Eop card browser/m1 data scaffolding

[ayman-art]

Description

• Implements web scaffolding and the basic mappings population for the Elevation of Privilege (EoP) edition (eop-5.0-en) including a reusable Python scaffolding script (scripts/scaffold_cards.py) to automate card folders generation, making it easy to onboard future editions and games.
• The PR completes the first milestone of the EoP Card Browser Project Adding a endpoint for each eop card and to the card browser #1322

Changes

Data scaffolding — cornucopia.owasp.org/data/cards/eop-cards-5.0-en/

• Created EoP edition data folder with 78 cards across 6 suits: spoofing, tampering, repudiation, information-disclosure, denial-of-service, elevation-of-privilege
• Each card folder contains two files:
  • explanation.md — pre-filled with a Scenario/Threat Modeling template
  • technical-note.md — intentionally empty, to be filled later

source/eop-mappings-5.0.yaml

• Populated mappings for all 78 cards with metadata: id, value, url, stride, stride_print
• For EoP, stride and stride_print map to the first letter and full name of the suit respectively (e.g. S / Spoofing)

scripts/scaffold_cards.py

• Created Python script to scaffold card files under cornucopia.owasp.org/data/cards/ by parsing card data files under source/
• Fixed docstring to accurately reflect the real output directory (cornucopia.owasp.org/data/cards/)
• Added path traversal prevention: all YAML-sourced path components (meta.edition, meta.version, meta.language, suit.name, card.id) are validated against allowlist regexes via safe_component(), and resolved paths are verified to stay within ROOT
• Added explicit validation for all required YAML keys (meta, meta.edition, meta.version, meta.language, suits, suit.name, suit.cards, card.id) to produce clear ValueError messages instead of cryptic KeyErrors

tests/scripts/scaffold_cards_utest.py

• Added 28 unit tests covering:
  • Correct directory layout and file content creation
  • Non-overwrite semantics (existing files are not modified on re-run)
  • Rejection of unsafe path components (traversal sequences, invalid formats, ...)
  • Acceptance of all valid input formats
  • Missing required YAML key detection for all required fields

tests/test_files/source/scaffold-cards-1.0-en.yaml

• Added a minimal YAML file used by the tests to show the full scaffolding flow

Screenshots

output files

unit test run output

Resolved or fixed issue: none (partial progress on #1322)

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: [e.g. GitHub CoPilot, ChatGPT, JetBrains Junie etc.]
  • LLMs and versions: [e.g. GPT-4.1, Claude Haiku 4.5, Gemini 2.5 Pro etc.]
  • Prompts: [Summarize the key prompts or instructions given to the AI tools]

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[qltysh]

❌ 1 blocking issue (1 total)

Tool	Category	Rule	Count
mypy	Lint	Library stubs not installed for "yaml"	1	❌

[Copilot]

Pull request overview

Adds initial data scaffolding needed to support browsing the Elevation of Privilege (EoP) 5.0 deck in the Cornucopia site, and introduces a Python utility to generate the per-card content folder structure from source/*-cards-*.yaml.

Changes:

• Populated source/eop-mappings-5.0.yaml with per-card metadata for all EoP suits/cards (IDs, URLs, STRIDE fields).
• Added scripts/scaffold_cards.py to scaffold cornucopia.owasp.org/data/cards/<edition>-cards-<version>-<lang>/... from a source cards YAML.
• Added scaffolded per-card Markdown placeholders under cornucopia.owasp.org/data/cards/eop-cards-5.0-en/ (explanation + technical note).

Reviewed changes

Copilot reviewed 80 out of 158 changed files in this pull request and generated 5 comments.

File	Description
source/eop-mappings-5.0.yaml	Adds full per-card mapping entries for the EoP 5.0 deck (IDs/URLs/stride metadata).
scripts/scaffold_cards.py	Introduces a generator script to create the expected card folder/file layout from source/*cards*.yaml.
cornucopia.owasp.org/data/cards/eop-cards-5.0-en/**	Adds scaffolded EoP card content folders (templates for explanation/technical notes).

[sydseter]

Please have a look at the Copilot comments.

[rewtd]

Summary

• Security │ Blocking - path traversal not yet fixed
• Code quality │ Minor issues (error handling, broad exception)
• Process │ Outstanding review comments not addressed

The scaffolding approach is sensible, but this PR will not be merged until the path traversal issue is fixed and comments addressed.

[Copilot]

Pull request overview

Copilot reviewed 82 out of 160 changed files in this pull request and generated 2 comments.

[qltysh]

Library stubs not installed for "yaml" [mypy:import-untyped]

[sydseter]

@ayman-art please look at the remaining comments

[Copilot]

Pull request overview

Copilot reviewed 82 out of 160 changed files in this pull request and generated 5 comments.

[sydseter]

@ayman-art getting close now.

[ayman-art]

@sydseter, Thank you, I extracted validation logic into separate methods to reduce the complexity, let me know if there is remaining work.