Add Persian (fa) edition for API Security 2023 #134

This-is-Neo · 2024-09-03T10:44:53Z

Add Persian (fa) edition for API Security 2023

This-is-Neo · 2024-09-28T09:21:44Z

PauloASilva

Hi @This-is-Neo,
The PR needs some changes before becoming ready for merge.
Please kindly review my comments.

Remember that you can render the site locally using docker. To add the Persian translation to the languages selector you should do the following change:

diff --git a/editions/2023/mkdocs.yml b/editions/2023/mkdocs.yml
index e4f73e3..505c4d2 100644
--- a/editions/2023/mkdocs.yml
+++ b/editions/2023/mkdocs.yml
@@ -9,3 +9,5 @@ extra:
       lang: en
     - name: Français
       lang: fr
+    - name: Persian
+      lang: fa

Also note that we are no longer providing the ODT/PDF versions of the document due to the additional effort required to keep them up to date. In the future we may consider providing distributable formats as long as they can be compiled from the source.

Cheers,
Paulo A. Silva

editions/2023/fa/images/0x00-toc.md

PauloASilva · 2024-10-10T10:49:58Z

editions/2023/fa/0x00-toc.md

There are several broken links here e.g. 0xa2-broken-user-autentication.md does not exist: the file name is 0xa2-broken-autentication.md.

Hi @PauloASilva ,
I wanted to let you know that the updates and revisions you requested in this part have been completed and committed.
Please feel free to review them, and let me know if any further adjustments are needed.

Best regards,

PauloASilva · 2024-10-10T10:53:18Z

editions/2023/fa/0xa1-broken-object-level-authorization.md

There are several Markdown rendering issues throughout the sections:

Tables

References

Hi @PauloASilva ,
Just a quick update—I’m actively working on the revisions you requested. I’ll make sure to commit the changes as soon as possible. If there’s anything else you’d like me to address, feel free to let me know!

Best Regards,

Hi @PauloASilva ,
I believe I’ve addressed all the revisions you mentioned, and my latest commit is ready for your review.

Looking forward to your feedback and any additional input you may have.

Thanks,

PauloASilva · 2024-10-10T11:01:56Z

editions/2023/fa/0xa1-broken-object-level-authorization.md

@@ -0,0 +1,89 @@
+<div dir="rtl" align='right'>


This is not required since MkDocs already takes care of it:

Code blocks are properly handled:

Hi @PauloASilva

I'm progressing with the revisions and just wanted to confirm a couple of details to ensure everything aligns with your expectations:

You mentioned that "MkDocs already takes care of it." Could you confirm which elements I can leave as-is, so I avoid unnecessary changes?

Regarding the "code blocks," I assume they’re properly handled, but is there anything specific you’d like adjusted, or can I proceed with the current setup?

Once I have your input, I’ll finalize and commit the changes as soon as possible. Feel free to let me know if there's anything else.

Best regards,

Hi @PauloASilva ,

I believe I’ve addressed all the revisions you mentioned, and my latest commit is ready for your review. In my last reply, I had a few questions, which I believe I've now resolved—if so, there's no need for further clarification.

Looking forward to your feedback and any additional input you may have.

Thanks,

This-is-Neo · 2024-10-13T07:33:26Z

Hi @This-is-Neo, The PR needs some changes before becoming ready for merge. Please kindly review my comments.

Remember that you can render the site locally using docker. To add the Persian translation to the languages selector you should do the following change:
diff --git a/editions/2023/mkdocs.yml b/editions/2023/mkdocs.yml
index e4f73e3..505c4d2 100644
--- a/editions/2023/mkdocs.yml
+++ b/editions/2023/mkdocs.yml
@@ -9,3 +9,5 @@ extra:
       lang: en
     - name: Français
       lang: fr
+    - name: Persian
+      lang: fa
Also note that we are no longer providing the ODT/PDF versions of the document due to the additional effort required to keep them up to date. In the future we may consider providing distributable formats as long as they can be compiled from the source.

Cheers, Paulo A. Silva

Hi @PauloASilva ,
I wanted to let you know that the updates and revisions you requested in this part have been completed and committed.
Please feel free to review them, and let me know if any further adjustments are needed.

Also, is there anything else I should consider adding or refining in the Mkdocs.yml file, particularly related to content structure or editing configurations? For example, should I include something like this for additional markdown support:


markdown_extensions:
  - footnotes

Best regards,

PauloASilva

Hi @This-is-Neo,
Carefully review my comments: some requested changes apply to all translation sources.

Please compare you sources with the original ones in terms of structure e.g. headings, unnecessary ---, use of markup instead of markdown when not required, ...

Take your time to carefully review the translation source making sure it follows the original EN source as much as possible. Keep in mind that reviews like this one require a lot of time and effort from all of us.

Cheers,
Paulo A. Silva

PauloASilva · 2024-10-15T07:16:51Z

editions/2023/fa/0x00-toc.md

+* [ ریسک‌های امنیت API](0x10-api-security-risks.md)
+* [ ده ریسک امنیت API OWASP 2019](0x11-t10.md)
+* [API1:2023 مجوزدهی نادرست در سطح اشیا](0xa1-broken-object-level-authorization.md)
+* [API2:2023 احرازهویت نادرست کاربر](0xa2-broken-autentication.md)


There's a typo here responsible for one of the warning in the image below

PauloASilva · 2024-10-15T07:17:07Z

editions/2023/fa/0x00-toc.md

+* [API2:2023 احرازهویت نادرست کاربر](0xa2-broken-autentication.md)
+* [API3:2023 افشای مفرط داده](0xa3-broken-object-property-level-authorization.md)
+* [API4:2023 کمبود منابع و نبود محدودیت بر نرخ ارسال](0xa4-unrestricted-resource-consumption.md)
+* [API5:2023 مجوزدهی نادرست در سطح توابع](0xa5-broken-function-level-authorizaion.md)


There's a typo here responsible for one of the warning in the image below

PauloASilva · 2024-10-15T07:28:43Z

editions/2023/mkdocs.yml

+  i18n:
+    nav:


You're not supposed to change this: it should remain alternate otherwise the language selector is not rendered.

Please revert these changes.

Keep in mind that you can render the documentation locally following this instructions.

PauloASilva · 2024-10-15T07:50:07Z

editions/2023/fa/index.md

Please remove this file since instructions are already provided here otherwise it may lead to issues like those introduced in the mkdocs.yml file.

PauloASilva · 2024-10-15T07:57:00Z

editions/2023/fa/0x00-header.md

The differences when compared to the original EN version:

are causing at least the following issue:

PauloASilva · 2024-10-15T08:20:27Z

editions/2023/fa/0xa1-broken-object-level-authorization.md

+| دسترسی غیرمجاز می‌تواند منجر به افشای اطلاعات، از دست رفتن داده یا دستکاری آن شود. همچنین دسترسی غیرمجاز به اشیا می‌تواند سبب کنترل کامل حساب کاربری توسط مهاجم گردد. | این حمله رایج‌ترین ‌آسیب‌پذیری APIها بوده و بیشترین پیامدها را نیز در پی دارد. مکانیزم‌های مجوزدهی و کنترل دسترسی در اپلیکیشن‌های مدرن، پیچیده و گسترده هستند. حتی اگر اپلیکیشن زیرساخت مناسب را برای کنترل‌های مجوزدهی ‌‌‌‌پیاده‌سازی نماید، ممکن است توسعه دهندگان پیش از دسترسی به اشیا حساس، استفاده از این کنترل‌ها را فراموش نمایند. تشخیص نقایص مربوط به کنترل دسترسی از طریق تست‌های ایستا یا پویا به صورت خودکار غالبا امکان پذیر نیست. | مهاجمین می‌توانند از نقاط و توابع ‌آسیب‌پذیر (از منظر مجوزدهی نادرست در سطح اشیا) با دستکاری شناسه شیء ارسالی درون درخواست سوءاستفاده و بهره برداری نمایند. این امر می‌تواند منجر به دسترسی غیرمجاز به داده حساس شود. دسترسی غیرمجاز به داده حساس، مساله‌ای رایج در اپلیکیشن‌های مبتنی بر API است چرا که مولفه سرور غالبا به طور کامل وضعیت کلاینت را رهگیری نمی‌کند و در عوض برای تصمیم گیری درباره دسترسی کلاینت به اشیاء از پارامترهایی نظیر شناسه شی که از سوی خود کلاینت ارسال می‌شوند، تکیه دارند. |
+
+### آیا API از نظر نقض مجوزدهی در سطح اشیاء آسیب‌پذیر است؟
+---


No need: check the original (en) markdown source

PauloASilva · 2024-10-15T08:20:32Z

editions/2023/fa/0xa1-broken-object-level-authorization.md

+در مسئله‌ی Broken Object Level Authorization (BOLA)، امنیت کاربران در دسترسی به اطلاعات و منابع در سیستم به خطر می‌افتد. این مشکل زمانی رخ می‌دهد که سیستم یک درخواست API حاوی یک شناسه (مثلاً شناسه یک مورد یا اشیاء خاص) را دریافت می‌کند و بدون بررسی دقیق این شناسه و اعتبارسنجی آن، به منابع مرتبط با آن شناسه دسترسی می‌دهد. مهاجمان با تغییر شناسه در درخواست‌های خود می‌توانند به اطلاعاتی دسترسی پیدا کنند که به طور عادی نباید به آن‌ها دسترسی داشته باشند.
+
+### مثال‌هایی از سناریوهای حمله
+---


No need: check the original (en) markdown source

PauloASilva · 2024-10-15T08:20:38Z

editions/2023/fa/0xa1-broken-object-level-authorization.md

+یک سرویس ذخیره‌سازی اسناد آنلاین به کاربران این امکان را می‌دهد که اسناد خود را مشاهده، ویرایش، ذخیره و حذف کنند. هنگامی که کاربری یکی از اسناد خود را حذف می‌کند، یک عملیات درخواستی به نام GraphQL Mutation با استفاده از شناسه (ID) مربوط به سند حذف‌شده به API ارسال می‌شود. این درخواست GraphQL به API اطلاع می‌دهد که یک سند باید حذف شود و API مسئول انجام این عملیات حذف است.
+
+### چگونه از آسیب‌پذیری مجوزدهی نادرست در سطح اشیاء پیشگیری کنیم؟
+---


No need: check the original (en) markdown source

PauloASilva · 2024-10-15T08:20:42Z

editions/2023/fa/0xa1-broken-object-level-authorization.md

+- طراحی آزمون‌هایی برای ارزیابی صحت عملکرد مکانیزم‌های مجوزدهی.
+
+### مراجع
+---


No need: check the original (en) markdown source

PauloASilva · 2024-10-15T08:22:48Z

editions/2023/fa/0xa1-broken-object-level-authorization.md

+- [Authorization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html)
+- [Authorization Testing Automation Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Testing_Automation_Cheat_Sheet.html)
+
+#### خارجی
+- [CWE-285: Improper Authorization](https://cwe.mitre.org/data/definitions/285.html)
+- [CWE-639: Authorization Bypass Through User-Controlled Key](https://cwe.mitre.org/data/definitions/639.html)
+


Consider moving the URLs to the bottom of the source file as in the original EN source.

If you decide to adhere then review and change the whole translation source accordingly.

This-is-Neo · 2024-10-19T13:23:14Z

Hi @This-is-Neo, Carefully review my comments: some requested changes apply to all translation sources.

Please compare you sources with the original ones in terms of structure e.g. headings, unnecessary ---, use of markup instead of markdown when not required, ...

Take your time to carefully review the translation source making sure it follows the original EN source as much as possible. Keep in mind that reviews like this one require a lot of time and effort from all of us.

Cheers, Paulo A. Silva

Hi @PauloASilva ,

I have completed the revisions as requested. Below is a summary of the updates I made:

Corrected the links for consistency and accuracy.
Updated the mkdocs.yml file to ensure proper structure and navigation.
Removed the index.md file as it is no longer required.
Edited 0x00-header.md to exactly match the original reference in this link. The original reason I had changed it earlier was due to differences between the Mkdocs server output and the GitHub display, but I have reverted it to the original for consistency.
Removed all
tags to align with the Markdown structure used in the English version.
Eliminated all inline markups that were not necessary.
Corrected the heading levels throughout the document to ensure proper hierarchy and readability.
Removed any unnecessary empty lines and standardized the use of headings (#) without alternate syntax.
Moved all URLs to the bottom of the source file, as per the original English source for cleaner and more organized code.

These changes should now make the document fully aligned with the original English source and address all of your previous comments. Please feel free to review and let me know if any further adjustments are needed.

Best regards,

PauloASilva · 2024-10-29T14:01:23Z

These changes should now make the document fully aligned with the original English source and address all of your previous comments. Please feel free to review and let me know if any further adjustments are needed.

Unfortunately, they don't: build process is broken I guess due to editions/2023/mkdocs.yml changes.

I may take a while to put this together so that it can be merged.

Cheers,
Paulo A. Silva

Add Persian (fa) edition for API Security 2023

c2fe68c

Add dist folder with .odt and .pdf files

dedd2f4

PauloASilva added translation 2023 labels Oct 10, 2024

PauloASilva requested changes Oct 10, 2024

View reviewed changes

This-is-Neo added 3 commits October 12, 2024 11:38

Updated mkdocs.yml: Added Persian language to the language selector

d8a7d16

Removed 0x00-toc.md from editions/2023/fa/images

d663873

Replaced 0x00toc.md with new content

248854e

This-is-Neo added 2 commits October 14, 2024 15:48

Edited Markdown files for the 2023 edition of API Security

748d037

Deleted the dist folder containing .pdf and .odt files

8448fc5

PauloASilva requested changes Oct 15, 2024

View reviewed changes

This-is-Neo added 2 commits October 19, 2024 16:28

Updated API-TOP10-2023-fa content

b5f4e06

Updated Mkdocs.yml

3e4827d

PauloASilva merged commit 3e4827d into OWASP:master Oct 29, 2024

Uh oh!

Add Persian (fa) edition for API Security 2023 #134

Add Persian (fa) edition for API Security 2023 #134

Uh oh!

Conversation

This-is-Neo commented Sep 3, 2024

Uh oh!

This-is-Neo commented Sep 28, 2024

Uh oh!

PauloASilva left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This-is-Neo commented Oct 13, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

PauloASilva left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This-is-Neo commented Oct 19, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

PauloASilva commented Oct 29, 2024

Uh oh!

Uh oh!

This-is-Neo commented Oct 13, 2024 •

edited

Loading

This-is-Neo commented Oct 19, 2024 •

edited

Loading