Skip to content

Add OpenCRE as a map analysis resource#825

Open
Bornunique911 wants to merge 5 commits intoOWASP:mainfrom
Bornunique911:feature/issue-469-opencre-mapanalysis
Open

Add OpenCRE as a map analysis resource#825
Bornunique911 wants to merge 5 commits intoOWASP:mainfrom
Bornunique911:feature/issue-469-opencre-mapanalysis

Conversation

@Bornunique911
Copy link
Copy Markdown

@Bornunique911 Bornunique911 commented Mar 25, 2026

Summary

Closes #469.

Issue #469 asks to add OpenCRE itself as an option in Map Analysis so users can get views such as OpenCRE <-> SAMM.

This PR implements that by adding OpenCRE as a selectable map-analysis resource and handling OpenCRE comparisons through a dedicated direct-link backend path.

What this PR adds

When one of the selected standards is OpenCRE, the backend now:

  • includes OpenCRE in /rest/v1/standards
  • resolves the comparison through OpenCRE’s direct mappings
  • returns results in the existing map-analysis response structure
  • preserves the selected left side as the grouping side

This makes views such as:

  • OpenCRE -> SAMM
  • SAMM -> OpenCRE
  • CWE -> OpenCRE

available directly from Map Analysis.

Implementation choice

For OpenCRE comparisons, this PR uses only direct Linked To relationships from OpenCRE CREs to the selected standard nodes.

That means:

  • direct mappings are included
  • indirect / automatic mappings are excluded

This keeps the OpenCRE view focused on explicit mappings rather than broader inferred overlap.

Resulting behavior

Standard <-> OpenCRE now behaves like a direct mapping view:

  • Standard -> OpenCRE groups by the selected standard entries and shows their directly linked CREs
  • OpenCRE -> Standard groups by CREs and shows their directly linked standard entries

For example, a case like CWE-1004 returns the directly linked OpenCRE mapping rather than a broader automatically related set.

Hover compatibility

The current Map Analysis popup infers direction from the one-step path payload.

To keep this PR backend-only, the direct OpenCRE fast path includes a small compatibility adjustment in the returned one-step path shape so the existing hover renders correctly for Standard -> OpenCRE without changing generic gap-analysis behavior.

This compatibility shaping is limited to the OpenCRE direct-link path only.

Validation

Focused regression:

./venv/bin/python -m pytest application/tests/web_main_test.py -k 'supports_opencre_as_standard or returns_only_direct_opencre_mappings' -q

@Bornunique911 Bornunique911 force-pushed the feature/issue-469-opencre-mapanalysis branch from e1b626a to 545f2fe Compare March 26, 2026 18:17
@Bornunique911
Copy link
Copy Markdown
Author

Bornunique911 commented Mar 26, 2026

OpenCRE is now included as standards :

image

Comparison between ASVS and OpenCRE :

image

Comparison between CWE and OpenCRE :

Screenshot from 2026-03-27 22-55-03

Note: updated CWE and OpenCRE comparison screenshot after the fix

@robvanderveer
Copy link
Copy Markdown
Collaborator

It sort of looks okay, but I am afraid that CWE 1004 links to only one CRE, and not 8. So something's wrong.

@Bornunique911 Bornunique911 force-pushed the feature/issue-469-opencre-mapanalysis branch 4 times, most recently from 77b407e to eb8a5df Compare March 26, 2026 22:13
@Bornunique911 Bornunique911 marked this pull request as draft March 26, 2026 22:39
@Bornunique911 Bornunique911 force-pushed the feature/issue-469-opencre-mapanalysis branch 2 times, most recently from 074733f to c93ea2f Compare March 26, 2026 22:57
@Bornunique911 Bornunique911 marked this pull request as ready for review March 26, 2026 22:57
@Bornunique911 Bornunique911 force-pushed the feature/issue-469-opencre-mapanalysis branch 2 times, most recently from d03b5dc to a302369 Compare March 26, 2026 23:34
@Bornunique911 Bornunique911 marked this pull request as draft March 26, 2026 23:56
@Bornunique911 Bornunique911 force-pushed the feature/issue-469-opencre-mapanalysis branch 2 times, most recently from 2a51270 to 876f801 Compare March 27, 2026 08:35
@Bornunique911 Bornunique911 marked this pull request as ready for review March 27, 2026 17:26
@Bornunique911
Copy link
Copy Markdown
Author

Hi @robvanderveer, thanks for calling out for the issue.

The issue was in the fetch logic where were also including the indirect links, now I have fixed it to only match direct links. So in the screenshot now we have only 1 mapping for CWE 1004 in CRE.

I also noticed an issue in hover logic, for now I have handled it at backend side.

image

@Bornunique911 Bornunique911 force-pushed the feature/issue-469-opencre-mapanalysis branch from b30d13c to f62149a Compare March 28, 2026 14:44
@Pa04rth Pa04rth requested a review from northdpole March 29, 2026 08:37
@Pa04rth
Copy link
Copy Markdown
Collaborator

Pa04rth commented Mar 29, 2026

For me it looks Okay , will request @northdpole and @robvanderveer to review it too before merging.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add OpenCRE itself to mapanalysis

3 participants