nc3-lu/mosp

A collaborative platform for creating, editing and sharing JSON objects.

MONARC Objects Sharing Platform

Presentation

MOSP is a platform for creating, editing and sharing validated JSON objects of any type.

You can use any available JSON schemas in order to create new JSON objects via a Web form dynamically generated and based on the selected JSON schema.

Since MOSP is a collaborative platform, all changes to JSON objects are tracked.

It is also possible to interact with MOSP programmatically thanks to its API. You can use PyMOSP if you need a client.

As example you can have a look at official instance operated by NC3-LU and more particularly the objects shared by the MONARC project. The goal is to gather security related JSON objects, in the first place aimed to be used with MONARC. Some JSON objects can be exported to a MISP galaxy.

Installation

Instructions available in reStructuredText or in HTML.

Documentation

A documentation is available on the MONARC website.

Contributing

Please read the CONTRIBUTING instructions.

License

This software is licensed under GNU Affero General Public License version 3

• Copyright (C) 2018-2024 Cédric Bonhomme
• Copyright (C) 2018-2024 Luxembourg House of Cybersecurity

For more information, the list of authors and contributors is available.

mosp's Issues

Change the owner of an object

Subscription mechanism

It would be interesting to have a way (email and/or RSS/ATOM) of notifying users about news concerning some specific objects/schemas. For example the availability of a new object dedicated to MONARC.

Add a warning when the UUID of new object is already taken

Managing members of organizations

Provide a way for administrators to manage the members of the organizations present on the platform. Probably through the pages to edit organizations and/or users in the admin panel.

Final report

Hello,
when I generate the final report, I have an issue when opening the doc file.
MS Word says :
"Word found unreadable content in "xxxxx.docx". Do you want to recover the contents of this document? If you trust the source of this document, click Yes."
It seems related to the tables embedded in the document.

Add the possibility to link objects

It would be interesting to be able to link objects in MOSP.
This is especially interesting in the case of referentials mapping, when a mapping references two objects (and those two objects are referenced by the referential).

So why not adding two new kind of relationship between objects: references and referenced_by.

Rewrite API v1 with Flask-Restless-ng

Rewrite API v1 with Flask-Restless-ng. Already started. Flask-Restless is no more maintained since years.
Flask-Restless-ng seems to be a valid candidate to be used for the API v1. But the goal in mid term is to only use the API v2.

Remove the attribute is_public from the JsonObject objects

Finally it won't be possible to mark an object as private. The goal of the platform is to promote the sharing of objects.

Deletion of JSON schemas

How to handle the deletion of JSON schemas? Especially when a schema from an organization has been used to generate an object in an other organization.

Maybe the deletion of the schema should be blocked until no more objects are referenced by the schema.

Add a creator property for the objects

Add a creator property for the objects.

Closes #6

Improve the management of collections

The management of collections could be improved in order to make the creation and edition of collections easier as well as the (un)linking of objects.

Copy a schema from an organization to an other

A feature which will let a user copy a public schema to one of her/his associated organizations would be useful for the users. This would be a sort of fork.
This is actually possible manually.

Log specific kind of events

Discussed in #50

^{Originally posted by cedricbonhomme February 15, 2022}
New functionality to log specific kind of events. For example:

• an object is viewed from the HTML page;
• an object is deleted;
• the import of an object via the API;
• the import of an object via the API from a MONARC instance (when user agent is MONARC);
• requests from a MONARC Stats Service instance (when user agent is Stats service);
• etc.

Updates to object are already logged since objects are versioned.

This will allow us to plot more stats.

Search on objects feature

Add the possibility to search through all the objects validated by a specific schema. This is kind of a meta-search, since we do not know in advance what are the search criteria. It will depend on the schema.

The search form can be generated thanks to the schema, by calculating all the possible paths that an object can have. Example will follow.

Not possible to join an open organisation as a member

This bug tracker is for tracking bugs, todos and confirmed new features.
If you want to submit a feature request please discuss about it here:
https://github.com/NC3-LU/MOSP/discussions

Describe the bug
I created a new account on MOSP and could initally join the organisation "various contributors" a few days ago.
When I logged in today, I received the information that I am not part of any organisaiton and I am also not on the memberlist of "various contributors" anymore,
It is also not possible to join the organisation again.

To Reproduce
Steps to reproduce the behavior:

1. Go to 'Organisations without restrictions'
2. Click on 'Various contributors'
3. Scroll down to 'Members'
4. See error

Expected behavior
I should be able to join an organisation without restriction, e.g. Various contributors,

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop:

• OS: Windows 11 Pro
• Browser edge
• Version 123.0.2420.97

Rendering a graph with the relations between schemas of the platform

A new page which will render a graph with the relations between schemas would be really nice. If the schemas are well defined we must end-up with a graph representing the database of MONARC (described with JSON schemas).

Button to upload objects

Add a way to create new objects by uploading a JSON file with a HTML upload button per JSON schemas on the platform.

Add a button in order to help the user generate a UUID easily

Error 500 when making a new account

Hi,

I tried to create a new account on https://objects.monarc.lu/ with the username first.last and i got an Error 500.

Thanks
T

Web Content Accessibility Guidelines (WCAG) 2.0

Describe the bug
Web interface is currently not really compliant to Web Content Accessibility Guidelines (WCAG) 2.0.

Screenshots

Lock an object

Discussed in #37

^{Originally posted by cedricbonhomme July 7, 2021}
This is to allow the author of an object to lock the edition of this object by another user of the same organization.

Currently an object can be edited by any member of the organization that owns the object.
It would be nice for an author to restrict the edition of an object. Especially in the case of open organizations that anyone can join.

Logo design

Hi, I'm a logo designer, I saw your project and I can make a free logo for your project. So, what do you think?

Adding a license to a JSON object

Users should be able to specify a license for their contributions (the JSON objects).

Maybe we can add a input (ListItem) in the object creation form. The input would be a list of licenses (from https://spdx.org/licenses/licenses.json). Like its done with Freshermeat.

Should we let the user select several licenses of an object?

By default AGPL can be selected. If the user specify nothing.

Versioning of objects

Discussed in #32

^{Originally posted by cedricbonhomme May 31, 2021}
It would be interesting to be able version objects: being able to revert to a previous state of an object and/or view the recent changes applied to an object.

Statistics about objects

Add indicators (like the average counts or the recent evolution in terms of use) for some objects thanks to the API of Stats Service (https://dashboard.monarc.lu for example).

Generation of MISP galaxies and clusters based on an object from MOSP

standard user management system

to implement

• Password recovery via email
• local admin by organization to add/remove users in the organization

Ideas for a domain name

• security-objects.org
• objects.security
• security-objects.club

Add the possibility to create collections

A collection would be a named set of objects from a MOSP instance.

For example CASES would be able to create the collection named "Security measures for MONARC".
This collection can be dynamic:

• defined by one or several JSON schema(s). All objects instantiated with one of the JSON schemas will be part this collection.

And static:

• simply a list of cherry picked objects, from different schemas and organizations.

Also both static and dynamic.

Note: objects from a collection can be objects from different organizations.

Finally this will enable to share a set of related objects with a nice URL, like:

• http://objects.monarc.lu/collection/Security-referentials, or
• http://objects.monarc.lu/collection/UUID-of-the-collection

Add the possibility to fork an object from one organization to an other.

Don't use unspecific JSON Schema version

In your JSON Schema files (Such as https://objects.monarc.lu/schema/def/16), you're using a $schema value of http://json-schema.org/schema#.

This means that you will always use the latest published, which is really not what you want.

I'm not sure what your chosen implementation does when presented with an unknown dialect URI in $schema. It may just use the latest version.

If you werer to update the impelementation today, your schemas would not be processed correctly, and you'd likely end up with data passing validation when it should not, and errors being thrown when they should not be.

I don't know which draft/version you intended to use, but the implementation supports draft-03 through 2020-12.

If you put that URI in your browser, you'll be greeterd with the following message and a redirect...

Several redirections on json-schema.org are special cases:

The unversioned meta-schema URIs should no longer be used.
The vocabularies are represented by their specification text.
The "latest" specification URIs are for convenice of browser bookmarking only.

Create objects with API v2

It is already possible to create objects with the API v1 via PyMOSP.
Since Flask-Restless is no more maintained it is preferable to move the creation of objects to the API v2 (already exists).