simonec73 / threatsmanager

Threats Manager Platform Core libraries and SDK
MIT License
72 stars 14 forks source link

Apply Schema Additional properties not reflecting uniformly in Item template #21

Closed rsrinivasanhome closed 2 years ago

rsrinivasanhome commented 2 years ago

Describe the bug To make things clear I am not sure if this is a bug or I am doing something wrong. I do not see all the manually added properties to my item template.

To Reproduce Steps to reproduce the behavior:

  1. I have added some properties to one of my items templates - ios App. I then clicked on apply schema. View screen shot below image

  2. I had previously dragged the item template- ios App on my diagram and I am able to see the additional properties

Extra Properties Visible

  1. Now I create a new instance of the ios app. It is missing the newly added properties Secondiosappnotvisible

Expected behavior The newly added properties should be visible when even I am using the ios app in my threat model. Now I see it the first time only.

Screenshots If applicable, add

screenshots to help explain your problem.

Additional context Add any other context about the problem here.

simonec73 commented 2 years ago

The behavior is by design. Please note that the iOS App property schema is applied to Processes, while the iOS App you created last is an External Interactor. I guess that the problem is that you have more iOS Apps going by the same name. You may need to change the name in the original template, for example renaming the External Interactor one to "[External] iOS App".

By the way, I've double checked, creating a file from scratch, and I confirm it works.

rsrinivasanhome commented 2 years ago

You analysis is correct . I fell back to a previous version which I had corrected using the microsoft threat modeling template and now after I import the template it sort of worked for ios template but did not work for the android one not sure why.

I will now try to add the properties in the microsoft threat modeling template and then import them

I tried merging my previous work on threats manager studio onto the fresh template I have now created from the corrected microsoft template . Some of my observations 1) When I try to to merge on a .tm file I do not see an action or differences popping up . Does this merge immediately ? 2) When I import the mitigations alone then link between the threat event is cut.

Can we use notepad to perform the merge or copy the rules manually ?

simonec73 commented 2 years ago
  1. Merge is immediate. I will add a message.
  2. Yes, this is by design because the link is from the threat to the mitigation, not vice-versa. This can change. Let me insert it in the backlog. I will not be able to implement it immediately, though.

Using notepad to merge the rules is possible, but not recommended. The result may not work. There are a lot of possible things which may go wrong.