def test_resolve(self):
random.seed(0)
TM.reset()
tm = TM("my test tm", description="aaa")
internet = Boundary("Internet")
server_db = Boundary("Server/DB")
user = Actor("User", inBoundary=internet, inScope=False)
web = Server("Web Server")
db = Datastore("SQL Database", inBoundary=server_db)
req = Dataflow(user, web, "User enters comments (*)")
query = Dataflow(web, db, "Insert query with comments")
results = Dataflow(db, web, "Retrieve comments")
resp = Dataflow(web, user, "Show comments (*)")
TM._BagOfThreats = [
Threat(SID=klass, target=klass)
for klass in ["Actor", "Server", "Datastore", "Dataflow"]
]
tm.resolve()
self.maxDiff = None
self.assertListEqual([f.id for f in tm.findings], [
'Server', 'Datastore', 'Dataflow', 'Dataflow', 'Dataflow',
'Dataflow'
])
self.assertListEqual([f.id for f in user.findings], [])
self.assertListEqual([f.id for f in web.findings], ["Server"])
self.assertListEqual([f.id for f in db.findings], ["Datastore"])
self.assertListEqual([f.id for f in req.findings], ["Dataflow"])
self.assertListEqual([f.id for f in query.findings], ["Dataflow"])
self.assertListEqual([f.id for f in results.findings], ["Dataflow"])
self.assertListEqual([f.id for f in resp.findings], ["Dataflow"])
def test_overrides(self):
random.seed(0)
TM.reset()
tm = TM("my test tm", description="aaa")
internet = Boundary("Internet")
server_db = Boundary("Server/DB")
user = Actor("User", inBoundary=internet, inScope=False)
web = Server(
"Web Server",
overrides=[
Finding(threat_id="Server",
response="mitigated by adding TLS"),
],
)
db = Datastore(
"SQL Database",
inBoundary=server_db,
overrides=[
Finding(
threat_id="Datastore",
response="accepted since inside the trust boundary",
),
],
)
req = Dataflow(user, web, "User enters comments (*)")
query = Dataflow(web, db, "Insert query with comments")
results = Dataflow(db, web, "Retrieve comments")
resp = Dataflow(web, user, "Show comments (*)")
TM._threats = [
Threat(SID="Server", target="Server", condition="False"),
Threat(SID="Datastore", target="Datastore"),
]
tm.resolve()
self.maxDiff = None
self.assertEqual(
[f.threat_id for f in tm.findings],
["Server", "Datastore"],
)
self.assertEqual([f.response for f in web.findings],
["mitigated by adding TLS"])
self.assertEqual(
[f.response for f in db.findings],
["accepted since inside the trust boundary"],
)
def test_exclude_threats_ignore(self):
random.seed(0)
TM.reset()
excluded_threat = "INP03"
remaining_threat = "AA01"
TM._threatsExcluded = [excluded_threat]
tm = TM("my test tm", description="aaa")
web = Server("Web")
web.sanitizesInput = False
web.encodesOutput = False
self.assertTrue(threats[excluded_threat].apply(web))
self.assertTrue(threats[remaining_threat].apply(web))
tm.resolve()
self.assertNotIn(excluded_threat, [t.threat_id for t in tm.findings])
self.assertIn(remaining_threat, [t.threat_id for t in tm.findings])
