daveed
Does the hex package sobelow implements OWASP?
Does anyone know if the library sobelow (GitHub - nccgroup/sobelow: Security-focused static analysis for the Phoenix Framework · GitHub) implements OWASP (Open Web Application Security Project) (https://www.owasp.org)?
Most Liked
daveed
Hi Griffin! Thanks that helps a lot - I checked OWASP top 10 2017 and mapped this way:
TOP 10 from OWASP (Sign in to GitHub · GitHub)
A1 Injection flaws, such as SQL, NoSQL, OS, and LDAP injection
A2 Broken Authentication
A3 Sensitive Data Exposure
A4 External Entities (XXE)
A5 Broken Access Control
A6 Security Misconfiguration
A7 Cross-Site Scripting (XSS)
A8 Insecure Deserialization
A9 Components with Known Vulnerabilities
A10 Insufficient Logging & Monitoring
From your package sobelow (sobelow/README.md at master · nccgroup/sobelow · GitHub)
[A6] Insecure configuration
[A9] Known-vulnerable Dependencies
[A7] Cross-Site Scripting
[A1] SQL injection
[A1] Command injection
[A4] Denial of Service
[A5] Directory traversal
[A8] Unsafe serialization
griffinbyatt
Hi Daveed! Sobelow checks for a number of top 10 OWASP vulnerabilities. However, it does not check for things like access control or authentication vulnerabilities, which will vary greatly from app to app.
Popular in Questions
Other popular topics
Latest on Elixir Forum
Sponsor Spotlight
We build reliable cloud platforms for business-critical systems.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #websockets
- #supervisor
- #elixirconf-us
- #advent-of-code
- #distillery
- #processes
- #forms
- #api
- #metaprogramming
- #hex
- #security
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking for Elixir devs who love to ship. Start your free account.
Develop your skills with books, videos, and courses.
Enabling companies to succeed by building software people love.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"