fix: fill empty recommendation for ROOT_DETECTION_PRESENT - #343
Conversation
There was a problem hiding this comment.
Code Review Results
I found 3 issues across metadata files in MOBILE_CLIENT/COMMON, all relating to incorrect OWASP MASWE references. Two are confirmed incorrect mappings (critical), and one needs verification before merging.
Key findings:
- ROOT_DETECTION_MISSING/meta.json (line 8) — MASWE-0097 was replaced with MASWE-0051, but MASWE-0051 is "Unprotected Open Ports", not "Root/Jailbreak Detection Not Implemented". The label and linked content no longer match.
- ROOT_DETECTION_PRESENT/meta.json (line 12) — Same incorrect swap: MASWE-0051 does not describe root/jailbreak detection. The reference must be reverted to MASWE-0097.
- SSL_TLS_PINNING_NOT_DETECTED/meta.json (line 8) — MASWE-0028 must be verified by inspecting the destination page content (not just an HTTP 200) to confirm it actually describes certificate/identity pinning.
Root cause: Replacement URLs were validated only by HTTP 200 status code, which OWASP also returns for redirect pages. The destination page content was never verified, allowing semantically incorrect links to pass automated checks.
Recommendation: Revert the two confirmed files back to MASWE-0097, verify MASWE-0028 by content inspection, and add content-based validation to CI for all MASWE URL references.
Reviewer Scores for Ostorlab/KB #343Each reviewer who left comments is scored between -10 and +10 based on the overall quality of their review feedback. Total reviewers scored: 1
|
ROOT_DETECTION_PRESENT/recommendation.mdwas the only empty recommendation file in the KB, so the Recommendation section renders blank in the report. Fills it with the same one-liner every other SECURE entry uses.Also fixes four
meta.jsonreferences pointing at MASWE ids that don't exist.MASWE-0097isn't in the catalog at all (MASVS-RESILIENCE ends at 0065) andMASWE-0047is a MASVS-CODE weakness, not the pinning one. Root detection now points at MASWE-0051, pinning at MASWE-0028, both verified 200.