Pular para conteúdo

AUR-015: Versionar standard de secure code review

Documento histórico do board. Pode descrever componentes removidos; para uso atual, consulte o guia do produto.

This is a research/standard card. It does not ship an executable feature; it fixes the secure-code-review contract later security-office cards run against. The observable behavior is the acceptance lint itself: tests/acceptance/AUR-015.sh deterministically resolves the artifacts below and either passes or names exactly which one is incomplete.

Behavior

tests/acceptance/AUR-015.sh (selector AC-001) reads four artifacts this card owns and checks that they resolve to one consistent, testable crosswalk, without making any network request:

  1. .board/research/secure-code-review.md — the source-selection record and the working definitions of threat, trust boundary, and fail closed. AC-001 requires the four literal terms OWASP, threat, trust boundary, and fail closed to appear, case-insensitive, and this is the exact failure the card's Given/When/Then pins: missing any one of them prints AUR-015/AC-001: missing <term> and exits 1 before any other check runs.
  2. standards/security-review/rules.md — a ## Rules section containing exactly nine ### Rule: <ID> — <title> blocks, one per CR-* control this project already defines in .board/research/code-review-standards.md (CR-EVD-001–003, CR-REV-001–005, CR-GATE-001). Each block names an OWASP Top 10 category, a CWE identifier, and a NIST SSDF practice — each as a [label](url) | version <v> | <YYYY-MM-DD> citation — plus the bound control, a one-line trust-boundary statement, and a vulnerable and a fixed fixture path.
  3. tests/specs/AUR-015/rule-ids.txt and tests/specs/AUR-015/allowed-source-domains.txt — the single source of truth for, respectively, the nine rule IDs rules.md must resolve and the source hostnames an OWASP/CWE/NIST SSDF citation may cite.
  4. tests/specs/AUR-015/<rule-id>/vulnerable.md and tests/specs/AUR-015/<rule-id>/fixed.md — one pair per rule, each carrying a Fixture: VULNERABLE or Fixture: FIXED marker line; the lint refuses a pair that is missing, empty, mismarked, or byte-identical to its counterpart.

Contract

  • A rule's OWASP/CWE/NIST SSDF citation must resolve to an http(s) URL whose host is listed in tests/specs/AUR-015/allowed-source-domains.txt, a version matching [0-9]+(\.[0-9]+){0,2}, and an ISO-8601 date (YYYY-MM-DD). A missing, unversioned, undated, or non-allowlisted citation fails with the same typed code: AUR-015/AC-001/undecided-rule.
  • A rule's Control: line must match CR-(EVD|REV|GATE)-[0-9]{3} and no two rules may bind the same control; every one of the nine controls the card declares must be bound by exactly one rule.
  • A rule's CWE citation must resolve a numeric CWE-<n> identifier from its label text, independent of the URL.
  • Every rule ID in rules.md must be exactly one of the nine names in tests/specs/AUR-015/rule-ids.txt; a rule outside that set, a duplicate rule ID, or a rule-ids fixture that resolves to anything other than exactly nine names all fail with AUR-015/AC-001/undecided-rule (a corrupted or emptied fixture list is AUR-015/AC-001/behavior-missing, since the fixture is this card's own deliverable, not an external dependency).
  • This card produces no scanner, no CLI surface, and does not scan AurumCode's own source for the weaknesses it catalogs; that belongs to dependent security-office cards.

Standard

standards/security-review/rules.md fixes the nine-rule crosswalk this project enforces during secure code review; .board/research/secure-code-review.md fixes which three frameworks (OWASP Top 10, CWE, NIST SSDF) were selected over three rejected alternatives (ISO/IEC 27034, the SANS/CWE Top 25, and BSIMM) and why. Both are within this card's owned paths and are versioned together.

Example (no secret)

Running the acceptance test directly, with no network access and no secret material of any kind:

$ ./.board/bin/oci-run --profile bootstrap-readonly-v1 --card AUR-015
{"card":"AUR-015","scenario":"AC-001","selector":"AC-001","rules":9,"result":"pass"}

A failing example — the baseline research document missing one of the four required terms:

$ tests/acceptance/AUR-015.sh
AUR-015/AC-001: missing trust boundary

A failing example — a rule's CWE citation loses its control binding:

$ tests/acceptance/AUR-015.sh
AUR-015/AC-001/undecided-rule: SCR-001: control is missing or not a CR-<FAMILY>-<NNN> id:

Diagnosis

  • AUR-015/AC-001: missing <term> — .board/research/secure-code-review.md is missing one of OWASP, threat, trust boundary, or fail closed, case-insensitive. Restore the term.
  • AUR-015/AC-001/behavior-missing: required artifact absent: <path> — one of the four card-owned artifacts (the research file, rules.md, or a tests/specs/AUR-015/* fixture) is missing, empty, or a symlink. Restore it from the card's owned paths.
  • AUR-015/AC-001/undecided-rule: rule id not in tests/specs/AUR-015/rule-ids.txt: <id> — rules.md names a rule ID outside the fixed nine-ID set. Either fix the ID or add it to rule-ids.txt and give it a rule block.
  • AUR-015/AC-001/undecided-rule: <id>: <label> source host is not allowlisted: <host> — a citation's URL host is not in allowed-source-domains.txt. Fix the citation or extend the allowlist with a reviewed change.
  • AUR-015/AC-001/undecided-rule: <id>: <label> has no versioned source: <v> or ... source date is not ISO 8601: <date> — the cited version or date is missing or malformed. Fix the citation.
  • AUR-015/AC-001/undecided-rule: <id>: control is missing or not a CR-<FAMILY>-<NNN> id: <value> or ... control already bound to another rule: <control> or expected control has no bound rule: <control> — the rule's control binding is missing, malformed, duplicated, or the nine-control coverage is incomplete. Fix the Control: line.
  • AUR-015/AC-001/undecided-rule: <id>: fixture absent: <path>, ... is empty: <path>, ... is missing its 'Fixture: <MARKER>' marker: <path>, or ... vulnerable and fixed fixtures are byte-identical: <path> — the named rule's fixture pair under tests/specs/AUR-015/<id>/ is missing, empty, mismarked, or not actually distinguishable. Fix the fixture pair.
  • AUR-015/AC-001/infrastructure: ... — a required host tool is missing or the repository root could not be resolved; this is never a behavioral result and never counts as RED evidence for this card.

Integration

tests/integration/AUR-015_test.go::TestAUR015Boundary is a Test-prefixed Go function, discoverable and run by the ordinary go test ./... suite with no external dispatcher. It re-derives, from the source files themselves (never from tests/acceptance/AUR-015.sh's own output), the same structural contract AC-001 enforces: the four required terms in the research baseline, the nine ### Rule: blocks in rules.md each resolving a versioned, dated, allowlisted OWASP/CWE/NIST SSDF citation and exactly one of the nine expected CR-* controls, and every rule's vulnerable/fixed fixture pair existing, marked, and mutually distinguishable. If any card-owned artifact disappears, or rules.md/the crosswalk loses a rule, a citation, or a control binding, this test fails closed independently of the acceptance container.

This resolves the tests/integration/AUR-015.go::IntegrationAUR015 path the card originally declared, which the same structural defect AUR-020's first two rounds hit: a .go file without a _test.go suffix is invisible to go test's file scanner, so no function inside it is ever discovered or run. .board/cards/ready/AUR-015.md was bumped to version 2 (mirroring AUR-020's own version-2 bump) to rename the declared path to tests/integration/AUR-015_test.go::TestAUR015Boundary, which this file now implements.