Open per-oestergaard opened 2 years ago
Make tm.threatsFile
a list of files, which will be merged via dict.update
, something like
with open(self.threatsFile[0], "r", encoding="utf8") as threat_file:
threats_json = json.load(threat_file)
for file in self.threatsFile[1:]:
with open(file, "r", encoding="utf8") as threat_file:
t = json.load(threat_file)
threats_json.update(t)
Use the default threat file if tm.threatsFile
is not set, by setting it to [pytm.pytm.default_threats]
If you want to define your own threats you can reuse pytm.pytm.default_threats
by writing
tm.threatsFile = [pytm.pytm.default_threats, "path/to/my/threat_lib.json"]
Or not use the default and write
tm.threatsFile = ["path/to/my/threat_lib.json", "path/to/my/threat_lib_for_java.json"]
By using pytm.pytm.default_threats
you don't have to use some magic and it is quite obvious what would happen.
For backwards compatibility it should be possible to also define the threats via the old way
tm.threatsFile = "path/to/my/threat_lib.json"
The current threatsFile property of class TM is defaulted to -
If I want to add extra rules keeping the built-in threats, I am challenged as setting threatsfile resets the existing threats. E.g., threatsfile must have all threats in a single file. To work around this, I have been using -
Not something I wanted to repeat all over ;).
Hence, I was looking at creating a pull request on a better approach. However, what would be the best approach?
Please advice.