Draft
Conversation
Made-with: Cursor
…istry Scaffolding for automated OWASP API Top 10 testing across all 29 v2 endpoints. Includes a generator script (generate.cjs) that produces 13-15 .bru test files per endpoint, covering auth bypass, BOLA, method fuzzing, security headers, SSRF probing, input validation, and inventory checks. Made-with: Cursor
Auto-generated via `node generate.cjs --all`. Each endpoint folder contains 13-15 Bruno test files covering OWASP API Security Top 10 (2023) categories. Made-with: Cursor
Add 11 endpoint-specific Bruno tests (16-26) covering negative timestamps, excessive limit, container filter, default params, start>end validation, huge time ranges, path traversal, NoSQL injection, zero limit, overwriteCache abuse, and FE response shape validation. Update endpoints.json status to IMPLEMENTED_NOT_DEPLOYED. Made-with: Cursor
…ntainer ID - Fix endpoint path from /auth/containers/:id/telemetry to /auth/metrics/containers/:id - Update expected response keys to [id, miners, telemetry] - Set dev environment containerId to bitdeer-4a (real container on dev) - Mark container-telemetry, containers, pools, finance-energy-balance, finance-ebitda, finance-cost-summary, metrics-power-mode-timeline as reviewed in endpoints.json Made-with: Cursor
…ption - Update cabinets and cabinet-detail Bruno tests with correct response keys - Set dev environment cabinetId to lv3_pm1 - Update metrics-consumption tests with actual schema (start/end required, remove undocumented params) - Mark cabinets, cabinet-detail, metrics-consumption as reviewed (13/29) Made-with: Cursor
Mark miners endpoint as reviewed — endpoint does not exist in the backend. Pre-implementation OWASP recommendations and implementation guide provided in owasp/utils/owasp-miners.md. (14/29 reviewed) Made-with: Cursor
Update endpoint registry and Bruno tests with actual schema (start/end required, no interval param). Response keys: [log, summary]. Fractional miner counts and missing status categories documented. (15/29 reviewed) Made-with: Cursor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OWASP API Security Testing Framework
Adds an automated OWASP API Security Top 10 (2023) testing framework for all 29 MiningOS v2 endpoints using Bruno.
What's included
Test generator (
owasp/bruno-tests/generate.cjs)--all,--list,--statuscommandsendpoints.json) with all 29 v2 endpoints, their params, and review status414 generated test files covering:
siteIdquery injection,X-Site-Id/X-Forwarded-*header injection/v1/,/v2/)Runner script (
run.sh) for running single endpoints or full suites.Environments for
devandstagingwith secret token support.Manual OWASP reviews completed
Two endpoints have been manually reviewed with detailed findings and remediation recommendations (stored in
owasp/utils/, gitignored):GET /auth/site/status/live— 3 FAIL (rate limiting, security headers, RPC validation)GET /auth/pool-stats/aggregate— 3 FAIL + 1 WARN (rate limiting, security headers, nocapCheck, RPC validation) + 5 verified peer-review bugs (missing days, broken pool filter, Sunday-based weeks, missing pool name, no week range metadata)How to use
Test plan
generate.cjs --listshows all 29 endpointsgenerate.cjs --allregenerates 414 test files without errorsowasp/bruno-tests/in Bruno GUI and verify collection loads correctlyowasp/utils/contents are not tracked by git