OWASP / Maturity-Models

Node application to help managing Maturity Models like the ones created by BSIMM and OpenSAMM
Apache License 2.0
188 stars 51 forks source link

Fix Radar bug in OwaspSAMM graph #164

Closed DinisCruz closed 8 years ago

DinisCruz commented 8 years ago

looks ok for BSIMM project

image

it is not working correctly on SAMM

image

DinisCruz commented 8 years ago

here is the test that replicates the bug

Data_Radar = require '../../../src/backend/Data-Radar'

describe 'bugs | backend | Data-Project', ->

  it 'Fix Radar bug in OwaspSAMM graph - #164', ->
    project    = 'samm'                                                                             # this value should be used

    using  new Data_Radar(), ->
      using @.get_Radar_Fields(), ->
        @.axes.assert_Size_Is 12
        @.axes.second().assert_Is     { axis: "Conf & Vuln Management" , xOffset: -110, value: 0}    # this is wrong (using BSIMM value)
        @.axes.second().assert_Is_Not {

once the schema was fixed, it was still not working, here is a test that shows the prob

  it 'Fix Radar bug in OwaspSAMM graph - #164 (prob with get_Radar_Data)', ->
    project = 'samm'
    team    = 'level-1'
    using  new Data_Radar(), ->
      using @.get_Radar_Data(project,team), ->
        @.axes.assert_Size_Is 12
        @.axes[0].value.assert_Is 1.125                      # ok
        (@.axes[0].value is undefined).assert_Is_False()     # ok
        (@.axes[1].value is undefined).assert_Is_True()      # this value should be set
        (@.axes[2].value is undefined).assert_Is_True()      # this value should be set

After finding the root cause of the problem (in map_Data function) here is a test that proves it

  it 'Fix Radar bug in OwaspSAMM graph - #164 (map_Data method)  ', ->
    keys_BSIMM = [ 'SM', 'CMVM', 'SE', 'PT', 'ST', 'CR', 'AA', 'SR', 'SFD', 'AM', 'T'  ,'CP' ]
    keys_SAMM  = [ 'SM', 'PC'  , 'EG', 'TA', 'SR', 'SA', 'DR', 'IR', 'ST' , 'IM', 'EH' ,'OE' ]
    data_Radar = new Data_Radar()
    data_Team  = new Data_Team()
    team_Data_SAAM   = data_Team.get_Team_Data 'samm' , 'level-1'
    team_Data_BSIMM  = data_Team.get_Team_Data 'bsimm', 'level-1'
    mapping_SAMM     = data_Radar.map_Data team_Data_SAAM
    mapping_BSIMM    = data_Radar.map_Data team_Data_BSIMM

    mapping_BSIMM._keys().assert_Is keys_BSIMM          # ok
    mapping_SAMM ._keys().assert_Is keys_BSIMM          # wrong
    mapping_SAMM ._keys().assert_Is_Not keys_SAMM       # wrong
DinisCruz commented 8 years ago

After fix test is changed to a regression test

image

DinisCruz commented 8 years ago

Done image