feat: add OWASP Kubernetes Top Ten 2022 & 2025 importers and golden dataset entries

application/tests/fixtures/owasp_mappings/owasp_kubernetes_top10_2022.json

@@ -3,13 +3,13 @@
     "section_id": "K01",
     "section": "Insecure Workload Configurations",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K01-insecure-workload-configurations",
-    "cre_ids": ["233-748", "486-813"]
+    "cre_ids": ["715-334", "053-751"]
   },
   {
     "section_id": "K02",
     "section": "Supply Chain Vulnerabilities",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K02-supply-chain-vulnerabilities",
-    "cre_ids": ["613-285", "613-287"]
+    "cre_ids": ["715-223", "307-507"]
   },
   {
     "section_id": "K03",
@@ -21,19 +21,19 @@
     "section_id": "K04",
     "section": "Lack of Centralized Policy Enforcement",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K04-lack-of-centralized-policy-enforcement",
-    "cre_ids": ["117-371"]
+    "cre_ids": ["117-371", "344-611"]
   },
   {
     "section_id": "K05",
     "section": "Inadequate Logging and Monitoring",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K05-inadequate-logging-and-monitoring",
-    "cre_ids": ["058-083", "148-420", "402-706", "843-841"]
+    "cre_ids": ["058-083", "148-420", "402-706"]
   },
   {
     "section_id": "K06",
     "section": "Broken Authentication Mechanisms",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K06-broken-authentication-mechanisms",
-    "cre_ids": ["177-260", "586-842", "633-428"]
+    "cre_ids": ["113-133", "576-042"]
   },
   {
     "section_id": "K07",
@@ -51,12 +51,12 @@
     "section_id": "K09",
     "section": "Misconfigured Cluster Components",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K09-misconfigured-cluster-components",
-    "cre_ids": ["233-748", "486-813"]
+    "cre_ids": ["053-751", "233-748", "715-334"]
   },
   {
     "section_id": "K10",
     "section": "Outdated and Vulnerable Kubernetes Components",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K10-outdated-and-vulnerable-kubernetes-components",
-    "cre_ids": ["053-751", "715-334", "863-521"]
+    "cre_ids": ["715-334", "053-751", "715-223"]
   }
-]
+]

application/tests/fixtures/owasp_mappings/owasp_kubernetes_top10_2025.json

@@ -2,71 +2,69 @@
   {
     "section_id": "K01",
     "section": "Insecure Workload Configurations",
-    "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/",
-    "cre_ids": ["233-748", "486-813"],
-    "fallback_section_ids": ["K01"]
+    "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K01-Insecure-Workload-Configurations.html",
+    "cre_ids": ["233-748", "486-813"]
   },
   {
     "section_id": "K02",
     "section": "Overly Permissive Authorization Configurations",
-    "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/",
+    "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K02-Overly-Permissive-Authorization-Configurations.html",
     "cre_ids": ["128-128", "724-770"],
     "fallback_section_ids": ["K03"]
   },
   {
     "section_id": "K03",
     "section": "Secrets Management Failures",
-    "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/",
+    "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K03-Secrets-Management-Failures.html",
     "cre_ids": ["340-375", "774-888", "813-610"],
     "fallback_section_ids": ["K08"]
   },
   {
     "section_id": "K04",
     "section": "Lack Of Cluster Level Policy Enforcement",
-    "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/",
-    "cre_ids": ["117-371"],
-    "fallback_section_ids": ["K04"]
+    "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K04-Lack-Of-Cluster-Level-Policy-Enforcement.html",
+    "cre_ids": ["117-371"]
   },
   {
     "section_id": "K05",
     "section": "Missing Network Segmentation Controls",
-    "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/",
+    "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K05-Missing-Network-Segmentation-Controls.html",
     "cre_ids": ["132-146", "467-784", "515-021"],
     "fallback_section_ids": ["K07"]
   },
   {
     "section_id": "K06",
     "section": "Overly Exposed Kubernetes Components",
-    "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/",
+    "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K06-Overly-Exposed-Kubernetes-Components.html",
     "cre_ids": ["152-725", "640-364"],
     "fallback_section_ids": ["K09"]
   },
   {
     "section_id": "K07",
     "section": "Misconfigured And Vulnerable Cluster Components",
-    "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/",
+    "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K07-Misconfigured-And-Vulnerable-Cluster-Components.html",
     "cre_ids": ["053-751", "233-748", "486-813", "715-334"],
     "fallback_section_ids": ["K09", "K10"]
   },
   {
     "section_id": "K08",
     "section": "Cluster To Cloud Lateral Movement",
-    "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/",
+    "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K08-Cluster-To-Cloud-Lateral-Movement.html",
     "cre_ids": ["132-146", "640-364", "724-770"],
     "fallback_section_ids": ["K03", "K07"]
   },
   {
     "section_id": "K09",
     "section": "Broken Authentication Mechanisms",
-    "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/",
+    "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K09-Broken-Authentication-Mechanisms.html",
     "cre_ids": ["177-260", "586-842", "633-428"],
     "fallback_section_ids": ["K06"]
   },
   {
     "section_id": "K10",
     "section": "Inadequate Logging And Monitoring",
-    "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/",
+    "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K10-Inadequate-Logging-And-Monitoring.html",
     "cre_ids": ["058-083", "148-420", "402-706", "843-841"],
     "fallback_section_ids": ["K05"]
   }
-]
+]

application/tests/librarian/dataset_test.py

@@ -151,9 +151,71 @@ def test_duplicate_id_is_rejected(self):
             os.unlink(tmp)
 
 
+# Import the parsers for the new standards so they can be registered into the DB.
+from application.utils.external_project_parsers.base_parser import BaseParser
+from application.utils.external_project_parsers.parsers import (
+    owasp_kubernetes_top10_2022,
+    owasp_kubernetes_top10_2025,
+)
+
+# # Optionally import API, LLM, AISVS if they exist; if not, skip gracefully.
+# try:
+#     from application.utils.external_project_parsers.parsers import (
+#         owasp_api_security_top10_2023,
+#     )
+# except ImportError:
+#     owasp_api_security_top10_2023 = None
+# try:
+#     from application.utils.external_project_parsers.parsers import (
+#         owasp_llm_top10_2025,
+#     )
+# except ImportError:
+#     owasp_llm_top10_2025 = None
+# try:
+#     from application.utils.external_project_parsers.parsers import (
+#         owasp_aisvs,
+#     )
+# except ImportError:
+#     owasp_aisvs = None
+
+
 class TestDatasetDeterminism(unittest.TestCase):
     """The committed JSON must re-derive identically from the DB."""
 
+    @classmethod
+    def setUpClass(cls):
+        """Populate the DB with all standards that appear in the golden dataset."""
+        if not os.path.exists(_DB):
+            return  # test will be skipped anyway
+        parser = BaseParser()
+        # Register Kubernetes standards
+        parser.register_resource(
+            owasp_kubernetes_top10_2022.OwaspKubernetesTop10_2022,
+            db_connection_str=f"sqlite:///{_DB}",
+        )
+        parser.register_resource(
+            owasp_kubernetes_top10_2025.OwaspKubernetesTop10_2025,
+            db_connection_str=f"sqlite:///{_DB}",
+        )
+        # Register API Security if available
+        # if owasp_api_security_top10_2023 is not None:
+        #     parser.register_resource(
+        #         owasp_api_security_top10_2023.OwaspApiSecurityTop10_2023,
+        #         db_connection_str=f"sqlite:///{_DB}",
+        #     )
+        # # Register LLM if available
+        # if owasp_llm_top10_2025 is not None:
+        #     parser.register_resource(
+        #         owasp_llm_top10_2025.OwaspLlmTop10_2025,
+        #         db_connection_str=f"sqlite:///{_DB}",
+        #     )
+        # # Register AISVS if available
+        # if owasp_aisvs is not None:
+        #     parser.register_resource(
+        #         owasp_aisvs.AISVS,
+        #         db_connection_str=f"sqlite:///{_DB}",
+        #     )
+
     def test_build_check_matches_committed_dataset(self):
         if not os.path.exists(_DB):
             self.skipTest("standards_cache.sqlite not present")