diff --git a/.github/workflows/functional-tests.yml b/.github/workflows/functional-tests.yml index 829891c61..448f86a45 100644 --- a/.github/workflows/functional-tests.yml +++ b/.github/workflows/functional-tests.yml @@ -27,15 +27,13 @@ jobs: options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5 mailhog: image: mailhog/mailhog - ports: [ - "1025:1025", - "8025:8025" - ] + ports: ["1025:1025", "8025:8025"] strategy: max-parallel: 4 matrix: python-version: ["3.11"] + playwright-browser: ["chromium", "firefox"] steps: - uses: actions/checkout@v4 @@ -54,10 +52,12 @@ jobs: if [ -f requirements.txt ]; then pip install -r requirements.txt; fi - name: Install dependencies working-directory: ${{ env.working-directory }} - run: npm ci - - name: Install Playwright Browsers + run: | + npm install + npm ci + - name: Install Playwright browser ${{ matrix.playwright-browser }} working-directory: ${{ env.working-directory }} - run: npx playwright install --with-deps + run: npx playwright install --with-deps ${{ matrix.playwright-browser }} - name: Create frontend environment variables file working-directory: ${{ env.working-directory }} run: | @@ -93,14 +93,14 @@ jobs: export $(grep -v '^#' .env | xargs) python manage.py createsuperuser --noinput nohup python manage.py runserver & - - name: Run tests + - name: Run tests with browser ${{ matrix.playwright-browser }} working-directory: ${{ env.working-directory }} - run: npx playwright test + run: npx playwright test --project=${{ matrix.playwright-browser }} - uses: actions/upload-artifact@v4 if: always() with: name: functional-tests-report path: | - ${{ env.working-directory }}/tests/results/ - ${{ env.working-directory }}/tests/reports/ + ${{ env.working-directory }}/tests/${{ matrix.playwright-browser }}results/ + ${{ env.working-directory }}/tests/${{ matrix.playwright-browser }}reports/ retention-days: 5 diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index dbe741ab8..2ea348010 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -9,11 +9,12 @@ repos: rev: v0.4.1 hooks: # Run the linter. - - id: ruff - args: [--fix backend] + # - id: ruff + # args: [--fix, backend] # Run the formatter. - id: ruff-format args: [backend] + exclude: (migrations) - repo: local hooks: - id: format-frontend diff --git a/README.md b/README.md index cbc26c5c9..03fc4741f 100644 --- a/README.md +++ b/README.md @@ -112,6 +112,7 @@ Check out the online documentation on https://intuitem.gitbook.io/ciso-assistant 1. ISO 27001:2022, version Française 🇫🇷🌐 2. PGSSI-S (Politique Générale de Sécurité des Systèmes d'Information de Santé) 🇫🇷 +3. ANSSI : Recommandations de configuration d'un système GNU/Linux 🇫🇷
@@ -261,6 +262,10 @@ export DJANGO_SECRET_KEY=... # Logging configuration export LOG_LEVEL=INFO # optional, default value is INFO. Available options: DEBUG, INFO, WARNING, ERROR, CRITICAL export LOG_FORMAT=plain # optional, default value is plain. Available options: json, plain + +# Authentication options +export AUTH_TOKEN_TTL=900 # optional, default value is 900 seconds (15 minutes). It defines the time to live of the authentication token +export AUTH_TOKEN_AUTO_REFRESH=True # optional, default value is True. It defines if the token TTL should be refreshed automatically after each request authenticated with the token ``` 3. Choose the tool of your choice, either python-venv or virtualenv. For example: @@ -413,7 +418,7 @@ Set DJANGO_DEBUG=False for security reason. - [Django](https://www.djangoproject.com/) - Python Web Development Framework - [SvelteKit](https://kit.svelte.dev/) - Frontend Framework -- [eCharts](https://echarts.apache.org) - Charting library +- [eCharts](https://echarts.apache.org) - Charting library - [Gunicorn](https://gunicorn.org/) - Python WSGI HTTP Server for UNIX - [Caddy](https://caddyserver.com) - The coolest reverse Proxy - [Gitbook](https://www.gitbook.com) - Documentation platform diff --git a/backend/app_tests/api/test_api_libraries.py b/backend/app_tests/api/test_api_libraries.py index 2076ca19d..58a09b591 100644 --- a/backend/app_tests/api/test_api_libraries.py +++ b/backend/app_tests/api/test_api_libraries.py @@ -1,6 +1,8 @@ +import json import pytest from rest_framework.test import APIClient -from core.models import Framework +from app_tests.test_vars import TEST_FRAMEWORK_URN, TEST_RISK_MATRIX_URN +from core.models import Framework, StoredLibrary from core.models import RiskMatrix from iam.models import Folder from rest_framework import status @@ -17,7 +19,7 @@ class TestLibrariesUnauthenticated: def test_get_libraries(self): """test to get libraries from the API without authentication""" - EndpointTestsQueries.get_object(self.client, "Libraries") + EndpointTestsQueries.get_object(self.client, "Stored libraries") def test_import_frameworks(self): """test to import libraries with the API without authentication""" @@ -50,7 +52,7 @@ def test_get_libraries(self, test): """test to get libraries from the API with authentication""" EndpointTestsQueries.Auth.get_object( - test.client, "Libraries", base_count=-1, user_group=test.user_group + test.client, "Stored libraries", base_count=-1, user_group=test.user_group ) def test_import_frameworks(self, test): @@ -58,13 +60,19 @@ def test_import_frameworks(self, test): # Uses the API endpoint to get library details with the admin client lib_detail_response = test.admin_client.get( - EndpointTestsUtils.get_object_urn("Framework") - ).json()["objects"]["framework"] + EndpointTestsUtils.get_stored_library_content( + test.client, TEST_FRAMEWORK_URN + ) + ) + lib_detail_response = lib_detail_response.content + lib_detail_response = json.loads(lib_detail_response) + lib_detail_response = json.loads(lib_detail_response) + lib_detail_response = lib_detail_response["framework"] - # Asserts that the library is not already imported + # Asserts that the library is not already loaded assert ( Framework.objects.all().count() == 0 - ), "libraries are already imported in the database" + ), "libraries are already loaded in the database" EndpointTestsQueries.Auth.get_object( test.client, "Frameworks", @@ -78,12 +86,12 @@ def test_import_frameworks(self, test): assert Framework.objects.all().count() == ( 1 if not EndpointTestsUtils.expected_request_response( - "add", "library", str(test.folder), test.user_group + "add", "loadedlibrary", str(test.folder), test.user_group )[0] else 0 ), "Frameworks are not correctly imported in the database" - # Uses the API endpoint to assert that the library was properly imported + # Uses the API endpoint to assert that the library was properly loaded EndpointTestsQueries.Auth.get_object( test.client, "Frameworks", @@ -96,7 +104,7 @@ def test_import_frameworks(self, test): base_count=1, user_group=test.user_group, fails=EndpointTestsUtils.expected_request_response( - "add", "library", str(test.folder), test.user_group + "add", "loadedlibrary", str(test.folder), test.user_group )[0], ) @@ -121,13 +129,19 @@ def test_import_risk_matrix(self, test): # Uses the API endpoint to get library details with the admin client lib_detail_response = test.admin_client.get( - EndpointTestsUtils.get_object_urn("Risk matrix") - ).json()["objects"]["risk_matrix"][0] + EndpointTestsUtils.get_stored_library_content( + test.client, TEST_RISK_MATRIX_URN + ) + ) + lib_detail_response = lib_detail_response.content + lib_detail_response = json.loads(lib_detail_response) + lib_detail_response = json.loads(lib_detail_response) + lib_detail_response = lib_detail_response["risk_matrix"][0] - # Asserts that the library is not already imported + # Asserts that the library is not already loaded assert ( RiskMatrix.objects.all().count() == 0 - ), "libraries are already imported in the database" + ), "libraries are already loaded in the database" EndpointTestsQueries.Auth.get_object( test.client, "Risk matrices", user_group=test.user_group ) @@ -139,12 +153,12 @@ def test_import_risk_matrix(self, test): assert RiskMatrix.objects.all().count() == ( 1 if not EndpointTestsUtils.expected_request_response( - "add", "library", str(test.folder), test.user_group + "add", "loadedlibrary", str(test.folder), test.user_group )[0] else 0 ), "Risk matrices are not correctly imported in the database" - # Uses the API endpoint to assert that the library was properly imported + # Uses the API endpoint to assert that the library was properly loaded EndpointTestsQueries.Auth.get_object( test.client, "Risk matrices", @@ -158,7 +172,7 @@ def test_import_risk_matrix(self, test): base_count=1, user_group=test.user_group, fails=EndpointTestsUtils.expected_request_response( - "add", "library", str(test.folder), test.user_group + "add", "loadedlibrary", str(test.folder), test.user_group )[0], ) diff --git a/backend/app_tests/api/test_api_requirement_nodes.py b/backend/app_tests/api/test_api_requirement_nodes.py index 5d0ac84fe..19bfaf76c 100644 --- a/backend/app_tests/api/test_api_requirement_nodes.py +++ b/backend/app_tests/api/test_api_requirement_nodes.py @@ -1,6 +1,7 @@ import pytest from rest_framework.test import APIClient -from core.models import RequirementNode, Framework +from app_tests.test_vars import TEST_FRAMEWORK_URN +from core.models import RequirementNode, Framework, StoredLibrary from iam.models import Folder from test_utils import EndpointTestsQueries, EndpointTestsUtils @@ -76,7 +77,9 @@ def test_import_requirement_nodes(self, test): test.client, "Requirement nodes", EndpointTestsUtils.get_endpoint_url("Requirement nodes"), - EndpointTestsUtils.get_object_urn("Framework"), + EndpointTestsUtils.get_stored_library_content( + test.client, TEST_FRAMEWORK_URN + ), [ "name", "description", diff --git a/backend/app_tests/api/test_utils.py b/backend/app_tests/api/test_utils.py index 5a6c6e5f6..0d8ba48ab 100644 --- a/backend/app_tests/api/test_utils.py +++ b/backend/app_tests/api/test_utils.py @@ -1,3 +1,4 @@ +from django.db import models from knox.auth import AuthToken import pytest import json @@ -6,6 +7,7 @@ from django.urls import reverse from rest_framework import status from rest_framework.test import APIClient +from core.models import StoredLibrary from test_vars import * @@ -25,7 +27,17 @@ def get_object_urn(object_name: str, resolved: bool = True): urn_varname = format_urn(object_name) urn = get_var(urn_varname) - return f"{reverse(LIBRARIES_ENDPOINT)}{urn}/" if resolved else eval(urn) + return f"{reverse(STORED_LIBRARIES_ENDPOINT)}{urn}/" if resolved else eval(urn) + + def get_referential_object_url_from_urn( + authenticated_client, urn: str, model: models.Model = StoredLibrary + ): + """Get the object URL from the URN""" + return f"{reverse(STORED_LIBRARIES_ENDPOINT)}{urn}/" + + def get_stored_library_content(authenticated_client, urn: str) -> str: + """Return an URL to fetch the content of a stored library""" + return f"{reverse(STORED_LIBRARIES_ENDPOINT)}{urn}/content/" @pytest.mark.django_db def get_test_client_and_folder( @@ -958,7 +970,7 @@ def import_object( user_perm_expected_status, user_perm_reason, ) = EndpointTestsUtils.expected_request_response( - "add", "library", scope, user_group, expected_status + "add", "loadedlibrary", scope, user_group, expected_status ) url = urn or EndpointTestsUtils.get_object_urn(verbose_name) @@ -1014,9 +1026,12 @@ def compare_results( reference.status_code == status.HTTP_200_OK ), "reference endpoint is not accessible" - for object in reference.json()["objects"]["framework"][ - object_name.lower().replace(" ", "_") - ][:count]: + content = json.loads(reference.content) + content = json.loads(content) + + for object in content["framework"][object_name.lower().replace(" ", "_")][ + :count + ]: comparelist = authenticated_client.get(compare_url) compare = dict() assert ( diff --git a/backend/app_tests/conftest.py b/backend/app_tests/conftest.py index d54672292..8cf15f291 100644 --- a/backend/app_tests/conftest.py +++ b/backend/app_tests/conftest.py @@ -15,7 +15,7 @@ def __init__(self, *args, **kwargs): @pytest.fixture def app_config(): - startup() + startup(sender=None, **{}) @pytest.fixture diff --git a/backend/app_tests/test_vars.py b/backend/app_tests/test_vars.py index fe9384a92..4450f18ed 100644 --- a/backend/app_tests/test_vars.py +++ b/backend/app_tests/test_vars.py @@ -13,7 +13,7 @@ EVIDENCES_ENDPOINT = "evidences-list" FOLDERS_ENDPOINT = "folders-list" FRAMEWORKS_ENDPOINT = "frameworks-list" -LIBRARIES_ENDPOINT = "libraries-list" +STORED_LIBRARIES_ENDPOINT = "stored-libraries-list" RISK_MATRICES_ENDPOINT = "risk-matrices-list" PROJECTS_ENDPOINT = "projects-list" REQUIREMENT_ASSESSMENTS_ENDPOINT = "requirement-assessments-list" @@ -95,7 +95,7 @@ def get_var(varname: str) -> Any: def get_singular_name(plural_name: str) -> str: exceptions = { - "Libraries": "Library", + "Stored libraries": "Stored library", "Risk matrices": "Risk matrix", "Policies": "Policy", } diff --git a/backend/cal/forms.py b/backend/cal/forms.py deleted file mode 100644 index a0333fe71..000000000 --- a/backend/cal/forms.py +++ /dev/null @@ -1,23 +0,0 @@ -from django.forms import ModelForm, DateInput -from cal.models import Event - - -class EventForm(ModelForm): - class Meta: - model = Event - # datetime-local is a HTML5 input type, format to make date time show on fields - widgets = { - "start_time": DateInput( - attrs={"type": "datetime-local"}, format="%Y-%m-%dT%H:%M" - ), - "end_time": DateInput( - attrs={"type": "datetime-local"}, format="%Y-%m-%dT%H:%M" - ), - } - fields = "__all__" - - def __init__(self, *args, **kwargs): - super(EventForm, self).__init__(*args, **kwargs) - # input_formats parses HTML5 datetime-local input to datetime field - self.fields["start_time"].input_formats = ("%Y-%m-%dT%H:%M",) - self.fields["end_time"].input_formats = ("%Y-%m-%dT%H:%M",) diff --git a/backend/ciso_assistant/settings.py b/backend/ciso_assistant/settings.py index 1d6a8904a..10aed45b1 100644 --- a/backend/ciso_assistant/settings.py +++ b/backend/ciso_assistant/settings.py @@ -280,7 +280,7 @@ def set_ciso_assistant_url(_, __, event_dict): # SQLIte file can be changed, useful for tests SQLITE_FILE = os.environ.get("SQLITE_FILE", BASE_DIR / "db/ciso-assistant.sqlite3") - +LIBRARIES_PATH = library_path = BASE_DIR / "library/libraries" if "POSTGRES_NAME" in os.environ: DATABASES = { diff --git a/backend/core/apps.py b/backend/core/apps.py index 86790cd31..b90f7359c 100644 --- a/backend/core/apps.py +++ b/backend/core/apps.py @@ -2,6 +2,8 @@ from django.db.models.signals import post_migrate from ciso_assistant.settings import CISO_ASSISTANT_SUPERUSER_EMAIL import os +from django.core.management import call_command + READER_PERMISSIONS_LIST = [ "view_project", @@ -21,7 +23,8 @@ "view_requirementnode", "view_evidence", "view_framework", - "view_library", + "view_loadedlibrary", + "view_storedlibrary", "view_user", ] @@ -44,7 +47,8 @@ "view_requirementnode", "view_evidence", "view_framework", - "view_library", + "view_storedlibrary", + "view_loadedlibrary", "view_user", ] @@ -97,7 +101,8 @@ "view_riskmatrix", "view_requirementnode", "view_framework", - "view_library", + "view_storedlibrary", + "view_loadedlibrary", "view_user", ] @@ -155,7 +160,8 @@ "delete_evidence", "view_requirementnode", "view_framework", - "view_library", + "view_storedlibrary", + "view_loadedlibrary", "view_user", ] @@ -231,15 +237,18 @@ "view_framework", "delete_framework", "view_requirementnode", - "view_library", - "add_library", - "delete_library", + "view_storedlibrary", + "add_storedlibrary", + "delete_storedlibrary", + "view_loadedlibrary", + "add_loadedlibrary", + "delete_loadedlibrary", "backup", "restore", ] -def startup(**kwargs): +def startup(sender: AppConfig, **kwargs): """ Implement CISO Assistant 1.0 default Roles and User Groups during migrate This makes sure root folder and global groups are defined before any other object is created @@ -346,6 +355,8 @@ def startup(**kwargs): except Exception as e: print(e) # NOTE: Add this exception in the logger + call_command("storelibraries") + class CoreConfig(AppConfig): default_auto_field = "django.db.models.BigAutoField" diff --git a/backend/core/base_models.py b/backend/core/base_models.py index aae66186f..cef56cd72 100644 --- a/backend/core/base_models.py +++ b/backend/core/base_models.py @@ -8,7 +8,7 @@ class AbstractBaseModel(models.Model): id = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False) created_at = models.DateTimeField(auto_now_add=True, verbose_name=_("Created at")) - updated_at = models.DateTimeField(auto_now=True, verbose_name=_("UpdatedÒ at")) + updated_at = models.DateTimeField(auto_now=True, verbose_name=_("Updated at")) is_published = models.BooleanField(_("published"), default=False) class Meta: diff --git a/backend/core/filters.py b/backend/core/filters.py index f1b17cdc2..99f7d25c7 100644 --- a/backend/core/filters.py +++ b/backend/core/filters.py @@ -22,8 +22,6 @@ class GenericFilterSet(FilterSet): def __init__(self, data=None, queryset=None, *, request=None, prefix=None): super().__init__(data, queryset, request=request, prefix=prefix) - # for f in self.filters.items(): - # print(f[0], f[1].field.widget) class GenericOrderingFilter(OrderingFilter): diff --git a/backend/core/forms.py b/backend/core/forms.py deleted file mode 100644 index 3c9ba9736..000000000 --- a/backend/core/forms.py +++ /dev/null @@ -1,189 +0,0 @@ -from django.forms import ( - CheckboxInput, - DateInput, - DateTimeInput, - EmailInput, - HiddenInput, - ModelForm, - NullBooleanSelect, - NumberInput, - PasswordInput, - Select, - SelectMultiple, - TextInput, - Textarea, - TimeInput, - URLInput, - CheckboxSelectMultiple, - ValidationError, -) -from django.contrib.auth.forms import SetPasswordForm -from django import forms -from .models import * -from django.utils.translation import gettext_lazy as _ -from django.utils.html import escape -from django.contrib.auth import get_user_model - -User = get_user_model() - - -class LinkCleanMixin: - """ - Prevent code injection in link field - """ - - def clean_link(self): - """ - Method to check if a link is valid - """ - link = self.cleaned_data.get("link") - if link: - link = escape(link) - if not link.startswith(("https://", "ftps://")): - raise ValidationError(_("Invalid link")) - return link - - -class SearchableCheckboxSelectMultiple(CheckboxSelectMultiple): - """ - A searchable checkbox select multiple widget. - - Widget attributes (in addition to the standard ones): - - wrapper_class: class for the wrapper div - - searchbar_class: class for the searchbar - """ - - template_name = "forms/widgets/select_multiple.html" - recommended_applied_controls = None - - def __init__(self, recommended_applied_controls=None, *args, **kwargs) -> None: - super().__init__(*args, **kwargs) - self.recommended_applied_controls = recommended_applied_controls - - def get_context(self, name, value, attrs): - context = super().get_context(name, value, attrs) - if self.recommended_applied_controls: - context["recommended_applied_controls"] = self.recommended_applied_controls - return context - - -class SearchableSelect(Select): - template_name = "forms/widgets/searchable_select.html" - option_template_name = "forms/widgets/select_option.html" - recommended_reference_controls = None - - def __init__(self, recommended_reference_controls=None, *args, **kwargs) -> None: - super().__init__(*args, **kwargs) - self.recommended_reference_controls = recommended_reference_controls - self.id = f"searchable-select-{id(self)}" - - def get_context(self, name, value, attrs): - context = super().get_context(name, value, attrs) - if self.recommended_reference_controls: - context["recommended_reference_controls"] = ( - self.recommended_reference_controls - ) - return context - - -class DefaultDateInput(DateInput): - input_type = "date" - - -class StyledModelForm(ModelForm): - def default_if_one(self, field_name): - field = self.fields[field_name] - if not hasattr(field, "_queryset"): - return - if field._queryset and len(field._queryset) == 1: - field.widget.attrs["disabled"] = True - field.widget.attrs["class"] += " disabled:opacity-50" - field.initial = field.queryset[0] - - def default_if_one_all(self): - for fname, f in self.fields.items(): - self.default_if_one(fname) - - def __init__(self, *args, **kwargs): - super(__class__, self).__init__(*args, **kwargs) - text_inputs = ( - TextInput, - NumberInput, - EmailInput, - URLInput, - PasswordInput, - HiddenInput, - DefaultDateInput, - DateInput, - DateTimeInput, - TimeInput, - ) - select_inputs = (Select, SelectMultiple, NullBooleanSelect) - for fname, f in self.fields.items(): - input_type = f.widget.__class__ - if self.Meta.model: - model_name = str(self.Meta.model).split(".")[-1].strip("'>").lower() - if input_type in text_inputs: - f.widget.attrs["id"] = ( - f"id_{model_name}_{fname}" if model_name else f"id_{fname}" - ) - f.widget.attrs["class"] = ( - "bg-gray-50 border border-gray-300 text-gray-900 text-sm rounded-lg focus:ring-blue-500 focus:border-blue-500 block w-full p-2.5" - ) - if input_type in select_inputs: - f.widget.attrs["id"] = f"id_{model_name}_{fname}" - f.widget.attrs["autocomplete"] = ( - "off" # workaround for Firefox behavior: https://stackoverflow.com/questions/4831848/firefox-ignores-option-selected-selected - ) - f.widget.attrs["class"] = ( - "bg-gray-50 border border-gray-300 text-gray-900 text-sm rounded-lg focus:ring-blue-500 focus:border-blue-500 block w-full p-2.5 disabled:opacity-50" - ) - if input_type == Textarea: - f.widget.attrs["class"] = ( - "block p-2.5 w-full text-sm text-gray-900 bg-gray-50 rounded-lg border border-gray-300 focus:ring-blue-500 focus:border-blue-500" - ) - if input_type == CheckboxInput: - f.widget.attrs["id"] = f"id_{model_name}_{fname}" - f.widget.attrs["class"] = ( - "w-4 h-4 text-blue-600 bg-gray-100 border-gray-300 rounded focus:ring-blue-500" - ) - if input_type == DefaultDateInput: - f.widget.attrs["id"] = f"id_{model_name}_{fname}" - f.widget.attrs["class"] = ( - "bg-gray-50 border border-gray-300 text-gray-900 text-sm rounded-lg focus:ring-blue-500 focus:border-blue-500 block w-full p-2.5" - ) - if input_type == Select: - self.default_if_one(fname) - - -class ResetForm(forms.Form): - email = forms.EmailField( - label=_("Email"), - widget=forms.TextInput( - attrs={ - "class": "my-2 block w-full rounded-md border-gray-300 shadow-sm focus:border-indigo-300 focus:ring focus:ring-indigo-200 focus:ring-opacity-50" - } - ), - ) - - -class ResetConfirmForm(SetPasswordForm): - def __init__(self, *args, **kwargs): - style = "my-2 block w-full rounded-md border-gray-300 shadow-sm focus:border-indigo-300 focus:ring focus:ring-indigo-200 focus:ring-opacity-50" - super(__class__, self).__init__(*args, **kwargs) - for password in self.fields.items(): - password[1].widget.attrs["class"] = style - - -class FirstConnexionConfirmForm(SetPasswordForm): - def __init__(self, *args, **kwargs): - style = "my-2 block w-full rounded-md border-gray-300 shadow-sm focus:border-indigo-300 focus:ring focus:ring-indigo-200 focus:ring-opacity-50" - super(__class__, self).__init__(*args, **kwargs) - for password in self.fields.items(): - password[1].widget.attrs["class"] = style - self.fields["terms_service"].widget.attrs["class"] = ( - "ml-2 rounded border-gray-300 shadow-sm focus:border-indigo-600 focus:ring focus:ring-indigo-500 focus:ring-opacity-50 text-indigo-500" - ) - self.fields["terms_service"].widget.attrs["id"] = "terms_service" - - terms_service = forms.BooleanField(label=_("terms and conditions of use")) diff --git a/backend/core/helpers.py b/backend/core/helpers.py index c71476bb1..3e515bb10 100644 --- a/backend/core/helpers.py +++ b/backend/core/helpers.py @@ -82,9 +82,8 @@ def measures_to_review(user: User): ) measures = ( AppliedControl.objects.filter(id__in=object_ids_view) - .filter(eta__lte=date.today() + timedelta(days=30)) - .exclude(status__iexact="done") - .order_by("eta") + .filter(expiry_date__lte=date.today() + timedelta(days=30)) + .order_by("expiry_date") ) return measures @@ -255,22 +254,24 @@ def get_sorted_requirement_nodes_rec( "parent_urn": node.parent_urn, "ref_id": node.ref_id, "name": node.name, - "implementation_groups": node.implementation_groups - if node.implementation_groups - else None, + "implementation_groups": ( + node.implementation_groups if node.implementation_groups else None + ), "ra_id": str(req_as.id) if requirements_assessed else None, "status": req_as.status if requirements_assessed else None, "is_scored": req_as.is_scored if requirements_assessed else None, "score": req_as.score if requirements_assessed else None, - "max_score": req_as.compliance_assessment.framework.max_score - if requirements_assessed - else None, - "status_display": req_as.get_status_display() - if requirements_assessed - else None, - "status_i18n": camel_case(req_as.status) - if requirements_assessed - else None, + "max_score": ( + req_as.compliance_assessment.framework.max_score + if requirements_assessed + else None + ), + "status_display": ( + req_as.get_status_display() if requirements_assessed else None + ), + "status_i18n": ( + camel_case(req_as.status) if requirements_assessed else None + ), "node_content": node.display_long, "style": "node", "assessable": node.assessable, @@ -293,9 +294,11 @@ def get_sorted_requirement_nodes_rec( { "urn": req.urn, "ref_id": req.ref_id, - "implementation_groups": req.implementation_groups - if req.implementation_groups - else None, + "implementation_groups": ( + req.implementation_groups + if req.implementation_groups + else None + ), "name": req.name, "description": req.description, "ra_id": str(req_as.id), @@ -576,7 +579,7 @@ def applied_control_per_cur_risk(user: User): for lvl in get_rating_options(user): cnt = ( AppliedControl.objects.filter(id__in=object_ids_view) - .exclude(status="done") + .exclude(status="active") .filter(risk_scenarios__current_level=lvl[0]) .count() ) @@ -744,15 +747,38 @@ def risks_per_project_groups(user: User): def get_counters(user: User): + print() return { - "domains": Folder.objects.filter( - content_type=Folder.ContentType.DOMAIN - ).count(), - "projects": Project.objects.all().count(), - "applied_controls": AppliedControl.objects.all().count(), - "risk_assessments": RiskAssessment.objects.all().count(), - "compliance_assessments": ComplianceAssessment.objects.all().count(), - "policies": Policy.objects.all().count(), + "domains": len( + RoleAssignment.get_accessible_object_ids( + Folder.get_root_folder(), user, Folder + )[0] + ), + "projects": len( + RoleAssignment.get_accessible_object_ids( + Folder.get_root_folder(), user, Project + )[0] + ), + "applied_controls": len( + RoleAssignment.get_accessible_object_ids( + Folder.get_root_folder(), user, AppliedControl + )[0] + ), + "risk_assessments": len( + RoleAssignment.get_accessible_object_ids( + Folder.get_root_folder(), user, RiskAssessment + )[0] + ), + "compliance_assessments": len( + RoleAssignment.get_accessible_object_ids( + Folder.get_root_folder(), user, ComplianceAssessment + )[0] + ), + "policies": len( + RoleAssignment.get_accessible_object_ids( + Folder.get_root_folder(), user, Policy + )[0] + ), } @@ -841,12 +867,9 @@ def acceptances_to_review(user: User): acceptances = ( RiskAcceptance.objects.filter(id__in=object_ids_view) .filter(expiry_date__lte=date.today() + timedelta(days=30)) - .order_by("expiry_date") - ) - acceptances |= ( - RiskAcceptance.objects.filter(id__in=object_ids_view) .filter(approver=user) - .filter(state="submitted") + .filter(state__in=["submitted", "accepted"]) + .order_by("expiry_date") ) return acceptances @@ -950,3 +973,35 @@ def compile_risk_assessment_for_composer(user, risk_assessment_list: list): }, "colors": get_risk_color_ordered_list(user, risk_assessment_list), } + + +def threats_count_per_name(user: User): + labels = list() + values = list() + ( + object_ids_view, + _, + _, + ) = RoleAssignment.get_accessible_object_ids(Folder.get_root_folder(), user, Threat) + viewable_scenarios = RoleAssignment.get_accessible_object_ids( + Folder.get_root_folder(), user, RiskScenario + )[0] + + # expected by echarts to send the threats names in labels and the count of each threat in values + + for threat in Threat.objects.filter(id__in=object_ids_view).order_by("name"): + val = ( + RiskScenario.objects.filter(threats=threat) + .filter(id__in=viewable_scenarios) + .count() + ) + if val > 0: + labels.append({"name": threat.name}) + values.append(val) + max_offset = max(values, default=0) # we can add x later on to improve visibility + + # update each label to include the max_offset + for label in labels: + label["max"] = max_offset + + return {"labels": labels, "values": values} diff --git a/backend/core/management/commands/status.py b/backend/core/management/commands/status.py index d62ec767f..7632c3349 100644 --- a/backend/core/management/commands/status.py +++ b/backend/core/management/commands/status.py @@ -9,7 +9,7 @@ class Command(BaseCommand): def handle(self, *args, **kwargs): nb_users = User.objects.all().count() nb_first_login = User.objects.filter(first_login=True).count() - nb_libraries = Library.objects.all().count() + nb_libraries = LoadedLibrary.objects.all().count() nb_domains = Folder.objects.filter(content_type="DO").count() nb_projects = Project.objects.all().count() nb_assets = Asset.objects.all().count() diff --git a/backend/core/migrations/0012_alter_appliedcontrol_updated_at_and_more.py b/backend/core/migrations/0012_alter_appliedcontrol_updated_at_and_more.py new file mode 100644 index 000000000..9b1f352d8 --- /dev/null +++ b/backend/core/migrations/0012_alter_appliedcontrol_updated_at_and_more.py @@ -0,0 +1,353 @@ +# Generated by Django 5.0.4 on 2024-05-03 12:41 +# loadedlibrary updates added manually + +import django.db.models.deletion +import iam.models +import uuid +from django.db import migrations, models + +BUILTIN_LIBRARY_URNS = set( + [ + "urn:intuitem:risk:library:nis2-directive", + "urn:intuitem:risk:library:cmmc-2.0", + "urn:intuitem:risk:library:pcidss-4_0", + "urn:intuitem:risk:library:nist-ssdf-1.1", + "urn:intuitem:risk:library:rgs-v2.0", + "urn:intuitem:risk:library:doc-pol", + "urn:intuitem:risk:library:dora", + "urn:intuitem:risk:library:3cf-v2", + "urn:intuitem:risk:library:owasp-top-10-web", + "urn:intuitem:risk:library:hds-v2023-a", + "urn:ackwa:risk:library:pgssi-s-1.0", + "urn:intuitem:risk:library:gdpr-checklist", + "urn:intuitem:risk:library:anssi-guide-hygiene", + "urn:intuitem:risk:library:iso27001-2022", + "urn:intuitem:risk:library:mitre-attack-v14", + "urn:protocolpaladin:risk:library:matrice-des-risques-critiques-5x5", + "urn:intuitem:risk:library:risk-matrix-3x3-mult", + "urn:intuitem:risk:library:fedramp-rev5", + "urn:intuitem:risk:library:nist-csf-1.1", + "urn:intuitem:risk:library:critical_risk_matrix_3x3", + "urn:intuitem:risk:library:nist-800-171-rev2", + "urn:intuitem:risk:library:ecc-1", + "urn:intuitem:risk:library:secnumcloud-3.2-annexe-2", + "urn:intuitem:risk:library:secnumcloud-3.2", + "urn:intuitem:risk:library:3cf-ed1-v1", + "urn:intuitem:risk:library:fadp", + "urn:intuitem:risk:library:tisax-v6.0.2", + "urn:intuitem:risk:library:owasp-asvs-4.0.3", + "urn:protocolpaladin:risk:library:anssi-recommandations-configuration-systeme-gnu-linux", + "urn:intuitem:risk:library:lpm-oiv-2019", + "urn:intuitem:risk:library:aircyber-v1.5.2", + "urn:intuitem:risk:library:nist-ai-rmf-1.0", + "urn:intuitem:risk:library:dfs-500-2023-11", + "urn:intuitem:risk:library:nist-csf-2.0", + "urn:intuitem:risk:library:anssi-nis-rules", + "urn:intuitem:risk:library:risk-matrix-5x5-sensitive", + "urn:intuitem:risk:library:iso27001-2022-fr", + "urn:intuitem:risk:library:pspf", + "urn:intuitem:risk:library:nist-privacy-1.0", + "urn:intuitem:risk:library:ccb-cff-2023-03-01", + "urn:intuitem:risk:library:cra-proposal-annexes", + "urn:ackwa:risk:library:risk-matrix-4x4-pgssi-s-1.0", + "urn:intuitem:risk:library:essential-eight", + "urn:intuitem:risk:library:nist-sp-800-66-rev2", + "urn:intuitem:risk:library:critical_risk_matrix_5x5", + "urn:protocolpaladin:risk:library:matrice-des-risques-critiques-3x3", + "urn:intuitem:risk:library:nist-sp-800-53-rev5", + "urn:intuitem:risk:library:tiber-eu-2018", + "urn:intuitem:risk:library:anssi-genai-security-recommendations-1.0", + "urn:intuitem:risk:library:soc2-2017", + ] +) + + +def adapt_libraries(apps, schema_editor): + LoadedLibrary = apps.get_model("core", "LoadedLibrary") + for library in LoadedLibrary.objects.all(): + library.builtin = ( + library.urn in BUILTIN_LIBRARY_URNS + ) # There is no perfect way to verify is a loaded custom library is builtin or not + # There is no way to generate the objects_meta dictionary without reading all files from ./backend/library/libraries, but we can generate the missing objects_meta values at the same time we generate the StoredLibrary objects. + + library.objects_meta = { + "frameworks": library.frameworks.count(), + "threats": library.threats.count(), + "reference_controls": library.reference_controls.count(), + "risk_matrix": library.risk_matrices.count(), + } + library.save() + + +class Migration(migrations.Migration): + dependencies = [ + ("core", "0011_auto_20240501_1342"), + ("iam", "0003_alter_folder_updated_at_alter_role_updated_at_and_more"), + ] + + operations = [ + migrations.AlterField( + model_name="appliedcontrol", + name="updated_at", + field=models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + migrations.AlterField( + model_name="asset", + name="updated_at", + field=models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + migrations.AlterField( + model_name="complianceassessment", + name="updated_at", + field=models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + migrations.AlterField( + model_name="evidence", + name="updated_at", + field=models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + migrations.AlterField( + model_name="framework", + name="updated_at", + field=models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + migrations.AlterField( + model_name="project", + name="updated_at", + field=models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + migrations.AlterField( + model_name="referencecontrol", + name="updated_at", + field=models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + migrations.AlterField( + model_name="requirementassessment", + name="updated_at", + field=models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + migrations.AlterField( + model_name="requirementnode", + name="updated_at", + field=models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + migrations.AlterField( + model_name="riskacceptance", + name="updated_at", + field=models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + migrations.AlterField( + model_name="riskassessment", + name="updated_at", + field=models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + migrations.AlterField( + model_name="riskmatrix", + name="updated_at", + field=models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + migrations.AlterField( + model_name="riskscenario", + name="updated_at", + field=models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + migrations.AlterField( + model_name="threat", + name="updated_at", + field=models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + migrations.RenameModel("Library", "LoadedLibrary"), + migrations.AlterField( + model_name="loadedlibrary", + name="provider", + field=models.CharField( + blank=True, max_length=200, null=True, verbose_name="Provider" + ), + ), + migrations.AlterField( + model_name="loadedlibrary", + name="urn", + field=models.CharField( + blank=True, max_length=100, null=True, verbose_name="URN" + ), + ), + migrations.AlterField( + model_name="loadedlibrary", + name="dependencies", + field=models.ManyToManyField( + blank=True, to="core.loadedlibrary", verbose_name="Dependencies" + ), + ), + migrations.AddField( + model_name="loadedlibrary", + name="builtin", + field=models.BooleanField(default=False), + ), + migrations.AddField( + model_name="loadedlibrary", + name="objects_meta", + field=models.JSONField(default=dict), + ), + migrations.AlterField( + model_name="loadedlibrary", + name="updated_at", + field=models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + migrations.AlterModelOptions( + name="loadedlibrary", + options={ + "abstract": False, + "unique_together": {("urn", "locale", "version")}, + }, + ), + migrations.AlterField( + model_name="framework", + name="library", + field=models.ForeignKey( + blank=True, + null=True, + on_delete=django.db.models.deletion.CASCADE, + related_name="frameworks", + to="core.loadedlibrary", + ), + ), + migrations.AlterField( + model_name="referencecontrol", + name="library", + field=models.ForeignKey( + blank=True, + null=True, + on_delete=django.db.models.deletion.CASCADE, + related_name="reference_controls", + to="core.loadedlibrary", + ), + ), + migrations.AlterField( + model_name="riskmatrix", + name="library", + field=models.ForeignKey( + blank=True, + null=True, + on_delete=django.db.models.deletion.CASCADE, + related_name="risk_matrices", + to="core.loadedlibrary", + ), + ), + migrations.AlterField( + model_name="threat", + name="library", + field=models.ForeignKey( + blank=True, + null=True, + on_delete=django.db.models.deletion.CASCADE, + related_name="threats", + to="core.loadedlibrary", + ), + ), + migrations.CreateModel( + name="StoredLibrary", + fields=[ + ( + "id", + models.UUIDField( + default=uuid.uuid4, + editable=False, + primary_key=True, + serialize=False, + ), + ), + ( + "created_at", + models.DateTimeField(auto_now_add=True, verbose_name="Created at"), + ), + ( + "updated_at", + models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + ( + "is_published", + models.BooleanField(default=False, verbose_name="published"), + ), + ( + "ref_id", + models.CharField( + blank=True, + max_length=100, + null=True, + verbose_name="Reference ID", + ), + ), + ( + "locale", + models.CharField( + default="en", max_length=100, verbose_name="Locale" + ), + ), + ( + "default_locale", + models.BooleanField(default=True, verbose_name="Default locale"), + ), + ( + "provider", + models.CharField( + blank=True, max_length=200, null=True, verbose_name="Provider" + ), + ), + ( + "name", + models.CharField(max_length=200, null=True, verbose_name="Name"), + ), + ( + "description", + models.TextField(blank=True, null=True, verbose_name="Description"), + ), + ( + "annotation", + models.TextField(blank=True, null=True, verbose_name="Annotation"), + ), + ( + "urn", + models.CharField( + blank=True, max_length=100, null=True, verbose_name="URN" + ), + ), + ( + "copyright", + models.CharField( + blank=True, max_length=4096, null=True, verbose_name="Copyright" + ), + ), + ("version", models.IntegerField(verbose_name="Version")), + ( + "packager", + models.CharField( + blank=True, + help_text="Packager of the library", + max_length=100, + null=True, + verbose_name="Packager", + ), + ), + ("builtin", models.BooleanField(default=False)), + ("objects_meta", models.JSONField(default=dict)), + ("dependencies", models.JSONField(null=True)), + ("is_loaded", models.BooleanField(default=False)), + ("hash_checksum", models.CharField(max_length=64)), + ("content", models.TextField()), + ( + "folder", + models.ForeignKey( + default=iam.models.Folder.get_root_folder, + on_delete=django.db.models.deletion.CASCADE, + related_name="%(class)s_folder", + to="iam.folder", + ), + ), + ], + options={ + "abstract": False, + "unique_together": {("urn", "locale", "version")}, + }, + ), + migrations.RunPython(adapt_libraries), + ] diff --git a/backend/core/models.py b/backend/core/models.py index 73ff08b8e..87e3cb929 100644 --- a/backend/core/models.py +++ b/backend/core/models.py @@ -1,3 +1,4 @@ +from pathlib import Path from django.apps import apps from django.forms.models import model_to_dict from django.contrib.auth import get_user_model @@ -7,16 +8,17 @@ from .base_models import * from .validators import validate_file_size, validate_file_name -from .utils import camel_case +from .utils import camel_case, sha256 from iam.models import FolderMixin, PublishInRootFolderMixin from django.core import serializers import os import json +import yaml from django.urls import reverse from datetime import date, datetime -from typing import Self +from typing import Union, Self from django.utils.html import format_html from structlog import get_logger @@ -83,18 +85,16 @@ def __str__(self) -> str: return self.display_short -class Library(ReferentialObjectMixin): +class LibraryMixin(ReferentialObjectMixin): + class Meta: + abstract = True + unique_together = [["urn", "locale", "version"]] + + urn = models.CharField(max_length=100, null=True, blank=True, verbose_name=_("URN")) copyright = models.CharField( max_length=4096, null=True, blank=True, verbose_name=_("Copyright") ) version = models.IntegerField(null=False, verbose_name=_("Version")) - provider = models.CharField( - max_length=100, - blank=True, - null=True, - help_text=_("Provider of the library"), - verbose_name=_("Provider"), - ) packager = models.CharField( max_length=100, blank=True, @@ -102,6 +102,108 @@ class Library(ReferentialObjectMixin): help_text=_("Packager of the library"), verbose_name=_("Packager"), ) + builtin = models.BooleanField(default=False) + objects_meta = models.JSONField(default=dict) + dependencies = models.JSONField( + null=True + ) # models.CharField(blank=False,null=True,max_length=16384) + + +class StoredLibrary(LibraryMixin): + is_loaded = models.BooleanField(default=False) + hash_checksum = models.CharField(max_length=64) + content = models.TextField() + + REQUIRED_FIELDS = {"urn", "name", "version", "objects"} + FIELDS_VERIFIERS = {} + HASH_CHECKSUM_SET = set() # For now a library isn't updated if its SHA256 checksum has already been registered in the database. + + @classmethod + def __init_class__(cls): + cls.HASH_CHECKSUM_SET = set( + value["hash_checksum"] for value in cls.objects.values("hash_checksum") + ) + + @classmethod + def store_library_content( + cls, library_content: bytes, builtin: bool = False + ) -> "StoredLibrary | None": + hash_checksum = sha256(library_content) + if hash_checksum in StoredLibrary.HASH_CHECKSUM_SET: + return None # We do not store the library if its hash checksum is in the database. + try: + library_data = yaml.safe_load(library_content) + except yaml.YAMLError as e: + logger.error("Error while loading library content", error=e) + raise e + + missing_fields = StoredLibrary.REQUIRED_FIELDS - set(library_data.keys()) + + if missing_fields: + err = "The following fields are missing : {}".format( + ", ".join(repr(field) for field in missing_fields) + ) + logger.error("Error while loading library content", error=err) + raise ValueError(err) + + urn = library_data["urn"] + locale = library_data.get("locale", "en") + version = int(library_data["version"]) + is_loaded = LoadedLibrary.objects.filter( + urn=urn, locale=locale, version=version + ).exists() + + objects_meta = { + key: (1 if key == "framework" else len(value)) + for key, value in library_data["objects"].items() + } + + dependencies = library_data.get( + "dependencies", [] + ) # I don't want whitespaces in URN anymore nontheless + + library_objects = json.dumps(library_data["objects"]) + return StoredLibrary.objects.create( + name=library_data["name"], + is_published=True, + urn=urn, + locale=locale, + version=version, + ref_id=library_data["ref_id"], + default_locale=False, # We don't care about this value yet. + description=library_data.get("description"), + annotation=library_data.get("annotation"), + copyright=library_data.get("copyright"), + provider=library_data.get("provider"), + packager=library_data.get("packager"), + objects_meta=objects_meta, + dependencies=dependencies, + is_loaded=is_loaded, + builtin=builtin, # We have to add a "builtin: true" line to every builtin library file. + hash_checksum=hash_checksum, + content=library_objects, + ) + + @classmethod + def store_library_file( + cls, fname: Path, builtin: bool = False + ) -> "StoredLibrary | None": + with open(fname, "rb") as f: + library_content = f.read() + return StoredLibrary.store_library_content(library_content, builtin) + + def load(self) -> Union[str, None]: + from library.utils import LibraryImporter + + library_importer = LibraryImporter(self) + error_msg = library_importer.import_library() + if error_msg is None: + self.is_loaded = True + self.save() + return error_msg + + +class LoadedLibrary(LibraryMixin): dependencies = models.ManyToManyField( "self", blank=True, verbose_name=_("Dependencies"), symmetrical=False ) @@ -151,7 +253,7 @@ def reference_count(self) -> int: ) .distinct() .count() - + Library.objects.filter(dependencies=self).distinct().count() + + LoadedLibrary.objects.filter(dependencies=self).distinct().count() ) def delete(self, *args, **kwargs): @@ -159,17 +261,26 @@ def delete(self, *args, **kwargs): raise ValueError( "This library is still referenced by some risk or compliance assessments" ) - dependent_libraries = Library.objects.filter(dependencies=self) + dependent_libraries = LoadedLibrary.objects.filter(dependencies=self) if dependent_libraries: raise ValueError( f"This library is a dependency of {dependent_libraries.count()} other libraries" ) - super(Library, self).delete(*args, **kwargs) + super(LoadedLibrary, self).delete(*args, **kwargs) + stored_library = StoredLibrary.objects.get( + urn=self.urn, locale=self.locale, version=self.version + ) # I don't if it works yet + stored_library.is_loaded = False + stored_library.save() class Threat(ReferentialObjectMixin, PublishInRootFolderMixin): library = models.ForeignKey( - Library, on_delete=models.CASCADE, null=True, blank=True, related_name="threats" + LoadedLibrary, + on_delete=models.CASCADE, + null=True, + blank=True, + related_name="threats", ) fields_to_check = ["ref_id", "name"] @@ -203,7 +314,7 @@ class ReferenceControl(ReferentialObjectMixin): ] library = models.ForeignKey( - Library, + LoadedLibrary, on_delete=models.CASCADE, null=True, blank=True, @@ -246,7 +357,7 @@ def __str__(self): class RiskMatrix(ReferentialObjectMixin): library = models.ForeignKey( - Library, + LoadedLibrary, on_delete=models.CASCADE, null=True, blank=True, @@ -336,7 +447,7 @@ class Framework(ReferentialObjectMixin): blank=True, null=True, verbose_name=_("Implementation groups definition") ) library = models.ForeignKey( - Library, + LoadedLibrary, on_delete=models.CASCADE, null=True, blank=True, @@ -938,7 +1049,7 @@ def quality_check(self) -> dict: measures[i]["id"] = json.loads(_measures)[i]["pk"] for mtg in measures: - if not mtg["eta"]: + if not mtg["eta"] and not mtg["status"] == "active": warnings_lst.append( { "msg": _("{} does not have an ETA").format(mtg["name"]), @@ -946,7 +1057,7 @@ def quality_check(self) -> dict: "object": {"name": mtg["name"], "id": mtg["id"]}, } ) - else: + elif mtg["eta"] and not mtg["status"] == "active": if date.today() > datetime.strptime(mtg["eta"], "%Y-%m-%d").date(): errors_lst.append( { @@ -1319,6 +1430,9 @@ def get_selected_implementation_groups(self): if group.get("ref_id") in self.selected_implementation_groups ] + def get_requirement_assessments(self): + return RequirementAssessment.objects.filter(compliance_assessment=self) + def get_requirements_status_count(self): requirements_status_count = [] for st in RequirementAssessment.Status: @@ -1348,11 +1462,6 @@ def get_measures_status_count(self): st, ) ) - print( - "AppliedControl".objects.filter(status=st[0]) - .filter(id__in=measures_list) - .count() - ) return measures_status_count def donut_render(self) -> dict: diff --git a/backend/core/serializers.py b/backend/core/serializers.py index bfdfd6327..f87aba05d 100644 --- a/backend/core/serializers.py +++ b/backend/core/serializers.py @@ -163,16 +163,17 @@ class ReferenceControlReadSerializer(ReferenceControlWriteSerializer): library = FieldsRelatedField(["name", "urn"]) -class LibraryReadSerializer(BaseModelSerializer): +"""class LibraryReadSerializer(BaseModelSerializer): class Meta: - model = Library + model = LoadedLibrary fields = "__all__" class LibraryWriteSerializer(BaseModelSerializer): class Meta: - model = Library + model = LoadedLibrary fields = "__all__" +""" class ThreatWriteSerializer(BaseModelSerializer): diff --git a/backend/core/templates/core/action_plan_pdf.html b/backend/core/templates/core/action_plan_pdf.html new file mode 100644 index 000000000..53efae1ba --- /dev/null +++ b/backend/core/templates/core/action_plan_pdf.html @@ -0,0 +1,68 @@ +{% extends 'core/base_pdf.html' %} +{% block content %} +{% load i18n core_extras %} + + + +
+

Action plan

+
+

{% trans "Domain" %}: {{ compliance_assessment.project.folder }}

+

/

+

{% trans "Project" %}: {{ compliance_assessment.project.name }}

+

/

+

{% trans "Audit" %}: {{ compliance_assessment.name }} - {{ compliance_assessment.version }}

+

/

+

{% trans "Framework" %}: {{ compliance_assessment.framework }}

+
+

{% trans "Associated applied controls" %}:

+

{% trans "Separated by status and sorted by eta" %}

+ {% for status, applied_controls in context.items%} + {% for status_color, color in color_map.items %} + {% if status_color == status %} +

{% trans status|title %}:

+ {% endif %} + {% endfor %} +
+
+ + + + + + + + + + + + + + {% for applied_control in applied_controls %} + + + + + + + + + + {% empty %} + + + + {% endfor %} + +
{% trans "Name" %}{% trans "Description" %}{% trans "Category" %}{% trans "ETA" %}{% trans "Expiry date" %}{% trans "Effort" %}{% trans "Matching requirements" %}
{{ applied_control.name }}{{ applied_control.description }}{{ applied_control.category }}{{ applied_control.eta }}{{ applied_control.expiry_date }}{{ applied_control.effort }}{% get_requirements_count applied_control compliance_assessment %}
+

{% trans "No entries found" %}

+
+
+
+ {% endfor %} +
+{% endblock %} diff --git a/backend/core/templates/core/base_pdf.html b/backend/core/templates/core/base_pdf.html index 60517e7fb..9ae07a2b2 100644 --- a/backend/core/templates/core/base_pdf.html +++ b/backend/core/templates/core/base_pdf.html @@ -23,6 +23,9 @@ .flex { display: flex; } +.flex-row { + flex-direction: row; +} .table { display: table; } @@ -234,6 +237,9 @@ .ml-3 { margin-left: 0.75rem; } +.ml-13 { + margin-left: 3.25rem; +} .p-1 { padding: 0.25rem; } @@ -267,6 +273,9 @@ .mt-10 { margin-top: 2.5rem; } +.mt-45{ + margin-top: 11.25rem; +} .justify-center { justify-content: center; diff --git a/backend/core/templates/snippets/ra_data.html b/backend/core/templates/snippets/ra_data.html index 4c26c57b3..ad4ae4e97 100644 --- a/backend/core/templates/snippets/ra_data.html +++ b/backend/core/templates/snippets/ra_data.html @@ -3,13 +3,18 @@
-
-
+
+
{% trans "Risk assessment" %}
-
{{ risk_assessment }}
+
{{ risk_assessment }}

    +
  • {% trans "Risk matrix:" %} +
      +
    • {{ risk_assessment.risk_matrix }}
      • +
    +
  • {% trans "Authors:" %}
      {% for author in risk_assessment.authors.all %} @@ -17,18 +22,24 @@ {% endfor %}
    • -
  • {% trans "Status:" %} {% if risk_assessment.is_draft %} - {% trans "Draft" %} {% else %} {% trans "Ready" %} {% endif %} +
  • {% trans "Reviewers:" %} +
      + {% for author in risk_assessment.reviewers.all %} +
    • {{ author }}
      • + {% endfor %} +
    +
    • +
  • {% trans "Status:" %} + {% if risk_assessment.status %} {{risk_assessment.status}} {% else %} -- {% endif %}
    • +
  • {% trans "ETA:" %} {{ risk_assessment.eta|date }}
    • +
  • {% trans "Due date:" %} {{ risk_assessment.due_date|date }}
  • {% trans "Created at:" %} {{ risk_assessment.created_at|date }}
  • {% trans "Updated at:" %} {{ risk_assessment.updated_at|date }}
-
{% trans "Risk matrix:" %}

{{ risk_assessment.risk_matrix }}

-
-
{% trans "Description" %}:
{% if risk_assessment.description %}{{ risk_assessment.description|linebreaksbr }}{% endif %}
@@ -37,12 +48,12 @@
-
{% trans "Risk scenarios" %} ({{ context|length }})
+

{% trans "Associated Risk scenarios" %} ({{ context|length }}):

{% include 'snippets/ri_list_nested.html' %}
-
-
{% trans "Risk matrix view" %}
+
+
{% trans "Risk matrix view" %}

{% trans "Current" %}

@@ -60,10 +71,11 @@

{% trans "Residual" %}

{% include 'snippets/risk_matrix.html' with data=ri_clusters.residual %} {% endif %}
- -
+
+
+ {% include 'snippets/risk_legend.html' %}
diff --git a/backend/core/templates/snippets/ri_list_nested.html b/backend/core/templates/snippets/ri_list_nested.html index f830aa110..6a2e7254b 100644 --- a/backend/core/templates/snippets/ri_list_nested.html +++ b/backend/core/templates/snippets/ri_list_nested.html @@ -1,7 +1,13 @@ {% load i18n %} {% load static tailwind_tags %} - + + +
{% for scenario in scenarios %} - + @@ -45,9 +51,13 @@
{% trans "ID" %} @@ -30,7 +36,7 @@
{{ scenario.rid }} -

- {% if scenario.threat %}{{ scenario.threat }}{% else %}--{% endif %} -

+ {% for threat in scenario.threats.all %} +

+ {{ threat }} +

+ {% empty %} + -- + {% endfor %}

{{ scenario.existing_controls|linebreaksbr }}

diff --git a/backend/core/templates/snippets/risk_legend.html b/backend/core/templates/snippets/risk_legend.html new file mode 100644 index 000000000..bb4ceed62 --- /dev/null +++ b/backend/core/templates/snippets/risk_legend.html @@ -0,0 +1,21 @@ +{% load i18n core_extras %} + +
+

{% trans "Risk levels" %}

+
+ + {% for risk in risk_matrix.parse_json.risk %} + + + + + + {% endfor %} +
+ + {{ risk.name }} + + {{ risk.description|linebreaksbr }} +
+
+
diff --git a/backend/core/templates/snippets/risk_matrix.html b/backend/core/templates/snippets/risk_matrix.html index 9b4614c90..45ed95bc0 100644 --- a/backend/core/templates/snippets/risk_matrix.html +++ b/backend/core/templates/snippets/risk_matrix.html @@ -41,18 +41,18 @@ {% else %}
-
-
+
+

{% trans "Probability" %}

- +
{% for row in risk_matrix.render_grid_as_colors reversed %} {% with row_index=forloop.revcounter0 %} {% if enriched_data %} @@ -73,7 +73,7 @@ {% endfor %} - {% for probability in risk_matrix.parse_json.probability %} + {% for impact in risk_matrix.parse_json.impact %} {#each $rows as row, rowIndex} - {@const meta = source.meta ? source.meta[rowIndex] : source.body[rowIndex]} + {@const meta = row.meta ? row.meta : row} {localItems(languageTag())[text]} @@ -241,7 +246,13 @@ {value.str ?? '-'} {/if} {:else if value && value.hexcolor} -

{value.name ?? value.str ?? '-'}

+

+ {#if localItems(languageTag())[toCamelCase(value.name ?? value.str ?? '-')]} + {localItems(languageTag())[toCamelCase(value.name ?? value.str ?? '-')]} + {:else} + {value.name ?? value.str ?? '-'} + {/if} +

{:else if ISO_8601_REGEX.test(value)} {formatDateOrDateTime(value, languageTag())} {:else} @@ -264,16 +275,17 @@ {#if row.meta[identifierField]} {@const actionsComponent = field_component_map['actions']} + {@const actionsURLModel = source.meta.urlmodel ?? URLModel} {#if $$slots.actionsHead} diff --git a/frontend/src/lib/components/SideBar/SideBarFooter.svelte b/frontend/src/lib/components/SideBar/SideBarFooter.svelte index 7d2cc7f5e..a79297a2a 100644 --- a/frontend/src/lib/components/SideBar/SideBarFooter.svelte +++ b/frontend/src/lib/components/SideBar/SideBarFooter.svelte @@ -17,6 +17,13 @@ const modalStore = getModalStore(); + const defaultLangLabels = { + fr: 'Français', + en: 'English', + ar: 'العربية', + pt: 'Português' + }; + let value = languageTag(); async function handleLocaleChange(event: Event) { @@ -85,9 +92,9 @@ data-testid="language-select" > {#each availableLanguageTags as lang} - + {/each}
{#if item.risk_assessment.quality_check.count > 0} diff --git a/frontend/src/routes/(app)/compliance-assessments/[id=uuid]/+page.svelte b/frontend/src/routes/(app)/compliance-assessments/[id=uuid]/+page.svelte index 3218f48c9..8ac67b039 100644 --- a/frontend/src/routes/(app)/compliance-assessments/[id=uuid]/+page.svelte +++ b/frontend/src/routes/(app)/compliance-assessments/[id=uuid]/+page.svelte @@ -2,7 +2,8 @@ import { page } from '$app/stores'; import RecursiveTreeView from '$lib/components/TreeView/RecursiveTreeView.svelte'; import { breadcrumbObject } from '$lib/utils/stores'; - import type { TreeViewNode } from '@skeletonlabs/skeleton'; + import type { PopupSettings, TreeViewNode } from '@skeletonlabs/skeleton'; + import { popup } from '@skeletonlabs/skeleton'; import type { PageData } from './$types'; import TreeViewItemContent from './TreeViewItemContent.svelte'; import TreeViewItemLead from './TreeViewItemLead.svelte'; @@ -103,6 +104,12 @@ expandedNodes = $expandedNodesState; $: expandedNodesState.set(expandedNodes); + + const popupDownload: PopupSettings = { + event: 'click', + target: 'popupDownload', + placement: 'bottom' + };
@@ -181,17 +188,37 @@ colors={compliance_assessment_donut_values.values.map((object) => object.itemStyle.color)} />
-
- {m.exportButton()} - {#if canEditObject} - {m.edit()} +
+ - {/if} +
+

{m.complianceAssessment()}

+ ... {m.asZIP()} +

{m.actionPlan()}

+ ... {m.asPDF()} +
+ {#if canEditObject} + {m.edit()} + {/if} +
+ {m.actionPlan()}
diff --git a/frontend/src/routes/(app)/compliance-assessments/[id=uuid]/action-plan/+page.server.ts b/frontend/src/routes/(app)/compliance-assessments/[id=uuid]/action-plan/+page.server.ts new file mode 100644 index 000000000..b625af982 --- /dev/null +++ b/frontend/src/routes/(app)/compliance-assessments/[id=uuid]/action-plan/+page.server.ts @@ -0,0 +1,15 @@ +import { BASE_API_URL } from '$lib/utils/constants'; + +import type { PageServerLoad } from './$types'; + +export const load = (async ({ fetch, params }) => { + const URLModel = 'compliance-assessments'; + const endpoint = `${BASE_API_URL}/${URLModel}/${params.id}/`; + const actionPlanEndpoint = `${BASE_API_URL}/${URLModel}/${params.id}/action_plan/`; + + const res = await fetch(endpoint); + const actionPlanRes = await fetch(actionPlanEndpoint); + const compliance_assessment = await res.json(); + const actionPlan = await actionPlanRes.json(); + return { URLModel, compliance_assessment, actionPlan }; +}) satisfies PageServerLoad; diff --git a/frontend/src/routes/(app)/compliance-assessments/[id=uuid]/action-plan/+page.svelte b/frontend/src/routes/(app)/compliance-assessments/[id=uuid]/action-plan/+page.svelte new file mode 100644 index 000000000..8efd5bde6 --- /dev/null +++ b/frontend/src/routes/(app)/compliance-assessments/[id=uuid]/action-plan/+page.svelte @@ -0,0 +1,206 @@ + + +
+

+ {m.project()}: + {data.compliance_assessment.project.str} +

+

/

+

+ {m.complianceAssessment()}: + {data.compliance_assessment.name} - {data.compliance_assessment.version} +

+

/

+

+ {m.framework()}: + {data.compliance_assessment.framework.str} +

+
+
+
+

{m.associatedAppliedControls()}

+

+ {m.actionPlanHelpText()} +

+
+
+ + {m.planned()} + {m.active()} + {m.inactive()} + {m.noStatus()} + +
+ {#if tabSet === 0} + + {/if} + {#if tabSet === 1} + + {/if} + {#if tabSet === 2} + + {/if} + {#if tabSet === 3} + + {/if} +
+ + +
+
diff --git a/frontend/src/routes/(app)/compliance-assessments/[id=uuid]/action-plan/export/pdf/+server.ts b/frontend/src/routes/(app)/compliance-assessments/[id=uuid]/action-plan/export/pdf/+server.ts new file mode 100644 index 000000000..41a8d50ed --- /dev/null +++ b/frontend/src/routes/(app)/compliance-assessments/[id=uuid]/action-plan/export/pdf/+server.ts @@ -0,0 +1,22 @@ +import { BASE_API_URL } from '$lib/utils/constants'; + +import { error } from '@sveltejs/kit'; +import type { RequestHandler } from './$types'; +export const GET: RequestHandler = async ({ fetch, params }) => { + const URLModel = 'compliance-assessments'; + const endpoint = `${BASE_API_URL}/${URLModel}/${params.id}/action_plan_pdf/`; + + const res = await fetch(endpoint); + if (!res.ok) { + error(400, 'Error fetching the PDF file'); + } + + const fileName = `AP-${params.id}-${new Date().toISOString()}.pdf`; + + return new Response(await res.blob(), { + headers: { + 'Content-Type': 'text/pdf', + 'Content-Disposition': `attachment; filename="${fileName}"` + } + }); +}; diff --git a/frontend/src/routes/(app)/libraries/+page.server.ts b/frontend/src/routes/(app)/libraries/+page.server.ts index 1ccfbb065..d5c6105c4 100644 --- a/frontend/src/routes/(app)/libraries/+page.server.ts +++ b/frontend/src/routes/(app)/libraries/+page.server.ts @@ -6,76 +6,77 @@ import { setFlash } from 'sveltekit-flash-message/server'; import { setError, superValidate } from 'sveltekit-superforms'; import type { PageServerLoad } from './$types'; import { z } from 'zod'; +import { zod } from 'sveltekit-superforms/adapters'; import { tableSourceMapper } from '@skeletonlabs/skeleton'; import { listViewFields } from '$lib/utils/table'; -import type { Library, urlModel } from '$lib/utils/types'; +import type { Library } from '$lib/utils/types'; import * as m from '$paraglide/messages'; import { localItems } from '$lib/utils/locales'; import { languageTag } from '$paraglide/runtime'; -import { zod } from 'sveltekit-superforms/adapters'; + +// ----------------------------------------------------------- // export const load = (async ({ fetch }) => { - const endpoint = `${BASE_API_URL}/libraries/`; - - const res = await fetch(endpoint); - const libraries: Library[] = await res.json().then((res) => res.results); - - function countObjects(library: Library) { - const result: { [key: string]: any } = new Object(); - for (const [key, value] of Object.entries(library.objects)) { - if (Array.isArray(value)) { - const str = key.charAt(0).toUpperCase() + key.slice(1).replace('_', ' '); - result[str] = value.length; - } else { - for (const [key2, value2] of Object.entries(value)) { - if (key2 === 'requirements') { - const str = key2.charAt(0).toUpperCase() + key2.slice(1); - result[str] = value2.length; - } - } - } - } - return result; - } + const stored_libraries_endpoint = `${BASE_API_URL}/stored-libraries/`; + const loaded_libaries_endpoint = `${BASE_API_URL}/loaded-libraries/`; + + const [stored_libraries_res, loaded_libaries_res] = await Promise.all([ + fetch(stored_libraries_endpoint), + fetch(loaded_libaries_endpoint) + ]); - libraries.forEach((row) => { + const storedLibraries = await stored_libraries_res.json().then((res) => res.results); + const loadedLibraries = await loaded_libaries_res.json().then((res) => res.results); + + const prepareRow = (row: Record) => { row.overview = [ `Provider: ${row.provider}`, `Packager: ${row.packager}`, - ...Object.entries(countObjects(row)).map(([key, value]) => `${key}: ${value}`) + ...Object.entries(row.objects_meta).map(([key, value]) => `${key}: ${value}`) ]; - row.allowDeleteLibrary = row.reference_count && row.reference_count > 0 ? false : true; - }); + row.allowDeleteLibrary = row.allowDeleteLibrary = + row.reference_count && row.reference_count > 0 ? false : true; + }; - const headData: Record = listViewFields['libraries' as urlModel].body.reduce( - (obj, key, index) => { - obj[key] = listViewFields['libraries' as urlModel].head[index]; + storedLibraries.forEach(prepareRow); + loadedLibraries.forEach(prepareRow); + + type libraryURLModel = 'stored-libraries' | 'loaded-libraries'; + + const makeHeadData = (URLModel: libraryURLModel) => { + return listViewFields[URLModel].body.reduce((obj, key, index) => { + obj[key] = listViewFields[URLModel].head[index]; return obj; - }, - {} - ); + }, {}); + }; - const bodyData = (libraries) => - tableSourceMapper(libraries, listViewFields['libraries' as urlModel].body); + const makeBodyData = (libraries: Library[], URLModel: libraryURLModel) => + tableSourceMapper(libraries, listViewFields[URLModel].body); - const librariesTable: TableSource = (libraries: Library[]) => { + const makeLibrariesTable = (libraries: Library[], URLModel: libraryURLModel) => { return { - head: headData, - body: bodyData(libraries), - meta: libraries + head: makeHeadData(URLModel), + body: makeBodyData(libraries, URLModel), + meta: { urlmodel: URLModel, ...libraries } }; }; - const defaultLibrariesTable = librariesTable(libraries.filter((lib) => !lib.id)); + const storedLibrariesTable = { + head: makeHeadData('stored-libraries'), + meta: { urlmodel: 'stored-libraries', ...storedLibraries }, + body: tableSourceMapper(storedLibraries, listViewFields['stored-libraries'].body) + }; - const importedLibrariesTable = librariesTable(libraries.filter((lib) => lib.id)); + const loadedLibrariesTable = makeLibrariesTable(loadedLibraries, 'loaded-libraries'); const schema = z.object({ id: z.string() }); const deleteForm = await superValidate(zod(schema)); - return { libraries, defaultLibrariesTable, importedLibrariesTable, deleteForm }; + return { storedLibrariesTable, loadedLibrariesTable, deleteForm }; }) satisfies PageServerLoad; +// ----------------------------------------------------------- // + export const actions: Actions = { upload: async (event) => { const formData = await event.request.formData(); @@ -83,12 +84,8 @@ export const actions: Actions = { if (formData.has('file')) { const { file } = Object.fromEntries(formData) as { file: File }; - - if (file.size <= 0) { - return fail(400, { form }); - } - - const endpoint = `${BASE_API_URL}/libraries/upload/`; + // Should i check if attachment.size > 0 ? + const endpoint = `${BASE_API_URL}/stored-libraries/upload/`; const req = await event.fetch(endpoint, { method: 'POST', headers: { @@ -106,7 +103,7 @@ export const actions: Actions = { setFlash({ type: 'error', message: toast_error_message }, event); return fail(400, { form }); } - setFlash({ type: 'success', message: m.librarySuccessfullyImported() }, event); + setFlash({ type: 'success', message: m.librarySuccessfullyLoaded() }, event); } else { setFlash({ type: 'error', message: m.noLibraryDetected() }, event); return fail(400, { form }); @@ -117,8 +114,10 @@ export const actions: Actions = { const schema = z.object({ id: z.string().regex(URN_REGEX) }); const deleteForm = await superValidate(formData, zod(schema)); + const URLModel = formData.get('urlmodel'); + const id = deleteForm.data.id; - const endpoint = `${BASE_API_URL}/libraries/${id}/`; + const endpoint = `${BASE_API_URL}/${URLModel}/${id}/`; if (!deleteForm.valid) { console.error(deleteForm.errors); @@ -139,10 +138,7 @@ export const actions: Actions = { } return fail(400, { form: deleteForm }); } - setFlash( - { type: 'success', message: m.successfullyDeletedObject({ object: 'library' }) }, - event - ); + setFlash({ type: 'success', message: m.successfullyDeletedLibrary() }, event); } return { deleteForm }; } diff --git a/frontend/src/routes/(app)/libraries/+page.svelte b/frontend/src/routes/(app)/libraries/+page.svelte index 47eef0ca7..6549adcab 100644 --- a/frontend/src/routes/(app)/libraries/+page.svelte +++ b/frontend/src/routes/(app)/libraries/+page.svelte @@ -11,43 +11,48 @@ export let data; import { TabGroup, Tab } from '@skeletonlabs/skeleton'; - let tabSet: number = data.importedLibrariesTable.body.length > 0 ? 0 : 1; - $: if (data.importedLibrariesTable.body.length === 0) tabSet = 1; + let tabSet: number = data.loadedLibrariesTable.body.length > 0 ? 0 : 1; + $: if (data.loadedLibrariesTable.body.length === 0) tabSet = 0;
- {#if data.importedLibrariesTable.body.length > 0} - {m.importedLibraries()} - {m.librariesStore()} + + {#if data.loadedLibrariesTable.body.length > 0} + {m.librariesStore()} + {m.loadedLibraries()} {:else}
- {m.currentlyNoImportedLibraries()}. + {m.currentlyNoLoadedLibraries()}.
{/if} + {#if tabSet === 0} {/if} {#if tabSet === 1} + {/if}
-{#if tabSet === 1} +{#if tabSet === 0}
{#await superValidate(zod(LibraryUploadSchema))}

{m.loadingLibraryUploadButton()}...

@@ -60,6 +65,7 @@ let:form validators={zod(LibraryUploadSchema)} action="?/upload" + useFocusTrap={false} onSubmit={() => { const fileInput = document.querySelector(`input[type="file"]`); console.log(fileInput); @@ -71,13 +77,13 @@ {form} helpText={m.libraryFileInYaml()} field="file" - label={m.uploadYourLibrary()} + label={m.addYourLibrary()} /> {m.add()} {:catch err} diff --git a/frontend/src/routes/(app)/libraries/[id=urn]/+page.server.ts b/frontend/src/routes/(app)/libraries/[id=urn]/+page.server.ts index b16c7a58f..d128182cc 100644 --- a/frontend/src/routes/(app)/libraries/[id=urn]/+page.server.ts +++ b/frontend/src/routes/(app)/libraries/[id=urn]/+page.server.ts @@ -5,7 +5,7 @@ import * as m from '$paraglide/messages'; export const actions: Actions = { default: async (event) => { - const endpoint = `${BASE_API_URL}/libraries/${event.params.id}/import`; + const endpoint = `${BASE_API_URL}/stored-libraries/${event.params.id}/import`; const res = await event.fetch(endpoint); if (!res.ok) { const response = await res.json(); @@ -16,10 +16,7 @@ export const actions: Actions = { setFlash( { type: 'success', - message: m.successfullyImportedObject({ - object: 'library', - id: event.params.id?.toString() ?? '' - }) + message: m.librarySuccessfullyLoaded() }, event ); diff --git a/frontend/src/routes/(app)/libraries/[id=urn]/+page.svelte b/frontend/src/routes/(app)/libraries/[id=urn]/+page.svelte index 063117abc..1e3811706 100644 --- a/frontend/src/routes/(app)/libraries/[id=urn]/+page.svelte +++ b/frontend/src/routes/(app)/libraries/[id=urn]/+page.svelte @@ -68,7 +68,7 @@ return riskMatricesDumps; } - $: displayImportButton = data.library.id === undefined; + $: displayImportButton = !(data.library.is_loaded ?? true);
diff --git a/frontend/src/routes/(app)/libraries/[id=urn]/+page.ts b/frontend/src/routes/(app)/libraries/[id=urn]/+page.ts index b1756f740..3aa9915b2 100644 --- a/frontend/src/routes/(app)/libraries/[id=urn]/+page.ts +++ b/frontend/src/routes/(app)/libraries/[id=urn]/+page.ts @@ -1,10 +1,11 @@ import type { PageLoad } from './$types'; -export const load: PageLoad = async ({ fetch, params }) => { +export const load: PageLoad = async ({ fetch, params, url }) => { const endpoint = `/libraries/${params.id}`; + const queryParams = url.searchParams.toString(); return { - tree: fetch(`/libraries/${params.id}/tree`).then((res) => res.json()) ?? {}, - library: await fetch(endpoint).then((res) => res.json()) + tree: fetch(`${endpoint}/tree?${queryParams}`).then((res) => res.json()) ?? {}, + library: await fetch(`${endpoint}?${queryParams}`).then((res) => res.json()) }; }; diff --git a/frontend/src/routes/(app)/libraries/[id=urn]/+server.ts b/frontend/src/routes/(app)/libraries/[id=urn]/+server.ts index 2abb9b113..a51bb86f7 100644 --- a/frontend/src/routes/(app)/libraries/[id=urn]/+server.ts +++ b/frontend/src/routes/(app)/libraries/[id=urn]/+server.ts @@ -3,16 +3,23 @@ import { BASE_API_URL } from '$lib/utils/constants'; import { error, type NumericRange } from '@sveltejs/kit'; import type { RequestHandler } from './$types'; -export const GET: RequestHandler = async ({ fetch, url }) => { - const endpoint = `${BASE_API_URL}${url.pathname}/${ - url.searchParams ? '?' + url.searchParams.toString() : '' - }`; +export const GET: RequestHandler = async ({ fetch, url, params }) => { + const isLoaded = url.searchParams.has('loaded'); + const URLModel = isLoaded ? 'loaded-libraries' : 'stored-libraries'; + const endpoint = `${BASE_API_URL}/${URLModel}/${params.id}/`; + const contentEndpoint = `${BASE_API_URL}/${URLModel}/${params.id}/content`; + + const [res, contentRes] = await Promise.all([fetch(endpoint), fetch(contentEndpoint)]); + + if (!res.ok) error(res.status as NumericRange<400, 599>, await res.json()); + if (!contentRes.ok) error(contentRes.status as NumericRange<400, 599>, await contentRes.json()); - const res = await fetch(endpoint); - if (!res.ok) { - error(res.status as NumericRange<400, 599>, await res.json()); - } const data = await res.json(); + const content = await contentRes.json(); + data.objects = content; + if (!isLoaded) { + data.objects = JSON.parse(content); + } return new Response(JSON.stringify(data), { headers: { diff --git a/frontend/src/routes/(app)/libraries/[id=urn]/tree/+server.ts b/frontend/src/routes/(app)/libraries/[id=urn]/tree/+server.ts index 2abb9b113..f2e2f9421 100644 --- a/frontend/src/routes/(app)/libraries/[id=urn]/tree/+server.ts +++ b/frontend/src/routes/(app)/libraries/[id=urn]/tree/+server.ts @@ -3,18 +3,15 @@ import { BASE_API_URL } from '$lib/utils/constants'; import { error, type NumericRange } from '@sveltejs/kit'; import type { RequestHandler } from './$types'; -export const GET: RequestHandler = async ({ fetch, url }) => { - const endpoint = `${BASE_API_URL}${url.pathname}/${ - url.searchParams ? '?' + url.searchParams.toString() : '' - }`; - +export const GET: RequestHandler = async ({ fetch, params, url }) => { + const URLModel = url.searchParams.has('loaded') ? 'loaded-libraries' : 'stored-libraries'; + const endpoint = `${BASE_API_URL}/${URLModel}/${params.id}/tree`; const res = await fetch(endpoint); - if (!res.ok) { - error(res.status as NumericRange<400, 599>, await res.json()); - } - const data = await res.json(); - return new Response(JSON.stringify(data), { + if (!res.ok) error(res.status as NumericRange<400, 599>, await res.json()); + + const tree = await res.json(); + return new Response(JSON.stringify(tree), { headers: { 'Content-Type': 'application/json' } diff --git a/frontend/src/routes/(app)/risk-assessments/[id=uuid]/+page.svelte b/frontend/src/routes/(app)/risk-assessments/[id=uuid]/+page.svelte index 1241b287a..3cc44b1fa 100644 --- a/frontend/src/routes/(app)/risk-assessments/[id=uuid]/+page.svelte +++ b/frontend/src/routes/(app)/risk-assessments/[id=uuid]/+page.svelte @@ -161,7 +161,9 @@
- {m.remediationPlan()}
- + @@ -107,7 +102,7 @@ - + @@ -117,9 +112,9 @@ diff --git a/frontend/src/routes/(app)/risk-assessments/[id=uuid]/plan/export/csv/+server.ts b/frontend/src/routes/(app)/risk-assessments/[id=uuid]/remediation-plan/export/csv/+server.ts similarity index 100% rename from frontend/src/routes/(app)/risk-assessments/[id=uuid]/plan/export/csv/+server.ts rename to frontend/src/routes/(app)/risk-assessments/[id=uuid]/remediation-plan/export/csv/+server.ts diff --git a/frontend/src/routes/(app)/risk-assessments/[id=uuid]/plan/export/pdf/+server.ts b/frontend/src/routes/(app)/risk-assessments/[id=uuid]/remediation-plan/export/pdf/+server.ts similarity index 100% rename from frontend/src/routes/(app)/risk-assessments/[id=uuid]/plan/export/pdf/+server.ts rename to frontend/src/routes/(app)/risk-assessments/[id=uuid]/remediation-plan/export/pdf/+server.ts diff --git a/frontend/tests/e2e-tests.sh b/frontend/tests/e2e-tests.sh index 44c5f0b99..cd37156cb 100755 --- a/frontend/tests/e2e-tests.sh +++ b/frontend/tests/e2e-tests.sh @@ -12,130 +12,129 @@ BACKEND_PORT=8173 MAILER_WEB_SERVER_PORT=8073 MAILER_SMTP_SERVER_PORT=1073 -for arg in "$@" -do - if [[ $arg == --port* ]]; then - if [[ "${arg#*=}" =~ ^[0-9]+$ ]]; then - BACKEND_PORT="${arg#*=}" - else - echo "Invalid format for --port argument. Please use --port=PORT" - exit 1 - fi - elif [[ $arg == --env* ]]; then - if [[ "${arg#*=}" =~ ^(.+)\/([^\/.]+)$ ]]; then - VENV_PATH="${arg#*=}" - else - echo "Invalid format for --env argument. Please use --env=PATH" - exit 1 - fi - elif [[ $arg == --mailer* ]]; then - MAILER_PORTS="${arg#*=}" - if [[ $MAILER_PORTS =~ ^[0-9]+/[0-9]+$ ]]; then - IFS='/' read -ra PORTS <<< "$MAILER_PORTS" - MAILER_SMTP_SERVER_PORT="${PORTS[0]}" - MAILER_WEB_SERVER_PORT="${PORTS[1]}" - SCRIPT_SHORT_ARGS+=("-m") - else - echo "Invalid format for --mailer argument. Please use --mailer=PORT/PORT" - exit 1 - fi - elif [[ $arg == --* ]]; then - SCRIPT_LONG_ARGS+=("$arg") - elif [[ $arg == -* ]]; then - SCRIPT_SHORT_ARGS+=("$arg") - elif [[ $arg != -* ]]; then - TEST_PATHS+=("$arg") - fi +for arg in "$@"; do + if [[ $arg == --port* ]]; then + if [[ "${arg#*=}" =~ ^[0-9]+$ ]]; then + BACKEND_PORT="${arg#*=}" + else + echo "Invalid format for --port argument. Please use --port=PORT" + exit 1 + fi + elif [[ $arg == --env* ]]; then + if [[ "${arg#*=}" =~ ^(.+)\/([^\/.]+)$ ]]; then + VENV_PATH="${arg#*=}" + else + echo "Invalid format for --env argument. Please use --env=PATH" + exit 1 + fi + elif [[ $arg == --mailer* ]]; then + MAILER_PORTS="${arg#*=}" + if [[ $MAILER_PORTS =~ ^[0-9]+/[0-9]+$ ]]; then + IFS='/' read -ra PORTS <<<"$MAILER_PORTS" + MAILER_SMTP_SERVER_PORT="${PORTS[0]}" + MAILER_WEB_SERVER_PORT="${PORTS[1]}" + SCRIPT_SHORT_ARGS+=("-m") + else + echo "Invalid format for --mailer argument. Please use --mailer=PORT/PORT" + exit 1 + fi + elif [[ $arg == --* ]]; then + SCRIPT_LONG_ARGS+=("$arg") + elif [[ $arg == -* ]]; then + SCRIPT_SHORT_ARGS+=("$arg") + elif [[ $arg != -* ]]; then + TEST_PATHS+=("$arg") + fi done if [[ " ${SCRIPT_SHORT_ARGS[@]} " =~ " -h " ]] || [[ " ${SCRIPT_LONG_ARGS[@]} " =~ " --help " ]]; then - echo "Usage: e2e-tests.sh [options] [test_path]" - echo "Run the end-to-end tests for the CISO Assistant application." - echo "Options:" - echo " --browser=NAME Run the tests in the specified browser (chromium, firefox, webkit)" - echo " --env=PATH Path to the virtual environment to use for the tests (default: first one found in $VENV_PATH)" - echo " --global-timeout=MS Maximum time this test suite can run in milliseconds (default: unlimited)" - echo " --grep=SEARCH Only run tests matching this regular expression (default: \".*\")" - echo " --headed Run the tests in headful mode" - echo " -h Show this help message and exit" - echo " --list List all the tests" - echo " -m, --mailer=PORT/PORT Use an existing mailer service on the optionally defined ports (default: $MAILER_SMTP_SERVER_PORT/$MAILER_WEB_SERVER_PORT)" - echo " --port=PORT Run the backend server on the specified port (default: $BACKEND_PORT)" - echo " --project=NAME Run the tests in the specified project (chromium, firefox, webkit)" - echo " -q Quick mode: execute only the tests 1 time with no retries and only 1 project" - echo " --repeat-each=COUNT Run the tests the specified number of times (default: 1)" - echo " --retries=COUNT Set the number of retries for the tests" - echo " --timeout=MS Set the timeout for the tests in milliseconds" - echo " -v Show the output of the backend server" - echo -e " --workers=COUNT Number of concurrent workers or percentage of logical CPU cores, use 1 to run in a single worker (default: 1)" - echo " Be aware that increasing the number of workers may reduce tests accuracy and stability" - exit 0 + echo "Usage: e2e-tests.sh [options] [test_path]" + echo "Run the end-to-end tests for the CISO Assistant application." + echo "Options:" + echo " --browser=NAME Run the tests in the specified browser (chromium, firefox, webkit)" + echo " --env=PATH Path to the virtual environment to use for the tests (default: first one found in $VENV_PATH)" + echo " --global-timeout=MS Maximum time this test suite can run in milliseconds (default: unlimited)" + echo " --grep=SEARCH Only run tests matching this regular expression (default: \".*\")" + echo " --headed Run the tests in headful mode" + echo " -h Show this help message and exit" + echo " --list List all the tests" + echo " -m, --mailer=PORT/PORT Use an existing mailer service on the optionally defined ports (default: $MAILER_SMTP_SERVER_PORT/$MAILER_WEB_SERVER_PORT)" + echo " --port=PORT Run the backend server on the specified port (default: $BACKEND_PORT)" + echo " --project=NAME Run the tests in the specified project (chromium, firefox, webkit)" + echo " -q Quick mode: execute only the tests 1 time with no retries and only 1 project" + echo " --repeat-each=COUNT Run the tests the specified number of times (default: 1)" + echo " --retries=COUNT Set the number of retries for the tests" + echo " --timeout=MS Set the timeout for the tests in milliseconds" + echo " -v Show the output of the backend server" + echo -e " --workers=COUNT Number of concurrent workers or percentage of logical CPU cores, use 1 to run in a single worker (default: 1)" + echo " Be aware that increasing the number of workers may reduce tests accuracy and stability" + exit 0 fi ENV_CFG=$(find "$VENV_PATH" -name "pyvenv.cfg" -print -quit) if [[ ! -z $ENV_CFG ]]; then - VENV_PATH=$(dirname $ENV_CFG) - if [ -d "$VENV_PATH/bin" ] ; then - source "$VENV_PATH/bin/activate" - else - source "$VENV_PATH/Scripts/activate" - fi - echo "Using virtual environment at $VENV_PATH" + VENV_PATH=$(dirname $ENV_CFG) + if [ -d "$VENV_PATH/bin" ]; then + source "$VENV_PATH/bin/activate" + else + source "$VENV_PATH/Scripts/activate" + fi + echo "Using virtual environment at $VENV_PATH" else - echo "No virtual environment found at $VENV_PATH, using standard python environment instead." + echo "No virtual environment found at $VENV_PATH, using standard python environment instead." fi -if python -c "import socket;exit(0 if 0 == socket.socket(socket.AF_INET, socket.SOCK_STREAM).connect_ex(('localhost',$BACKEND_PORT)) else 1)" ; then - echo "The port $BACKEND_PORT is already in use!" - echo "Please stop the running process using the port or change the backend test server port using --port=PORT and try again." - exit 1 +if python -c "import socket;exit(0 if 0 == socket.socket(socket.AF_INET, socket.SOCK_STREAM).connect_ex(('127.0.0.1',$BACKEND_PORT)) else 1)"; then + echo "The port $BACKEND_PORT is already in use!" + echo "Please stop the running process using the port or change the backend test server port using --port=PORT and try again." + exit 1 fi -for PORT in $MAILER_WEB_SERVER_PORT $MAILER_SMTP_SERVER_PORT ; do - if python -c "import socket;exit(0 if 0 == socket.socket(socket.AF_INET, socket.SOCK_STREAM).connect_ex(('localhost',$PORT)) else 1)" ; then - if [[ ! " ${SCRIPT_SHORT_ARGS[@]} " =~ " -m " ]] ; then - echo "The port $PORT is already in use!" - echo "Please stop the running process using the port or change the mailer port and try again." - exit 1 - fi - elif [[ " ${SCRIPT_SHORT_ARGS[@]} " =~ " -m " ]] ; then - echo "No mailer service is running on port $PORT!" - echo "Please start a mailer service on port $PORT or change the mailer port using --mailer=PORT/PORT and try again." - echo "You can also use the isolated test mailer service by removing the -m option." - exit 1 - fi +for PORT in $MAILER_WEB_SERVER_PORT $MAILER_SMTP_SERVER_PORT; do + if python -c "import socket;exit(0 if 0 == socket.socket(socket.AF_INET, socket.SOCK_STREAM).connect_ex(('localhost',$PORT)) else 1)"; then + if [[ ! " ${SCRIPT_SHORT_ARGS[@]} " =~ " -m " ]]; then + echo "The port $PORT is already in use!" + echo "Please stop the running process using the port or change the mailer port and try again." + exit 1 + fi + elif [[ " ${SCRIPT_SHORT_ARGS[@]} " =~ " -m " ]]; then + echo "No mailer service is running on port $PORT!" + echo "Please start a mailer service on port $PORT or change the mailer port using --mailer=PORT/PORT and try again." + echo "You can also use the isolated test mailer service by removing the -m option." + exit 1 + fi done cleanup() { - echo -e "\nCleaning up..." - if type deactivate >/dev/null 2>&1; then - deactivate - fi - if [ -n "$BACKEND_PID" ] ; then - kill $BACKEND_PID > /dev/null 2>&1 - echo "| backend server stopped" - fi - if [ -n "$MAILER_PID" ] ; then - docker stop $MAILER_PID > /dev/null 2>&1 - docker rm $MAILER_PID > /dev/null 2>&1 - echo "| mailer service stopped" - fi - if [ -f "$DB_DIR/$DB_NAME" ] ; then - rm "$DB_DIR/$DB_NAME" - echo "| test database deleted" - fi - if [ -d "$APP_DIR/frontend/tests/utils/.testhistory" ] ; then - rm -rf "$APP_DIR/frontend/tests/utils/.testhistory" - echo "| test data history removed" - fi - trap - SIGINT SIGTERM EXIT - echo "Cleanup done" - exit 0 + echo -e "\nCleaning up..." + if type deactivate >/dev/null 2>&1; then + deactivate + fi + if [ -n "$BACKEND_PID" ]; then + kill $BACKEND_PID >/dev/null 2>&1 + echo "| backend server stopped" + fi + if [ -n "$MAILER_PID" ]; then + docker stop $MAILER_PID >/dev/null 2>&1 + docker rm $MAILER_PID >/dev/null 2>&1 + echo "| mailer service stopped" + fi + if [ -f "$DB_DIR/$DB_NAME" ]; then + rm "$DB_DIR/$DB_NAME" + echo "| test database deleted" + fi + if [ -d "$APP_DIR/frontend/tests/utils/.testhistory" ]; then + rm -rf "$APP_DIR/frontend/tests/utils/.testhistory" + echo "| test data history removed" + fi + trap - SIGINT SIGTERM EXIT + echo "Cleanup done" + exit 0 } finish() { - echo "Test successfully completed!" - cleanup + echo "Test successfully completed!" + cleanup } trap cleanup SIGINT SIGTERM @@ -144,7 +143,7 @@ trap finish EXIT echo "Starting backend server..." unset POSTGRES_NAME POSTGRES_USER POSTGRES_PASSWORD export CISO_ASSISTANT_URL=http://localhost:4173 -export ALLOWED_HOSTS=localhost +export ALLOWED_HOSTS=localhost,127.0.0.1,0.0.0.0 export DJANGO_DEBUG=True export DJANGO_SUPERUSER_EMAIL=admin@tests.com export DJANGO_SUPERUSER_PASSWORD=1234 @@ -159,50 +158,50 @@ cd $APP_DIR/backend/ python manage.py makemigrations python manage.py migrate python manage.py createsuperuser --noinput -if [[ " ${SCRIPT_SHORT_ARGS[@]} " =~ " -v " ]] ; then - nohup python manage.py runserver $BACKEND_PORT > $APP_DIR/frontend/tests/utils/.testbackendoutput.out 2>&1 & - echo "You can view the backend server output at $APP_DIR/frontend/tests/utils/.testbackendoutput.out" +if [[ " ${SCRIPT_SHORT_ARGS[@]} " =~ " -v " ]]; then + nohup python manage.py runserver $BACKEND_PORT >$APP_DIR/frontend/tests/utils/.testbackendoutput.out 2>&1 & + echo "You can view the backend server output at $APP_DIR/frontend/tests/utils/.testbackendoutput.out" else - nohup python manage.py runserver $BACKEND_PORT > /dev/null 2>&1 & + nohup python manage.py runserver $BACKEND_PORT >/dev/null 2>&1 & fi BACKEND_PID=$! echo "Test backend server started on port $BACKEND_PORT (PID: $BACKEND_PID)" -if [[ ! " ${SCRIPT_SHORT_ARGS[@]} " =~ " -m " ]] ; then - if command -v docker > /dev/null 2>&1 ; then - echo "Starting mailer service..." - MAILER_PID=$(docker run -d -p $MAILER_SMTP_SERVER_PORT:1025 -p $MAILER_WEB_SERVER_PORT:8025 mailhog/mailhog) - echo "Mailer service started on ports $MAILER_SMTP_SERVER_PORT/$MAILER_WEB_SERVER_PORT (Container ID: ${MAILER_PID:0:6})" - else - echo "Docker is not installed!" - echo "Please install Docker to use the isolated test mailer service or use -m to tell the tests to use an existing one." - exit 1 - fi +if [[ ! " ${SCRIPT_SHORT_ARGS[@]} " =~ " -m " ]]; then + if command -v docker >/dev/null 2>&1; then + echo "Starting mailer service..." + MAILER_PID=$(docker run -d -p $MAILER_SMTP_SERVER_PORT:1025 -p $MAILER_WEB_SERVER_PORT:8025 mailhog/mailhog) + echo "Mailer service started on ports $MAILER_SMTP_SERVER_PORT/$MAILER_WEB_SERVER_PORT (Container ID: ${MAILER_PID:0:6})" + else + echo "Docker is not installed!" + echo "Please install Docker to use the isolated test mailer service or use -m to tell the tests to use an existing one." + exit 1 + fi else - echo "Using an existing mailer service on ports $MAILER_SMTP_SERVER_PORT/$MAILER_WEB_SERVER_PORT" + echo "Using an existing mailer service on ports $MAILER_SMTP_SERVER_PORT/$MAILER_WEB_SERVER_PORT" fi echo "Starting playwright tests" export ORIGIN=http://localhost:4173 -export PUBLIC_BACKEND_API_URL=http://localhost:$BACKEND_PORT/api +export PUBLIC_BACKEND_API_URL=http://127.0.0.1:$BACKEND_PORT/api export MAILER_WEB_SERVER_PORT=$MAILER_WEB_SERVER_PORT cd $APP_DIR/frontend/ -if (( ${#TEST_PATHS[@]} == 0 )); then - echo "| running every functional test" +if ((${#TEST_PATHS[@]} == 0)); then + echo "| running every functional test" else - echo "| running tests: ${TEST_PATHS[@]}" + echo "| running tests: ${TEST_PATHS[@]}" fi -if (( ${#SCRIPT_LONG_ARGS[@]} == 0 )); then - echo "| without args" +if ((${#SCRIPT_LONG_ARGS[@]} == 0)); then + echo "| without args" else - echo "| with args: ${SCRIPT_LONG_ARGS[@]}" + echo "| with args: ${SCRIPT_LONG_ARGS[@]}" fi echo "==========================================================================================" -if [[ " ${SCRIPT_SHORT_ARGS[@]} " =~ " -q " ]] ; then - npx playwright test ./tests/functional/"${TEST_PATHS[@]}" -x --project=chromium "${SCRIPT_LONG_ARGS[@]}" +if [[ " ${SCRIPT_SHORT_ARGS[@]} " =~ " -q " ]]; then + npx playwright test ./tests/functional/"${TEST_PATHS[@]}" -x --project=chromium "${SCRIPT_LONG_ARGS[@]}" else - npx playwright test ./tests/functional/"${TEST_PATHS[@]}" "${SCRIPT_LONG_ARGS[@]}" + npx playwright test ./tests/functional/"${TEST_PATHS[@]}" "${SCRIPT_LONG_ARGS[@]}" fi diff --git a/frontend/tests/functional/detailed/libraries.test.ts b/frontend/tests/functional/detailed/libraries.test.ts index 38a620eef..4675615d2 100644 --- a/frontend/tests/functional/detailed/libraries.test.ts +++ b/frontend/tests/functional/detailed/libraries.test.ts @@ -1,25 +1,26 @@ -import { test, expect } from '../../utils/test-utils.js'; +import { test, expect, type Locator } from '../../utils/test-utils.js'; test.describe.configure({ mode: 'serial' }); -test('every libraries can be imported', async ({ logedPage, librariesPage, page }) => { +test('every library can be loaded', async ({ logedPage, librariesPage, page }) => { test.slow(); await librariesPage.goto(); await librariesPage.hasUrl(); + const libraries: Locator[] = await page.locator('tbody tr td:nth-child(1)').all(); + const libraryNames: string[] = await Promise.all( + libraries.map(async (library) => await library.innerText()) + ); + let previousRemainingLibrary = ''; - let nextRemainingLibrary = await page.locator('tbody tr td:nth-child(1)').first()?.innerText(); - while (nextRemainingLibrary) { + let nextRemainingLibrary = libraryNames[0]; + for (let i = 1; i < libraryNames.length; i++) { await librariesPage.importLibrary(nextRemainingLibrary, undefined, 'any'); await librariesPage.tab('Libraries store').click(); expect(librariesPage.tab('Libraries store').getAttribute('aria-selected')).toBeTruthy(); previousRemainingLibrary = nextRemainingLibrary; - if ((await page.locator('tbody tr td:nth-child(1)').count()) !== 0) { - nextRemainingLibrary = await page.locator('tbody tr td:nth-child(1)').first()?.innerText(); - } else { - break; - } + nextRemainingLibrary = libraryNames[i]; expect( previousRemainingLibrary, 'An error occured while importing library: ' + previousRemainingLibrary @@ -27,7 +28,7 @@ test('every libraries can be imported', async ({ logedPage, librariesPage, page } }); -test('every libraries can be deleted', async ({ logedPage, librariesPage, page }) => { +test('every library can be deleted', async ({ logedPage, librariesPage, page }) => { test.slow(); test.skip( true, @@ -38,15 +39,15 @@ test('every libraries can be deleted', async ({ logedPage, librariesPage, page } await librariesPage.hasUrl(); await expect( - librariesPage.tab('Imported libraries'), - 'There is no imported libraries to delete' + librariesPage.tab('Loaded libraries'), + 'There is no loaded libraries to delete' ).toBeVisible(); if ( - (await librariesPage.tab('Imported libraries').isVisible()) && - (await librariesPage.tab('Imported libraries').getAttribute('aria-selected')) === 'false' + (await librariesPage.tab('Loaded libraries').isVisible()) && + (await librariesPage.tab('Loaded libraries').getAttribute('aria-selected')) === 'false' ) { - await librariesPage.tab('Imported libraries').click(); - expect(librariesPage.tab('Imported libraries').getAttribute('aria-selected')).toBeTruthy(); + await librariesPage.tab('Loaded libraries').click(); + expect(librariesPage.tab('Loaded libraries').getAttribute('aria-selected')).toBeTruthy(); } let previousRemainingLibrary = ''; @@ -54,7 +55,7 @@ test('every libraries can be deleted', async ({ logedPage, librariesPage, page } let count = 0; do { await page.reload(); // this is a workaround to try to fix the issue with delete button not being visible with dependencies in CI - if (await librariesPage.tab('Imported libraries').isVisible()) { + if (await librariesPage.tab('Loaded libraries').isVisible()) { previousRemainingLibrary = nextRemainingLibrary; nextRemainingLibrary = await page.locator('tbody tr td:nth-child(1)').nth(count)?.innerText(); expect( @@ -75,7 +76,7 @@ test('every libraries can be deleted', async ({ logedPage, librariesPage, page } timeout: 15000 } ); - if (await page.getByText(' You currently have no imported libraries.').isHidden()) { + if (await page.getByText(' You currently have no loaded libraries.').isHidden()) { await expect(librariesPage.getRow(nextRemainingLibrary)).not.toBeVisible(); } else { break; @@ -87,6 +88,6 @@ test('every libraries can be deleted', async ({ logedPage, librariesPage, page } } } while ( nextRemainingLibrary || - (await page.getByText(' You currently have no imported libraries.').isHidden()) + (await page.getByText(' You currently have no loaded libraries.').isHidden()) ); }); diff --git a/frontend/tests/functional/nav.test.ts b/frontend/tests/functional/nav.test.ts index 4ed65d0fc..669481ce8 100644 --- a/frontend/tests/functional/nav.test.ts +++ b/frontend/tests/functional/nav.test.ts @@ -60,10 +60,13 @@ test('sidebar navigation tests', async ({ logedPage, analyticsPage, sideBar, pag await test.step('translation panel is working properly', async () => { await analyticsPage.goto(); - for await (const languageTag of availableLanguageTags.toSorted((a, b) => { - // English is always tested at last to ensure a clean state at the end - return a === 'en' ? 1 : b === 'en' ? -1 : a.localeCompare(b); - })) { + const locales = [...availableLanguageTags]; + const index = locales.indexOf('en'); + if (index !== -1) { + locales.splice(index, 1); + locales.push('en'); + } + for (const languageTag of locales) { await sideBar.moreButton.click(); await expect(sideBar.morePanel).not.toHaveAttribute('inert'); await expect(sideBar.languageSelect).toBeVisible(); diff --git a/frontend/tests/utils/page-content.ts b/frontend/tests/utils/page-content.ts index 92a1faa53..8f648da63 100644 --- a/frontend/tests/utils/page-content.ts +++ b/frontend/tests/utils/page-content.ts @@ -65,10 +65,10 @@ export class PageContent extends BasePage { } } - async importLibrary(ref: string, urn?: string, language: string = 'English') { + async importLibrary(ref: string, urn?: string, language = 'English') { if ( - (await this.tab('Imported libraries').isVisible()) && - (await this.tab('Imported libraries').getAttribute('aria-selected')) === 'true' + (await this.tab('Loaded libraries').isVisible()) && + (await this.tab('Loaded libraries').getAttribute('aria-selected')) === 'true' ) { if (await this.getRow(ref).isHidden()) { await this.tab('Libraries store').click(); @@ -77,12 +77,19 @@ export class PageContent extends BasePage { return; } } + // If the library is not visible, it might have already been loaded + if (await this.importItemButton(ref, language === 'any' ? undefined : language).isHidden()) { + await this.tab('Loaded libraries').click(); + expect(this.tab('Loaded libraries').getAttribute('aria-selected')).toBeTruthy(); + expect(this.getRow(ref)).toBeVisible(); + return; + } await this.importItemButton(ref, language === 'any' ? undefined : language).click(); - await this.isToastVisible(`The library object has been successfully imported.+`, undefined, { + await this.isToastVisible(`The library has been successfully loaded.+`, undefined, { timeout: 15000 }); - await this.tab('Imported libraries').click(); - expect(this.tab('Imported libraries').getAttribute('aria-selected')).toBeTruthy(); + await this.tab('Loaded libraries').click(); + expect(this.tab('Loaded libraries').getAttribute('aria-selected')).toBeTruthy(); expect(this.getRow(ref)).toBeVisible(); } diff --git a/frontend/tests/utils/test-data.ts b/frontend/tests/utils/test-data.ts index 033b8d56e..9890b9262 100644 --- a/frontend/tests/utils/test-data.ts +++ b/frontend/tests/utils/test-data.ts @@ -72,7 +72,7 @@ export default { 'view_riskmatrix', 'view_requirementnode', 'view_framework', - 'view_library', + 'view_loadedlibrary', 'view_user' ] }, @@ -96,7 +96,7 @@ export default { 'view_requirementnode', 'view_evidence', 'view_framework', - 'view_library', + 'view_loadedlibrary', 'view_user' ] }, @@ -156,7 +156,7 @@ export default { 'delete_evidence', 'view_requirementnode', 'view_framework', - 'view_library', + 'view_loadedlibrary', 'view_user' ] }, @@ -181,7 +181,7 @@ export default { 'view_requirementnode', 'view_evidence', 'view_framework', - 'view_library', + 'view_loadedlibrary', 'view_user' ] } diff --git a/frontend/tests/utils/test-utils.ts b/frontend/tests/utils/test-utils.ts index 62370a66f..d9dfa8232 100644 --- a/frontend/tests/utils/test-utils.ts +++ b/frontend/tests/utils/test-utils.ts @@ -621,7 +621,7 @@ export function getUniqueValue(value: string): string { } export function replaceValues(obj: any, searchValue: string, replaceValue: string) { - for (let key in obj) { + for (const key in obj) { if (typeof obj[key] === 'object') { replaceValues(obj[key], searchValue, replaceValue); } else if (typeof obj[key] === 'string') { diff --git a/tools/anssi/anssi-recommandations-configuration-systeme-gnu-linux.xlsx b/tools/anssi/anssi-recommandations-configuration-systeme-gnu-linux.xlsx new file mode 100644 index 000000000..da50c4121 Binary files /dev/null and b/tools/anssi/anssi-recommandations-configuration-systeme-gnu-linux.xlsx differ diff --git a/tools/cis/README.md b/tools/cis/README.md new file mode 100644 index 000000000..493fb8165 --- /dev/null +++ b/tools/cis/README.md @@ -0,0 +1,6 @@ +This script prepares the file to be parsed by the converter: + +- copy the downloaded excel sheet from CIS next to this script (for instance CIS_Controls_Version_8.xlsx) +- run the preparation script by passing the filename as 1st argument and your name/entity as a second one for the packager +- run the converter on the prepared excel sheet +- use the resulting yaml in CISO Assistant \ No newline at end of file diff --git a/tools/cis/convert_cis.py b/tools/cis/prep_cis.py similarity index 96% rename from tools/cis/convert_cis.py rename to tools/cis/prep_cis.py index 458993cbb..007b2f3e7 100644 --- a/tools/cis/convert_cis.py +++ b/tools/cis/prep_cis.py @@ -86,18 +86,18 @@ ws2.append( [ "IG1", - "Essential Cyber Hygiene", + "IG1", "Minimum standard of information security for all enterprises.", ] ) ws2.append( [ "IG2", - "", + "IG2", "For enterprises managing IT infrastructure of multiple departments with differing risk profiles.", ] ) -ws2.append(["IG3", "", "To secure sensitive and confidential data."]) +ws2.append(["IG3", "IG3", "To secure sensitive and confidential data."]) print("generate ", output_file_name) wb_output.save(output_file_name) diff --git a/tools/convert_cis.sh b/tools/convert_cis.sh new file mode 100755 index 000000000..0806a6a91 --- /dev/null +++ b/tools/convert_cis.sh @@ -0,0 +1,6 @@ +file="CIS_Controls_Version_8.xlsx" +packager="personal" +python cis/prep_cis.py $file $packager +intermediate="cis-controls-v8.xlsx" +python convert_library.py cis/cis-controls-v8.xlsx +echo "Resulting file is available at cis/cis-controls-v8.yaml" \ No newline at end of file diff --git a/tools/pgssi-s/pgssi-s-1.0.xlsx b/tools/pgssi-s/pgssi-s-1.0.xlsx new file mode 100644 index 000000000..916461742 Binary files /dev/null and b/tools/pgssi-s/pgssi-s-1.0.xlsx differ diff --git a/tools/pgssi-s/pgssi-s-v1.0.xlsx b/tools/pgssi-s/pgssi-s-v1.0.xlsx deleted file mode 100644 index 47a6b2324..000000000 Binary files a/tools/pgssi-s/pgssi-s-v1.0.xlsx and /dev/null differ diff --git a/tools/sample/sample.xlsx b/tools/sample/sample.xlsx new file mode 100644 index 000000000..0e4a2b74e Binary files /dev/null and b/tools/sample/sample.xlsx differ
- {% with impact=risk_matrix.parse_json.impact|index:row_index %} - {{ impact.name }}: - {{ impact.description|linebreaksbr }} + {% with probability=risk_matrix.parse_json.probability|index:row_index %} + {{ probability.name }}: + {{ probability.description|linebreaksbr }} {% endwith %}
{{ impact.name }}: {{ impact.description|linebreaksbr }} @@ -86,24 +86,5 @@ {% trans "Impact" %} -
-

{% trans "Risk levels" %}

-
- - {% for risk in risk_matrix.parse_json.risk %} - - - - - - {% endfor %} -
- - {{ risk.name }} - - {{ risk.description|linebreaksbr }} -
-
-
{% endif %} diff --git a/backend/core/templatetags/core_extras.py b/backend/core/templatetags/core_extras.py index 0aebc1e5b..8fa6edbc5 100644 --- a/backend/core/templatetags/core_extras.py +++ b/backend/core/templatetags/core_extras.py @@ -2,6 +2,7 @@ from ciso_assistant.settings import VERSION, BUILD, DEBUG from core.utils import COUNTRY_FLAGS, LANGUAGES +from core.models import RequirementAssessment register = template.Library() @@ -16,6 +17,17 @@ def app_build(): return f"{BUILD} (dev)" if DEBUG else BUILD +@register.simple_tag() +def get_requirements_count(applied_control, compliance_assessment): + return ( + RequirementAssessment.objects.filter( + compliance_assessment=compliance_assessment + ) + .filter(applied_controls=applied_control) + .count() + ) + + @register.filter("class") def _class(obj): return obj.__class__.__name__ if obj else "" diff --git a/backend/core/tests/test_helpers.py b/backend/core/tests/test_helpers.py index ef5abe66b..315491ab5 100644 --- a/backend/core/tests/test_helpers.py +++ b/backend/core/tests/test_helpers.py @@ -8,9 +8,11 @@ @pytest.fixture def risk_matrix_fixture(): - import_library_view( - get_library("urn:intuitem:risk:library:critical_risk_matrix_5x5") - ) + library = StoredLibrary.objects.filter( + urn="urn:intuitem:risk:library:critical_risk_matrix_5x5" + ).last() + assert library is not None + library.load() @pytest.mark.django_db diff --git a/backend/core/tests/test_models.py b/backend/core/tests/test_models.py index 068b00014..e21387024 100644 --- a/backend/core/tests/test_models.py +++ b/backend/core/tests/test_models.py @@ -16,15 +16,15 @@ Evidence, RiskAcceptance, Asset, + StoredLibrary, Threat, RiskMatrix, - Library, + LoadedLibrary, Framework, ) from django.contrib.auth import get_user_model from django.core.files.uploadedfile import SimpleUploadedFile from iam.models import Folder -from library.utils import import_library_view, get_library User = get_user_model() @@ -42,9 +42,11 @@ def domain_project_fixture(): @pytest.fixture def risk_matrix_fixture(): - library = get_library("urn:intuitem:risk:library:critical_risk_matrix_5x5") + library = StoredLibrary.objects.filter( + urn="urn:intuitem:risk:library:critical_risk_matrix_5x5" + ).last() assert library is not None - import_library_view(library) + library.load() @pytest.mark.django_db @@ -863,12 +865,13 @@ class TestLibrary: pytestmark = pytest.mark.django_db def test_library_creation(self): - library = Library.objects.create( + library = LoadedLibrary.objects.create( name="Library", description="Library description", folder=Folder.get_root_folder(), locale="en", version=1, + objects_meta={}, ) assert library.name == "Library" assert library.description == "Library description" @@ -877,12 +880,13 @@ def test_library_creation(self): assert library.folder == Folder.get_root_folder() def test_library_reference_count_zero_if_unused(self): - library = Library.objects.create( + library = LoadedLibrary.objects.create( name="Library", description="Library description", folder=Folder.get_root_folder(), locale="en", version=1, + objects_meta={}, ) assert library.reference_count == 0 @@ -890,12 +894,13 @@ def test_library_reference_count_zero_if_unused(self): def test_library_reference_count_incremented_when_framework_is_referenced_by_compliance_assessment_and_decremented_when_compliance_assessment_is_deleted( self, ): - library = Library.objects.create( + library = LoadedLibrary.objects.create( name="Library", description="Library description", folder=Folder.get_root_folder(), locale="en", version=1, + objects_meta={}, ) framework = Framework.objects.create( name="Framework", @@ -923,12 +928,13 @@ def test_library_reference_count_incremented_when_framework_is_referenced_by_com def test_library_reference_count_incremented_when_reference_control_is_referenced_by_complance_assessment_and_decremented_when_compliance_assessment_is_deleted( self, ): - library = Library.objects.create( + library = LoadedLibrary.objects.create( name="Library", description="Library description", folder=Folder.get_root_folder(), locale="en", version=1, + objects_meta={}, ) framework = Framework.objects.create( name="Framework", @@ -983,7 +989,7 @@ def test_library_reference_count_incremented_when_risk_matrix_is_referenced_by_r domain = Folder.objects.create(name="Domain", description="Domain description") project = Project.objects.create(name="Project", folder=domain) - library = Library.objects.get() + library = LoadedLibrary.objects.get() risk_matrix = RiskMatrix.objects.get() assert library.reference_count == 0 @@ -1010,12 +1016,13 @@ def test_library_reference_count_incremented_when_threat_is_referenced_by_risk_s risk_matrix = RiskMatrix.objects.get() - library = Library.objects.create( + library = LoadedLibrary.objects.create( name="Library", description="Library description", folder=Folder.get_root_folder(), locale="en", version=1, + objects_meta={}, ) threat = Threat.objects.create( name="Threat", @@ -1055,12 +1062,13 @@ def test_library_reference_count_incremented_when_reference_control_is_reference risk_matrix = RiskMatrix.objects.get() - library = Library.objects.create( + library = LoadedLibrary.objects.create( name="Library", description="Library description", folder=Folder.get_root_folder(), locale="en", version=1, + objects_meta={}, ) reference_control = ReferenceControl.objects.create( name="ReferenceControl", @@ -1101,12 +1109,13 @@ def test_library_reference_count_incremented_when_reference_control_is_reference def test_library_reference_count_must_be_zero_for_library_deletion( self, ): - library = Library.objects.create( + library = LoadedLibrary.objects.create( name="Library", description="Library description", folder=Folder.get_root_folder(), locale="en", version=1, + objects_meta={}, ) framework = Framework.objects.create( name="Framework", @@ -1130,33 +1139,45 @@ def test_library_reference_count_must_be_zero_for_library_deletion( assert library.reference_count == 0 - library.delete() + try: # wrapping in try/except to avoid raising exception due to StoredLibrary not existing + library.delete() + except: + None - assert Library.objects.count() == 0 + assert LoadedLibrary.objects.count() == 0 @pytest.mark.usefixtures("domain_project_fixture") def test_library_cannot_be_deleted_if_it_is_a_dependency_of_other_libraries(self): - dependency_library = Library.objects.create( + dependency_library = LoadedLibrary.objects.create( name="Dependency Library", description="Dependency Library description", folder=Folder.get_root_folder(), locale="en", version=1, + objects_meta={}, ) - library = Library.objects.create( + library = LoadedLibrary.objects.create( name="Library", description="Library description", folder=Folder.get_root_folder(), locale="en", version=1, + objects_meta={}, ) library.dependencies.add(dependency_library) with pytest.raises(ValueError): dependency_library.delete() - library.delete() - assert Library.objects.count() == 1 + try: # wrapping in try/except to avoid raising exception due to StoredLibrary not existing + library.delete() + except: + None + + assert LoadedLibrary.objects.count() == 1 - dependency_library.delete() - assert Library.objects.count() == 0 + try: # wrapping in try/except to avoid raising exception due to StoredLibrary not existing + dependency_library.delete() + except: + None + assert LoadedLibrary.objects.count() == 0 diff --git a/backend/core/urls.py b/backend/core/urls.py index a521df423..2f8062ee6 100644 --- a/backend/core/urls.py +++ b/backend/core/urls.py @@ -1,5 +1,5 @@ from .views import * -from library.views import LibraryViewSet +from library.views import StoredLibraryViewSet, LoadedLibraryViewSet from django.urls import include, path @@ -39,7 +39,8 @@ RequirementAssessmentViewSet, basename="requirement-assessments", ) -router.register(r"libraries", LibraryViewSet, basename="libraries") +router.register(r"stored-libraries", StoredLibraryViewSet, basename="stored-libraries") +router.register(r"loaded-libraries", LoadedLibraryViewSet, basename="loaded-libraries") urlpatterns = [ diff --git a/backend/core/utils.py b/backend/core/utils.py index 8c65a4a77..bb6eca6f9 100644 --- a/backend/core/utils.py +++ b/backend/core/utils.py @@ -1,6 +1,7 @@ from django.utils.translation import gettext_lazy as _ from re import sub from enum import Enum +import hashlib def camel_case(s): @@ -9,6 +10,13 @@ def camel_case(s): return "".join([s[0].lower(), s[1:]]) +def sha256(string: bytes) -> str: + """Return the SHA256-hashed hexadecimal representation of the bytes object given as argument.""" + h = hashlib.new("SHA256") + h.update(string) + return h.hexdigest() + + class RoleCodename(Enum): ADMINISTRATOR = "BI-RL-ADM" DOMAIN_MANAGER = "BI-RL-DMA" diff --git a/backend/core/views.py b/backend/core/views.py index e66b2b14d..ed2c22b18 100644 --- a/backend/core/views.py +++ b/backend/core/views.py @@ -8,6 +8,7 @@ from datetime import datetime from typing import Any from uuid import UUID +from datetime import date, timedelta import django_filters as df from ciso_assistant.settings import ( @@ -236,6 +237,10 @@ class ThreatViewSet(BaseModelViewSet): filterset_fields = ["folder", "risk_scenarios"] search_fields = ["name", "provider", "description"] + @action(detail=False, name="Get threats count") + def threats_count(self, request): + return Response({"results": threats_count_per_name(request.user)}) + class AssetViewSet(BaseModelViewSet): """ @@ -279,14 +284,25 @@ def colors(self, request): @action(detail=False, name="Get used risk matrices") def used(self, request): - _used_matrices = RiskMatrix.objects.filter( - riskassessment__isnull=False - ).distinct() + viewable_matrices = RoleAssignment.get_accessible_object_ids( + Folder.get_root_folder(), request.user, RiskMatrix + )[0] + viewable_assessments = RoleAssignment.get_accessible_object_ids( + Folder.get_root_folder(), request.user, RiskAssessment + )[0] + _used_matrices = ( + RiskMatrix.objects.filter(riskassessment__isnull=False) + .filter(id__in=viewable_matrices) + .filter(riskassessment__id__in=viewable_assessments) + .distinct() + ) used_matrices = _used_matrices.values("id", "name") for i in range(len(used_matrices)): - used_matrices[i]["risk_assessments_count"] = _used_matrices.get( - id=used_matrices[i]["id"] - ).riskassessment_set.count() + used_matrices[i]["risk_assessments_count"] = ( + RiskAssessment.objects.filter(risk_matrix=_used_matrices[i].id) + .filter(id__in=viewable_assessments) + .count() + ) return Response({"results": used_matrices}) @@ -574,7 +590,8 @@ def todo(self, request): measures = sorted( AppliedControl.objects.filter(id__in=object_ids_view) - .exclude(status="done") + .filter(eta__lte=date.today() + timedelta(days=30)) + .exclude(status="active") .order_by("eta"), key=lambda mtg: mtg.get_ranking_score(), reverse=True, @@ -611,9 +628,6 @@ def todo(self, request): def to_review(self, request): measures = measures_to_review(request.user) - """print("ODZFFHZ") - print(measures[0].get_ranking_score())""" - measures = [AppliedControlReadSerializer(mtg).data for mtg in measures] """ @@ -772,7 +786,6 @@ def revoke(self, request, pk): def perform_create(self, serializer): risk_acceptance = serializer.validated_data submitted = False - print(risk_acceptance) if risk_acceptance.get("approver"): submitted = True for scenario in risk_acceptance.get("risk_scenarios"): @@ -1056,14 +1069,25 @@ def tree(self, request, pk): @action(detail=False, name="Get used frameworks") def used(self, request): - _used_frameworks = Framework.objects.filter( - complianceassessment__isnull=False - ).distinct() + viewable_framework = RoleAssignment.get_accessible_object_ids( + Folder.get_root_folder(), request.user, Framework + )[0] + viewable_assessments = RoleAssignment.get_accessible_object_ids( + Folder.get_root_folder(), request.user, ComplianceAssessment + )[0] + _used_frameworks = ( + Framework.objects.filter(complianceassessment__isnull=False) + .filter(id__in=viewable_framework) + .filter(complianceassessment__id__in=viewable_assessments) + .distinct() + ) used_frameworks = _used_frameworks.values("id", "name") for i in range(len(used_frameworks)): - used_frameworks[i]["compliance_assessments_count"] = _used_frameworks.get( - id=used_frameworks[i]["id"] - ).complianceassessment_set.count() + used_frameworks[i]["compliance_assessments_count"] = ( + ComplianceAssessment.objects.filter(framework=_used_frameworks[i].id) + .filter(id__in=viewable_assessments) + .count() + ) return Response({"results": used_frameworks}) @@ -1184,6 +1208,92 @@ def selected_implementation_groups(self, request, pk): } return Response(implementation_group_choices) + @action(detail=True, methods=["get"], name="Get action plan data") + def action_plan(self, request, pk): + (viewable_objects, _, _) = RoleAssignment.get_accessible_object_ids( + folder=Folder.get_root_folder(), + user=request.user, + object_type=ComplianceAssessment, + ) + if UUID(pk) in viewable_objects: + response = { + "planned": list(), + "active": list(), + "inactive": list(), + "none": list(), + } + compliance_assessment_object = self.get_object() + requirement_assessments_objects = ( + compliance_assessment_object.get_requirement_assessments() + ) + applied_controls = AppliedControlReadSerializer( + AppliedControl.objects.filter( + requirement_assessments__in=requirement_assessments_objects + ).distinct(), + many=True, + ).data + for applied_control in applied_controls: + applied_control["requirements_count"] = ( + RequirementAssessment.objects.filter( + compliance_assessment=compliance_assessment_object + ) + .filter(applied_controls=applied_control["id"]) + .count() + ) + response[applied_control["status"].lower()].append( + applied_control + ) if applied_control["status"] else response["none"].append( + applied_control + ) + return Response(response) + + @action(detail=True, name="Get action plan PDF") + def action_plan_pdf(self, request, pk): + (object_ids_view, _, _) = RoleAssignment.get_accessible_object_ids( + Folder.get_root_folder(), request.user, ComplianceAssessment + ) + if UUID(pk) in object_ids_view: + context = { + "planned": list(), + "active": list(), + "inactive": list(), + "no status": list(), + } + color_map = { + "planned": "#93c5fd", + "active": "#86efac", + "inactive": "#fca5a5", + "no status": "#e5e7eb", + } + compliance_assessment_object = self.get_object() + requirement_assessments_objects = ( + compliance_assessment_object.get_requirement_assessments() + ) + applied_controls = ( + AppliedControl.objects.filter( + requirement_assessments__in=requirement_assessments_objects + ) + .distinct() + .order_by("eta") + ) + for applied_control in applied_controls: + context[applied_control.status].append( + applied_control + ) if applied_control.status else context["no status"].append( + applied_control + ) + data = { + "color_map": color_map, + "context": context, + "compliance_assessment": compliance_assessment_object, + } + html = render_to_string("core/action_plan_pdf.html", data) + pdf_file = HTML(string=html).write_pdf() + response = HttpResponse(pdf_file, content_type="application/pdf") + return response + else: + return Response({"error": "Permission denied"}) + def perform_create(self, serializer): """ Create RequirementAssessment objects for the newly created ComplianceAssessment @@ -1356,8 +1466,6 @@ def todo(self, request): measures = [AppliedControlReadSerializer(mtg).data for mtg in measures] - # How to add ranking_score directly in the serializer ? - for i in range(len(measures)): measures[i]["ranking_score"] = ranking_scores[measures[i]["id"]] @@ -1370,10 +1478,6 @@ def todo(self, request): @action(detail=False, name="Get the secuity measures to review") def to_review(self, request): measures = measures_to_review(request.user) - - """print("ODZFFHZ") - print(measures[0].get_ranking_score())""" - measures = [AppliedControlReadSerializer(mtg).data for mtg in measures] """ diff --git a/backend/iam/forms.py b/backend/iam/forms.py deleted file mode 100644 index 448875e6c..000000000 --- a/backend/iam/forms.py +++ /dev/null @@ -1,290 +0,0 @@ -"""this module contains forms related to iam app""" - -from django.forms import ( - CheckboxInput, - DateInput, - DateTimeInput, - EmailInput, - HiddenInput, - ModelForm, - NullBooleanSelect, - NumberInput, - PasswordInput, - Select, - SelectMultiple, - TextInput, - Textarea, - TimeInput, - URLInput, - ValidationError, -) -from django.contrib.auth.forms import UserChangeForm, AdminPasswordChangeForm -from django.urls import reverse -from django.utils.translation import gettext_lazy as _ -from django.contrib.auth import password_validation -from django import forms -from .models import Folder, User, UserGroup, RoleAssignment, Role - -from core.forms import SearchableCheckboxSelectMultiple - - -class DefaultDateInput(DateInput): - """default date for input""" - - input_type = "date" - - -class StyledModelForm(ModelForm): - """a nice ModelForm""" - - def __init__(self, *args, **kwargs): - # pragma pylint: disable=no-member - super(__class__, self).__init__(*args, **kwargs) - text_inputs = ( - TextInput, - NumberInput, - EmailInput, - URLInput, - PasswordInput, - HiddenInput, - DefaultDateInput, - DateInput, - DateTimeInput, - TimeInput, - ) - select_inputs = (Select, SelectMultiple, NullBooleanSelect) - for fname, f in self.fields.items(): - input_type = f.widget.__class__ - if self.Meta.model: - model_name = str(self.Meta.model).split(".")[-1].strip("'>").lower() - if input_type in text_inputs: - f.widget.attrs["id"] = ( - f"id_{model_name}_{fname}" if model_name else f"id_{fname}" - ) - f.widget.attrs["class"] = ( - "bg-gray-50 border border-gray-300 text-gray-900 text-sm rounded-lg focus:ring-blue-500 focus:border-blue-500 block w-full p-2.5" - ) - if input_type in select_inputs: - f.widget.attrs["id"] = f"id_{model_name}_{fname}" - f.widget.attrs["class"] = ( - "bg-gray-50 border border-gray-300 text-gray-900 text-sm rounded-lg focus:ring-blue-500 focus:border-blue-500 block w-full p-2.5" - ) - if input_type == Textarea: - f.widget.attrs["class"] = ( - "block p-2.5 w-full text-sm text-gray-900 bg-gray-50 rounded-lg border border-gray-300 focus:ring-blue-500 focus:border-blue-500" - ) - if input_type == CheckboxInput: - f.widget.attrs["id"] = f"id_{model_name}_{fname}" - f.widget.attrs["class"] = ( - "w-4 h-4 text-blue-600 bg-gray-100 border-gray-300 rounded focus:ring-blue-500" - ) - if input_type == DefaultDateInput: - f.widget.attrs["id"] = f"id_{model_name}_{fname}" - f.widget.attrs["class"] = ( - "bg-gray-50 border border-gray-300 text-gray-900 text-sm rounded-lg focus:ring-blue-500 focus:border-blue-500 block w-full p-2.5" - ) - - -class FolderUpdateForm(StyledModelForm): - """form to update a folder""" - - # pragma pylint: disable=no-member - - class Meta: - """for Model""" - - model = Folder - exclude = ["content_type", "builtin", "parent_folder"] - - -class UserCreationForm(forms.ModelForm): - """A form for creating new users""" - - email = forms.EmailField(max_length=100) - - class Meta: - model = User - fields = ("email",) - - def clean_email(self): - email = self.cleaned_data.get("email") - return email.lower() - - def clean_password2(self): - password1 = self.cleaned_data.get("password1") - password2 = self.cleaned_data.get("password2") - if password1 and password2 and password1 != password2: - raise ValidationError( - self.error_messages["password_mismatch"], - code="password_mismatch", - ) - return password2 - - def _post_clean(self): - super()._post_clean() - # Validate the password after self.instance is updated with form data - # by super(). - password = self.cleaned_data.get("password2") - if password: - try: - password_validation.validate_password(password, self.instance) - except ValidationError as error: - self.add_error("password2", error) - - def save(self, commit=True): - # Save the provided password in hashed format - user = super().save(commit=False) - user.set_password(self.cleaned_data["password1"]) - if commit: - user.save() - return user - - -class UserCreateForm(UserCreationForm, StyledModelForm): - """form to create user""" - - pass - - -class UserUpdateForm(UserChangeForm, StyledModelForm): - """form to update user""" - - def __init__(self, *args, user, **kwargs): - self.user = user - super().__init__(*args, **kwargs) - password = self.fields.get("password") - self.fields["password"].help_text = _( - "Raw passwords are not stored, so there is no way to see this " - "user’s password, but you can change the password using " - 'this form.' - ) - self.fields["password"].widget.attrs["class"] = "text-sm -mb-1 password_update" - self.fields["is_active"].widget.attrs["class"] += " -mt-1" - self.fields["user_groups"].widget = SearchableCheckboxSelectMultiple( - choices=self.fields["user_groups"].choices, - attrs={ - "class": "text-sm rounded", - "searchbar_class": "[&_.search-icon]:text-gray-500 text-sm border border-gray-300 rounded-t-lg px-3", - "wrapper_class": "border border-gray-300 bg-gray-50 text-gray-900 text-sm rounded-b-lg focus:ring-blue-500 focus:border-blue-500 py-2 px-4 max-h-56 overflow-y-scroll", - }, - ) - if password: - password.help_text = password.help_text.format( - reverse("password-change", kwargs={"pk": user.pk}) - ) - - field_order = ["email", "password", "first_name", "last_name", "is_active"] - - def clean_email(self): - email = self.cleaned_data.get("email") - return email.lower() - - class Meta: - """for Model""" - - model = User - fields = [ - "email", - "password", - "first_name", - "last_name", - "is_active", - "user_groups", - ] - - -class MyProfileUpdateForm(UserChangeForm, StyledModelForm): - """form for logged user""" - - # TODO: not sure this section is useful, self user could be in user list with a mention "me" - - def __init__(self, *args, user, **kwargs): - self.user = user - super().__init__(*args, **kwargs) - self.fields["email"].widget.attrs["readonly"] = True - self.fields["email"].help_text = _( - "To change your email address, please contact your administrator." - ) - self.fields["password"].widget.attrs["class"] = "text-sm -mb-1 password_update" - password = self.fields.get("password") - self.fields["password"].help_text = _( - "Raw passwords are not stored, so there is no way to see this " - "user’s password, but you can change the password using " - 'this form.' - ) - if password: - password.help_text = password.help_text.format( - reverse("password-change", kwargs={"pk": user.pk}) - ) - - field_order = ["last_name", "first_name", "password", "email"] - - class Meta: - model = User - exclude = [ - "last_login", - "is_superuser", - "date_joined", - "user_permissions", - "user_groups", - "is_active", - "first_login", - ] - - -class UserPasswordChangeForm(AdminPasswordChangeForm): - """change user password form""" - - def __init__(self, user, *args, **kwargs): - super().__init__(user, *args, **kwargs) - for fname, f in self.fields.items(): - f.widget.attrs["class"] = ( - "bg-gray-50 border border-gray-300 text-gray-900 text-sm rounded-lg focus:ring-blue-500 focus:border-blue-500 block w-full p-2.5" - ) - print("FNAME:", fname) - self.fields.get("password1").widget.attrs["id"] = "password1" - self.fields.get("password2").widget.attrs["id"] = "password2" - - -class UserGroupCreateForm(StyledModelForm): - """form to create a user group""" - - class Meta: - """for Model""" - - model = UserGroup - exclude = ["permissions", "builtin"] - - -class UserGroupUpdateForm(StyledModelForm): - """form to update a user group""" - - class Meta: - """for Model""" - - model = UserGroup - exclude = ["permissions", "builtin"] - - -class RoleAssignmentCreateForm(StyledModelForm): - """form to create a RoleAssigment""" - - class Meta: - """for Model""" - - model = RoleAssignment - exclude = ["builtin"] - - -class RoleAssignmentUpdateForm(StyledModelForm): - """form to update a RoleAssigment""" - - class Meta: - """for Model""" - - model = Role - fields = ["permissions"] - - def __init__(self, *args, **kwargs): - super().__init__(*args, **kwargs) - self.fields["permissions"].widget.attrs["class"] += " h-96" diff --git a/backend/iam/migrations/0003_alter_folder_updated_at_alter_role_updated_at_and_more.py b/backend/iam/migrations/0003_alter_folder_updated_at_alter_role_updated_at_and_more.py new file mode 100644 index 000000000..07acec635 --- /dev/null +++ b/backend/iam/migrations/0003_alter_folder_updated_at_alter_role_updated_at_and_more.py @@ -0,0 +1,37 @@ +# Generated by Django 5.0.4 on 2024-04-30 21:19 + +from django.db import migrations, models + + +class Migration(migrations.Migration): + dependencies = [ + ("iam", "0002_purge_validator"), + ] + + operations = [ + migrations.AlterField( + model_name="folder", + name="updated_at", + field=models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + migrations.AlterField( + model_name="role", + name="updated_at", + field=models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + migrations.AlterField( + model_name="roleassignment", + name="updated_at", + field=models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + migrations.AlterField( + model_name="user", + name="updated_at", + field=models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + migrations.AlterField( + model_name="usergroup", + name="updated_at", + field=models.DateTimeField(auto_now=True, verbose_name="Updated at"), + ), + ] diff --git a/backend/library/forms.py b/backend/library/forms.py deleted file mode 100644 index 7d6b945bb..000000000 --- a/backend/library/forms.py +++ /dev/null @@ -1,9 +0,0 @@ -from django import forms -from django.utils.translation import gettext_lazy as _ -from library.validators import validate_file_extension - - -class UploadFileForm(forms.Form): - file = forms.FileField( - required=True, label=_("Select a file"), validators=[validate_file_extension] - ) diff --git a/backend/library/helpers.py b/backend/library/helpers.py index 845af420b..172a2f7c7 100644 --- a/backend/library/helpers.py +++ b/backend/library/helpers.py @@ -1,16 +1,17 @@ from core.models import RequirementNode -def preview_library(library) -> dict[str, list]: +# Change the name of this function +def preview_library(framework: dict) -> dict[str, list]: """ Function to create temporary requirement nodes list Used to display requirements in tree view inside library detail view """ preview = {} requirement_nodes_list = [] - if library["objects"]["framework"].get("requirement_nodes"): + if framework.get("requirement_nodes"): index = 0 - for requirement_node in library["objects"]["framework"]["requirement_nodes"]: + for requirement_node in framework["requirement_nodes"]: index += 1 requirement_nodes_list.append( RequirementNode( diff --git a/backend/library/libraries/anssi-recommandations-configuration-systeme-gnu-linux.yaml b/backend/library/libraries/anssi-recommandations-configuration-systeme-gnu-linux.yaml new file mode 100644 index 000000000..e381f13e5 --- /dev/null +++ b/backend/library/libraries/anssi-recommandations-configuration-systeme-gnu-linux.yaml @@ -0,0 +1,1642 @@ +urn: urn:protocolpaladin:risk:library:anssi-recommandations-configuration-systeme-gnu-linux +locale: fr +ref_id: 'ANSSI-RECOMMANDATIONS-CONFIGURATION-SYSTEME-GNU-LINUX ' +name: "ANSSI - Recommandations de s\xE9curit\xE9 relatives \xE0 un syst\xE8me GNU-Linux" +description: "Renforcer la s\xE9curit\xE9 d\u2019un syst\xE8me GNU-Linux\nhttps://cyber.gouv.fr/sites/default/files/document/fr_np_linux_configuration-v2.0.pdf" +copyright: Licence ouverte / Open Licence v2.0 (Etalab) +version: 1 +provider: ANSSI +packager: protocolpaladin +objects: + framework: + urn: urn:protocolpaladin:risk:framework:anssi-recommandations-configuration-systeme-gnu-linux + ref_id: 'ANSSI-RECOMMANDATIONS-CONFIGURATION-SYSTEME-GNU-LINUX ' + name: "ANSSI - Recommandations de s\xE9curit\xE9 relatives \xE0 un syst\xE8me\ + \ GNU-Linux" + description: "Renforcer la s\xE9curit\xE9 d\u2019un syst\xE8me GNU-Linux" + implementation_groups_definition: + - ref_id: M + name: minimal + description: null + - ref_id: I + name: "interm\xE9diaire " + description: null + - ref_id: R + name: "renforc\xE9" + description: null + - ref_id: E + name: "\xE9lev\xE9" + description: null + requirement_nodes: + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:4 + assessable: false + depth: 1 + ref_id: '4' + name: "Configuration mat\xE9rielle" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:4.1 + assessable: false + depth: 2 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:4 + ref_id: '4.1' + name: "Support mat\xE9riel" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r1 + assessable: true + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:4.1 + ref_id: R1 + name: "Choisir et configurer son mat\xE9riel" + description: "Il est conseill\xE9 d\u2019appliquer les recommandations du support\ + \ mat\xE9riel mentionn\xE9es dans la note technique \xAB Recommandations de\ + \ configuration mat\xE9rielle de postes clients et serveurs x86 \xBB. Les\ + \ recommandations de la note technique \xAB Recommandations de configuration\ + \ mat\xE9rielle de postes clients et serveurs x86 \xBB s\u2019appliquent aux\ + \ architectures x86. L\u2019approche reste cependant applicable \xE0 d\u2019\ + autres architectures \xE0 ceci pr\xE8s que les m\xE9canismes et directives\ + \ de configuration seront susceptibles d\u2019\xEAtre diff\xE9rents." + implementation_groups: + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:4.2 + assessable: false + depth: 2 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:4 + ref_id: '4.2' + name: BIOS/UEFI + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r2 + assessable: true + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:4.2 + ref_id: R2 + name: Configurer le BIOS/UEFI + description: "Il est conseill\xE9 d\u2019appliquer les recommandations de la\ + \ configuration du BIOS/UEFI mentionn\xE9es dans la note technique \xAB Recommandations\ + \ de configuration mat\xE9rielle de postes clients et serveurs x86 \xBB." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:4.3 + assessable: false + depth: 2 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:4 + ref_id: '4.3' + name: "D\xE9marrage s\xE9curis\xE9 UEFI" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:4.3.1 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:4.3 + ref_id: 4.3.1 + name: "Cl\xE9s pr\xE9charg\xE9es" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r3 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:4.3.1 + ref_id: R3 + name: "Activer le d\xE9marrage s\xE9curis\xE9 UEFI" + description: "Il est recommand\xE9 d\u2019activer la configuration du d\xE9\ + marrage s\xE9curis\xE9 UEFI associ\xE9e \xE0 \nla distribution." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:4.3.2 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:4.3 + ref_id: 4.3.2 + name: "Nouvelles cl\xE9s" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r4 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:4.3.2 + ref_id: R4 + name: "Remplacer les cl\xE9s pr\xE9charg\xE9es" + description: "Il est recommand\xE9 de remplacer les cl\xE9s pr\xE9charg\xE9\ + es dans l\u2019UEFI par de nouvelles cl\xE9s avec lesquelles seront sign\xE9\ + s : le chargeur de d\xE9marrage et le noyau Linux ou l\u2019image du noyau\ + \ Linux au format EFI." + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5 + assessable: false + depth: 1 + ref_id: '5' + name: Configuration du noyau Linux + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.1 + assessable: false + depth: 2 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5 + ref_id: '5.1' + name: "Chargeur de d\xE9marrage" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r5 + assessable: true + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.1 + ref_id: R5 + name: "Configurer un mot de passe pour le chargeur de d\xE9marrage" + description: "Un chargeur de d\xE9marrage permettant de prot\xE9ger son d\xE9\ + marrage par mot de passe est \xE0 privil\xE9gier. Ce mot de passe doit emp\xEA\ + cher un utilisateur quelconque de modifier ses options de configuration.\L\ + \LQuand le chargeur de d\xE9marrage n\u2019offre pas la possibilit\xE9 de\ + \ lui adjoindre un mot de passe, une autre mesure technique ou organisationnelle\ + \ doit \xEAtre mise en place afin de bloquer toutes tentatives de modification\ + \ des options de configuration par un utilisateur non-autoris\xE9." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.2 + assessable: false + depth: 2 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5 + ref_id: '5.2' + name: Configuration dynamique + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r6 + assessable: true + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.2 + ref_id: R6 + name: "Prot\xE9ger les param\xE8tres de ligne de commande du noyau et l\u2019\ + initramfs" + description: "Il est recommand\xE9 de prot\xE9ger les param\xE8tres de ligne\ + \ de commande du noyau Linux et l\u2019initramfs pour qu\u2019ils soient v\xE9\ + rifi\xE9s lors du d\xE9marrage s\xE9curis\xE9 UEFI." + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.2.1 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.2 + ref_id: 5.2.1 + name: "Configuration de la m\xE9moire" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r7 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.2.1 + ref_id: R7 + name: "Activer l\u2019IOMMU" + description: "Il est recommand\xE9 d\u2019activer l\u2019IOMMU en ajoutant la\ + \ directive iommu=force \xE0 la liste des param\xE8tres du noyau lors du d\xE9\ + marrage en plus de celles d\xE9j\xE0 pr\xE9sentes dans les fichiers de configuration\ + \ du chargeur de d\xE9marrage." + implementation_groups: + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r8 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.2.1 + ref_id: R8 + name: "Param\xE9trer les options de configuration de la m\xE9moire" + description: "Les listes ci-dessous pr\xE9sentent les options de configuration\ + \ de la m\xE9moire recommand\xE9es." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.2.2 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.2 + ref_id: 5.2.2 + name: Configuration du noyau + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r9 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.2.2 + ref_id: R9 + name: "Param\xE9trer les options de configuration du noyau" + description: "La liste ci-dessous pr\xE9sente les options de configuration du\ + \ noyau recommand\xE9es.\L\LListe des options de configuration du noyau recommand\xE9\ + es \L\nLes options de configuration du noyau d\xE9taill\xE9es dans cette liste\ + \ sont pr\xE9sent\xE9es telles que rencontr\xE9es dans le fichier de configuration\ + \ sysctl.conf : \L\n# Restreint l'acc\xE8s au buffer dmesg (\xE9quivalent\ + \ \xE0\L# CONFIG_SECURITY_DMESG_RESTRICT=y)\Lkernel.dmesg_restrict=1\L# Cache\ + \ les adresses noyau dans /proc et les diff\xE9rentes autres interfaces, y\ + \ compris aux utilisateurs privil\xE9gi\xE9s \nkernel.kptr_restrict=2 \n#\ + \ Sp\xE9cifie explicitement l'espace d'identifiants de processus support\xE9\ + \ par le noyau, 65 536 \xE9tant une valeur donn\xE9e \xE0 titre d'exemple\ + \ kernel.pid_max=65536\L# Restreint l'utilisation du sous-syst\xE8me perf\L\ + kernel.perf_cpu_time_max_percent=1 \nkernel.perf_event_max_sample_rate=1 \n\ + # Interdit l'acc\xE8s non privil\xE9gi\xE9 \xE0 l'appel syst\xE8me perf_event_open().\ + \ Avec une valeur plus grande que 2, on impose la possession de CAP_SYS_ADMIN,\ + \ pour pouvoir recueillir les \xE9v\xE8nements perf.\Lkernel.perf_event_paranoid=2\L\ + # Active l'ASLR\Lkernel.randomize_va_space=2\L# D\xE9sactive les combinaisons\ + \ de touches magiques (Magic System Request Key)\Lkernel.sysrq=0\L# Restreint\ + \ l'usage du BPF noyau aux utilisateurs privil\xE9gi\xE9s\Lkernel.unprivileged_bpf_disabled=1\L\ + # Arr\xEAte compl\xE8tement le syst\xE8me en cas de comportement inattendu\ + \ du noyau Linux\Lkernel.panic_on_oops=1" + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r10 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.2.2 + ref_id: R10 + name: "D\xE9sactiver le chargement des modules noyau" + description: "Il est recommand\xE9 de bloquer le chargement des modules noyau\ + \ par l\u2019activation de \nl\u2019option de configuration du noyau kernel.modules_disabled.\n" + implementation_groups: + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.2.3 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.2 + ref_id: 5.2.3 + name: Configuration des processus + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r11 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.2.3 + ref_id: R11 + name: Activer et configurer le LSM Yama + description: "Il est recommand\xE9 de charger le module de s\xE9curit\xE9 Yama\ + \ lors du d\xE9marrage, par exemple en passant la directive security=yama\ + \ au noyau, et d\u2019affecter \xE0 l\u2019option de configuration du noyau\ + \ kernel.yama.ptrace_scope une valeur au moins \xE9gale \xE0 1." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.2.4 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.2 + ref_id: 5.2.4 + name: "Configuration du r\xE9seau" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r12 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.2.4 + ref_id: R12 + name: "Param\xE9trer les options de configuration du r\xE9seau IPv4" + description: "La liste ci-dessous pr\xE9sente les options de configuration du\ + \ r\xE9seau IPv4 pour un h\xF4te \xAB serveur \xBB typique qui n\u2019effectue\ + \ pas de routage et ayant une configuration IPv4 minimaliste (adressage statique).\L\ + \nListe des options de configuration du r\xE9seau IPv4 recommand\xE9es \L\n\ + Les options de configuration du r\xE9seau IPv4 d\xE9taill\xE9es dans cette\ + \ liste sont recommand\xE9es pour un h\xF4te de type \xAB serveur \xBB n\u2019\ + effectuant pas de routage et ayant une configuration IPv4 minimaliste. Elles\ + \ sont pr\xE9sent\xE9es telles que rencontr\xE9es dans le fichier de configuration\ + \ sysctl.conf : \L\n# Att\xE9nuation de l'effet de dispersion du JIT noyau\ + \ au co\xFBt d'un compromis sur les performances associ\xE9es.\Lnet.core.bpf_jit_harden=2\L\ + # Pas de routage entre les interfaces. Cette option est sp\xE9ciale et peut\ + \ entrainer des modifications d'autres options. En pla\xE7ant cette option\ + \ au plus t\xF4t, on s'assure que la configuration des options suivantes ne\ + \ change pas. net.ipv4.ip_forward=0\L# Consid\xE8re comme invalides les paquets\ + \ re\xE7us de l'ext\xE9rieur ayant comme source le r\xE9seau 127/8. \nnet.ipv4.conf.all.accept_local=0\ + \ \n# Refuse la r\xE9ception de paquet ICMP redirect. Le param\xE9trage sugg\xE9\ + r\xE9 de cette option est \xE0 consid\xE9rer fortement dans le cas de routeurs\ + \ qui ne doivent pas d\xE9pendre d'un \xE9l\xE9ment ext\xE9rieur pour d\xE9\ + terminer le calcul d'une route. M\xEAme pour le cas de machines non-routeurs,\ + \ ce param\xE9trage pr\xE9munit contre les d\xE9tournements de trafic avec\ + \ des paquets de type ICMP redirect. \nnet.ipv4.conf.all.accept_redirects=0\L\ + net.ipv4.conf.default.accept_redirects=0\Lnet.ipv4.conf.all.secure_redirects=0\L\ + net.ipv4.conf.default.secure_redirects=0\Lnet.ipv4.conf.all.shared_media=0\L\ + net.ipv4.conf.default.shared_media=0\L# Refuse les informations d'en-t\xEA\ + tes de source routing fournies par le paquet pour d\xE9terminer sa route.\L\ + net.ipv4.conf.all.accept_source_route=0\Lnet.ipv4.conf.default.accept_source_route=0\ + \ \n# Emp\xEAche le noyau Linux de g\xE9rer la table ARP globalement. Par\ + \ d\xE9faut, il peut r\xE9pondre \xE0 une requ\xEAte ARP d'une interface X\ + \ avec les informations d'une interface Y. Ce comportement est probl\xE9matique\ + \ pour les routeurs et les \xE9quipements d'un syst\xE8me en haute disponibilit\xE9\ + \ (VRRP...).\Lnet.ipv4.conf.all.arp_filter=1 \n# Ne r\xE9pond aux sollicitations\ + \ ARP que si l'adresse source et destination sont sur # le m\xEAme r\xE9seau\ + \ et sur l'interface sur laquelle le paquet a \xE9t\xE9 re\xE7u. Il est \xE0\ + \ noter que la configuration de cette option est \xE0 \xE9tudier selon le\ + \ cas d'usage. net.ipv4.conf.all.arp_ignore=2 \n# Refuse le routage de paquet\ + \ dont l'adresse source ou destination est celle de la boucle locale. Cela\ + \ interdit l'\xE9mission de paquet ayant comme source 127/8.\Lnet.ipv4.conf.all.route_localnet=0\L\ + # Ignore les sollicitations de type gratuitous ARP. Cette configuration est\ + \ efficace contre les attaques de type ARP poisoning mais ne s'applique qu'en\ + \ association avec un ou plusieurs proxy ARP ma\xEEtris\xE9s. Elle peut \xE9\ + galement \xEAtre probl\xE9matique sur un r\xE9seau avec des \xE9quipements\ + \ en haute disponibilit\xE9 (VRRP...) net.ipv4.conf.all.drop_gratuitous_arp=1\L\ + # V\xE9rifie que l'adresse source des paquets re\xE7us sur une interface donn\xE9\ + e aurait bien \xE9t\xE9 contact\xE9e via cette m\xEAme interface. \xC0 d\xE9\ + faut, le paquet est ignor\xE9. Selon l'usage, la valeur 1 peut permettre d'accro\xEE\ + tre la v\xE9rification \xE0 l'ensemble des interfaces, lorsque l'\xE9quipement\ + \ est un routeur dont le calcul de # routes est dynamique. Le lecteur int\xE9\ + ress\xE9 est renvoy\xE9 \xE0 la RFC3704 pour tout compl\xE9ment concernant\ + \ cette fonctionnalit\xE9.\Lnet.ipv4.conf.default.rp_filter=1\Lnet.ipv4.conf.all.rp_filter=1\L\ + # Cette option ne doit \xEAtre mise \xE0 1 que dans le cas d'un routeur, car\ + \ pour ces \xE9quipements l'envoi de ICMP redirect est un comportement normal.\ + \ Un \xE9quipement terminal n'a pas de raison de recevoir un flux dont il\ + \ n'est pas destinataire et donc d'\xE9mettre un paquet ICMP redirect.\Lnet.ipv4.conf.default.send_redirects=0\L\ + net.ipv4.conf.all.send_redirects=0\L# Ignorer les r\xE9ponses non conformes\ + \ \xE0 la RFC 1122\Lnet.ipv4.icmp_ignore_bogus_error_responses=1\L# Augmenter\ + \ la plage pour les ports \xE9ph\xE9m\xE8res\Lnet.ipv4.ip_local_port_range=32768\ + \ 65535\L# RFC 1337\Lnet.ipv4.tcp_rfc1337=1\L# Utilise les SYN cookies. Cette\ + \ option permet la pr\xE9vention d'attaque de type SYN flood.\Lnet.ipv4.tcp_syncookies=1" + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r13 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.2.4 + ref_id: R13 + name: "D\xE9sactiver le plan IPv6" + description: "Quand IPv6 n\u2019est pas utilis\xE9, il est recommand\xE9 de\ + \ d\xE9sactiver la pile IPv6 en :\L\n- Ajoutant la directive ipv6.disable=1\ + \ \xE0 la liste des param\xE8tres du noyau choisi lors du d\xE9marrage en\ + \ plus de celles d\xE9j\xE0 pr\xE9sentes dans les fichiers de configuration\ + \ du chargeur de d\xE9marrage\L\n- Activant les options de configuration du r\xE9\ + seau pr\xE9sent\xE9es dans la liste ci-dessous.\L\nListe des options de configuration\ + \ du r\xE9seau pour d\xE9sactiver le plan IPv6\L\nLes options de configuration\ + \ du r\xE9seau d\xE9taill\xE9es dans cette liste d\xE9sactivent le plan IPv6.\ + \ Elles sont pr\xE9sent\xE9es telles que rencontr\xE9es dans le fichier de\ + \ configuration sysctl.conf : \L\Lnet.ipv6.conf.default.disable_ipv6=1 \n\ + net.ipv6.conf.all.disable_ipv6=1" + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.2.5 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.2 + ref_id: 5.2.5 + name: "Configuration des syst\xE8mes de fichiers" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r14 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.2.5 + ref_id: R14 + name: "Param\xE9trer les options de configuration des syst\xE8mes de fichiers" + description: "La liste ci-dessous pr\xE9sente les options de configuration des\ + \ syst\xE8mes de fichiers recommand\xE9es au format du ficher de configuration\ + \ sysctl.conf.\L\nListe des options de configuration des syst\xE8mes de fichiers\ + \ recommand\xE9es\L\nLes options de configuration des syst\xE8mes de fichiers\ + \ d\xE9taill\xE9es dans cette liste sont pr\xE9sent\xE9es telles que rencontr\xE9\ + es dans le fichier de configuration sysctl.conf :\L\n# D\xE9sactive la cr\xE9\ + ation de coredump pour les ex\xE9cutables setuid\L# Notez qu'il est possible\ + \ de d\xE9sactiver tous les coredumps avec la configuration CONFIG_COREDUMP=n\L\ + fs.suid_dumpable = 0\L# Disponible \xE0 partir de la version 4.19 du noyau\ + \ Linux, permet d'interdire l'ouverture des FIFOS et des fichiers \"r\xE9\ + guliers\" qui ne sont pas la propri\xE9t\xE9 de l'utilisateur dans les dossiers\ + \ sticky en \xE9criture pour tout le monde.\Lfs.protected_fifos=2\Lfs.protected_regular=2\L\ + # Restreint la cr\xE9ation de liens symboliques \xE0 des fichiers dont l\u2019\ + utilisateur est propri\xE9taire. Cette option fait partie des m\xE9canismes\ + \ de pr\xE9vention contre les vuln\xE9rabilit\xE9s de la famille Time of Check\ + \ - Time of Use (Time of Check - Time of Use)\Lfs.protected_symlinks=1\L#\ + \ Restreint la cr\xE9ation de liens durs \xE0 des fichiers dont l'utilisateur\ + \ est propri\xE9taire. Ce sysctl fait partie des m\xE9canismes de pr\xE9vention\ + \ contre les vuln\xE9rabilit\xE9s Time of Check - Time of Use, mais aussi\ + \ contre la possibilit\xE9 de conserver des acc\xE8s \xE0 des fichiers obsol\xE8\ + tes\Lfs.protected_hardinks=1" + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.3 + assessable: false + depth: 2 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5 + ref_id: '5.3' + name: Configuration statique + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.3.1 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.3 + ref_id: 5.3.1 + name: "Configuration ind\xE9pendante de la cible mat\xE9rielle" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r15 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.3.1 + ref_id: R15 + name: "Param\xE9trer les options de compilation pour la gestion de la m\xE9\ + moire" + description: "La liste ci-dessous pr\xE9sente les options de compilation du\ + \ noyau recommand\xE9es pour durcir la gestion de la m\xE9moire.\L\nListe\ + \ des options de compilation du noyau recommand\xE9es pour durcir la gestion\ + \ de la m\xE9moire\L\n# Cette option a remplac\xE9 CONFIG_DEBUG_RODATA dans\ + \ le noyau (>=4.11) qui \xE9tait une d\xE9pendance de CONFIG_DEBUG_KERNEL\L\ + CONFIG_STRICT_KERNEL_RWX=y\L# CONFIG_ARCH_OPTIONAL_KERNEL_RWX et CONFIG_ARCH_HAS_STRICT_KERNEL_RWX\ + \ sont des d\xE9pendances de CONFIG_STRICT_KERNEL_RWX\LCONFIG_ARCH_OPTIONAL_KERNEL_RWX=y\ + \ \nCONFIG_ARCH_HAS_STRICT_KERNEL_RWX=y \n# V\xE9rifie et rapporte les permissions\ + \ de mapping m\xE9moire dangereuses, par # exemple, lorsque les pages noyau\ + \ sont en \xE9criture et sont ex\xE9cutables. Cette option n'est pas disponible\ + \ sur l'ensemble des architectures mat\xE9rielles (x86 >=4.4, arm64 >=4.10,\ + \ etc.).\LCONFIG_DEBUG_WX=y\L# D\xE9sactive le syst\xE8me de fichiers utilis\xE9\ + \ uniquement dans le cadre de d\xE9bogage. Prot\xE9ger ce syst\xE8me de fichiers\ + \ n\xE9cessite un travail suppl\xE9mentaire. \nCONFIG_DEBUG_FS=n \n# A partir\ + \ de la version 4.18 du noyau, ces options ajoutent -fstack-protector-strong\ + \ \xE0 la compilation afin de renforcer le stack canary, il est n\xE9cessaire\ + \ d'avoir une version de GCC au moins \xE9gale \xE0 4.9.\L# Avant la version\ + \ 4.18 du noyau linux, il faut utiliser les options CONFIG_CC_STACKPROTECTOR\ + \ et CONFIG_CC_STACKPROTECTOR_STRONG\LCONFIG_STACKPROTECTOR=y\LCONFIG_STACKPROTECTOR_STRONG=y\L\ + # Interdit l'acc\xE8s direct \xE0 la m\xE9moire physique. En cas de besoin\ + \ et uniquement dans ce cas, il est possible d'activer un acc\xE8s strict\ + \ \xE0 la m\xE9moire, limitant ainsi son acc\xE8s, avec les options CONFIG_STRICT_DEVMEM=y\ + \ et CONFIG_IO_STRICT_DEVMEM=y\LCONFIG_DEVMEM is not set\L# D\xE9tecte la\ + \ corruption de la pile pendant l'appel \xE0 l'ordonnanceur CONFIG_SCHED_STACK_END_CHECK=y\L\ + # Impose une v\xE9rification des limites du mapping m\xE9moire du processus\ + \ au moment des copies de donn\xE9es.\LCONFIG_HARDENED_USERCOPY=y\L# Interdit\ + \ de revenir \xE0 une v\xE9rification du mapping aupr\xE8s de l'allocateur\ + \ si l'option pr\xE9c\xE9dente a \xE9chou\xE9 (<=5.15)\L#CONFIG_HARDENED_USERCOPY_FALLBACK\ + \ is not set\L# Ajout de pages de garde entre les piles noyau. Cela prot\xE8\ + ge contre les effets de bord des d\xE9bordements de pile (cette option n'est\ + \ pas support\xE9e sur toutes # les architectures).\LCONFIG_VMAP_STACK=y\L\ + # V\xE9rifications exhaustives sur les compteurs de r\xE9f\xE9rence du noyau\ + \ (<=5.4)\LCONFIG_REFCOUNT_FULL=y\L# V\xE9rifie les actions de recopie m\xE9\ + moire qui pourraient provoquer une corruption de structure dans les fonctions\ + \ noyau str*() et mem*(). Cette v\xE9rification est effectu\xE9e \xE0 la compilation\ + \ et \xE0 l'ex\xE9cution.\LCONFIG_FORTIFY_SOURCE=y\L# D\xE9sactive l'usage\ + \ dangereux de l'ACPI, pouvant entrainer une \xE9criture directe en m\xE9\ + moire physique.\L#CONFIG_ACPI_CUSTOM_METHOD is not set\L# Interdit tout acc\xE8\ + s direct \xE0 la m\xE9moire du noyau \xE0 partir du users-ace (<=-5.12)\L\ + #CONFIG_DEVKMEM is not set\L# Interdit la fourniture de la disposition de\ + \ l'image noyau\L#CONFIG_PROC_KCORE is not set\L# D\xE9sactive la r\xE9trocompatibilit\xE9\ + \ VDSO, qui rend impossible l\u2019usage de l\u2019ASLR\L#CONFIG_COMPAT_VDSO\ + \ is not set\L# Emp\xE8che les utilisateurs non privil\xE9gi\xE9s de r\xE9\ + cup\xE9rer des adresses noyau avec dmesg(8)\LCONFIG_SECURITY_DMESG_RESTRICT=y\L\ + # Active les retpoline qui sont n\xE9cessaires pour se prot\xE9ger de Spectre\ + \ v2 GCC >= 7.3.0 est requis.\LCONFIG_RETPOLINE=y\L# D\xE9sactive la table\ + \ vsyscall. Elle n'est plus requise par la libc et est une source potentielle\ + \ de ROP gadgets.\LCONFIG_LEGACY_VSYSCALL_NONE=y\LCONFIG_LEGACY_VSYSCALL_EMULATE=n\L\ + CONFIG_LEGACY_VSYSCALL_XONLY=n\LCONFIG_X86_VSYSCALL_EMULATION=n" + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r16 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.3.1 + ref_id: R16 + name: "Param\xE9trer les options de compilation pour les structures de donn\xE9\ + es du noyau" + description: "La liste ci-dessous pr\xE9sente les options de compilation du\ + \ noyau recommand\xE9es pour prot\xE9ger les structures de donn\xE9es du noyau.\L\ + \nListe des options de compilation du noyau recommand\xE9es pour prot\xE9\ + ger les structures de donn\xE9es du noyau\L\L# V\xE9rifie les structures de\ + \ gestion des autorisations.\nCONFIG_DEBUG_CREDENTIALS=y \n# V\xE9rifie les\ + \ structures de notification.\nCONFIG_DEBUG_NOTIFIERS=y \n# V\xE9rifie les\ + \ listes noyau. \nCONFIG_DEBUG_LIST=y\n# V\xE9rifie les tables de Scatter-Gather\ + \ du noyau. \nCONFIG_DEBUG_SG=y \n# G\xE9n\xE8re un appel \xE0 BUG() en cas\ + \ de d\xE9tection de corruption. \nCONFIG_BUG_ON_DATA_CORRUPTION=y" + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r17 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.3.1 + ref_id: R17 + name: "Param\xE9trer les options de compilation pour l\u2019allocateur m\xE9\ + moire" + description: "La liste ci-dessous pr\xE9sente les options de compilation du\ + \ noyau recommand\xE9es pour durcir l\u2019allocateur m\xE9moire.\L\nListe\ + \ des options de compilation du noyau recommand\xE9es pour durcir l'allocateur\ + \ m\xE9moire\L \n# Positionne les informations de cha\xEEnage des blocs libres\ + \ de l'allocateur de mani\xE8re al\xE9atoire.\LCONFIG_SLAB_FREELIST_RANDOM=y\L\ + # CONFI_SLAB est une d\xE9pendance de CONFIG_SLAB_FREELIST_RANDOM \nCONFIG_SLUB=y\ + \ \n# Prot\xE8ge les m\xE9tadonn\xE9es de l'allocateur en int\xE9grit\xE9\ + . \nCONFIG_SLAB_FREELIST_HARDENED=y \n# A partir de la version 4.13 du noyau,\ + \ cette option d\xE9sactive le merge des caches SLAB\LCONFIG_SLAB_MERGE_DEFAULT=n\L\ + # Active la v\xE9rification des structures de l'allocateur m\xE9moire et r\xE9\ + initialise \xE0 z\xE9ro les zones allou\xE9es \xE0 leur lib\xE9ration (n\xE9\ + cessite l'activation de l'option de configuration de la m\xE9moire page_poison=on\ + \ ajout\xE9e \xE0 la liste des # param\xE8tres du noyau lors du d\xE9marrage).\ + \ Il est pr\xE9f\xE9rable d'utiliser l'option de configuration slub_debug\ + \ de la m\xE9moire ajout\xE9e \xE0 la liste des param\xE8tres du noyau lors\ + \ du d\xE9marrage car elle permet une gestion plus fine du slub debug. \n\ + CONFIG_SLUB_DEBUG=y\L# Nettoie les pages m\xE9moire au moment de leur lib\xE9\ + ration. \nCONFIG_PAGE_POISONING=y \n# Nettoyage en profondeur d\xE9sactiv\xE9\ + . Cette option a un co\xFBt important; cependant si l'impact en performance\ + \ est compatible avec le besoin op\xE9rationnel de l'\xE9quipement il est\ + \ recommand\xE9 de l'activer (<=5.10)\LCONFIG_PAGE_POISONING_NO_SANITY=y\L\ + #Le nettoyage des pages m\xE9moire est effectu\xE9 avec une r\xE9\xE9criture\ + \ de z\xE9ros en # lieu et place des donn\xE9es (<=5.10)\LCONFIG_PAGE_POISONING_ZERO=y\L\ + # D\xE9sactive la r\xE9trocompatibilit\xE9 avec brk() qui rend impossible\ + \ une impl\xE9mentation de brk() avec l'ASLR. \n#CONFIG_COMPAT_BRK is not\ + \ set" + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r18 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.3.1 + ref_id: R18 + name: "Param\xE9trer les options de compilation pour la gestion des modules\ + \ noyau" + description: "La liste ci-dessous pr\xE9sente les options de compilation du\ + \ noyau recommand\xE9es pour durcir la gestion des modules noyau.\L\nListe\ + \ des options de compilation du noyau recommand\xE9es pour durcir la gestion\ + \ des modules noyau\L\n# Activation du support des modules \nCONFIG_MODULES=y\ + \ \n# Cette option a remplac\xE9 CONFIG_DEBUG_SET_MODULE_RONX dans le noyau\ + \ (>=4.11) \nCONFIG_STRICT_MODULE_RWX=y \n# Les modules doivent \xEAtre sign\xE9\ + s. Attention, les modules ne doivent pas \xEAtre stripp\xE9s apr\xE8s signature.\L\ + CONFIG_MODULE_SIG=y\L# Emp\xE8che le chargement des modules non sign\xE9s\ + \ ou sign\xE9s avec une cl\xE9 qui ne nous appartient pas. \nCONFIG_MODULE_SIG_FORCE=y\ + \ \n# Activer CONFIG_MODULE_SIG_ALL permet de signer tous les modules automatiquement\ + \ pendant l'\xE9tape \"make modules_install\", sans cette option les modules\ + \ doivent \xEAtre sign\xE9s manuellement en utilisant le script scripts/sign-file.\ + \ L'option CONFIG_MODULE_SIG_ALL d\xE9pend de CONFIG_MODULE_SIG et CONFIG_MODULE_SIG_FORCE,\ + \ elles doivent donc \xEAtre activ\xE9es.\LCONFIG_MODULE_SIG_ALL=y\L# La signature\ + \ des modules utilise SHA512 comme fonction de hash CONFIG_MODULE_SIG_SHA512=y\L\ + CONFIG_MODULE_SIG_HASH=\"sha512\"\L# Indique le chemin vers le fichier contenant\ + \ certificat X.509 au format PEM utilis\xE9 pour relatif \xE0 la racine du\ + \ noyau.\LCONFIG_MODULE_SIG_KEY=\"certs/signing_key.pem\"" + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r19 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.3.1 + ref_id: R19 + name: "Param\xE9trer les options de compilation pour les \xE9v\xE8nements anormaux" + description: "La liste ci-dessous pr\xE9sente les options de compilation du\ + \ noyau recommand\xE9es pour r\xE9agir aux \xE9v\xE8nements anormaux.\L\n\ + Liste des options de compilation du noyau recommand\xE9es pour r\xE9agir aux\ + \ \xE9v\xE8nements anormaux\L\n# \xC9met un rapport sur les conditions d'appel\ + \ \xE0 la macro noyau BUG() et tue le processus \xE0 l'origine de l'appel.\ + \ Ne pas positionner cette variable peut passer sous silence un certain nombre\ + \ d'erreurs critiques.\LCONFIG_BUG=y\L# Arr\xEAte le syst\xE8me en cas d'erreur\ + \ critique pour couper court \xE0 tout comportement erron\xE9.\LCONFIG_PANIC_ON_OOPS=y\L\ + # Emp\xEAche le red\xE9marrage de la machine suite \xE0 un panic ce qui coupe\ + \ court \xE0 toute tentative d'attaque par force brute. Ceci a \xE9videmment\ + \ un impact fort sur des serveurs en production.\LCONFIG_PANIC_TIMEOUT=-1" + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r20 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.3.1 + ref_id: R20 + name: "Param\xE9trer les options de compilation pour les primitives de s\xE9\ + curit\xE9 du noyau" + description: "La liste ci-dessous pr\xE9sente une liste des options de compilation\ + \ du noyau recommand\xE9es pour configurer les primitives de s\xE9curit\xE9\ + \ du noyau.\L\nListe des options de compilation du noyau recommand\xE9es pour\ + \ configurer les primitives de s\xE9curit\xE9 du noyau\L\n# Active la possibilit\xE9\ + \ de filtrer les appels syst\xE8me faits par une\L# application.\LCONFIG_SECCOMP=y\L\ + # Active la possibilit\xE9 d'utiliser des script BPF (Berkeley Packet Filter).\ + \ CONFIG_SECCOMP_FILTER=y \n# Active les primitives de s\xE9curit\xE9 du noyau\ + \ Linux, n\xE9cessaire pour les LSM. \nCONFIG_SECURITY=y \n# Active Yama,\ + \ qui permet de limiter simplement l'usage de l'appel syst\xE8me ptrace().\ + \ Une fois les modules de s\xE9curit\xE9 utilis\xE9s par le syst\xE8me s\xE9\ + lectionn\xE9, il convient de d\xE9sactiver le support des autres modules de\ + \ s\xE9curit\xE9 dans le noyau afin de r\xE9duire la surface d'attaque. CONFIG_SECURITY_YAMA=y\ + \ \n# Assure que les structures noyau associ\xE9es aux LSM sont toujours mapp\xE9\ + es en lecture seule apr\xE8s le d\xE9marrage du syst\xE8me. Dans le cas o\xF9\ + \ SELinux est utilis\xE9, il faut s'assurer que CONFIG_SECURITY_SELINUX_DISABLE\ + \ is not set, pour que cette option soit disponible. Il n'est alors plus possible\ + \ de d\xE9sactiver un LSM une fois le noyau d\xE9marr\xE9. Il est en revanche\ + \ encore possible de le faire en modifiant la ligne de commande du noyau.\ + \ Pour le noyau 4.18 les LSM pr\xE9sents sont: AppArmor, LoadPin, SELinux,\ + \ Smack, TOMOYO et Yama.\L#CONFIG_SECURITY_WRITABLE_HOOKS is not set" + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r21 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.3.1 + ref_id: R21 + name: "Param\xE9trer les options de compilation pour les plugins du compilateur" + description: "La liste ci-dessous pr\xE9sente les options de compilation du\ + \ noyau recommand\xE9es pour configurer les plugins du compilateur.\L\nListe\ + \ des options de compilation du noyau recommand\xE9es pour configurer les\ + \ plugins du compilateur\L\n# Active le support des plugins du compilateur\ + \ (implique l'usage de GCC). \nCONFIG_GCC_PLUGINS=y \n# Amplifie la g\xE9\ + n\xE9ration d'entropie au d\xE9marrage de l'\xE9quipement pour ceux ayant\ + \ des sources d'entropie inappropri\xE9es\LCONFIG_GCC_PLUGIN_LATENT_ENTROPY=y\L\ + # Nettoie le contenu de la pile au moment de l'appel syst\xE8me exit. CONFIG_GCC_PLUGIN_STACKLEAK=y\ + \ \n# Impose l'initialisation des structures en m\xE9moire pour \xE9viter\ + \ la fuite de donn\xE9es par superposition avec une ancienne structure.\L\ + CONFIG_GCC_PLUGIN_STRUCTLEAK=y\L# Globalisation de l'option pr\xE9c\xE9dente\ + \ au cas du passage de structure par r\xE9f\xE9rence entre fonction si celles-ci\ + \ ont des champs non initialis\xE9s. \nCONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y\ + \ \n# Construit un plan m\xE9moire al\xE9atoire pour les structures syst\xE8\ + me du noyau. Cette option a un impact fort sur les performances. L\u2019option\ + \ CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE=y est \xE0 utiliser en substitution\ + \ si # cet impact n'est pas acceptable.\LCONFIG_GCC_PLUGIN_RANDSTRUCT=y" + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r22 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.3.1 + ref_id: R22 + name: "Param\xE9trer les options de compilation pour la pile r\xE9seau" + description: "La liste ci-dessous pr\xE9sente les options de compilation du\ + \ noyau recommand\xE9es pour configurer la pile r\xE9seau.\L\nListe des options\ + \ de compilation du noyau recommand\xE9es pour configurer la pile r\xE9seau\L\ + \n# D\xE9sactive le plan IPv6 \n#CONFIG_IPV6 option set. \n# Permet de pr\xE9\ + venir les attaques de type SYN flood. \nCONFIG_SYN_COOKIES=y" + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r23 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.3.1 + ref_id: R23 + name: "Param\xE9trer les options de compilation pour divers comportements du\ + \ noyau" + description: "La liste ci-dessous pr\xE9sente les options de compilation du\ + \ noyau recommand\xE9es pour configurer divers comportements du noyau.\L\n\ + Certains comportements du noyau Linux peuvent augmenter inutilement la surface\ + \ d\u2019attaque du noyau. Si ceux-ci ne sont pas absolument n\xE9cessaires,\ + \ ils ne doivent pas \xEAtre activ\xE9s.\L\nListe des options de compilation\ + \ du noyau recommand\xE9es pour configurer divers comportements du noyau\L\ + \n# Interdit l'ex\xE9cution d'une nouvelle image noyau \xE0 chaud. \n#CONFIG_KEXEC\ + \ is not set \n# Interdit le passage en mode hibernation, qui permet de substituer\ + \ l'image noyau \xE0 son insu.\L#CONFIG_HIBERNATION is not set\L# D\xE9sactive\ + \ le support de format binaire arbitraire. \n#CONFIG_BINFMT_MISC is not set\ + \ \n# Impose l'utilisation des ptys modernes (devpts) dont on peut contr\xF4\ + ler le nombre et l'usage.\L#CONFIG_LEGACY_PTYS is not set\L# Si le support\ + \ des modules n'est pas absolument n\xE9cessaire celui-ci doit \xEAtre d\xE9\ + sactiv\xE9. \n#CONFIG_MODULES is not set" + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.3.2 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.3 + ref_id: 5.3.2 + name: "Configuration sp\xE9cifique aux architectures mat\xE9rielles" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r24 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.3.2 + ref_id: R24 + name: "Param\xE9trer les options de compilation sp\xE9cifiques aux architectures\ + \ 32 bits" + description: "La liste ci-dessous pr\xE9sente les options de compilation du\ + \ noyau recommand\xE9es pour les architectures de type x86 32 bits. Elles\ + \ ne sont pas toutes pertinentes sur des architectures 64 bits.\L\nListe des\ + \ options de compilation du noyau recommand\xE9es pour les architectures 32\ + \ bits\L\n# Active le support des extensions d'adresse physique, ce qui est\ + \ un pr\xE9requis pour le support du bit de permission NX dans la table des\ + \ pages qui permet de # marquer certaines pages comme non ex\xE9cutables.\L\ + CONFIG_HIGHMEM64G=y\LCONFIG_X86_PAE=y\L# Interdit l'utilisation d'adresses\ + \ m\xE9moire en dessous d'une certaine valeur\L# (contre-mesure contre les\ + \ null pointer dereference). CONFIG_DEFAULT_MMAP_MIN_ADDR=65536\L# Rend non\ + \ pr\xE9dictible l'adresse de base du noyau. Cette option complexifie la t\xE2\ + che d'un attaquant.\LCONFIG_RANDOMIZE_BASE=y" + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r25 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.3.2 + ref_id: R25 + name: "Param\xE9trer les options de compilation sp\xE9cifiques aux architectures\ + \ x86_64 bits" + description: "La liste ci-dessous pr\xE9sente les options de compilation du\ + \ noyau recommand\xE9es pour les architectures de type x86_64 bits. Elles\ + \ ne sont pas toutes pertinentes sur des architectures 32 bits.\L\nListe des\ + \ options de compilation du noyau recommand\xE9es pour les architectures x86_64\ + \ bits\L\n# Activate le mode complet 64 bits. \nCONFIG_X86_64=y \n# Interdit\ + \ l'utilisation d'adresses m\xE9moire en dessous d'une certaine valeur (contre-mesure\ + \ contre les null pointer dereference).\LCONFIG_DEFAULT_MMAP_MIN_ADDR=65536\L\ + # Rend non pr\xE9dictible l'adresse de base du noyau, cette option complexifie\ + \ la t\xE2che d'un attaquant. \nCONFIG_RANDOMIZE_BASE=y \n# Rend non pr\xE9\ + dictible l'adresse \xE0 laquelle les composants du noyau sont expos\xE9s dans\ + \ l'espace d'adressage des processus.\LCONFIG_RANDOMIZE_MEMORY=y\L# Contre-mesure\ + \ \xE0 l'attaque Meltdown. \nCONFIG_PAGE_TABLE_ISOLATION=y \n# D\xE9sactive\ + \ la r\xE9tro-compatibilit\xE9 32 bits, ce qui permet de r\xE9duire la surface\ + \ d'attaque mais emp\xEAche d'ex\xE9cuter des binaires 32 bits.\L#CONFIG_IA32_EMULATION\ + \ is not set\L# Interdit la surcharge par processus de la Local Descriptor\ + \ Table (m\xE9canisme li\xE9 \xE0 l'usage de la segmentation). \n#CONFIG_MODIFY_LDT_SYSCALL\ + \ is not set" + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r26 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.3.2 + ref_id: R26 + name: "Param\xE9trer les options de compilation sp\xE9cifiques aux architectures\ + \ ARM" + description: "La liste ci-dessous pr\xE9sente les options de compilation du\ + \ noyau recommand\xE9es pour les architectures de type ARM.\L\nListe des options\ + \ de compilation du noyau recommand\xE9es pour les architectures ARM\L \n\ + # Interdit l'utilisation d'adresses m\xE9moire en dessous d'une certaine valeur\ + \ (contre-mesure contre les null pointer dereference).\LCONFIG_DEFAULT_MMAP_MIN_ADDR=32768\L\ + # Maximise la taille de la m\xE9moire virtuelle des processus (et de l'ASLR\ + \ aff\xE9rent). \nCONFIG_VMSPLIT_3G=y \n# Interdit les mappings m\xE9moire\ + \ RWX. \nCONFIG_STRICT_MEMORY_RWX=y \n# Interdit les acc\xE8s par le noyau\ + \ \xE0 la m\xE9moire utilisateur (m\xE9canisme \xE9quivalent sur ARM \xE0\ + \ SMAP sur x86_64).\LCONFIG_CPU_SW_DOMAIN_PAN=y\L# Cette option de compatibilit\xE9\ + \ avec l'ancienne ABI ARM est dangereuse et ouvre la voie \xE0 diverses attaques.\ + \ \n#CONFIG_OABI_COMPAT is unset" + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r27 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:5.3.2 + ref_id: R27 + name: "Param\xE9trer les options de compilation sp\xE9cifiques aux architectures\ + \ ARM 64 bits" + description: "La liste ci-dessous pr\xE9sente les options de compilation du\ + \ noyau recommand\xE9es pour les architectures de type ARM 64 bits.\L\nListe\ + \ des options de compilation du noyau recommand\xE9es pour les architectures\ + \ ARM 64 bits\L\n# Interdit l'utilisation d'adresses m\xE9moire en dessous\ + \ d'une certaine valeur (contre-mesure contre les null pointer dereference).\L\ + CONFIG_DEFAULT_MMAP_MIN_ADDR=32768\L# Rend non pr\xE9dictible l'adresse de\ + \ base du noyau, cette option complexifie la t\xE2che d'un attaquant. L'entropie\ + \ n\xE9cessaire \xE0 la g\xE9n\xE9ration de l'al\xE9a doit \xEAtre fournie\ + \ par l'UEFI ou, \xE0 d\xE9faut, par le chargeur de d\xE9marrage. \nCONFIG_RANDOMIZE_BASE=y\ + \ \n# Interdit les acc\xE8s par le noyau \xE0 la m\xE9moire utilisateur (m\xE9\ + canisme \xE9quivalent sur ARM \xE0 SMAP sur 86_64).\LCONFIG_ARM64_SW_TTBR0_PAN=y\L\ + # Contre mesure \xE0 l'attaque Meltdown.\LCONFIG_UNMAP_KERNEL_AT_EL0=y \n\n" + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6 + assessable: false + depth: 1 + ref_id: '6' + name: "Configuration syst\xE8me" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.1 + assessable: false + depth: 2 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6 + ref_id: '6.1' + name: Partitionnement + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r28 + assessable: true + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.1 + ref_id: R28 + name: Partitionnement type + description: "Le partitionnement type recommand\xE9 est le suivant :\n\nPoint\ + \ de montage : /\nOptions: \nDescription: Partition racine, contient\ + \ le reste de l\u2019arborescence \nPoint de montage : /boot\nOptions: nosuid,nodev,noexec\ + \ (noauto optionnel)\nDescription: Contient le noyau et le chargeur de d\xE9\ + marrage. Pas d\u2019acc\xE8s n\xE9cessaire une fois le boot termin\xE9 (sauf\ + \ mise \xE0 jour) \nPoint de montage : /opt\nOptions: nosuid,nodev (ro optionnel)\n\ + Description: Packages additionnels au syst\xE8me. Montage en lecture seule\ + \ si non utilis\xE9 \nPoint de montage : /tmp\nOptions: nosuid,nodev,noexec\n\ + Description: Fichiers temporaires. Ne doit contenir que des \xE9l\xE9ments\ + \ non ex\xE9cutables. Nettoy\xE9 apr\xE8s red\xE9marrage ou pr\xE9f\xE9rablement\ + \ de type tmpfs \nPoint de montage : /srv\nOptions: nosuid,nodev (noexec,ro\ + \ optionnels)\nDescription: Contient des fichiers servis par un service type\ + \ Web, FTP... \nPoint de montage : /home\nOptions: nosuid,nodev,noexec\nDescription:\ + \ Contient les HOME utilisateurs. \nPoint de montage : /proc\nOptions: hidepid=2\ + \ 14\nDescription: Contient des informations sur les processus et le syst\xE8\ + me \nPoint de montage : /usr\nOptions: nodev\nDescription: Contient la majorit\xE9\ + \ des utilitaires et fichiers syst\xE8me \nPoint de montage : /var\nOptions:\ + \ nosuid,nodev,noexec\nDescription: Partition contenant des fichiers variables\ + \ pendant la vie du syst\xE8me (mails, fichiers PID, bases de donn\xE9es d\u2019\ + un service) \nPoint de montage : /var/log\nOptions: nosuid,nodev,noexec\n\ + Description: Contient les logs du syst\xE8me \nPoint de montage : /var/tmp\n\ + Options: nosuid,nodev,noexec\nDescription: Fichiers temporaires conserv\xE9\ + s apr\xE8s extinction \n" + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r29 + assessable: true + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.1 + ref_id: R29 + name: "Restreindre les acc\xE8s au dossier /boot" + description: "Lorsque c\u2019est possible, il est recommand\xE9 de ne pas monter\ + \ automatiquement la partition /boot. Dans tous les cas, l\u2019acc\xE8s au\ + \ dossier /boot doit \xEAtre uniquement autoris\xE9 pour l\u2019utilisateur\ + \ root.\L\nAttention \nLa modification du montage de /boot demande une adaptation\ + \ des outils syst\xE8me \xE0 cette configuration particuli\xE8re, notamment\ + \ pour la mise \xE0 jour du noyau et du chargeur de d\xE9marrage." + implementation_groups: + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.2 + assessable: false + depth: 2 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6 + ref_id: '6.2' + name: "Comptes d'acc\xE8s" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.2.1 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.2 + ref_id: 6.2.1 + name: Comptes utilisateur + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r30 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.2.1 + ref_id: R30 + name: "D\xE9sactiver les comptes utilisateur inutilis\xE9s" + description: "Les comptes utilisateur inutilis\xE9s doivent \xEAtre d\xE9sactiv\xE9\ + s au niveau du syst\xE8me." + implementation_groups: + - M + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r31 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.2.1 + ref_id: R31 + name: Utiliser des mots de passe robustes + description: "Il est conseill\xE9 d\u2019appliquer les recommandations de la\ + \ note technique \xAB Recommandations relatives \xE0 l\u2019authentification\ + \ multifacteur et aux mots de passe \xBB. Ce mot de passe doit \xEAtre unique\ + \ et propre \xE0 chaque machine." + implementation_groups: + - M + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r32 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.2.1 + ref_id: R32 + name: "\xC9xpirer les sessions utilisateur locales" + description: "Les sessions utilisateur locales (console TTY, session graphique)\ + \ doivent \xEAtre verrouill\xE9es au bout d\u2019un certain d\xE9lai d\u2019\ + inactivit\xE9." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.2.2 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.2 + ref_id: 6.2.2 + name: Comptes administrateur + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r33 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.2.2 + ref_id: R33 + name: "Assurer l\u2019imputabilit\xE9 des actions d\u2019administration" + description: "Les actions d\u2019administration n\xE9cessitant des privil\xE8\ + ges doivent \xEAtre trac\xE9es afin de pouvoir identifier l\u2019administrateur\ + \ \xE0 l\u2019origine d\u2019une activit\xE9 malveillante." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.2.3 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.2 + ref_id: 6.2.3 + name: Comptes de service + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r34 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.2.3 + ref_id: R34 + name: "D\xE9sactiver les comptes de service" + description: "Les comptes de service doivent \xEAtre d\xE9sactiv\xE9s." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r35 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.2.3 + ref_id: R35 + name: Utiliser des comptes de service uniques et exclusifs + description: "Chaque service m\xE9tier (nginx, php, mysql, ...) ajout\xE9 par\ + \ l\u2019administrateur doit poss\xE9der son propre compte syst\xE8me d\xE9\ + di\xE9." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.3 + assessable: false + depth: 2 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6 + ref_id: '6.3' + name: "Contr\xF4le d'acc\xE8s" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.3.1 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.3 + ref_id: 6.3.1 + name: "Mod\xE8le traditionnel Unix" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r36 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.3.1 + ref_id: R36 + name: "Modifier la valeur par d\xE9faut de UMASK" + description: "La valeur par d\xE9faut de UMASK des shells doit \xEAtre positionn\xE9\ + e \xE0 0077 pour permettre un acc\xE8s au fichier ou au r\xE9pertoire cr\xE9\ + \xE9 en lecture et \xE9criture uniquement \xE0 l\u2019utilisateur propri\xE9\ + taire. Celle-ci peut \xEAtre sp\xE9cifi\xE9e dans le fichier de configuration\ + \ /etc/profile que la plupart des shells (bash, dash, ksh...) utiliseront.\L\ + \nLa valeur par d\xE9faut de UMASK des services doit \xEAtre \xE9tudi\xE9\ + e au cas par cas mais devrait g\xE9n\xE9ralement \xEAtre \xE00027(ou plus\ + \ restrictif). Ceci permet un acc\xE8s au fichier ou au r\xE9pertoire cr\xE9\ + \xE9 en lecture uniquement \xE0 l\u2019utilisateur propri\xE9taire et \xE0\ + \ son groupe et un acc\xE8s en \xE9criture au propri\xE9taire. Pour les services\ + \ systemd, cette valeur peut \xEAtre sp\xE9cifi\xE9e dans le fichier de configuration\ + \ du service avec la directive UMask=0027." + implementation_groups: + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r37 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.3.1 + ref_id: R37 + name: "Utiliser des fonctionnalit\xE9s de contr\xF4le d\u2019acc\xE8s obligatoire\ + \ MAC" + description: "Il est recommand\xE9 d\u2019utiliser les fonctionnalit\xE9s de\ + \ Mandatory Access Control ou contr\xF4le d\u2019acc\xE8s obligatoire (MAC)\ + \ en plus du traditionnel mod\xE8le utilisateur Unix, Discretionary Access\ + \ Control ou contr\xF4le d\u2019acc\xE8s discr\xE9tionnaire (DAC), voire \xE9\ + ventuellement de les combiner avec des m\xE9canismes de cloisonnement." + implementation_groups: + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r38 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.3.1 + ref_id: R38 + name: "Cr\xE9er un groupe d\xE9di\xE9 \xE0 l\u2019usage de sudo" + description: "Un groupe d\xE9di\xE9 \xE0 l\u2019usage de sudo doit \xEAtre cr\xE9\ + \xE9. Seuls les utilisateurs membres de ce groupe doivent avoir le droit d\u2019\ + ex\xE9cuter sudo." + implementation_groups: + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r39 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.3.1 + ref_id: R39 + name: Modifier les directives de configuration sudo + description: "Les directives suivantes doivent \xEAtre activ\xE9es par d\xE9\ + faut : \nnoexec appliquer le tag NOEXEC par d\xE9faut sur les commandes\L\ + requiretty imposer \xE0 l\u2019utilisateur d\u2019avoir un tty de login\L\ + use_pty utiliser un pseudo-tty lorsqu\u2019une commande est ex\xE9cut\xE9\ + e\Lumask=0077 forcer umask \xE0 un masque plus restrictif \nignore_dot ignorer\ + \ le \xAB . \xBB dans $PATH\Lenv_reset r\xE9initialiser les variables d\u2019\ + environnement" + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r40 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.3.1 + ref_id: R40 + name: "Utiliser des utilisateurs cibles non-privil\xE9gi\xE9s pour les commandes\ + \ sudo" + description: "Les utilisateurs cibles d\u2019une r\xE8gle doivent autant que\ + \ possible \xEAtre des utilisateurs non privil\xE9gi\xE9s (c\u2019est-\xE0\ + -dire non root)." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r41 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.3.1 + ref_id: R41 + name: "Limiter l\u2019utilisation de commandes n\xE9cessitant la directive EXEC" + description: "Les commandes n\xE9cessitant l\u2019ex\xE9cution de sous-processus,\ + \ directive EXEC doivent \xEAtre explicitement list\xE9es et r\xE9duites autant\ + \ que possible au strict minimum." + implementation_groups: + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r42 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.3.1 + ref_id: R42 + name: "Bannir les n\xE9gations dans les sp\xE9cifications sudo" + description: "Les sp\xE9cifications de commande ne doivent pas faire intervenir\ + \ de n\xE9gation." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r43 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.3.1 + ref_id: R43 + name: "Pr\xE9ciser les arguments dans les sp\xE9cifications sudo" + description: "Toutes les commandes du fichier de configuration sudoers doivent\ + \ pr\xE9ciser strictement les arguments autoris\xE9s \xE0 \xEAtre utilis\xE9\ + s pour un utilisateur donn\xE9. L\u2019usage de * (wildcard) dans les r\xE8\ + gles doit \xEAtre autant que possible \xE9vit\xE9. L\u2019absence d\u2019\ + arguments aupr\xE8s d\u2019une commande doit \xEAtre sp\xE9cifi\xE9e par la\ + \ pr\xE9sence d\u2019une cha\xEEne vide (\"\")." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r44 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.3.1 + ref_id: R44 + name: "\xC9diter les fichiers de mani\xE8re s\xE9curis\xE9e avec sudo" + description: "L\u2019\xE9dition d\u2019un fichier par sudo doit \xEAtre r\xE9\ + alis\xE9e au travers de l\u2019\xE9diteur de texte sudoedit." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.3.2 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.3 + ref_id: 6.3.2 + name: AppArmor + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r45 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.3.2 + ref_id: R45 + name: "Activer les profils de s\xE9curit\xE9 AppArmor" + description: "Tout profil de s\xE9curit\xE9 AppArmor pr\xE9sent sur le syst\xE8\ + me doit \xEAtre activ\xE9 en mode enforce par d\xE9faut quand la distribution\ + \ en offre le support et qu\u2019elle n\u2019exploite pas de module de s\xE9\ + curit\xE9 autre que AppArmor." + implementation_groups: + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.3.3 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.3 + ref_id: 6.3.3 + name: SELinux + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r46 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.3.3 + ref_id: R46 + name: Activer SELinux avec la politique targeted + description: "Il est recommand\xE9 d\u2019activer SELinux en mode enforcing\ + \ et d\u2019utiliser la politique targeted quand la distribution en offre\ + \ le support et qu\u2019elle n\u2019exploite pas de module de s\xE9curit\xE9\ + \ autre que SELinux." + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r47 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.3.3 + ref_id: R47 + name: "Confiner les utilisateurs interactifs non privil\xE9gi\xE9s" + description: "Les utilisateurs interactifs non privil\xE9gi\xE9s d\u2019un syst\xE8\ + me doivent \xEAtre confin\xE9s en leur associant un utilisateur SELinux confin\xE9\ + ." + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r48 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.3.3 + ref_id: R48 + name: "Param\xE9trer les variables SELinux" + description: "Il est recommand\xE9 d\u2019appliquer les politiques de s\xE9\ + curit\xE9 suivantes :\L\n- Interdit aux processus de rendre ex\xE9cutable leur\ + \ tas - heap -\L\n- Interdit aux processus d\u2019avoir une zone m\xE9moire avec\ + \ des droits en \xE9criture - w - et en ex\xE9cution - x -\L\n- Interdit aux processus\ + \ le droit de rendre leur pile - stack - ex\xE9cutable\L\n- Interdit le chargement\ + \ dynamique des modules par n\u2019importe quel processus ;\L\n- Interdit les\ + \ logins SSH de se connecter directement en r\xF4le sysadmin." + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r49 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.3.3 + ref_id: R49 + name: "D\xE9sinstaller les outils de d\xE9bogage de politique SELinux" + description: "Les outils de manipulation et de d\xE9bogage de politique SELinux\ + \ ne doivent pas \xEAtre install\xE9s sur une machine en production." + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.4 + assessable: false + depth: 2 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6 + ref_id: '6.4' + name: "Fichiers et r\xE9pertoires" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.4.1 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.4 + ref_id: 6.4.1 + name: "Fichiers et r\xE9pertoires sensibles" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r50 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.4.1 + ref_id: R50 + name: "Restreindre les droits d\u2019acc\xE8s aux fichiers et aux r\xE9pertoires\ + \ sensibles" + description: "Les fichiers et les r\xE9pertoires sensibles ne doivent \xEAtre\ + \ lisibles que par les utilisateurs ayant le strict besoin d\u2019en conna\xEE\ + tre." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r51 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.4.1 + ref_id: R51 + name: "Changer les secrets et droits d\u2019acc\xE8s d\xE8s l\u2019installation" + description: "Tous les fichiers sensibles et ceux qui concourent aux m\xE9canismes\ + \ d\u2019authentification doivent \xEAtre mis en place d\xE8s l\u2019installation\ + \ du syst\xE8me. Si des secrets par d\xE9faut sont pr\xE9configur\xE9s, ils\ + \ doivent alors \xEAtre remplac\xE9s pendant, ou juste apr\xE8s, la phase\ + \ d\u2019installation du syst\xE8me." + implementation_groups: + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.4.2 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.4 + ref_id: 6.4.2 + name: "Fichiers IPC nomm\xE9s, sockets ou pipes" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r52 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.4.2 + ref_id: R52 + name: "Restreindre les acc\xE8s aux sockets et aux pipes nomm\xE9es" + description: "Les sockets et pipes nomm\xE9es doivent \xEAtre prot\xE9g\xE9\ + es en acc\xE8s par un r\xE9pertoire poss\xE9dant des droits appropri\xE9s.\ + \ Les droits de la socket ou du pipe nomm\xE9 doivent \xE9galement restreindre\ + \ les acc\xE8s." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.4.3 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.4 + ref_id: 6.4.3 + name: "Droits d'acc\xE8s" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r53 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.4.3 + ref_id: R53 + name: "\xC9viter les fichiers ou r\xE9pertoires sans utilisateur ou sans groupe\ + \ connu" + description: "Les fichiers ou r\xE9pertoires sans utilisateur ou groupe identifiable\ + \ par le syst\xE8me doivent \xEAtre analys\xE9s et \xE9ventuellement corrig\xE9\ + s afin d\u2019avoir un propri\xE9taire ou un groupe connu du syst\xE8me." + implementation_groups: + - M + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r54 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.4.3 + ref_id: R54 + name: "Activer le sticky bit sur les r\xE9pertoires inscriptibles" + description: "Tous les r\xE9pertoires accessibles en \xE9criture par tous doivent\ + \ avoir le sticky bit positionn\xE9." + implementation_groups: + - M + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r55 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.4.3 + ref_id: R55 + name: "S\xE9parer les r\xE9pertoires temporaires des utilisateurs" + description: "Chaque utilisateur ou application doit poss\xE9der son propre\ + \ r\xE9pertoire temporaire et en disposer exclusivement." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r56 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.4.3 + ref_id: R56 + name: "\xC9viter l\u2019usage d\u2019ex\xE9cutables avec les droits sp\xE9ciaux\ + \ setuid et setgid" + description: "Seuls les logiciels de confiance issus, par exemple, de la distribution\ + \ ou de d\xE9p\xF4ts officiels de paquets et sp\xE9cifiquement con\xE7us pour\ + \ \xEAtre utilis\xE9s avec les droits sp\xE9ciaux setuid ou setgid peuvent\ + \ avoir ces droits positionn\xE9s." + implementation_groups: + - M + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r57 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.4.3 + ref_id: R57 + name: "\xC9viter l\u2019usage d\u2019ex\xE9cutables avec les droits sp\xE9ciaux\ + \ setuid root et setgid root" + description: "Les ex\xE9cutables avec les droits sp\xE9ciaux setuid root et\ + \ setgid root doivent \xEAtre le moins nombreux possible. Lorsqu\u2019il est\ + \ attendu que seuls les administrateurs les ex\xE9cutent, il faut leur retirer\ + \ ces droits sp\xE9ciaux (setuid ou setgid) et leur pr\xE9f\xE9rer les commandes\ + \ comme su ou sudo, qui peuvent \xEAtre surveill\xE9es." + implementation_groups: + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.5 + assessable: false + depth: 2 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6 + ref_id: '6.5' + name: Gestion des paquets + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r58 + assessable: true + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.5 + ref_id: R58 + name: "N\u2019installer que les paquets strictement n\xE9cessaires" + description: "Le choix des paquets doit conduire \xE0 une installation aussi\ + \ minimale que possible, se limitant \xE0 ne s\xE9lectionner que ceux qui\ + \ sont n\xE9cessaires au besoin." + implementation_groups: + - M + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r59 + assessable: true + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.5 + ref_id: R59 + name: "Utiliser des d\xE9p\xF4ts de paquets de confiance" + description: "Seuls les d\xE9p\xF4ts internes \xE0 l\u2019organisation ou officiels\ + \ (de la distribution ou de d\u2019un \xE9diteur) doivent \xEAtre utilis\xE9\ + s." + implementation_groups: + - M + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r60 + assessable: true + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.5 + ref_id: R60 + name: "Utiliser des d\xE9p\xF4ts de paquets durcis" + description: "Lorsque la distribution fournit plusieurs types de d\xE9p\xF4\ + ts, la pr\xE9f\xE9rence doit aller \xE0 ceux contenant des paquets faisant\ + \ l\u2019objet de mesures de durcissement suppl\xE9mentaires. Entre deux paquets\ + \ fournissant le m\xEAme service, ceux faisant l\u2019objet de mesures de\ + \ durcissement (\xE0 la compilation, \xE0 l\u2019installation ou dans la configuration\ + \ par d\xE9faut) doivent \xEAtre privil\xE9gi\xE9s." + implementation_groups: + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.6 + assessable: false + depth: 2 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6 + ref_id: '6.6' + name: Veille et maintenance + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r61 + assessable: true + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:6.6 + ref_id: R61 + name: "Effectuer des mises \xE0 jour r\xE9guli\xE8res" + description: "Il est recommand\xE9 d\u2019avoir une proc\xE9dure de mise \xE0\ + \ jour de s\xE9curit\xE9 r\xE9guli\xE8re et r\xE9active." + implementation_groups: + - M + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7 + assessable: false + depth: 1 + ref_id: '7' + name: Configuration des services + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r62 + assessable: true + depth: 2 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7 + ref_id: R62 + name: "D\xE9sactiver les services non n\xE9cessaires" + description: "Seuls les composants strictement n\xE9cessaires au service rendu\ + \ par le syst\xE8me doivent \xEAtre install\xE9s.Tout service, et particuli\xE8\ + rement ceux en \xE9coute active sur le r\xE9seau, est un \xE9l\xE9ment sensible.\ + \ Seuls ceux connus et requis pour le fonctionnement et la maintenance doivent\ + \ \xEAtre install\xE9s. Il est recommand\xE9 de d\xE9sinstaller les services\ + \ dont la pr\xE9sence ne peut \xEAtre justifi\xE9e ou de les d\xE9sactiver\ + \ si leur d\xE9sinstallation n\u2019est pas possible." + implementation_groups: + - M + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r63 + assessable: true + depth: 2 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7 + ref_id: R63 + name: "D\xE9sactiver les fonctionnalit\xE9s des services non essentielles" + description: "Les fonctionnalit\xE9s configur\xE9es au niveau des services d\xE9\ + marr\xE9s doivent \xEAtre limit\xE9es au strict n\xE9cessaire." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r64 + assessable: true + depth: 2 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7 + ref_id: R64 + name: "Configurer les privil\xE8ges des services" + description: "Tous les services et ex\xE9cutables disponibles sur le syst\xE8\ + me doivent faire l\u2019objet d\u2019une analyse afin de conna\xEEtre les\ + \ privil\xE8ges qui leur sont associ\xE9s, et doivent ensuite \xEAtre mis\ + \ en \u0153uvre et configur\xE9s en vue d\u2019en utiliser le strict n\xE9\ + cessaire." + implementation_groups: + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.1 + assessable: false + depth: 2 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7 + ref_id: '7.1' + name: Cloisonnement + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r65 + assessable: true + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.1 + ref_id: R65 + name: Cloisonner les services + description: "Dans le cadre du principe de minimisation, il est recommand\xE9\ + \ de cloisonner les services avec les m\xE9canismes de confinement, de filtrage\ + \ et d\u2019isolation disponibles dans le noyau Linux." + implementation_groups: + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r66 + assessable: true + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.1 + ref_id: R66 + name: Durcir les composants de cloisonnement + description: "Tout composant support de cloisonnement doit \xEAtre durci, notamment\ + \ par l\u2019application de mesures techniques contrant les tentatives d\u2019\ + exploitation." + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.2 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.1 + ref_id: '7.2' + name: "Services syst\xE8me" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.2.1 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.1 + ref_id: 7.2.1 + name: Pluggable Authentication Module ou module d'authentification enfichable + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r67 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.2.1 + ref_id: R67 + name: "S\xE9curiser les authentifications distante par PAM" + description: "Quand l\u2019authentification se d\xE9roule au travers d\u2019\ + une application distante (r\xE9seau), le protocole d\u2019authentification\ + \ utilis\xE9 par PAM doit \xEAtre s\xE9curis\xE9 (chiffrement du flux, authentification\ + \ du serveur distant, m\xE9canismes d\u2019anti-rejeu...)." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r68 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.2.1 + ref_id: R68 + name: "Prot\xE9ger les mots de passe stock\xE9s" + description: "Tout mot de passe doit \xEAtre prot\xE9g\xE9 par des m\xE9canismes\ + \ cryptographiques \xE9vitant de les exposer en clair \xE0 un attaquant. Pour\ + \ cela, se r\xE9f\xE9rer \xE0 la section 4.6 Stockage de mots de passe du\ + \ guide Recommandations relatives \xE0 l\u2019authentification multifacteur\ + \ et aux mots de passe." + implementation_groups: + - M + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.2.2 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.1 + ref_id: 7.2.2 + name: Name Service Switch ou service de gestion de noms + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r69 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.2.2 + ref_id: R69 + name: "S\xE9curiser les acc\xE8s aux bases utilisateur distantes" + description: "Lorsque les bases utilisateur sont stock\xE9es sur un serveur\ + \ r\xE9seau distant, NSS doit \xEAtre configur\xE9 pour \xE9tablir une liaison\ + \ s\xE9curis\xE9e permettant au minimum d\u2019authentifier le serveur et\ + \ de prot\xE9ger le canal de communication." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r70 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.2.2 + ref_id: R70 + name: "S\xE9parer les comptes syst\xE8me et d\u2019administrateur de l\u2019\ + annuaire" + description: "Il est recommand\xE9 de ne pas avoir de recouvrement de compte\ + \ entre ceux utilis\xE9s par le syst\xE8me d\u2019exploitation et ceux utilis\xE9\ + s pour administrer l\u2019annuaire. L\u2019usage de comptes administrateur\ + \ d\u2019annuaire pour effectuer des requ\xEAtes d\u2019\xE9num\xE9ration\ + \ de comptes par NSS doit \xEAtre prohib\xE9." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.2.3 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.1 + ref_id: 7.2.3 + name: Journalisation + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r71 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.2.3 + ref_id: R71 + name: "Mettre en place un syst\xE8me de journalisation" + description: "Il est conseill\xE9 d\u2019appliquer les recommandations de la\ + \ note technique \xAB Recommandations de s\xE9curit\xE9 pour l\u2019architecture\ + \ d\u2019un syst\xE8me de journalisation \xBB." + implementation_groups: + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r72 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.2.3 + ref_id: R72 + name: "Mettre en place des journaux d\u2019activit\xE9 de service d\xE9di\xE9\ + s" + description: "Chaque service doit poss\xE9der un journal d\u2019\xE9v\xE9nements\ + \ d\xE9di\xE9 sur le syst\xE8me. Ce journal ne doit \xEAtre accessible que\ + \ par le serveur syslog, et ne doit pas \xEAtre lisible, modifiable ou supprimable\ + \ par le service directement." + implementation_groups: + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r73 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.2.3 + ref_id: R73 + name: "Journaliser l\u2019activit\xE9 syst\xE8me avec auditd" + description: "La journalisation de l\u2019activit\xE9 du syst\xE8me doit \xEA\ + tre faite au travers du service auditd." + implementation_groups: + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.2.4 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.1 + ref_id: 7.2.4 + name: Messagerie + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r74 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.2.4 + ref_id: R74 + name: Durcir le service de messagerie locale + description: "Quand un service de messagerie est install\xE9 sur la machine,\ + \ il doit \xEAtre configur\xE9 pour n\u2019accepter que :\L\n- Les messages \xE0\ + \ destination d\u2019un compte utilisateur local \xE0 la machine\L\n- Les connexions\ + \ sur l\u2019interface r\xE9seau de la boucle locale, les connexions distantes\ + \ au service de messagerie doivent \xEAtre rejet\xE9es." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r75 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.2.4 + ref_id: R75 + name: Configurer un alias de messagerie des comptes de service + description: "Pour chaque service exploit\xE9 sur le syst\xE8me, ainsi que pour\ + \ le compte d\u2019administrateur (ou root), un alias vers un compte utilisateur\ + \ administrateur doit \xEAtre configur\xE9 afin que celui-ci re\xE7oive les\ + \ notifications et les rapports adress\xE9s par messagerie \xE9lectronique." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.2.5 + assessable: false + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.1 + ref_id: 7.2.5 + name: "Surveillance du syst\xE8me de fichiers" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r76 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.2.5 + ref_id: R76 + name: "Sceller et v\xE9rifier l\u2019int\xE9grit\xE9 des fichiers" + description: "Tout fichier qui ne rev\xEAt pas un caract\xE8re transitoire (comme\ + \ des fichiers temporaires, des bases de donn\xE9es...) doit \xEAtre surveill\xE9\ + \ par un logiciel de scellement. Cela inclut notamment : les r\xE9pertoires\ + \ contenant des ex\xE9cutables, des biblioth\xE8ques, des fichiers de configuration,\ + \ ainsi que tout fichier pouvant contenir des \xE9l\xE9ments sensibles (cl\xE9\ + s cryptographiques, mots de passe, donn\xE9es confidentielles...)." + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r77 + assessable: true + depth: 4 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.2.5 + ref_id: R77 + name: "Prot\xE9ger la base de donn\xE9es des scell\xE9s" + description: "La base de donn\xE9es de scellement doit \xEAtre prot\xE9g\xE9\ + e de tout acc\xE8s frauduleux par des m\xE9canismes de signature cryptographique\ + \ (avec la cl\xE9 utilis\xE9e pour la signature non enregistr\xE9e localement\ + \ en clair), ou \xEAtre \xE9ventuellement stock\xE9e sur une machine distincte\ + \ de celle sur laquelle le scellement est r\xE9alis\xE9." + implementation_groups: + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.3 + assessable: false + depth: 2 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7 + ref_id: '7.3' + name: "Services r\xE9seau" + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r78 + assessable: true + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.3 + ref_id: R78 + name: "Cloisonner les services r\xE9seau" + description: "Les services r\xE9seau doivent autant que possible \xEAtre h\xE9\ + berg\xE9s sur des environnements distincts. Cela \xE9vite d\u2019avoir d\u2019\ + autres services potentiellement affect\xE9s si l\u2019un d\u2019eux se retrouve\ + \ compromis sous le m\xEAme environnement." + implementation_groups: + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r79 + assessable: true + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.3 + ref_id: R79 + name: "Durcir et surveiller les services expos\xE9s" + description: "Les services expos\xE9s \xE0 des flux non ma\xEEtris\xE9s doivent\ + \ \xEAtre durcis et particuli\xE8rement surveill\xE9s." + implementation_groups: + - I + - R + - E + - urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:r80 + assessable: true + depth: 3 + parent_urn: urn:protocolpaladin:risk:req_node:anssi-recommandations-configuration-systeme-gnu-linux:7.3 + ref_id: R80 + name: "R\xE9duire la surface d\u2019attaque des services r\xE9seau" + description: "Tous les services r\xE9seau doivent \xEAtre en \xE9coute sur les\ + \ interfaces r\xE9seau ad\xE9quates." + implementation_groups: + - M + - I + - R + - E diff --git a/backend/library/management/__init__.py b/backend/library/management/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/backend/library/management/commands/__init__.py b/backend/library/management/commands/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/backend/library/management/commands/storelibraries.py b/backend/library/management/commands/storelibraries.py new file mode 100644 index 000000000..36e2d3288 --- /dev/null +++ b/backend/library/management/commands/storelibraries.py @@ -0,0 +1,36 @@ +from pathlib import Path + +import structlog +from ciso_assistant.settings import LIBRARIES_PATH +from core.models import StoredLibrary +from django.core.management.base import BaseCommand + +logger = structlog.getLogger(__name__) + + +class Command(BaseCommand): + help = "Store libraries in the database" + + def add_arguments(self, parser) -> None: + parser.add_argument("--path", type=str, help="Path to library files") + + def handle(self, *args, **options): + StoredLibrary.__init_class__() + path = Path(options.get("path") or LIBRARIES_PATH) + if path.is_dir(): + library_files = [ + f for f in path.iterdir() if f.is_file and f.suffix == ".yaml" + ] + else: + library_files = [path] + for fname in library_files: + # logger.info("Begin library file storage", filename=fname) + library = StoredLibrary.store_library_file(fname, True) + if library: + logger.info( + "Successfully stored library", + filename=fname, + library=library, + ) + # else: + # logger.info("Library is up to date", filename=fname) diff --git a/backend/library/serializers.py b/backend/library/serializers.py index b75407092..4515fab3d 100644 --- a/backend/library/serializers.py +++ b/backend/library/serializers.py @@ -1,11 +1,7 @@ -from core.models import Library -from core.serializers import ( - BaseModelSerializer, -) +from core.models import StoredLibrary, LoadedLibrary from rest_framework import serializers - -class LibraryObjectSerializer(serializers.Serializer): +"""class LibraryObjectSerializer(serializers.Serializer): type = serializers.ChoiceField( choices=[ "risk_matrix", @@ -15,21 +11,66 @@ class LibraryObjectSerializer(serializers.Serializer): ] ) fields = serializers.DictField(child=serializers.CharField()) +""" + + +class StoredLibrarySerializer(serializers.ModelSerializer): + # Not used yet + class Meta: + model = StoredLibrary + fields = [ + "id", + "name", + "description", + "urn", + "ref_id", + "locale", + "version", + "packager", + "provider", + "builtin", + "objects_meta", + "is_loaded", + ] + + +class StoredLibraryDetailedSerializer(serializers.ModelSerializer): + class Meta: + model = StoredLibrary + fields = "__all__" + + +class LoadedLibraryDetailedSerializer(serializers.ModelSerializer): + class Meta: + model = LoadedLibrary + fields = "__all__" + + +""" +class StoredLibraryReadSerializer(StoredLibraryWriteSerializer): + content = serializers.SerializerMethodField() + + def get_content(self, content: bytes): + return content.encode("utf-8") # Should we enforce UTF-8 for library files ? +""" -class LibrarySerializer(serializers.Serializer): +class LoadedLibrarySerializer(serializers.Serializer): + id = serializers.CharField() name = serializers.CharField() description = serializers.CharField() locale = serializers.ChoiceField(choices=["en", "fr"]) - objects = LibraryObjectSerializer(many=True) - format_version = serializers.CharField() + # objects = LibraryObjectSerializer(many=True) + version = serializers.CharField() copyright = serializers.CharField() + builtin = serializers.BooleanField() -class LibraryModelSerializer(BaseModelSerializer): +"""class LibraryModelSerializer(BaseModelSerializer): class Meta: - model = Library + model = LoadedLibrary fields = "__all__" +""" class LibraryUploadSerializer(serializers.Serializer): diff --git a/backend/library/utils.py b/backend/library/utils.py index a9c7ee22f..a9be619fd 100644 --- a/backend/library/utils.py +++ b/backend/library/utils.py @@ -13,7 +13,8 @@ from ciso_assistant import settings from core.models import ( Framework, - Library, + StoredLibrary, + LoadedLibrary, RequirementNode, RiskMatrix, ReferenceControl, @@ -79,7 +80,9 @@ def get_available_libraries(): libs = list(yaml.load_all(file, Loader=yaml.CSafeLoader)) AVAILABLE_LIBRARIES[(fname, os.path.getmtime(fname))] = libs for _lib in libs: - if (lib := Library.objects.filter(urn=_lib["urn"]).first()) is not None: + if ( + lib := LoadedLibrary.objects.filter(urn=_lib["urn"]).first() + ) is not None: _lib["id"] = lib.id _lib["reference_count"] = lib.reference_count libraries.append(_lib) @@ -115,7 +118,7 @@ def get_library(urn: str) -> dict | None: # First, try to fetch the library from the database.dd try: - lib = Library.objects.get(urn=urn) + lib = LoadedLibrary.objects.get(urn=urn) return { "id": lib.id, "urn": lib.urn, @@ -127,7 +130,7 @@ def get_library(urn: str) -> dict | None: "reference_count": lib.reference_count, "objects": lib._objects, } - except Library.DoesNotExist: + except LoadedLibrary.DoesNotExist: # Construct the path to the YAML file from the urn. filename = urn.split(":")[-1] libraries_path = settings.BASE_DIR / "library/libraries" @@ -286,7 +289,7 @@ def init(self) -> Union[str, None]: ) is not None: return requirement_node_import_error - def import_framework(self, library_object: Library): + def import_framework(self, library_object: LoadedLibrary): min_score = self.framework_data.get("min_score", 0) max_score = self.framework_data.get("max_score", 100) @@ -333,7 +336,7 @@ def is_valid(self) -> Union[str, None]: if missing_fields := self.REQUIRED_FIELDS - set(self.threat_data.keys()): return "Missing the following fields : {}".format(", ".join(missing_fields)) - def import_threat(self, library_object: Library): + def import_threat(self, library_object: LoadedLibrary): Threat.objects.create( library=library_object, urn=self.threat_data.get("urn"), @@ -367,7 +370,7 @@ def is_valid(self) -> Union[str, None]: category, ", ".join(ReferenceControlImporter.CATEGORIES) ) - def import_reference_control(self, library_object: Library): + def import_reference_control(self, library_object: LoadedLibrary): ReferenceControl.objects.create( library=library_object, urn=self.reference_control_data.get("urn"), @@ -403,14 +406,13 @@ def is_valid(self) -> Union[str, None]: if missing_fields := self.REQUIRED_FIELDS - set(self.risk_matrix_data.keys()): return "Missing the following fields : {}".format(", ".join(missing_fields)) - def import_risk_matrix(self, library_object: Library): + def import_risk_matrix(self, library_object: LoadedLibrary): matrix_data = { key: value for key, value in self.risk_matrix_data.items() if key in self.MATRIX_FIELDS } - - RiskMatrix.objects.create( + matrix = RiskMatrix.objects.create( library=library_object, folder=Folder.get_root_folder(), name=self.risk_matrix_data.get("name"), @@ -424,14 +426,18 @@ def import_risk_matrix(self, library_object: Library): default_locale=library_object.default_locale, # Change this in the future ? is_published=True, ) + logger.info("Risk matrix created", matrix=matrix) + return matrix class LibraryImporter: + # The word "import" must be replaced by "load" in all classes/methods/variables declared in this file. + REQUIRED_FIELDS = {"ref_id", "urn", "locale", "objects", "version"} OBJECT_FIELDS = ["threats", "reference_controls", "risk_matrix", "framework"] - def __init__(self, data: dict): - self._library_data = data + def __init__(self, library: StoredLibrary): + self._library = library self._framework_importer = None self._threats = [] self._reference_controls = [] @@ -515,18 +521,18 @@ def init_framework(self, framework_data: dict) -> Union[str, None]: return self._framework_importer.init() def init(self) -> Union[str, None]: - missing_fields = self.REQUIRED_FIELDS - set(self._library_data.keys()) + """missing_fields = self.REQUIRED_FIELDS - set(self._library_data.keys()) if missing_fields: return "The following fields are missing in the library: {}".format( ", ".join(missing_fields) - ) + )""" - library_objects = self._library_data["objects"] + library_objects = json.loads(self._library.content) if not any( object_field in library_objects for object_field in self.OBJECT_FIELDS ): - return "The libary 'objects' field data must contain at least one of the following fields : {}".format( + return "The library 'objects' field data must contain at least one of the following fields : {}".format( ", ".join(self.OBJECT_FIELDS) ) @@ -562,31 +568,48 @@ def init(self) -> Union[str, None]: def check_and_import_dependencies(self): """Check and import library dependencies.""" - dependencies = self._library_data.get("dependencies", []) - for dependency in dependencies: - if not Library.objects.filter(urn=dependency).exists(): - import_library_view(get_library(dependency)) + + if not self._library.dependencies: + return None + for dependency_urn in self._library.dependencies: + if not LoadedLibrary.objects.filter(urn=dependency_urn).exists(): + # import_library_view(get_library(dependency)) + dependency = StoredLibrary.objects.get( + urn=dependency_urn + ) # We only fetch by URN without thinking about what locale, that may be a problem in the future. + error_msg = dependency.load() + if error_msg is not None: + return error_msg def create_or_update_library(self): """Create or update the library object.""" - _urn = self._library_data["urn"] - _locale = self._library_data["locale"] - _default_locale = not Library.objects.filter(urn=_urn).exists() + _urn = self._library.urn + _locale = self._library.locale + _default_locale = not LoadedLibrary.objects.filter(urn=_urn).exists() - library_object, _created = Library.objects.update_or_create( + logger.info( + "Loading library", + urn=_urn, + locale=_locale, + default_locale=_default_locale, + library=self._library, + ) + library_object, _created = LoadedLibrary.objects.update_or_create( defaults={ - "ref_id": self._library_data["ref_id"], - "name": self._library_data.get("name"), - "description": self._library_data.get("description", None), + "ref_id": self._library.ref_id, + "name": self._library.name, + "description": self._library.description, "urn": _urn, "locale": _locale, "default_locale": _default_locale, - "version": self._library_data.get("version", None), - "provider": self._library_data.get("provider", None), - "packager": self._library_data.get("packager", None), - "copyright": self._library_data.get("copyright", None), - "folder": Folder.get_root_folder(), # TODO: make this configurable + "version": self._library.version, + "provider": self._library.provider, + "packager": self._library.packager, + "copyright": self._library.copyright, + "folder": Folder.get_root_folder(), # TODO: make this configurable, "is_published": True, + "builtin": self._library.builtin, + "objects_meta": self._library.objects_meta, }, urn=_urn, locale=_locale, @@ -611,16 +634,19 @@ def import_objects(self, library_object): def _import_library(self): library_object = self.create_or_update_library() self.import_objects(library_object) - library_object.dependencies.set( - Library.objects.filter(urn__in=self._library_data.get("dependencies", [])) - ) + if dependencies := self._library.dependencies: + library_object.dependencies.set( + LoadedLibrary.objects.filter(urn__in=dependencies) + ) def import_library(self): """Main method to import a library.""" if (error_message := self.init()) is not None: - return error_message + return error_message # This error check should be done when storing the Library but no after. - self.check_and_import_dependencies() + error_msg = self.check_and_import_dependencies() + if error_msg is not None: + return error_msg for _ in range(10): try: @@ -632,8 +658,7 @@ def import_library(self): else: raise e except Exception as e: - # TODO: Switch to proper logging - print(f"Library import exception: {e}") + logger.error("Library import error", error=e, library=self._library) raise e diff --git a/backend/library/views.py b/backend/library/views.py index 4124cb947..6ea57133f 100644 --- a/backend/library/views.py +++ b/backend/library/views.py @@ -1,19 +1,20 @@ import json from django.db import IntegrityError -from rest_framework import status +from rest_framework import viewsets, status from rest_framework.status import ( HTTP_200_OK, + HTTP_204_NO_CONTENT, HTTP_400_BAD_REQUEST, + HTTP_403_FORBIDDEN, + HTTP_404_NOT_FOUND, HTTP_422_UNPROCESSABLE_ENTITY, ) from rest_framework.parsers import FileUploadParser - from django.http import HttpResponse -import yaml from core.helpers import get_sorted_requirement_nodes -from core.models import Library +from core.models import StoredLibrary, LoadedLibrary from core.views import BaseModelViewSet from iam.models import RoleAssignment, Folder, Permission from library.validators import validate_file_extension @@ -22,106 +23,132 @@ from rest_framework.decorators import action from rest_framework.response import Response -from .serializers import LibrarySerializer -from .utils import get_available_libraries, get_library, import_library_view +from .serializers import ( + StoredLibraryDetailedSerializer, + LoadedLibraryDetailedSerializer, + StoredLibrarySerializer, +) + +import structlog +logger = structlog.get_logger(__name__) -class LibraryViewSet(BaseModelViewSet): - serializer_class = LibrarySerializer + +class StoredLibraryViewSet(BaseModelViewSet): parser_classes = [FileUploadParser] # solve issue with URN containing dot, see https://stackoverflow.com/questions/27963899/django-rest-framework-using-dot-in-url lookup_value_regex = r"[\w.:-]+" - model = Library + model = StoredLibrary + queryset = StoredLibrary.objects.all() - def list(self, request, *args, **kwargs): - if "view_library" not in request.user.permissions: - return Response(status=status.HTTP_403_FORBIDDEN) - return Response({"results": get_available_libraries()}) + filterset_fields = ["urn", "locale", "version", "packager", "provider"] + search_fields = ["name", "description", "urn"] + + def get_serializer_class(self): + if self.action == "list": + return StoredLibrarySerializer + return StoredLibraryDetailedSerializer def retrieve(self, request, *args, pk, **kwargs): - if "view_library" not in request.user.permissions: - return Response(status=status.HTTP_403_FORBIDDEN) - return Response( - status=status.HTTP_403_FORBIDDEN, - ) - library = get_library(pk) - return Response(library) + if "view_storedlibrary" not in request.user.permissions: + return Response(status=HTTP_403_FORBIDDEN) + try: + key = "urn" if pk.startswith("urn:") else "id" + lib = StoredLibrary.objects.get( + **{key: pk} + ) # There is no "locale" value involved in the fetch + we have to handle the exception if the pk urn doesn't exist + except: + return Response(data="Library not found.", status=HTTP_404_NOT_FOUND) + data = StoredLibrarySerializer(lib).data + return Response(data) + + def content(self, request, pk): + try: + key = "urn" if pk.startswith("urn:") else "id" + lib = StoredLibrary.objects.get(**{key: pk}) + except: + return Response("Library not found.", status=HTTP_404_NOT_FOUND) + return Response(lib.content) + + @action(detail=True, methods=["get"]) + def content(self, request, pk): + try: + key = "urn" if pk.startswith("urn:") else "id" + lib = StoredLibrary.objects.get(**{key: pk}) + except: + return Response("Library not found.", status=HTTP_404_NOT_FOUND) + return Response(lib.content) def destroy(self, request, *args, pk, **kwargs): if not RoleAssignment.is_access_allowed( user=request.user, - perm=Permission.objects.get(codename="delete_library"), + perm=Permission.objects.get(codename="delete_storedlibrary"), folder=Folder.get_root_folder(), ): - return Response(status=status.HTTP_403_FORBIDDEN) + return Response(status=HTTP_403_FORBIDDEN) - library = get_library(pk) + try: + key = "urn" if pk.startswith("urn:") else "id" + lib = StoredLibrary.objects.get(**{key: pk}) + except: + return Response(data="Library not found.", status=HTTP_404_NOT_FOUND) - if library is None: - return Response(data="Library not found.", status=status.HTTP_404_NOT_FOUND) + lib.delete() + return Response(status=HTTP_204_NO_CONTENT) - # "reference_count" is not always defined (is this normal ?) - if library.get("reference_count", 0) != 0: - return Response( - data="Library cannot be deleted because it has references.", - status=status.HTTP_400_BAD_REQUEST, - ) + @action(detail=True, methods=["get"], url_path="import") + def import_library(self, request, pk): + if not RoleAssignment.is_access_allowed( + user=request.user, + perm=Permission.objects.get(codename="add_loadedlibrary"), + folder=Folder.get_root_folder(), + ): + return Response(status=HTTP_403_FORBIDDEN) + try: + key = "urn" if pk.startswith("urn:") else "id" + library = StoredLibrary.objects.get( + **{key: pk} + ) # This is only fetching the lib by URN without caring about the locale or the version, this must change in the future. + except: + return Response(data="Library not found.", status=HTTP_404_NOT_FOUND) try: - Library.objects.get(id=library.get("id")).delete() - except IntegrityError as e: - # TODO: Log the exception if logging is set up - # logging.exception("Integrity error while deleting library: %s", e) - print(e) - except Exception as e: - # TODO: Log the exception if logging is set up - # logging.exception("Unexpected error while deleting library: %s", e) - print(e) + error_msg = library.load() + if error_msg is not None: + return Response( + {"status": "error", "error": error_msg}, + status=HTTP_400_BAD_REQUEST, + ) # This can cause translation issues + return Response({"status": "success"}) + except Exception: return Response( - data="Unexpected error occurred while deleting the library.", - status=status.HTTP_500_INTERNAL_SERVER_ERROR, + { + "error": "Failed to load library, please check if it has dependencies" + }, # This must translated + status=HTTP_422_UNPROCESSABLE_ENTITY, ) - return Response(status=status.HTTP_204_NO_CONTENT) - @action(detail=True, methods=["get"]) def tree(self, request, pk): - library = get_library(pk) - if not library: - return Response( - data="This library does not exist.", status=HTTP_400_BAD_REQUEST - ) - if not library["objects"].get("framework"): + try: + key = "urn" if pk.startswith("urn:") else "id" + lib = StoredLibrary.objects.get(**{key: pk}) + except: + return Response(data="Library not found.", status=HTTP_404_NOT_FOUND) + + library_objects = json.loads(lib.content) # We may need caching for this + if not (framework := library_objects.get("framework")): return Response( data="This library does not include a framework.", status=HTTP_400_BAD_REQUEST, ) - preview = preview_library(library) + + preview = preview_library(framework) return Response( get_sorted_requirement_nodes(preview.get("requirement_nodes"), None) ) - @action(detail=True, methods=["get"], url_path="import") - def import_library(self, request, pk=None): - if not RoleAssignment.is_access_allowed( - user=request.user, - perm=Permission.objects.get(codename="add_library"), - folder=Folder.get_root_folder(), - ): - return Response(status=status.HTTP_403_FORBIDDEN) - library = get_library(pk) - try: - import_library_view(library) - return Response({"status": "success"}) - except Exception as e: - return Response( - { - "error": f"Failed to load library, please check if it has dependencies: {e}" - }, - status=HTTP_422_UNPROCESSABLE_ENTITY, - ) - @action(detail=False, methods=["post"], url_path="upload") def upload_library(self, request): if not request.data: @@ -133,22 +160,22 @@ def upload_library(self, request): attachment = request.FILES["file"] validate_file_extension(attachment) # Use safe_load to prevent arbitrary code execution. - library = yaml.load(attachment, Loader=yaml.CSafeLoader) - - # This code doesn't handle the library "dependencies" field yet as decribed in the architecture. - error_msg = import_library_view(library) + content = attachment.read() # Should we read it chunck by chunck or ensure that the file size of the library content is reasonnable before reading ? - if error_msg is not None: + try: + StoredLibrary.store_library_content(content) + except ValueError as e: + logger.error("Failed to store library content", error=e) return HttpResponse( - json.dumps({"error": error_msg}), + json.dumps({"error": "Failed to store library content"}), status=HTTP_422_UNPROCESSABLE_ENTITY, ) return HttpResponse(json.dumps({}), status=HTTP_200_OK) except IntegrityError: return HttpResponse( - json.dumps({"error": "libraryAlreadyImportedError"}), + json.dumps({"error": "libraryAlreadyLoadedError"}), status=HTTP_400_BAD_REQUEST, ) except yaml.YAMLError: @@ -156,3 +183,105 @@ def upload_library(self, request): json.dumps({"error": "invalidLibraryFileError"}), status=HTTP_400_BAD_REQUEST, ) + + +class LoadedLibraryViewSet(viewsets.ModelViewSet): + # serializer_class = LoadedLibrarySerializer + # parser_classes = [FileUploadParser] + + # solve issue with URN containing dot, see https://stackoverflow.com/questions/27963899/django-rest-framework-using-dot-in-url + lookup_value_regex = r"[\w.:-]+" + model = LoadedLibrary + queryset = LoadedLibrary.objects.all() + + def list(self, request, *args, **kwargs): + if "view_storedlibrary" not in request.user.permissions: + return Response(status=HTTP_403_FORBIDDEN) + + loaded_libraries = [ + { + key: getattr(library, key) + for key in [ + "id", + "name", + "description", + "urn", + "ref_id", + "locale", + "version", + "packager", + "provider", + "builtin", + "objects_meta", + "reference_count", + ] + } + for library in LoadedLibrary.objects.all() + ] + return Response({"results": loaded_libraries}) + + def retrieve(self, request, *args, pk, **kwargs): + if "view_loadedlibrary" not in request.user.permissions: + return Response(status=HTTP_403_FORBIDDEN) + try: + key = "urn" if pk.startswith("urn:") else "id" + lib = LoadedLibrary.objects.get( + **{key: pk} + ) # There is no "locale" value involved in the fetch + we have to handle the exception if the pk urn doesn't exist + except: + return Response(data="Library not found.", status=HTTP_404_NOT_FOUND) + data = LoadedLibraryDetailedSerializer(lib).data + data["objects"] = lib._objects + return Response(data) + + def destroy(self, request, *args, pk, **kwargs): + if not RoleAssignment.is_access_allowed( + user=request.user, + perm=Permission.objects.get(codename="delete_loadedlibrary"), + folder=Folder.get_root_folder(), + ): + return Response(status=HTTP_403_FORBIDDEN) + + try: + key = "urn" if pk.startswith("urn:") else "id" + lib = LoadedLibrary.objects.get(**{key: pk}) + except: + return Response(data="Library not found.", status=HTTP_404_NOT_FOUND) + + if lib.reference_count != 0: + return Response( + data="Library cannot be deleted because it has references.", + status=HTTP_400_BAD_REQUEST, + ) + + lib.delete() + return Response(status=HTTP_204_NO_CONTENT) + + @action(detail=True, methods=["get"]) + def content(self, request, pk): + try: + key = "urn" if pk.startswith("urn:") else "id" + lib = LoadedLibrary.objects.get(**{key: pk}) + except: + return Response("Library not found.", status=HTTP_404_NOT_FOUND) + return Response(lib._objects) + + @action(detail=True, methods=["get"]) + def tree( + self, request, pk + ): # We must ensure that users that are not allowed to read the content of libraries can't have any access to them either from the /api/{URLModel/{library_urn}/tree view or the /api/{URLModel}/{library_urn} view. + try: + key = "urn" if pk.startswith("urn:") else "id" + lib = LoadedLibrary.objects.get(**{key: pk}) + except: + return Response(data="Library not found.", status=HTTP_404_NOT_FOUND) + + if lib.frameworks.count() == 0: + return Response( + data="This library doesn't contain any framework.", + status=HTTP_404_NOT_FOUND, + ) + + framework = lib.frameworks.first() + requirement_nodes = framework.requirement_nodes.all() + return Response(get_sorted_requirement_nodes(requirement_nodes, None)) diff --git a/backend/serdes/forms.py b/backend/serdes/forms.py deleted file mode 100644 index 37adbc94a..000000000 --- a/backend/serdes/forms.py +++ /dev/null @@ -1,17 +0,0 @@ -from typing import Any, Dict -from django import forms -from django.utils.translation import gettext_lazy as _ - - -class UploadFileForm(forms.Form): - file = forms.FileField(required=True, label=_("Select a file")) - - def clean(self) -> Dict[str, Any]: - cleaned_data = super().clean() - file = cleaned_data.get("file") - - if file: - if not file.name.endswith(".json"): - self.add_error("file", _("File must be a JSON file.")) - - return file diff --git a/documentation/architecture/data-model.md b/documentation/architecture/data-model.md index d6e6787dc..6ff4375cb 100644 --- a/documentation/architecture/data-model.md +++ b/documentation/architecture/data-model.md @@ -35,7 +35,8 @@ erDiagram DOMAIN ||--o{ COMPLIANCE_ASSESSMENT_REVIEW: contains ROOT_FOLDER ||--o{ FRAMEWORK : contains ROOT_FOLDER ||--o{ REFERENCE_CONTROL : contains - ROOT_FOLDER ||--o{ LIBRARY : contains + ROOT_FOLDER ||--o{ STORED_LIBRARY : contains + ROOT_FOLDER ||--o{ LOADED_LIBRARY : contains ROOT_FOLDER ||--o{ USER : contains ROOT_FOLDER ||--o{ USER_GROUP : contains ROOT_FOLDER ||--o{ ROLE : contains @@ -58,12 +59,12 @@ erDiagram ```mermaid erDiagram - LIBRARY |o--o{ REFERENCE_CONTROL: contains - LIBRARY |o--o{ THREAT : contains - LIBRARY ||--o{ FRAMEWORK : contains - LIBRARY ||--o{ RISK_MATRIX : contains - LIBRARY ||--o{ MAPPING : contains - LIBRARY2 }o--o{ LIBRARY : depends_on + LOADED_LIBRARY |o--o{ REFERENCE_CONTROL: contains + LOADED_LIBRARY |o--o{ THREAT : contains + LOADED_LIBRARY ||--o{ FRAMEWORK : contains + LOADED_LIBRARY ||--o{ RISK_MATRIX : contains + LOADED_LIBRARY ||--o{ MAPPING : contains + LOADED_LIBRARY2 }o--o{ LOADED_LIBRARY : depends_on ``` ### General data model @@ -419,13 +420,15 @@ NameDescriptionMixin <|-- RiskScenario AbstractBaseModel <|-- NameDescriptionMixin NameDescriptionMixin <|-- ReferentialObjectMixin FolderMixin <|-- ReferentialObjectMixin -ReferentialObjectMixin <|-- Library ReferentialObjectMixin <|-- Threat ReferentialObjectMixin <|-- ReferenceControl ReferentialObjectMixin <|-- RiskMatrix ReferentialObjectMixin <|-- Framework ReferentialObjectMixin <|-- RequirementNode ReferentialObjectMixin <|-- Mapping +ReferentialObjectMixin <|-- LibraryMixin +LibraryMixin <|-- StoredLibrary +LibraryMixin <|-- LoadedLibrary NameDescriptionMixin <|-- Assessment FolderMixin <|-- Project NameDescriptionMixin <|-- Project @@ -455,23 +458,35 @@ namespace ReferentialObjects { +display_long() str } - class Library { + class LibraryMixin { +CharField copyright +IntegerField version +CharField provider +CharField packager - +Library[] dependencies + +JsonField dependencies + +BooleanField builtin + +JSONField objects_meta + } + + class StoredLibrary { + +BooleanField is_loaded + +CharField hash_checksum + +TextField content + } + + class LoadedLibrary { + +LoadedLibrary[] dependencies +reference_count() int } class Threat { - +Library library + +LoadedLibrary library +is_deletable() bool +frameworks() Framework[] } class ReferenceControl { - +Library library + +LoadedLibrary library +CharField category +JSONField typical_evidence +is_deletable() bool @@ -479,7 +494,7 @@ namespace ReferentialObjects { } class RiskMatrix { - +Library library + +LoadedLibrary library +JSONField json_definition +BooleanField is_enabled +CharField provider @@ -492,7 +507,7 @@ namespace ReferentialObjects { } class Framework { - +Library library + +LoadedLibrary library +int get_next_order_id(obj_type, _parent_urn) +is_deletable() bool } diff --git a/frontend/messages/en.json b/frontend/messages/en.json index 27a31c89d..494babc2f 100644 --- a/frontend/messages/en.json +++ b/frontend/messages/en.json @@ -167,9 +167,9 @@ "active": "Active", "inactive": "Inactive", "watchlist": "Watch list", - "watchlistDescription": "Items that have expired or with close ETA", + "watchlistDescription": "Items that have expired or will expire in the next 30 days", "measuresToReview": "Applied controls to review", - "exceptionsToReview": "Exceptions to review", + "exceptionsToReview": "Acceptances to review", "expired": "Expired", "upcoming": "Upcoming", "today": "Today", @@ -187,7 +187,7 @@ "exportButton": "Export", "treatmentProgressOverview": "Treatment progress overview", "pendingMeasures": "Your pending applied controls", - "orderdByRankingScore": "Ordered by ranking score", + "orderdByRankingScore": "Over the next 30 days and ordered by ranking score", "rankingScore": "Ranking score", "noPendingAppliedControl": "No pending applied control", "rankingScoreDefintion": "Ranking score is an adaptive metric that combines the information of effort and current risk level, and crosses it with the other data to assist you for the prioritization", @@ -335,21 +335,22 @@ "lossOfAccountabilityChoice2": "Possibly traceable", "lossOfAccountabilityChoice3": "Completely anonymous", "ignore": "Ignore", - "importedLibraries": "Imported libraries", + "loadedLibraries": "Loaded libraries", "librariesStore": "Libraries store", - "currentlyNoImportedLibraries": "You currently have no imported libraries", + "currentlyNoLoadedLibraries": "You currently have no loaded libraries", "loadingLibraryUploadButton": "Loading the library upload button", "errorOccuredWhileLoadingLibrary": "The following error occurred while loading the library form", "packager": "Packager", "dependencies": "Dependencies", "copyright": "Copyright", - "uploadYourLibrary": "Upload your own library", + "addYourLibrary": "Add your own library", "libraryFileInYaml": "Library file in YAML format", "importBackup": "Import backup", "exportBackup": "Export backup", "confirmImportBackup": "Are you sure you want to import this backup? This will overwrite all existing data.", "exportDatabase": "Export database", "upload": "Upload", + "add": "Add", "undefined": "--", "production": "Production", "design": "Design", @@ -458,6 +459,7 @@ "successfullyUpdatedObject": "The {object} object: {name} has been successfully updated", "successfullySavedObject": "The {object} object has been successfully saved", "successfullyDeletedObject": "The {object} object has been successfully deleted", + "successfullyDeletedLibrary": "The library has been successfully deleted", "successfullyCreatedUser": "User successfully created. An email was sent to set the password.", "successfullyUpdatedUser": "The user: {email} has been successfully updated", "successfullyValidatedObject": "The {object} object has been successfully validated", @@ -466,7 +468,7 @@ "successfullyImportedObject": "The {object} object has been successfully imported", "anErrorOccurred": "An error has occurred", "attachmentDeleted": "The attachment has been successfully deleted", - "librarySuccessfullyImported": "The library has been successfully imported", + "librarySuccessfullyLoaded": "The library has been successfully loaded", "noLibraryDetected": "No library detected", "errorImportingLibrary": "Error importing library", "passwordSuccessfullyChanged": "Your password has been successfully changed", @@ -493,7 +495,7 @@ "mediumSOK": "The strength of the knowledge supporting the assessment is medium", "highSOK": "The strength of the knowledge supporting the assessment is high", "libraryImportError": "An error occurred during the importation of your library.", - "libraryAlreadyImportedError": "This library has already been imported.", + "libraryAlreadyLoadedError": "This library has already been loaded.", "invalidLibraryFileError": "Invalid library file. Please make sure the format is correct.", "taintedFormMessage": "Do you want to leave this page? Changes you made may not be saved.", "riskScenariosStatus": "Risk scenarios status", @@ -513,5 +515,14 @@ "userWillBeDisconnected": "The user will be disconnected and will need to log in again", "scoresDefinition": "Scores definition", "selectedImplementationGroups": "Selected implementation groups", - "implementationGroupsDefinition": "Implementation groups definition" + "implementationGroupsDefinition": "Implementation groups definition", + "threatRadarChart": "Threat radar", + "noThreatsMapped": "No threats mapped. Consider attaching threats to your risk scenarios for a better overview.", + "actionPlan": "Action plan", + "noStatus": "No status", + "actionPlanHelpText": "Separated by status and sorted by eta", + "matchingRequirements": "Matching requirements", + "asZIP": "as ZIP", + "incoming": "Incoming", + "outdated": "Outdated" } diff --git a/frontend/messages/fr.json b/frontend/messages/fr.json index 3a51e832e..761dcf9df 100644 --- a/frontend/messages/fr.json +++ b/frontend/messages/fr.json @@ -164,12 +164,12 @@ "currentRisk": "Risque courant", "residualRisk": "Risque résiduel", "planned": "Planifié", - "active": "Active", - "inactive": "Inactive", + "active": "Actif", + "inactive": "Inactif", "watchlist": "Liste de surveillance", - "watchlistDescription": "Objets expirés ou expirant bientôt", + "watchlistDescription": "Objets qui ont expiré ou expireront dans les 30 prochains jours", "measuresToReview": "Mesures à revoir", - "exceptionsToReview": "Exceptions à revoir", + "exceptionsToReview": "Acceptations à revoir", "expired": "Expiré", "upcoming": "À venir", "today": "Aujourd'hui", @@ -187,7 +187,7 @@ "exportButton": "Exporter", "treatmentProgressOverview": "Vue d'ensemble de l'avancement du traitement", "pendingMeasures": "Vos mesures en attente", - "orderdByRankingScore": "Classées par score", + "orderdByRankingScore": "Au cours des 30 prochains jours et classés par score de classement", "rankingScore": "Score de classement", "noPendingAppliedControl": "Aucune mesure appliquée en attente", "rankingScoreDefintion": "Le score de classement est une mesure adaptative qui combine les informations relatives à l'effort et au niveau de risque courant, et les croise avec d'autres données pour vous aider à établir des priorités", @@ -335,21 +335,22 @@ "lossOfAccountabilityChoice2": "Peut-être traçable", "lossOfAccountabilityChoice3": "Complètement anonyme", "ignore": "Ignorer", - "importedLibraries": "Bibliothèques importées", + "loadedLibraries": "Bibliothèques chargées", "librariesStore": "Magasin de bibliothèques", - "currentlyNoImportedLibraries": "Vous n'avez actuellement aucune bibliothèque importée", + "currentlyNoLoadedLibraries": "Vous n'avez actuellement aucune bibliothèque chargée", "loadingLibraryUploadButton": "Chargement du bouton de téléchargement de la bibliothèque", "errorOccuredWhileLoadingLibrary": "L'erreur suivante s'est produite lors du chargement du formulaire de bibliothèque", "packager": "Éditeur", "dependencies": "Dépendances", "copyright": "Copyright", - "uploadYourLibrary": "Téléchargez votre propre bibliothèque", + "addYourLibrary": "Ajouter votre propre bibliothèque", "libraryFileInYaml": "Fichier de librairie en format YAML", "importBackup": "Importer une sauvegarde", "exportBackup": "Exporter une sauvegarde", "confirmImportBackup": "Êtes-vous sûr de vouloir importer cette sauvegarde ? Cela écrasera toutes les données existantes.", "exportDatabase": "Exporter la base de données", "upload": "Télécharger", + "add": "Ajouter", "undefined": "--", "production": "Production", "design": "Conception", @@ -458,6 +459,7 @@ "successfullyUpdatedObject": "L'objet {object}: {name} a été mis à jour avec succès", "successfullySavedObject": "L'objet {object} a été enregistré avec succès", "successfullyDeletedObject": "L'objet {object} a été supprimé avec succès", + "successfullyDeletedLibrary": "La librairie a été supprimée avec succès", "successfullyCreatedUser": "Utilisateur créé avec succès. Un email a été envoyé pour définir le mot de passe.", "successfullyUpdatedUser": "L'utilisateur: {email} a été mis à jour avec succès", "successfullyValidatedObject": "L'objet {object} a été validé avec succès", @@ -466,7 +468,7 @@ "successfullyImportedObject": "L'objet {object} a été importé avec succès", "anErrorOccurred": "Une erreur est survenue", "attachmentDeleted": "La pièce jointe a été supprimée avec succès", - "librarySuccessfullyImported": "La bibliothèque a été importée avec succès", + "librarySuccessfullyLoaded": "La bibliothèque a été chargée avec succès", "noLibraryDetected": "Aucune bibliothèque détectée", "errorImportingLibrary": "Erreur lors de l'importation de la bibliothèque", "passwordSuccessfullyChanged": "Votre mot de passe a été changé avec succès", @@ -493,7 +495,7 @@ "mediumSOK": "La force des connaissances à l’appui de l’évaluation est moyenne", "highSOK": "La force des connaissances à l’appui de l’évaluation est élevée", "libraryImportError": "Une erreur a été détectée durant l'importation de votre librairie.", - "libraryAlreadyImportedError": "Cette librairie a été déjà été importée.", + "libraryAlreadyLoadedError": "Cette librairie a été déjà été chargée.", "invalidLibraryFileError": "Fichier de bibliothèque invalide. Veuillez vérifier le format du fichier.", "taintedFormMessage": "Voulez-vous vraiment quitter cette page ? Toutes les données non enregistrées seront perdues.", "riskScenariosStatus": "Statut des scénarios de risque", @@ -513,5 +515,14 @@ "userWillBeDisconnected": "L'utilisateur sera déconnecté et devra se reconnecter", "scoresDefinition": "Définition des scores", "selectedImplementationGroups": "Groupes d'implémentation sélectionnés", - "implementationGroupsDefinition": "Définition des groupes d'implémentation" + "implementationGroupsDefinition": "Définition des groupes d'implémentation", + "threatRadarChart": "Radar des menaces", + "noThreatsMapped": "Aucune menace n'a été attachée. Pensez à lier les menaces à vos scénarios de risque pour une meilleure visibilité.", + "actionPlan": "Plan d'action", + "noStatus": "Pas de statut", + "actionPlanHelpText": "Séparé par statut et trié par eta", + "matchingRequirements": "Exigences associées", + "asZIP": "en ZIP", + "incoming": "En approche", + "outdated": "Dépassé" } diff --git a/frontend/messages/pt.json b/frontend/messages/pt.json index 2686372fc..d3fae1ab3 100644 --- a/frontend/messages/pt.json +++ b/frontend/messages/pt.json @@ -167,9 +167,9 @@ "active": "Ativo", "inactive": "Inativo", "watchlist": "Lista de observação", - "watchlistDescription": "Itens que expiraram ou estão próximos do ETA", + "watchlistDescription": "Itens que expiraram ou irão expirar nos próximos 30 dias", "measuresToReview": "Controles aplicados para revisão", - "exceptionsToReview": "Exceções para revisão", + "exceptionsToReview": "Aceitações para revisão", "expired": "Expirado", "upcoming": "Próximo", "today": "Hoje", @@ -187,7 +187,7 @@ "exportButton": "Exportar", "treatmentProgressOverview": "Visão geral do progresso do tratamento", "pendingMeasures": "Seus controles aplicados pendentes", - "orderdByRankingScore": "Ordenado por pontuação de classificação", + "orderdByRankingScore": "Nos próximos 30 dias e ordenados por pontuação de classificação", "rankingScore": "Pontuação de classificação", "noPendingAppliedControl": "Nenhum controle aplicado pendente", "rankingScoreDefintion": "A pontuação de classificação é uma métrica adaptativa que combina informações de esforço e nível de risco atual, cruzando-as com outros dados para auxiliá-lo na priorização", @@ -335,21 +335,22 @@ "lossOfAccountabilityChoice2": "Possivelmente rastreável", "lossOfAccountabilityChoice3": "Completamente anônimo", "ignore": "Ignorar", - "importedLibraries": "Bibliotecas importadas", + "loadedLibraries": "Bibliotecas carregadas", "librariesStore": "Loja de bibliotecas", - "currentlyNoImportedLibraries": "Atualmente, você não possui bibliotecas importadas", + "currentlyNoLoadedLibraries": "Atualmente, você não possui bibliotecas carregadas", "loadingLibraryUploadButton": "Carregando o botão de upload de biblioteca", "errorOccuredWhileLoadingLibrary": "O seguinte erro ocorreu ao carregar o formulário da biblioteca", "packager": "Empacotador", "dependencies": "Dependências", "copyright": "Direitos autorais", - "uploadYourLibrary": "Carregue sua própria biblioteca", + "addYourLibrary": "Adicione sua própria biblioteca", "libraryFileInYaml": "Arquivo de biblioteca no formato YAML", "importBackup": "Importar backup", "exportBackup": "Exportar backup", "confirmImportBackup": "Você tem certeza de que deseja importar este backup? Isso substituirá todos os dados existentes.", "exportDatabase": "Exportar banco de dados", "upload": "Carregar", + "add": "Adicionar", "undefined": "--", "production": "Produção", "design": "Design", @@ -458,6 +459,7 @@ "successfullyUpdatedObject": "O objeto {object}: {name} foi atualizado com sucesso", "successfullySavedObject": "O objeto {object} foi salvo com sucesso", "successfullyDeletedObject": "O objeto {object} foi excluído com sucesso", + "successfullyDeletedLibrary": "A biblioteca foi excluída com sucesso", "successfullyCreatedUser": "Usuário criado com sucesso. Um e-mail foi enviado para definir a senha.", "successfullyUpdatedUser": "O usuário: {email} foi atualizado com sucesso", "successfullyValidatedObject": "O objeto {object} foi validado com sucesso", @@ -466,7 +468,7 @@ "successfullyImportedObject": "O objeto {object} foi importado com sucesso", "anErrorOccurred": "Ocorreu um erro", "attachmentDeleted": "O anexo foi excluído com sucesso", - "librarySuccessfullyImported": "A biblioteca foi importada com sucesso", + "librarySuccessfullyLoaded": "A biblioteca foi carregada com sucesso", "noLibraryDetected": "Nenhuma biblioteca detectada", "errorImportingLibrary": "Erro ao importar a biblioteca", "passwordSuccessfullyChanged": "Sua senha foi alterada com sucesso", @@ -493,7 +495,7 @@ "mediumSOK": "A força do conhecimento que sustenta a avaliação é média", "highSOK": "A força do conhecimento que sustenta a avaliação é alta", "libraryImportError": "Ocorreu um erro durante a importação da sua biblioteca.", - "libraryAlreadyImportedError": "Esta biblioteca já foi importada.", + "libraryAlreadyLoadedError": "Esta biblioteca já foi carregada.", "invalidLibraryFileError": "Arquivo de biblioteca inválido. Certifique-se de que o formato está correto.", "taintedFormMessage": "Você deseja sair desta página? As alterações que você fez podem não ser salvas.", "riskScenariosStatus": "Status dos cenários de risco", @@ -513,5 +515,14 @@ "userWillBeDisconnected": "O usuário será desconectado e precisará fazer login novamente", "scoresDefinition": "Definição de pontuações", "selectedImplementationGroups": "Grupos de implementação selecionados", - "implementationGroupsDefinition": "Definição de grupos de implementação" + "implementationGroupsDefinition": "Definição de grupos de implementação", + "threatRadarChart": "Radar de ameaças", + "noThreatsMapped": "Nenhuma ameaça mapeada. Considere anexar ameaças aos seus cenários de risco para ter uma visão geral melhor.", + "actionPlan": "Plano de ação", + "noStatus": "Sem status", + "actionPlanHelpText": "Separados por status e classificados por eta", + "matchingRequirements": "Requisitos correspondentes", + "asZIP": "em ZIP", + "incoming": "aproximação", + "outdated": "Desatualizado" } diff --git a/frontend/src/lib/components/Chart/RadarChart.svelte b/frontend/src/lib/components/Chart/RadarChart.svelte new file mode 100644 index 000000000..1c3075c41 --- /dev/null +++ b/frontend/src/lib/components/Chart/RadarChart.svelte @@ -0,0 +1,73 @@ + + +
diff --git a/frontend/src/lib/components/Forms/Form.svelte b/frontend/src/lib/components/Forms/Form.svelte index 23c5fdad0..a255c0ff0 100644 --- a/frontend/src/lib/components/Forms/Form.svelte +++ b/frontend/src/lib/components/Forms/Form.svelte @@ -21,6 +21,8 @@ export let onSubmit = (submit_data: any) => {}; export let taintedMessage: string | null = m.taintedFormMessage(); + export let useFocusTrap = true; + export let debug = false; // set to true to enable SuperDebug component function handleFormUpdated({ form, closeModal }: { form: any; closeModal: boolean }) { @@ -48,7 +50,7 @@ {/if} -
+ {#if $errors._errors} {#each $errors._errors as error}

{error}

diff --git a/frontend/src/lib/components/ModelTable/LibraryActions.svelte b/frontend/src/lib/components/ModelTable/LibraryActions.svelte index b85402d12..3ffd5659b 100644 --- a/frontend/src/lib/components/ModelTable/LibraryActions.svelte +++ b/frontend/src/lib/components/ModelTable/LibraryActions.svelte @@ -24,7 +24,8 @@ } -{#if !library.id}{#if loading.form && loading.library === library.urn} +{#if Object.hasOwn(library, 'is_loaded') && !library.is_loaded} + {#if loading.form && loading.library === library.urn}
@@ -180,7 +185,7 @@
{m.name()} {m.description()}{m.type()}{m.category()} {m.referenceControl()} {m.eta()} {m.effort()}M.{index + 1} {measure.name ?? '--'} {measure.description ?? '--'}{measure.type ?? '--'}{measure.category ?? '--'} {measure.reference_control ? measure.reference_control.str : '--'}{measure.status} + >{measure.status ?? '--'}