8dfab4ba14
Ausfuehrbares Pruefpaket fuer Payment-Terminal-Systeme: 1. Semgrep-Regeln (25 Regeln in 5 Dateien): - Logging: Sensitive Daten, Tokens, Debug-Flags - Crypto: MD5/SHA1/DES/ECB, Hardcoded Secrets, Weak Random, TLS - API: Debug-Routes, Exception Leaks, IDOR, Input Validation - Config: Test-Endpoints, CORS, Cookies, Retry - Data: Telemetrie, Cache, Export, Queue, Testdaten 2. CodeQL Query-Specs (5 Briefings): - Sensitive Data → Logs - Sensitive Data → HTTP Response - Tenant Context Loss - Sensitive Data → Telemetry - Cache/Export Leak 3. State-Machine-Tests (10 Testfaelle): - 11 Zustaende, 15 Events, 8 Invarianten - Duplicate Response, Timeout+Late Success, Decline - Invalid Reversal, Cancel, Backend Timeout - Parallel Reversal, Unknown Response, Reconnect - Late Response after Cancel 4. Finding Schema (JSON Schema): - Einheitliches Format fuer alle Engines - control_id, engine, status, confidence, evidence, verdict_text Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
46 lines
1.4 KiB
JSON
46 lines
1.4 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"title": "Payment Compliance Finding",
|
|
"type": "object",
|
|
"required": ["control_id", "engine", "status", "confidence", "evidence", "verdict_text"],
|
|
"properties": {
|
|
"control_id": { "type": "string" },
|
|
"engine": {
|
|
"type": "string",
|
|
"enum": ["semgrep", "codeql", "contract_test", "state_machine_test", "integration_test", "manual"]
|
|
},
|
|
"status": {
|
|
"type": "string",
|
|
"enum": ["passed", "failed", "warning", "not_tested", "needs_manual_review"]
|
|
},
|
|
"confidence": { "type": "number", "minimum": 0, "maximum": 1 },
|
|
"severity": {
|
|
"type": "string",
|
|
"enum": ["low", "medium", "high", "critical"]
|
|
},
|
|
"evidence": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"file": { "type": "string" },
|
|
"line": { "type": "integer" },
|
|
"snippet_type": { "type": "string" },
|
|
"scenario": { "type": "string" },
|
|
"observed_state": { "type": "string" },
|
|
"expected_state": { "type": "string" },
|
|
"notes": { "type": "string" }
|
|
},
|
|
"additionalProperties": true
|
|
}
|
|
},
|
|
"mapped_requirements": {
|
|
"type": "array",
|
|
"items": { "type": "string" }
|
|
},
|
|
"verdict_text": { "type": "string" },
|
|
"next_action": { "type": "string" }
|
|
},
|
|
"additionalProperties": false
|
|
}
|