22 lines
3.6 KiB
Markdown
22 lines
3.6 KiB
Markdown
# WRNexusJS Security Control Map — OWASP ASVS 5.0.0
|
|
|
|
This is a framework-control map, not an ASVS certification of applications built with WRNexusJS. Application authorization, business logic, deployment, infrastructure, and operational controls must still be verified for each deployment.
|
|
|
|
The canonical requirement identifiers come from the [OWASP ASVS 5.0.0 release](https://github.com/OWASP/ASVS/tree/v5.0.0/5.0). Run `bun run security:asvs` to verify that this governed map and its evidence files remain present, and run `wrnexus security audit`, `wrnexus security headers`, and `wrnexus security test` for an application-level baseline.
|
|
|
|
| Framework control | ASVS 5.0.0 requirements | Implementation evidence | Verification evidence |
|
|
| ---------------------------------------------------------------- | ---------------------------------------------- | ---------------------------------------- | ---------------------------------------------- |
|
|
| Contextual HTML, attribute, JavaScript, and JSON output encoding | `v5.0.0-1.1.2`, `v5.0.0-1.2.1`, `v5.0.0-1.2.3` | `packages/compiler/src/codegen.ts` | `packages/compiler/test/compiler.test.ts` |
|
|
| Parameterized database operations | `v5.0.0-1.2.4` | `packages/db/src/query.ts` | `packages/db/test/bunsql-placeholders.test.ts` |
|
|
| SSRF allowlists and private-network blocking | `v5.0.0-1.3.6` | `packages/security/src/url.ts` | `packages/security/test/security.test.ts` |
|
|
| Secure, HttpOnly, SameSite cookie defaults | `v5.0.0-3.3.1`, `v5.0.0-3.3.2`, `v5.0.0-3.3.4` | `packages/security/src/cookies.ts` | `packages/security/test/security.test.ts` |
|
|
| HSTS and restrictive response headers | `v5.0.0-3.4.1` | `packages/core/src/headers.ts` | `packages/core/test/headers.test.ts` |
|
|
| Explicit CORS origins | `v5.0.0-3.4.2` | `packages/core/src/headers.ts` | `packages/core/test/headers.test.ts` |
|
|
| CSP frame protection and per-response nonces | `v5.0.0-3.4.6` | `packages/core/src/headers.ts` | `packages/core/test/headers.test.ts` |
|
|
| CSRF tokens for unsafe requests | `v5.0.0-3.5.1` | `packages/core/src/csrf.ts` | `packages/core/test/csrf.test.ts` |
|
|
| External redirect allowlists | `v5.0.0-3.7.2` | `packages/security/src/url.ts` | `packages/security/test/security.test.ts` |
|
|
| Secret masking in diagnostics and logs | `v5.0.0-16.2.5` | `packages/security/src/serialization.ts` | `packages/security/test/security.test.ts` |
|
|
| Authentication and authorization security events | `v5.0.0-16.3.1`, `v5.0.0-16.3.2` | `packages/auth/src/engine.ts` | `packages/auth/test/engine.test.ts` |
|
|
|
|
Controls including tenant policy, API-key lifecycle, malware-engine integration, and application-specific authorization remain application/deployment responsibilities. The CLI reports framework defaults and detectable unsafe configuration; it does not claim full ASVS conformance.
|