Adding Distant Related Items

[lrljoe]

I wrote something very similar for mapping various frameworks together some time ago.

I've noticed that some of the more distant relations aren't mapped into the CREs, e.g. a CRE contains a CWE, but doesn't consistently delve into the related elements (e.g. the mapping from the related CWE to an OWASP top-10 where that link exists).

Before I think about creating an enormous PR to add (what I see as) the missing links, is this in appetite?

[robvanderveer]

Hi. Thanks for this input. The goal is to have relations on relations to reach distant relations in OpenCRE.
A common requirement links to a CWE, and from that common requirement the related common requirements should bring you to corresponding entries in the top 10.
I'm interested in examples, because chances are that we have omissions, or perhaps a pointer to how this mechanism is perhaps unclear. Thanks again!

[lrljoe]

Albeit it's an outdated one, as it's an old OWASP Top-10, but the one that immediately springs to mind as I looked at it earlier is this one, not sure if older top-10s etc are automatically excluded due to age?

I do know of quite a few places that still "adhere" to the older top-10s sadly, so may prove useful to someone anyway!

CRE: 155-155
  Links to
    CRE : 117-371 : Use a centralized access control mechanism](https://opencre.org/cre/117-371)
      Links to
        CWE-284
          Links to
             OWASP Top Ten 2017 Category A5 - Broken Access Control

I presently map OWASP 2004 through to 2021 where it's a clear link between them, as various older CVEs etc link into those and unentertainingly, there's still "findings" out there from way back then.

The sheer quantity of correlation in this project is awesome by the way, massive congrats and thanks

[robvanderveer]

If you go to the 117-371, you'll see on that page the link to the top 10 Broken acces control. It is linked through technical application access control. This is the design of OpenCRE: it shows why/through wat concepts a certain standard is linked, instead of showing an unorganized long list of standards. Makes sense? Now, if your question would be: how does CWE map to just the top 10, then you can use the map analysis function and you'll see the full list with every top 10 entry. See https://www.opencre.org/map_analysis?base=OWASP%20Top%2010%202021&compare=CWE

[lrljoe]

I guess my question is more around ASVS/CWE links, that link off to let's say OWASP 2017 items.

Appreciate that mappings are present for OWASP 2021 where the links exist in the related items.

Has the mapping for say a CWE or ASVS referencing A7 of OWASP 2017 been made to the relevant OWASP 2021 item?
I know quite a few of the CWE and ASVS still relate in their own data sets to older top-10s for example.

Effectively just trying to figure out whether any of my remapping from older top-10s etc needs adding as a PR, or if I can abandon that and rely solely on the OpenCRE data!
Which frankly is amazing, and means I can remove hundreds of lines of code for mapping it all myself ha