ASVA offers an interface for interacting with ASVS JSON files, a format developed by OWASP for documenting the security aspects of a system.
To set up and run this project locally, you'll need:
- Clojure: The project is built with Clojure and ClojureScript. Install Clojure on your system.
- Node.js and npm: Required for managing JavaScript dependencies and executing compiled ClojureScript. Download Node.js.
git clone https://github.com/dnv-opensource/asva
cd asva
npm installRun the following command to start the web server using shadow-cljs:
clojure -M:devFollow the on-screen instructions to access and interact with the application, typically running on http://localhost:8080/.
On the initial page, you will be prompted to select an ASVS JSON file
from the available options, which can be found in multiple languages at
this GitHub repository.
ASVA supports the detailed and flat ASVS JSON files, as well as the
CycloneDX-style .cdx.json ASVS format. Once selected, you will access
the main application interface. Here, you can either import an existing
ASVA.json file, if you have one, or make adjustments and export a new
ASVA.json file. All data is securely stored in your browser's local
storage.
For ASVS formats that publish CWE and NIST references separately, use the association import action in the main interface to load the CWE JSON or NIST Markdown mapping files. Imported associations are merged into the current ASVS data and stored locally.
This project is licensed under the MIT License - see the LICENSE.md file for details.