izar / pytm

A Pythonic framework for threat modeling
Other
876 stars 165 forks source link

Adding uniqueId and includeOrder #190

Closed per-oestergaard closed 2 years ago

per-oestergaard commented 2 years ago

I want to have stable references so I can synchronize the findings with an risk management tool and make the model a living document. To do so, I allow includeOrder to be set on any component (Actor etc.) and when that is set and the order is specified (not -1), the name is changed to contain the order and the findings are containing the order as well.

In this version, there is no validation of whether the order is unique. That is up to the person writing the Python to ensure that.

On finding object's UniqueId: When order is present and includeOrder is true on the object, this will be formatted as findingId:order. E.g. if finding is INP01 and order is 123, the value becomes INP01:123."

On object's includeOrder: If True and Order is set (not -1), the displayed name will be formatted as 'order:name'. If you make Order unique, this will give you a stable reference you can use for synchronization etc.

ghost commented 2 years ago

CodeSee Review Map:

Review these changes using an interactive CodeSee Map

Review in an interactive map

View more CodeSee Maps

Legend

CodeSee Map Legend

izar commented 2 years ago

thanks! I'll be looking into this this coming Saturday. Sorry for the delay!

per-oestergaard commented 2 years ago

@izar any news?

izar commented 2 years ago

SO sorry! Work is crazy these days and I can't find a minute to get to this. It is on the top of the pile though.

izar commented 2 years ago

hi @per-oestergaard - tests are failing, apparently the Element names are not matching. Functionality seems OK, just the tests. Can you take a look please?

per-oestergaard commented 2 years ago

@izar is this still an issue? When I run (powershell) -

@'
cd /pwd
ls -l
pip install -r requirements-dev.txt
pip install -r requirements.txt
pwd 
python3 -m unittest -v tests/test_pytmfunc.py
ls
'@ | set-content x.sh -NoNewline; docker run --rm -v "${pwd}:/pwd" python bash /pwd/x.sh

All tests passes

izar commented 2 years ago

It seems to still be an issue:

====================================================================== FAIL: test_duplicate_boundary_names_have_different_unique_names (tests.testprivate func.TestUniqueNames)

Traceback (most recent call last): File "/home/itarandach/Src/pytm/tests/test_private_func.py", line 28, in test_dupl icate_boundary_names_have_different_unique_names self.assertEqual(object_1_uniq_name, "boundary_foo_acf3059e70") AssertionError: 'boundary__acf3059e70' != 'boundary_foo_acf3059e70'

====================================================================== FAIL: test_dfd (tests.test_pytmfunc.TestTM)

Traceback (most recent call last): File "/home/itarandach/Src/pytm/tests/test_pytmfunc.py", line 125, in test_dfd self.assertEqual(output, expected) AssertionError: 'digr[383 chars]dary__88f2d9c06f {\n graph [\n [2872 chars]n\n}' != 'digr[383 chars]dary_Companynet_88f2d9c06f {\n graph [[3190 c hars]n\n}' digraph tm { graph [

➜ pytm git:(per-oestergaard-includeOrder) ✗ grep FAIL test.txt FAIL: test_write_once (tests.test_private_func.TestAttributes) FAIL: test_duplicate_boundary_names_have_different_unique_names (tests.test_private_func.TestUniqueNames) FAIL: test_dfd (tests.test_pytmfunc.TestTM) FAIL: test_dfd_duplicates_ignore (tests.test_pytmfunc.TestTM) FAIL: test_dfd_duplicates_raise (tests.test_pytmfunc.TestTM) FAIL: test_json_dumps (tests.test_pytmfunc.TestTM) FAIL: test_json_loads (tests.test_pytmfunc.TestTM) FAIL: test_multilevel_dfd (tests.test_pytmfunc.TestTM) FAIL: test_report (tests.test_pytmfunc.TestTM) FAIL: test_seq (tests.test_pytmfunc.TestTM) FAILED (failures=10, errors=1)

All fails apart from one seem to point baack to changes in the element's name.

per-oestergaard commented 2 years ago

Hi @izar

When I run the tests using run-unittests.ps1 (#194), it "works on my machine" - however, in docker so it should be the same elsewhere. The tests in #194 seem to work, so do we have an issue?