2170a58734
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
Export Center CI / export-ci (push) Has been cancelled
Findings Ledger CI / build-test (push) Has been cancelled
Findings Ledger CI / migration-validation (push) Has been cancelled
Findings Ledger CI / generate-manifest (push) Has been cancelled
Manifest Integrity / Validate Schema Integrity (push) Has been cancelled
Lighthouse CI / Lighthouse Audit (push) Has been cancelled
Lighthouse CI / Axe Accessibility Audit (push) Has been cancelled
Manifest Integrity / Validate Contract Documents (push) Has been cancelled
Manifest Integrity / Validate Pack Fixtures (push) Has been cancelled
Manifest Integrity / Audit SHA256SUMS Files (push) Has been cancelled
Manifest Integrity / Verify Merkle Roots (push) Has been cancelled
Policy Lint & Smoke / policy-lint (push) Has been cancelled
Policy Simulation / policy-simulate (push) Has been cancelled
- Implemented tests for Cryptographic Failures (A02) to ensure proper handling of sensitive data, secure algorithms, and key management. - Added tests for Security Misconfiguration (A05) to validate production configurations, security headers, CORS settings, and feature management. - Developed tests for Authentication Failures (A07) to enforce strong password policies, rate limiting, session management, and MFA support. - Created tests for Software and Data Integrity Failures (A08) to verify artifact signatures, SBOM integrity, attestation chains, and feed updates.
Security Testing Framework
This directory contains systematic security tests covering OWASP Top 10 vulnerabilities for StellaOps modules.
Structure
security/
├── StellaOps.Security.Tests/
│ ├── Infrastructure/ # Base classes and test utilities
│ ├── A01_BrokenAccessControl/ # Authorization bypass tests
│ ├── A02_CryptographicFailures/ # Crypto weakness tests
│ ├── A03_Injection/ # SQL, Command, ORM injection tests
│ ├── A05_SecurityMisconfiguration/ # Config validation tests
│ ├── A07_AuthenticationFailures/ # Auth bypass tests
│ ├── A08_IntegrityFailures/ # Data integrity tests
│ └── A10_SSRF/ # Server-side request forgery tests
└── README.md
OWASP Top 10 Coverage
| Rank | Category | Priority | Status |
|---|---|---|---|
| A01 | Broken Access Control | CRITICAL | ✓ |
| A02 | Cryptographic Failures | CRITICAL | ✓ |
| A03 | Injection | CRITICAL | ✓ |
| A05 | Security Misconfiguration | HIGH | ✓ |
| A07 | Authentication Failures | CRITICAL | ✓ |
| A08 | Integrity Failures | HIGH | ✓ |
| A10 | SSRF | HIGH | ✓ |
Running Tests
# Run all security tests
dotnet test tests/security/StellaOps.Security.Tests --filter "Category=Security"
# Run specific OWASP category
dotnet test --filter "FullyQualifiedName~A01_BrokenAccessControl"
# Run with detailed output
dotnet test tests/security/StellaOps.Security.Tests -v normal
Adding New Tests
- Create test class in appropriate category directory
- Inherit from
SecurityTestBase - Use
MaliciousPayloadsfor injection payloads - Use
SecurityAssertionsfor security-specific assertions
CI Integration
Security tests run as part of the CI pipeline:
- All PRs: Run critical security tests (A01, A02, A03, A07)
- Nightly: Full OWASP Top 10 coverage
- Pre-release: Full suite with extended fuzzing
References
- OWASP Top 10
- OWASP Testing Guide
- StellaOps Security Policy:
docs/13_SECURITY_POLICY.md