+
"filePath": "docs/anchors/owasp-top-10.adoc"
658+
},
628659
{
629660
"id": "problem-space-nvc",
630661
"title": "Problem Space NVC",

‎website/public/data/categories.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,7 @@
118118
"anchors": [
119119
"iec-61508-sil-levels",
120120
"mutation-testing",
121+
"owasp-top-10",
121122
"property-based-testing",
122123
"tdd-chicago-school",
123124
"tdd-london-school",

‎website/public/data/metadata.json‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
2-
"generatedAt": "2026-03-01T22:48:19.586Z",
2+
"generatedAt": "2026-03-04T12:59:17.826Z",
33
"version": "1.0.0",
44
"counts": {
5-
"anchors": 53,
5+
"anchors": 54,
66
"categories": 12,
77
"roles": 12
88
},
99
"statistics": {
10-
"averageRolesPerAnchor": "3.28",
10+
"averageRolesPerAnchor": "3.33",
1111
"averageCategoriesPerAnchor": "1.00",
12-
"anchorsWithTags": 8,
13-
"anchorsWithRelated": 7
12+
"anchorsWithTags": 9,
13+
"anchorsWithRelated": 8
1414
}
1515
}

‎website/public/data/roles.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
"mental-model-according-to-naur",
3838
"morphological-box",
3939
"moscow",
40+
"owasp-top-10",
4041
"problem-space-nvc",
4142
"pyramid-principle",
4243
"regulated-environment",
@@ -71,6 +72,7 @@
7172
"five-whys",
7273
"iec-61508-sil-levels",
7374
"nelson-rules",
75+
"owasp-top-10",
7476
"regulated-environment",
7577
"semantic-versioning",
7678
"spc",
@@ -116,6 +118,7 @@
116118
"five-whys",
117119
"iec-61508-sil-levels",
118120
"mutation-testing",
121+
"owasp-top-10",
119122
"property-based-testing",
120123
"regulated-environment",
121124
"rubber-duck-debugging",
@@ -144,6 +147,7 @@
144147
"madr",
145148
"mece",
146149
"morphological-box",
150+
"owasp-top-10",
147151
"pugh-matrix",
148152
"regulated-environment",
149153
"solid-principles",
@@ -175,6 +179,7 @@
175179
"mental-model-according-to-naur",
176180
"morphological-box",
177181
"mutation-testing",
182+
"owasp-top-10",
178183
"property-based-testing",
179184
"regulated-environment",
180185
"rubber-duck-debugging",
@@ -210,6 +215,7 @@
210215
"madr",
211216
"mental-model-according-to-naur",
212217
"moscow",
218+
"owasp-top-10",
213219
"pugh-matrix",
214220
"pyramid-principle",
215221
"regulated-environment",

0 commit comments

Comments
 (0)