search

OWASP / threat-dragon

An open source threat modeling tool from OWASP
https://owasp.org/www-project-threat-dragon/
Apache License 2.0
856 stars 231 forks source link

Gitlab integration can't handle nested projects #1003

Closed ch-lepp closed 2 weeks ago

ch-lepp commented 3 weeks ago

Describe the bug: I have a rather deeply nested repo tree in my gitlab. So imagine not "OWASP/threat-dragon" but "OWASP/add/some/more/layers/threat-dragon"...

This results in a 404 from the threat-dragon backend, when I try to query the branches. The URL in my browser looks like this: http://localhost:3000/#/git/gitlab/OWASP%2Fadd%2Fsome%2Fmore%2Flayers%2Fthreat-dragon/branch But what of course ultimately reaches the backend is this: http://localhost:3000/#/git/gitlab/OWASP/add/some/more/layers/threat-dragon/branches?page=1 And for that URI the backend has no proper route defined...

Expected behaviour: The gitlab integration should be able to handle deeply nested repo trees.

Environment:

To Reproduce: Have threat-dragon integrated with gitlab and try to open a repo that is more than to layers deep.

Any additional context, screenshots, etc:

It seems to me the solution here requires changing the API approach entirely and switching from the current resource param approach (domain.com/:param/create) to propper query params (domain.com/create?param=:param). Since that is a rather massive refactoring, I am hesitating to open a PR myself...

ch-lepp commented 2 weeks ago

Ah, I was wrong. There is no need to refactor the current API behavior.

One only needs to properly url-encode every :param in the url...