Skip to content

Add OWASP CSRFGuard metadata #372

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add OWASP CSRFGuard metadata #372

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/workflows/validate-owasp-metadata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
name: Validate OWASP entity metadata

on:
pull_request:
paths:
- '*.owasp.yaml'
push:
paths:
- '*.owasp.yaml'

concurrency:
cancel-in-progress: true
group: ${{ github.repository }}-${{ github.workflow }}-${{ github.ref }}

jobs:
validate-metadata:
runs-on: ubuntu-latest

steps:
- name: Checkout code
uses: actions/checkout@v5

- name: Validate metadata file
uses: owasp/nest-schema/.github/actions/validate@a733198b4a942eb12d3ee8629cd9e0d409b1b2b9
Comment on lines +17 to +24

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 24 days ago

To fix this issue, you should add a permissions block to the workflow that explicitly sets the permissions granted to the GITHUB_TOKEN. Since neither the checkout nor the validation step are expected to require write access, the minimal privilege required is likely contents: read. You may add this block either at the top level (applies to all jobs) or under the validate-metadata job specifically. The best approach is to add it as a top-level key just below the workflow name, which will make the permission restriction explicit and protect against permission creep in future jobs. No new methods or imports are required—just a change to the YAML configuration file at the top level.

Suggested changeset 1
.github/workflows/validate-owasp-metadata.yaml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/validate-owasp-metadata.yaml b/.github/workflows/validate-owasp-metadata.yaml
--- a/.github/workflows/validate-owasp-metadata.yaml
+++ b/.github/workflows/validate-owasp-metadata.yaml
@@ -1,4 +1,6 @@
 name: Validate OWASP entity metadata
+permissions:
+  contents: read
 
 on:
   pull_request:
EOF
@@ -1,4 +1,6 @@
name: Validate OWASP entity metadata
permissions:
contents: read

on:
pull_request:
Copilot is powered by AI and may make mistakes. Always verify output.
32 changes: 32 additions & 0 deletions project.owasp.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
audience:
- breaker
- builder
leaders:
- name: Azzeddine RAMRAMI
email: [email protected]
github: aramrami
- name: Istvan Albert-Toth
email: [email protected]
- name: Sébastien Gioria
email: [email protected]
github: SPoint42
level: 4
license:
- BSD-3-Clause
name: OWASP CSRFGuard
pitch: OWASP CSRFGuard is a library that implements a variant of the synchronizer token pattern to mitigate the risk of Cross-Site Request Forgery (CSRF)
attacks.
repositories:
- name: www-project-csrfguard
url: https://github.com/OWASP/www-project-csrfguard
description: The aim of this project is to protect Java applications against CSRF attacks with the use of Synchronizer Tokens
- name: OWASP-CSRFGuard
url: https://github.com/aramrami/OWASP-CSRFGuard
description: OWASP CSRFGuard 3.1.0
tags:
- csrfguard
- defenders
- breakers
- vulnerability-management
type: tool
website: https://owasp.org/www-project-csrfguard
Loading