cwe

README

cwe

Go library for looking up MITRE CWE (Common Weakness Enumeration) entries by ID.

The catalogue is embedded at build time and covers every non-deprecated weakness with its name, short description, and View-1400 category. A monthly workflow regenerates it from cwec_latest.xml.zip and opens a PR when it changes.

Installation

go get github.com/git-pkgs/cwe

Usage

import "github.com/git-pkgs/cwe"

id, e, ok := cwe.Lookup("79")
// id = "CWE-79"
// e.Name = "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
// e.Category = "Injection"

for _, label := range cwe.Categories() {
    fmt.Println(cwe.CategoryID(label), label, len(cwe.InCategory(label)))
}
// CWE-1396 Access Control 60
// CWE-1397 Comparison 13
// ...

cwe.CategoryOf("CWE-352") // "CWE-1411"

Lookup accepts "CWE-79", "cwe-79", or "79" and returns the canonical CWE- form.

Regenerating the catalogue

go generate ./...

fetches the latest XML from cwe.mitre.org and rewrites cwe.json. The output is deterministic (sorted keys, no whitespace), so a re-run against unchanged XML produces no diff.

License

MIT. The CWE catalogue is © The MITRE Corporation and used under its terms of use.

Documentation

Overview

Package cwe embeds the MITRE CWE catalogue and looks up entries by ID.

Each entry carries the weakness name, its short description, and its View-1400 ("Comprehensive Categorization for Software Assurance Trends") category label. Deprecated weaknesses are excluded. The embedded catalogue is regenerated from https://cwe.mitre.org/data/xml/cwec_latest.xml.zip via go generate.

Index

• func Categories() []string
• func CategorizedIDs() []string
• func CategoryID(label string) string
• func CategoryOf(id string) string
• func InCategory(label string) []string
• type Entry
  • func Lookup(raw string) (id string, e Entry, ok bool)

Functions

func Categories

func Categories() []string

Categories returns the View-1400 category labels in alphabetical order.

func CategorizedIDs

func CategorizedIDs() []string

CategorizedIDs returns every CWE-ID that has a View-1400 category, sorted.

func CategoryID

func CategoryID(label string) string

CategoryID returns the CWE-ID for a View-1400 category label, e.g. "Injection" -> "CWE-1409". Returns "" for an unknown label.

func CategoryOf

func CategoryOf(id string) string

CategoryOf returns the View-1400 category CWE-ID for a weakness ID, e.g. "CWE-352" -> "CWE-1411". Returns "" when the weakness is unknown or not mapped to a View-1400 bucket.

func InCategory

func InCategory(label string) []string

InCategory returns the CWE-IDs that belong to a View-1400 category, sorted, or nil for an unknown category.

Types

type Entry

type Entry struct {
	Name        string `json:"name"`
	Description string `json:"description"`
	Category    string `json:"category,omitempty"`
}

Entry is one weakness in the catalogue. Category is the View-1400 bucket the weakness belongs to, or empty when the weakness is not mapped.

func Lookup

func Lookup(raw string) (id string, e Entry, ok bool)

Lookup accepts "CWE-79", "cwe-79", or "79" and returns the canonical ID and the entry. The bool is false when the ID is not in the catalogue.