search

izar / pytm

A Pythonic framework for threat modeling
Other
891 stars 168 forks source link

Expose Actor and Asset lists in report template #150

Closed nozmore closed 3 years ago

nozmore commented 3 years ago

I was trying to use the report framework to mimc existing TM output where annotations for components (Assets in pytm) are separate from dataflows. I couldn't do this currently as Assets were only included in Elements so I replicated what was done for boundaries, flows and elements for assets.

Everything works locally in my manual tests, also updated json test data to reflect inclusion of the asset list and confirm all tests now pass.

One difference here is that the other TM._lists are actually used in the code for logic purposes, boundaries, flows, elements are looped thru in various points to process the TM. Currently this not needed for Assets but seems reasonable there may be a use case in the future.

I implemented the same for Actors.

Alternatively if we don't want to include additional TM._lists the report issue could be addressed by filtering elements in the TM.report method.

`assets = [ obj for obj in TM._elements if not isinstance(obj, Asset) ]

     data = {
         "tm": self,
         "dataflows": TM._flows,
         "threats": TM._threats,
         "findings": self.findings,
         "elements": TM._elements,
         "assets": assets,
         "boundaries": TM._boundaries,
         "data": TM._data,

`

nozmore commented 3 years ago

If we want to proceed with this approach I can do the same for Actors in this PR, otherwise I can revert and just filter elements in the report method.

ghost commented 3 years ago

DeepCode failed to analyze this pull request

Something went wrong despite trying multiple times, sorry about that. Please comment this pull request with "Retry DeepCode" to manually retry, or contact us so that a human can look into the issue.

nozmore commented 3 years ago

I updated the PR with a similar change for Actors so its ready to merge if desired.