search

stevespringett / threatmodel-sdk

A Java library for parsing and programmatically using threat models
77 stars 24 forks source link

source and destination are null for 'Data flows' which are marked as 'Out of scope' #10

Open narayanai opened 6 years ago

narayanai commented 6 years ago

Hi Team,

The 'Out of scope' property is missing in us.springett.threatmodeling.model.DataFlow.

Also, the 'source' and 'destination' values are null if the 'Out of scope' value is true in TM7 file.

Could you please help us in finding the solution for validations on Out of scope.

thanks, Narayana

stevespringett commented 6 years ago

@narayanai can you attach a sample tm7 so I can take a look?

narayanai commented 6 years ago

@stevespringett i've attached a sample TM7 where the Generic Data Flow is out of scope. While parsing the ThreatModel, I am getting NULL for source and destination. Could you please verify and suggest the solution.

Dataflow_Is_OutOfScope.zip

narayanai commented 6 years ago

@stevespringett, i've gone through the source code. It seems the source and destination ids are extracted from threat list to attach to Dataflow. If there are no threats in a dataflow, source and destination are null. Can i make necessary changes to API to add source and destination and attach the files here for next version. Please suggest :)