Replace Secvisogram with csaf-validator-lib #35

Open
Open
Replace Secvisogram with csaf-validator-lib#35

Description

@achrinza
achrinza
opened on Nov 8, 2022

Overview

Secvisogram is a project for a React-powered, web-based Common Security Advisory Framework Version 2.0 (CSAF 2.0) validator.

#5 / 17f860a added CSAF 2.0 validation with Secvisogram. When that change was merged, Secvisogram was bundled as a single solution, and the validation code was not distributed separately. Hence, we implemented a hacky solution to import the entire project and then to call only the validation logic. Notably, this includes:

  • Installing all of Secvisogram's depenencies
  • Re-constructing and executing relevant parts of Secvisogram's custom build pipeline

Since then, this validation code has been decoupled and Secvisogram has been updated to use the csaf-validator-lib Node.js module (BSI-Bund/secvisogram#39 / BSI-Bund/secvisogram@4487b6b).

Benefits of making the switch include:

  • A more stable interface for us to bootstrap and use the dependency.
  • Reduced build pipeline complexity
  • Removed need for frontend build pipeline knowledge
  • Reduced attack surface from unneeded web frontend packages.

Implementation remarks

The current approach involves:

  • git submodule-ing https://github.com/BSI-Bund/secvisogram.git
  • Installing Secvisogram's dependencies and calling Babel as part of the build pipeline
  • Manually copying some non-JavaScript resources to the distibution directory
  • Importing validation logic from dist/shared/Core

In contrast, the new approach would involve:

  • git submodule-ing https://github.com/secvisogram/csaf-validator-lib.git
    Although the csaf-validator-lib README indicates to use git subtree, git submodule is better for explicitly linking two Git repositories together. In contrast, git subtree copies the Git history without any coupling to the source Git repository.
  • Installing csaf-validator-lib's production dependencies

This switch would also bring in the latest features and validation tests such Test 6.3.8 ("Spell check", powered by the Hunspell spell checking library), of which the BSI-Bund Git repository is currently lacking.

Mitigating against NPM dependency confusion attacks

At time of writing, csaf-validator-lib is not published as an NPM package, hence the need to install this as a "local dependency". To mitigate against NPM dependency confusion attacks, it is important that the package.json dependency entry explicitly points to the local copy.

We can achieve this "explicit pointer" requirement by leveraging package aliases, which was introduced in

This issue is to track switching over to csaf-validator-lib

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
     blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

    Skip to content
    Replace Secvisogram with csaf-validator-lib #35
    Open
    Open
    Replace Secvisogram with csaf-validator-lib#35
    Description
    @achrinza
    achrinza
    opened on Nov 8, 2022
    Overview
    Secvisogram is a project for a React-powered, web-based Common Security Advisory Framework Version 2.0 (CSAF 2.0) validator.
    #5 / 17f860a added CSAF 2.0 validation with Secvisogram. When that change was merged, Secvisogram was bundled as a single solution, and the validation code was not distributed separately. Hence, we implemented a hacky solution to import the entire project and then to call only the validation logic. Notably, this includes:
    • Installing all of Secvisogram's depenencies
    • Re-constructing and executing relevant parts of Secvisogram's custom build pipeline
    Since then, this validation code has been decoupled and Secvisogram has been updated to use the csaf-validator-lib Node.js module (BSI-Bund/secvisogram#39 / BSI-Bund/secvisogram@4487b6b).
    Benefits of making the switch include:
    • A more stable interface for us to bootstrap and use the dependency.
    • Reduced build pipeline complexity
    • Removed need for frontend build pipeline knowledge
    • Reduced attack surface from unneeded web frontend packages.
    Implementation remarks
    The current approach involves:
    • git submodule-ing https://github.com/BSI-Bund/secvisogram.git
    • Installing Secvisogram's dependencies and calling Babel as part of the build pipeline
    • Manually copying some non-JavaScript resources to the distibution directory
    • Importing validation logic from dist/shared/Core
    In contrast, the new approach would involve:
    • git submodule-ing https://github.com/secvisogram/csaf-validator-lib.git
      
Although the csaf-validator-lib README indicates to use git subtree, git submodule is better for explicitly linking two Git repositories together. In contrast, git subtree copies the Git history without any coupling to the source Git repository.
    • Installing csaf-validator-lib's production dependencies
    This switch would also bring in the latest features and validation tests such Test 6.3.8 ("Spell check", powered by the Hunspell spell checking library), of which the BSI-Bund Git repository is currently lacking.
    Mitigating against NPM dependency confusion attacks
    At time of writing, csaf-validator-lib is not published as an NPM package, hence the need to install this as a "local dependency". To mitigate against NPM dependency confusion attacks, it is important that the package.json dependency entry explicitly points to the local copy.
    We can achieve this "explicit pointer" requirement by leveraging package aliases, which was introduced in
    This issue is to track switching over to csaf-validator-lib
    Metadata
    Metadata
    Assignees
    No one assigned
      Labels
      No labels
      No labels
      Type
      No type
      Projects
      Milestone
      No milestone
      Relationships
      None yet
      Development
      No branches or pull requests
      Issue actions
      
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

      Skip to content
      Replace Secvisogram with csaf-validator-lib #35
      Open
      Open
      Replace Secvisogram with csaf-validator-lib#35
      Description
      @achrinza
      achrinza
      opened on Nov 8, 2022
      Overview
      Secvisogram is a project for a React-powered, web-based Common Security Advisory Framework Version 2.0 (CSAF 2.0) validator.
      #5 / 17f860a added CSAF 2.0 validation with Secvisogram. When that change was merged, Secvisogram was bundled as a single solution, and the validation code was not distributed separately. Hence, we implemented a hacky solution to import the entire project and then to call only the validation logic. Notably, this includes:
      • Installing all of Secvisogram's depenencies
      • Re-constructing and executing relevant parts of Secvisogram's custom build pipeline
      Since then, this validation code has been decoupled and Secvisogram has been updated to use the csaf-validator-lib Node.js module (BSI-Bund/secvisogram#39 / BSI-Bund/secvisogram@4487b6b).
      Benefits of making the switch include:
      • A more stable interface for us to bootstrap and use the dependency.
      • Reduced build pipeline complexity
      • Removed need for frontend build pipeline knowledge
      • Reduced attack surface from unneeded web frontend packages.
      Implementation remarks
      The current approach involves:
      • git submodule-ing https://github.com/BSI-Bund/secvisogram.git
      • Installing Secvisogram's dependencies and calling Babel as part of the build pipeline
      • Manually copying some non-JavaScript resources to the distibution directory
      • Importing validation logic from dist/shared/Core
      In contrast, the new approach would involve:
      • git submodule-ing https://github.com/secvisogram/csaf-validator-lib.git
        
Although the csaf-validator-lib README indicates to use git subtree, git submodule is better for explicitly linking two Git repositories together. In contrast, git subtree copies the Git history without any coupling to the source Git repository.
      • Installing csaf-validator-lib's production dependencies
      This switch would also bring in the latest features and validation tests such Test 6.3.8 ("Spell check", powered by the Hunspell spell checking library), of which the BSI-Bund Git repository is currently lacking.
      Mitigating against NPM dependency confusion attacks
      At time of writing, csaf-validator-lib is not published as an NPM package, hence the need to install this as a "local dependency". To mitigate against NPM dependency confusion attacks, it is important that the package.json dependency entry explicitly points to the local copy.
      We can achieve this "explicit pointer" requirement by leveraging package aliases, which was introduced in
      This issue is to track switching over to csaf-validator-lib
      Metadata
      Metadata
      Assignees
      No one assigned
        Labels
        No labels
        No labels
        Type
        No type
        Projects
        Milestone
        No milestone
        Relationships
        None yet
        Development
        No branches or pull requests
        Issue actions
        
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

        Skip to content
        Replace Secvisogram with csaf-validator-lib #35
        Open
        Open
        Replace Secvisogram with csaf-validator-lib#35
        Description
        @achrinza
        achrinza
        opened on Nov 8, 2022
        Overview
        Secvisogram is a project for a React-powered, web-based Common Security Advisory Framework Version 2.0 (CSAF 2.0) validator.
        #5 / 17f860a added CSAF 2.0 validation with Secvisogram. When that change was merged, Secvisogram was bundled as a single solution, and the validation code was not distributed separately. Hence, we implemented a hacky solution to import the entire project and then to call only the validation logic. Notably, this includes:
        • Installing all of Secvisogram's depenencies
        • Re-constructing and executing relevant parts of Secvisogram's custom build pipeline
        Since then, this validation code has been decoupled and Secvisogram has been updated to use the csaf-validator-lib Node.js module (BSI-Bund/secvisogram#39 / BSI-Bund/secvisogram@4487b6b).
        Benefits of making the switch include:
        • A more stable interface for us to bootstrap and use the dependency.
        • Reduced build pipeline complexity
        • Removed need for frontend build pipeline knowledge
        • Reduced attack surface from unneeded web frontend packages.
        Implementation remarks
        The current approach involves:
        • git submodule-ing https://github.com/BSI-Bund/secvisogram.git
        • Installing Secvisogram's dependencies and calling Babel as part of the build pipeline
        • Manually copying some non-JavaScript resources to the distibution directory
        • Importing validation logic from dist/shared/Core
        In contrast, the new approach would involve:
        • git submodule-ing https://github.com/secvisogram/csaf-validator-lib.git
          
Although the csaf-validator-lib README indicates to use git subtree, git submodule is better for explicitly linking two Git repositories together. In contrast, git subtree copies the Git history without any coupling to the source Git repository.
        • Installing csaf-validator-lib's production dependencies
        This switch would also bring in the latest features and validation tests such Test 6.3.8 ("Spell check", powered by the Hunspell spell checking library), of which the BSI-Bund Git repository is currently lacking.
        Mitigating against NPM dependency confusion attacks
        At time of writing, csaf-validator-lib is not published as an NPM package, hence the need to install this as a "local dependency". To mitigate against NPM dependency confusion attacks, it is important that the package.json dependency entry explicitly points to the local copy.
        We can achieve this "explicit pointer" requirement by leveraging package aliases, which was introduced in
        This issue is to track switching over to csaf-validator-lib
        Metadata
        Metadata
        Assignees
        No one assigned
          Labels
          No labels
          No labels
          Type
          No type
          Projects
          Milestone
          No milestone
          Relationships
          None yet
          Development
          No branches or pull requests
          Issue actions
          
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

          Skip to content
          Replace Secvisogram with csaf-validator-lib #35
          Open
          Open
          Replace Secvisogram with csaf-validator-lib#35
          Description
          @achrinza
          achrinza
          opened on Nov 8, 2022
          Overview
          Secvisogram is a project for a React-powered, web-based Common Security Advisory Framework Version 2.0 (CSAF 2.0) validator.
          #5 / 17f860a added CSAF 2.0 validation with Secvisogram. When that change was merged, Secvisogram was bundled as a single solution, and the validation code was not distributed separately. Hence, we implemented a hacky solution to import the entire project and then to call only the validation logic. Notably, this includes:
          • Installing all of Secvisogram's depenencies
          • Re-constructing and executing relevant parts of Secvisogram's custom build pipeline
          Since then, this validation code has been decoupled and Secvisogram has been updated to use the csaf-validator-lib Node.js module (BSI-Bund/secvisogram#39 / BSI-Bund/secvisogram@4487b6b).
          Benefits of making the switch include:
          • A more stable interface for us to bootstrap and use the dependency.
          • Reduced build pipeline complexity
          • Removed need for frontend build pipeline knowledge
          • Reduced attack surface from unneeded web frontend packages.
          Implementation remarks
          The current approach involves:
          • git submodule-ing https://github.com/BSI-Bund/secvisogram.git
          • Installing Secvisogram's dependencies and calling Babel as part of the build pipeline
          • Manually copying some non-JavaScript resources to the distibution directory
          • Importing validation logic from dist/shared/Core
          In contrast, the new approach would involve:
          • git submodule-ing https://github.com/secvisogram/csaf-validator-lib.git
            
Although the csaf-validator-lib README indicates to use git subtree, git submodule is better for explicitly linking two Git repositories together. In contrast, git subtree copies the Git history without any coupling to the source Git repository.
          • Installing csaf-validator-lib's production dependencies
          This switch would also bring in the latest features and validation tests such Test 6.3.8 ("Spell check", powered by the Hunspell spell checking library), of which the BSI-Bund Git repository is currently lacking.
          Mitigating against NPM dependency confusion attacks
          At time of writing, csaf-validator-lib is not published as an NPM package, hence the need to install this as a "local dependency". To mitigate against NPM dependency confusion attacks, it is important that the package.json dependency entry explicitly points to the local copy.
          We can achieve this "explicit pointer" requirement by leveraging package aliases, which was introduced in
          This issue is to track switching over to csaf-validator-lib
          Metadata
          Metadata
          Assignees
          No one assigned
            Labels
            No labels
            No labels
            Type
            No type
            Projects
            Milestone
            No milestone
            Relationships
            None yet
            Development
            No branches or pull requests
            Issue actions
            
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

            Skip to content
            Replace Secvisogram with csaf-validator-lib #35
            Open
            Open
            Replace Secvisogram with csaf-validator-lib#35
            Description
            @achrinza
            achrinza
            opened on Nov 8, 2022
            Overview
            Secvisogram is a project for a React-powered, web-based Common Security Advisory Framework Version 2.0 (CSAF 2.0) validator.
            #5 / 17f860a added CSAF 2.0 validation with Secvisogram. When that change was merged, Secvisogram was bundled as a single solution, and the validation code was not distributed separately. Hence, we implemented a hacky solution to import the entire project and then to call only the validation logic. Notably, this includes:
            • Installing all of Secvisogram's depenencies
            • Re-constructing and executing relevant parts of Secvisogram's custom build pipeline
            Since then, this validation code has been decoupled and Secvisogram has been updated to use the csaf-validator-lib Node.js module (BSI-Bund/secvisogram#39 / BSI-Bund/secvisogram@4487b6b).
            Benefits of making the switch include:
            • A more stable interface for us to bootstrap and use the dependency.
            • Reduced build pipeline complexity
            • Removed need for frontend build pipeline knowledge
            • Reduced attack surface from unneeded web frontend packages.
            Implementation remarks
            The current approach involves:
            • git submodule-ing https://github.com/BSI-Bund/secvisogram.git
            • Installing Secvisogram's dependencies and calling Babel as part of the build pipeline
            • Manually copying some non-JavaScript resources to the distibution directory
            • Importing validation logic from dist/shared/Core
            In contrast, the new approach would involve:
            • git submodule-ing https://github.com/secvisogram/csaf-validator-lib.git
              
Although the csaf-validator-lib README indicates to use git subtree, git submodule is better for explicitly linking two Git repositories together. In contrast, git subtree copies the Git history without any coupling to the source Git repository.
            • Installing csaf-validator-lib's production dependencies
            This switch would also bring in the latest features and validation tests such Test 6.3.8 ("Spell check", powered by the Hunspell spell checking library), of which the BSI-Bund Git repository is currently lacking.
            Mitigating against NPM dependency confusion attacks
            At time of writing, csaf-validator-lib is not published as an NPM package, hence the need to install this as a "local dependency". To mitigate against NPM dependency confusion attacks, it is important that the package.json dependency entry explicitly points to the local copy.
            We can achieve this "explicit pointer" requirement by leveraging package aliases, which was introduced in
            This issue is to track switching over to csaf-validator-lib
            Metadata
            Metadata
            Assignees
            No one assigned
              Labels
              No labels
              No labels
              Type
              No type
              Projects
              Milestone
              No milestone
              Relationships
              None yet
              Development
              No branches or pull requests
              Issue actions
              
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

              Skip to content
              Replace Secvisogram with csaf-validator-lib #35
              Open
              Open
              Replace Secvisogram with csaf-validator-lib#35
              Description
              @achrinza
              achrinza
              opened on Nov 8, 2022
              Overview
              Secvisogram is a project for a React-powered, web-based Common Security Advisory Framework Version 2.0 (CSAF 2.0) validator.
              #5 / 17f860a added CSAF 2.0 validation with Secvisogram. When that change was merged, Secvisogram was bundled as a single solution, and the validation code was not distributed separately. Hence, we implemented a hacky solution to import the entire project and then to call only the validation logic. Notably, this includes:
              • Installing all of Secvisogram's depenencies
              • Re-constructing and executing relevant parts of Secvisogram's custom build pipeline
              Since then, this validation code has been decoupled and Secvisogram has been updated to use the csaf-validator-lib Node.js module (BSI-Bund/secvisogram#39 / BSI-Bund/secvisogram@4487b6b).
              Benefits of making the switch include:
              • A more stable interface for us to bootstrap and use the dependency.
              • Reduced build pipeline complexity
              • Removed need for frontend build pipeline knowledge
              • Reduced attack surface from unneeded web frontend packages.
              Implementation remarks
              The current approach involves:
              • git submodule-ing https://github.com/BSI-Bund/secvisogram.git
              • Installing Secvisogram's dependencies and calling Babel as part of the build pipeline
              • Manually copying some non-JavaScript resources to the distibution directory
              • Importing validation logic from dist/shared/Core
              In contrast, the new approach would involve:
              • git submodule-ing https://github.com/secvisogram/csaf-validator-lib.git
                
Although the csaf-validator-lib README indicates to use git subtree, git submodule is better for explicitly linking two Git repositories together. In contrast, git subtree copies the Git history without any coupling to the source Git repository.
              • Installing csaf-validator-lib's production dependencies
              This switch would also bring in the latest features and validation tests such Test 6.3.8 ("Spell check", powered by the Hunspell spell checking library), of which the BSI-Bund Git repository is currently lacking.
              Mitigating against NPM dependency confusion attacks
              At time of writing, csaf-validator-lib is not published as an NPM package, hence the need to install this as a "local dependency". To mitigate against NPM dependency confusion attacks, it is important that the package.json dependency entry explicitly points to the local copy.
              We can achieve this "explicit pointer" requirement by leveraging package aliases, which was introduced in
              This issue is to track switching over to csaf-validator-lib
              Metadata
              Metadata
              Assignees
              No one assigned
                Labels
                No labels
                No labels
                Type
                No type
                Projects
                Milestone
                No milestone
                Relationships
                None yet
                Development
                No branches or pull requests
                Issue actions
                
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

                Skip to content
                Replace Secvisogram with csaf-validator-lib #35
                Open
                Open
                Replace Secvisogram with csaf-validator-lib#35
                Description
                @achrinza
                achrinza
                opened on Nov 8, 2022
                Overview
                Secvisogram is a project for a React-powered, web-based Common Security Advisory Framework Version 2.0 (CSAF 2.0) validator.
                #5 / 17f860a added CSAF 2.0 validation with Secvisogram. When that change was merged, Secvisogram was bundled as a single solution, and the validation code was not distributed separately. Hence, we implemented a hacky solution to import the entire project and then to call only the validation logic. Notably, this includes:
                • Installing all of Secvisogram's depenencies
                • Re-constructing and executing relevant parts of Secvisogram's custom build pipeline
                Since then, this validation code has been decoupled and Secvisogram has been updated to use the csaf-validator-lib Node.js module (BSI-Bund/secvisogram#39 / BSI-Bund/secvisogram@4487b6b).
                Benefits of making the switch include:
                • A more stable interface for us to bootstrap and use the dependency.
                • Reduced build pipeline complexity
                • Removed need for frontend build pipeline knowledge
                • Reduced attack surface from unneeded web frontend packages.
                Implementation remarks
                The current approach involves:
                • git submodule-ing https://github.com/BSI-Bund/secvisogram.git
                • Installing Secvisogram's dependencies and calling Babel as part of the build pipeline
                • Manually copying some non-JavaScript resources to the distibution directory
                • Importing validation logic from dist/shared/Core
                In contrast, the new approach would involve:
                • git submodule-ing https://github.com/secvisogram/csaf-validator-lib.git
                  
Although the csaf-validator-lib README indicates to use git subtree, git submodule is better for explicitly linking two Git repositories together. In contrast, git subtree copies the Git history without any coupling to the source Git repository.
                • Installing csaf-validator-lib's production dependencies
                This switch would also bring in the latest features and validation tests such Test 6.3.8 ("Spell check", powered by the Hunspell spell checking library), of which the BSI-Bund Git repository is currently lacking.
                Mitigating against NPM dependency confusion attacks
                At time of writing, csaf-validator-lib is not published as an NPM package, hence the need to install this as a "local dependency". To mitigate against NPM dependency confusion attacks, it is important that the package.json dependency entry explicitly points to the local copy.
                We can achieve this "explicit pointer" requirement by leveraging package aliases, which was introduced in
                This issue is to track switching over to csaf-validator-lib
                Metadata
                Metadata
                Assignees
                No one assigned
                  Labels
                  No labels
                  No labels
                  Type
                  No type
                  Projects
                  Milestone
                  No milestone
                  Relationships
                  None yet
                  Development
                  No branches or pull requests
                  Issue actions