@xenos1996/usa 2.23.0 → 2.25.0

package/rules/catalogues.yaml

@@ -7,7 +7,7 @@
 # the single place a standard's version is recorded.
 #
 # `prefixes` are matched case-insensitively against the start of each reference
-# (e.g. `ASVS-2.10.4` matches the `ASVS` prefix). `usa standards` reports how
+# (e.g. `ASVS-13.3.1` matches the `ASVS` prefix). `usa standards` reports how
 # many rules draw from each catalogue and how many the engine can fully decide.
 #
 # Adding a standard: give it a stable `id`, a human `name`, a `version`, and the

package/rules/core/architecture.yaml

@@ -142,7 +142,7 @@ rules:
       flags: i
     why: 'A hardcoded production URL means the only way to run staging is to edit source.'
     remediation: 'Read every environment-specific value from configuration; keep defaults that are safe for local dev.'
-    references: ['12-Factor:Config', 'ASVS-14.1.3']
+    references: ['12-Factor:Config']
 
   - id: ARCH-008
     title: Side effects are isolated and testable

package/rules/core/cicd.yaml

@@ -87,7 +87,7 @@ rules:
     evidence: 'dev / staging / production configuration, and confirmation that dev cannot reach production data.'
     why: 'Testing in production is a slogan, not a strategy.'
     remediation: 'At minimum: local + staging + production, with separate credentials and datasets per environment.'
-    references: ['NIST-SSDF-PO.5', 'ASVS-14.1.3']
+    references: ['NIST-SSDF-PO.5']
 
   - id: CICD-006
     title: Infrastructure is defined as code

package/rules/core/security.yaml

@@ -37,7 +37,7 @@ rules:
       flags: i
     why: 'Hardcoded credentials leak through every clone, fork, and CI log. Rotation after exposure is mandatory, not optional.'
     remediation: 'Move to environment variables backed by a secret manager; rotate anything that was ever committed.'
-    references: ['CWE-798', 'ASVS-2.10.4', 'OWASP-A02:2021']
+    references: ['CWE-798', 'ASVS-13.3.1', 'OWASP-A02:2021']
 
   - id: SEC-002
     title: Sensitive data is not written to logs
@@ -122,7 +122,7 @@ rules:
       flags: i
     why: 'String-built SQL is the oldest and most reliable way to lose a database. Parameterise or use a query builder.'
     remediation: 'Use parameterised queries ($1, ?, :name) or the ORM query API. Never interpolate user input into SQL text.'
-    references: ['CWE-89', 'ASVS-5.3.4', 'OWASP-A03:2021']
+    references: ['CWE-89', 'ASVS-1.2.4', 'OWASP-A03:2021']
 
   - id: SEC-006
     title: No unsafe dynamic code execution
@@ -158,7 +158,7 @@ rules:
       exclude: ['**/*.test.*', '**/*.spec.*', '**/scripts/**']
     why: 'Command injection with user-controlled input is full remote code execution, usually unauthenticated.'
     remediation: 'Use execFile with an argument array (no shell), or a library call. If unavoidable, allowlist the inputs.'
-    references: ['CWE-78', 'ASVS-5.3.8']
+    references: ['CWE-78', 'ASVS-1.2.5']
 
   - id: SEC-008
     title: User input is validated at a trust boundary
@@ -211,7 +211,7 @@ rules:
       exclude: ['**/*.test.*', '**/*.spec.*', '**/scripts/**', '**/tools/**']
     why: '`../../etc/passwd` is still the single most reliable bug class in file-serving code.'
     remediation: 'Resolve the path, then verify it is inside the intended base directory before touching the disk.'
-    references: ['CWE-22', 'ASVS-12.5.1']
+    references: ['CWE-22', 'ASVS-13.4.7']
 
   # ------------------------------------------------------------------ auth
   - id: SEC-011
@@ -348,7 +348,7 @@ rules:
       flags: i
     why: '`Access-Control-Allow-Origin: *` lets any site read authenticated responses from your API.'
     remediation: 'Allowlist exact origins; only use * for genuinely public, unauthenticated assets.'
-    references: ['CWE-942', 'ASVS-14.5.3']
+    references: ['CWE-942', 'ASVS-3.4.2']
 
   - id: SEC-018
     title: Security headers are set
@@ -367,7 +367,7 @@ rules:
       flags: i
     why: 'Four headers turn whole classes of browser attack off. They cost about six lines.'
     remediation: 'Use helmet (Node) or equivalent; add HSTS (max-age ≥31536000; includeSubDomains), X-Content-Type-Options: nosniff, Referrer-Policy, and a CSP.'
-    references: ['ASVS-14.4.3', 'OWASP-Secure-Headers']
+    references: ['ASVS-3.4.3', 'OWASP-Secure-Headers']
 
   - id: SEC-019
     title: CSRF protection for cookie-based sessions
@@ -435,7 +435,7 @@ rules:
       An upload endpoint that trusts the client's Content-Type is a remote code execution endpoint with extra steps.
     evidence: 'Upload handler: allowed MIME allowlist, max size, and where the file is written (outside the web root).'
     remediation: 'Allowlist extensions AND sniff content; cap size; store outside the served directory; serve from a separate origin.'
-    references: ['CWE-434', 'ASVS-12.5.2']
+    references: ['CWE-434', 'ASVS-5.3.1']
 
   - id: SEC-023
     title: PII is identified and protected at rest
@@ -534,7 +534,7 @@ rules:
       assert: { rule: SEC-014, status: [PASS] }
     why: 'Sound tokens with expiry but no rate limiting leave a credential-stuffing window: each token check passes, the login endpoint still takes unlimited guesses.'
     remediation: 'Rate-limit failed authentication (see SEC-014) on every endpoint that accepts these tokens.'
-    references: ['CWE-307', 'ASVS-2.2.4']
+    references: ['CWE-307', 'ASVS-6.3.3']
 
   - id: INV-SEC-003
     title: Validated input is also encoded on output

package/rules/stacks/api-backend.yaml

@@ -26,7 +26,7 @@ rules:
       flags: i
     why: 'Without a version in the path or header, every breaking change is a coordinated deploy across every client.'
     remediation: 'Prefix routes with /v1 (or use a version header); never break an existing version in place.'
-    references: ['ASVS-14.1.3', 'API-Design']
+    references: ['API-Design']
 
   - id: API-002
     title: Request timeouts are configured

package/rules/stacks/containers.yaml

@@ -20,7 +20,7 @@ rules:
       exclude: ['**/node_modules/**']
     why: 'A root process inside the container is one kernel exploit away from root on the host.'
     remediation: 'Add `USER node` (or a dedicated non-root uid) and `securityContext.runAsNonRoot: true` in Kubernetes.'
-    references: ['CWE-250', 'CIS-Docker-4.1', 'ASVS-14.1.3']
+    references: ['CWE-250', 'CIS-Docker-4.1']
 
   - id: CTNR-002
     title: Multi-stage builds are used

package/rules/stacks/data.yaml

@@ -46,7 +46,7 @@ rules:
       flags: i
     why: 'Relations enforced only in application code are relations that drift out of sync the first time someone writes a script.'
     remediation: 'Declare constraints at the DB level; add a periodic orphan-row check if you cannot.'
-    references: ['ASVS-5.3.4']
+    references: ['ASVS-1.2.4']
 
   - id: DATA-003
     title: Indexes exist on queried columns
@@ -118,7 +118,7 @@ rules:
       flags: i
     why: 'A half-applied write is worse than a failed one: the data looks fine until someone reconciles it.'
     remediation: 'Wrap related writes in a transaction; make the operation idempotent so retries are safe.'
-    references: ['ASVS-5.3.4']
+    references: ['ASVS-1.2.4']
 
   - id: DATA-008
     title: No SELECT * in hot paths

package/rules/stacks/go.yaml

@@ -115,7 +115,7 @@ rules:
       flags: i
     why: 'Sprintf-built SQL is textbook injection.'
     remediation: 'Use placeholders: db.QueryContext(ctx, "SELECT ... WHERE id = $1", id).'
-    references: ['CWE-89', 'ASVS-5.3.4']
+    references: ['CWE-89', 'ASVS-1.2.4']
 
   - id: GO-008
     title: HTTP servers set timeouts

package/rules/stacks/iac.yaml

@@ -25,7 +25,7 @@ rules:
       exclude: ['**/node_modules/**']
     why: 'This is the single most common cause of cloud data breaches, and it is one line of config.'
     remediation: 'Default to private; allowlist specific principals/CIDRs; add an automated check (Checkov/tfsec) in CI.'
-    references: ['CWE-284', 'CIS-AWS-2.1.5', 'ASVS-14.1.3']
+    references: ['CWE-284', 'CIS-AWS-2.1.5']
 
   - id: IAC-002
     title: Encryption at rest is enabled

package/rules/stacks/jvm.yaml

@@ -80,7 +80,7 @@ rules:
       flags: i
     why: 'String-concatenated JPQL is exactly as injectable as raw SQL.'
     remediation: 'Use named parameters (:name) or the Criteria API. Never build a query string from input.'
-    references: ['CWE-89', 'ASVS-5.3.4']
+    references: ['CWE-89', 'ASVS-1.2.4']
 
   - id: JVM-005
     title: Nullability is explicit
@@ -131,7 +131,7 @@ rules:
       exclude: ['**/src/test/**', '**/test/**']
     why: 'Java deserialisation gadget chains are one of the most reliable RCE vectors in existence.'
     remediation: 'Use JSON with an explicit schema and no polymorphic default typing; validate before binding.'
-    references: ['CWE-502', 'ASVS-5.5.1']
+    references: ['CWE-502', 'ASVS-1.5.2']
 
   - id: JVM-008
     title: JVM/container memory limits are respected

package/rules/stacks/python.yaml

@@ -111,7 +111,7 @@ rules:
       exclude: ['**/tests/**']
     why: 'pickle.load on untrusted input is remote code execution by design. yaml.load without SafeLoader is the same class of bug.'
     remediation: 'Use json, yaml.safe_load, or torch.load(weights_only=True). Never deserialise untrusted pickle.'
-    references: ['CWE-502', 'ASVS-5.5.1']
+    references: ['CWE-502', 'ASVS-1.5.2']
 
   - id: PY-007
     title: Subprocess calls do not use shell=True

package/rules/stacks/swift.yaml

@@ -99,4 +99,4 @@ rules:
       include: ['**/*.swift']
     why: 'Missing security headers exposes the app to clickjacking, MIME sniffing, and other browser attacks.'
     remediation: 'Add SecurityHeadersMiddleware to the middleware chain with appropriate policies.'
-    references: ['ASVS-14.4.3', 'OWASP-Secure-Headers']
+    references: ['ASVS-3.4.3', 'OWASP-Secure-Headers']