ASVS/MASVS fields for Findings

[sgspinola]

Hi @rsrdesarrollo,

I thought it would be interesting to be able to relate each finding to the security requirement that, if implemented following the OWASP standards for web applications (ASVS) and mobile applications (MASVS), would have prevented it.

Since you're already using the testing guides, I considered this to be some valuable additional information.

Both fields have been added to the finding and finding template tables.

[rsrdesarrollo]

The work is fine, but I can not add REQUIRED fields (like SCA and SAST) to the main branch if they are not completely work-flow independent.

Also, in order to avoid the unnecessary grow of model and forms definition, I rather prefer some kind of dynamic meta-field in assessment and findings to let you an everyone configure custom fields as they needed them.

The use of the full CVSS calculator is OK for me, at first it looks a little bit massive but, I think is a good idea.

[sgspinola]

You're right, I'll make them nullable.

About the model and forms definition growth, would you care to explain what you mean by "dynamic meta-field"? is there any example already in code?

Thanks.