Provide cross references to cornucopia

[jgadsden]

Describe what content should be added :
It would be good to link across to the cornucopia cards from the checklist
The first step to cross referencing to cornucopia is provide identifiers to the checklist (done in #225 )
then the checklists can link across to the cornucopia cards API

migrated from previous repo: 'Provide cross references to cornucopia' #231

Context :
Section: 06-design/02-web-app-checklist/

From @sydseter 's comment in Threat dragon issue #140 'Integrate threat engine with Cornucopia / EoP cards', we have :
Full yaml source can be found at https://github.com/OWASP/cornucopia/tree/master/source
We also have endpoints to the OWASP Cornucopia Website App and Mobile App editions.

Example of card 2 in the OWASP Cornucopia Website App Edition:

https://cornucopia.owasp.org/cards/PC2
https://cornucopia.owasp.org/cards/AZ2
https://cornucopia.owasp.org/cards/CO2
https://cornucopia.owasp.org/cards/CR2
https://cornucopia.owasp.org/cards/VE2
https://cornucopia.owasp.org/cards/SM2

OWASP Cornucopia Mobile App Edition:

https://cornucopia.owasp.org/cards/AA2
https://cornucopia.owasp.org/cards/CO2
https://cornucopia.owasp.org/cards/COM2
https://cornucopia.owasp.org/cards/CRM2
https://cornucopia.owasp.org/cards/NS2
https://cornucopia.owasp.org/cards/PC2
https://cornucopia.owasp.org/cards/RS2

[sydseter]

I would like to start this. Is that ok?

[sydseter]

There are a couple of things I would like to add to https://github.com/OWASP/DevGuide/blob/8fa0fc43677f7b1ba553cc9a3f42d6edaa3892de/docs/en/04-design/01-threat-modeling/04-cornucopia.md as well. E.g., that we now have an online edition where you can play OWASP Cumulus, Elevation of MLSec, and Elevation of Privilege.

[sydseter]

I also saw that you needed some help with the Spanish version. I can help with that as well.

[jgadsden]

yes, please go ahead with this @sydseter , you are certainly best placed to do this

[sydseter]

@jgadsden I recognize that I am coming a bit late to the party, but could I come with some suggestions to checklist? I’t meant to be a practical list right? As it stands now, it looks like a merger between ASVS and SCP? Wouldn’t it be better to let this be more of the practical answer list giving concrete advice more towards coding and not reiterate design fundamentals?

I see that here are some things that’s kept in the secure coding section that came from https://github.com/OWASP/DevGuide/blob/main/docs/en/12-appendices/01-implementation-dos-donts/02-secure-coding.mdit looks a bit like the leftovers are kept there.

If it’s ok, I would like to open some issues related to the child cklist and work on separate sections asking for comments and feedback ofcourse. Would that be ok?

[jgadsden]

Very good points @sydseter - the checklist in 04-design/02-web-app-checklist is the checklist from Secure Coding Practices Quick-reference Guide copied over just about word-for-word:
https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/

Cornucopia cards reference (or used to) the SCP-QRG and so we wanted to provide this reference in a project that was active.
I archived the SCP-QRG some time ago, but the Version 2.1 of the Secure Coding Practices quick reference guide is still available to provide the numbering system used in the Cornucopia playing cards.

Anyway, that is the background to it all, and why I wanted to provide the cross reference for Cornucopia for the DevGuide checklist - I still feel a bit guilty about archiving SCP-QRG :)

[jgadsden]

I also saw that you needed some help with the Spanish version. I can help with that as well.

@sydseter it would be great to have help with the Spanish translation, thank you!
Could you coordinate with @roxana-calderon-owasp ?
Just to avoid duplicating effort as Roxana may be working on some sections

[jgadsden]

If it’s ok, I would like to open some issues related to the child cklist and work on separate sections asking for comments and feedback ofcourse. Would that be ok?

certainly @sydseter , please go ahead and suggest / modify at will, it would be good to have this section revised

[sydseter]

i can see that it already deviate from the SCP ver. 2.1 quite a bit. I don’t see that as a big issue. Parts of it was quite dated anyway. I’ll focus on the checklist first.