Guidance or examples on Classification
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 1.2k
- Forks
- 229
- PR merge metrics
- No merged PRs in 30d
Description
First of all excellent tool!
In some of the examples I have begun to build I see a lot of DS06 - Data Leak threats.
I see from the source code that the method hasDataLeaks() compares the classification of data in the dataflow sink and source to the classification of the data that is being transmitted, which seems to make sense.
Is there any guidance / examples / OWASP documentation on how one should model the classification in data and data flows?
I could contribute with an example when I get this figured out.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the hasDataLeaks() method and the existing examples that produce DS06 data-leak threats. Then consult the OWASP documentation mentioned in the issue to determine how data and data-flow classifications should be modeled. Done means providing clear guidance or an example that demonstrates the classification approach.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100