def test_dfd(self):
dir_path = os.path.dirname(os.path.realpath(__file__))
with open(os.path.join(dir_path, 'dfd.dot')) as x:
expected = x.read().strip()
random.seed(0)
TM.reset()
tm = TM("my test tm", description="aaa")
internet = Boundary("Internet")
server_db = Boundary("Server/DB")
user = Actor("User", inBoundary=internet)
web = Server("Web Server")
db = Datastore("SQL Database", inBoundary=server_db)
Dataflow(user, web, "User enters comments (*)")
Dataflow(web, db, "Insert query with comments")
Dataflow(db, web, "Retrieve comments")
Dataflow(web, user, "Show comments (*)")
tm.check()
with captured_output() as (out, err):
tm.dfd()
output = out.getvalue().strip()
self.maxDiff = None
self.assertEqual(output, expected)
def test_dfd_duplicates_raise(self):
random.seed(0)
TM.reset()
tm = TM("my test tm", description="aaa", onDuplicates=Action.RESTRICT)
internet = Boundary("Internet")
server_db = Boundary("Server/DB")
user = Actor("User", inBoundary=internet)
web = Server("Web Server")
db = Datastore("SQL Database", inBoundary=server_db)
Dataflow(user, web, "User enters comments (*)")
Dataflow(user, web, "User views comments")
Dataflow(web, db, "Insert query with comments")
Dataflow(web, db, "Select query")
Dataflow(db, web, "Retrieve comments")
Dataflow(web, user, "Show comments (*)")
e = re.escape(
"Duplicate Dataflow found between Actor(User) "
"and Server(Web Server): Dataflow(User enters comments (*)) "
"is same as Dataflow(User views comments)"
)
with self.assertRaisesRegex(ValueError, e):
tm.check()
def test_multilevel_dfd(self):
random.seed(0)
dir_path = os.path.dirname(os.path.realpath(__file__))
install_path = os.path.dirname(os.path.realpath(pytm.__file__))
with open(os.path.join(dir_path, "dfd_level0.txt")) as x:
level_0 = (
x.read().strip().replace("INSTALL_PATH", os.path.dirname(install_path))
)
with open(os.path.join(dir_path, "dfd_level1.txt")) as x:
level_1 = (
x.read().strip().replace("INSTALL_PATH", os.path.dirname(install_path))
)
TM.reset()
tm = TM("my test tm", description="aaa")
tm.isOrdered = False
internet = Boundary("Internet")
server_db = Boundary("Server/DB")
user = Actor("User", inBoundary=internet, levels=0)
web = Server("Web Server")
db = Datastore("SQL Database", inBoundary=server_db)
Dataflow(user, web, "User enters comments (*)", note="bbb")
Dataflow(web, db, "Insert query with comments", note="ccc")
Dataflow(db, web, "Retrieve comments")
Dataflow(web, user, "Show comments (*)")
self.assertTrue(tm.check())
output = tm.dfd(levels={0})
with open(os.path.join(dir_path, "0.txt"), "w") as x:
x.write(output)
self.assertEqual(output, level_0)
TM.reset()
tm = TM("my test tm", description="aaa")
tm.isOrdered = False
internet = Boundary("Internet")
server_db = Boundary("Server/DB")
user = Actor("User", inBoundary=internet, levels=1)
web = Server("Web Server")
db = Datastore("SQL Database", inBoundary=server_db)
Dataflow(user, web, "User enters comments (*)", note="bbb")
Dataflow(web, db, "Insert query with comments", note="ccc")
Dataflow(db, web, "Retrieve comments")
Dataflow(web, user, "Show comments (*)")
self.assertTrue(tm.check())
output = tm.dfd(levels={1})
with open(os.path.join(dir_path, "1.txt"), "w") as x:
x.write(output)
self.maxDiff = None
self.assertEqual(output, level_1)
def test_dfd(self):
dir_path = os.path.dirname(os.path.realpath(__file__))
with open(os.path.join(dir_path, "dfd.dot")) as x:
expected = x.read().strip()
random.seed(0)
TM.reset()
tm = TM("my test tm", description="aaa")
internet = Boundary("Internet")
net = Boundary("Company net")
dmz = Boundary("dmz", inBoundary=net)
backend = Boundary("backend", inBoundary=net)
user = Actor("User", inBoundary=internet)
gw = Server("Gateway", inBoundary=dmz)
web = Server("Web Server", inBoundary=backend)
db = Datastore("SQL Database", inBoundary=backend)
Dataflow(user, gw, "User enters comments (*)")
Dataflow(gw, web, "Request")
Dataflow(web, db, "Insert query with comments")
Dataflow(db, web, "Retrieve comments")
Dataflow(web, gw, "Response")
Dataflow(gw, user, "Show comments (*)")
self.assertTrue(tm.check())
output = tm.dfd()
self.maxDiff = None
self.assertEqual(output, expected)
def test_seq_unused(self):
random.seed(0)
dir_path = os.path.dirname(os.path.realpath(__file__))
with open(os.path.join(dir_path, "seq_unused.plantuml")) as x:
expected = x.read().strip()
TM.reset()
tm = TM("my test tm", description="aaa", ignoreUnused=True)
internet = Boundary("Internet")
server_db = Boundary("Server/DB")
user = Actor("User", inBoundary=internet)
web = Server("Web Server")
db = Datastore("SQL Database", inBoundary=server_db)
Lambda("Unused Lambda")
Dataflow(user, web, "User enters comments (*)", note="bbb")
Dataflow(web, db, "Insert query with comments", note="ccc")
Dataflow(db, web, "Retrieve comments")
Dataflow(web, user, "Show comments (*)")
self.assertTrue(tm.check())
output = tm.seq()
self.maxDiff = None
self.assertEqual(output, expected)
def test_report(self):
random.seed(0)
dir_path = os.path.dirname(os.path.realpath(__file__))
with open(os.path.join(dir_path, "output.md")) as x:
expected = x.read().strip()
TM.reset()
tm = TM("my test tm",
description="aaa",
threatsFile="pytm/threatlib/threats.json")
tm.isOrdered = True
internet = Boundary("Internet")
server_db = Boundary("Server/DB")
user = Actor("User", inBoundary=internet)
web = Server("Web Server")
func = Lambda("Lambda func")
worker = Process("Task queue worker")
db = Datastore("SQL Database", inBoundary=server_db)
Dataflow(user,
web,
"User enters comments (*)",
note="bbb",
data="auth cookie")
Dataflow(web, db, "Insert query with comments", note="ccc")
Dataflow(web, func, "Call func")
Dataflow(db, web, "Retrieve comments")
Dataflow(web, user, "Show comments (*)")
Dataflow(worker, db, "Query for tasks")
self.assertTrue(tm.check())
output = tm.report("docs/template.md")
self.maxDiff = None
self.assertEqual(output.strip(), expected.strip())
def test_json_dumps(self):
random.seed(0)
dir_path = os.path.dirname(os.path.realpath(__file__))
with open(os.path.join(dir_path, "output.json")) as x:
expected = x.read().strip()
TM.reset()
tm = TM("my test tm",
description="aaa",
threatsFile="pytm/threatlib/threats.json")
tm.isOrdered = True
internet = Boundary("Internet")
server_db = Boundary("Server/DB")
user = Actor("User", inBoundary=internet)
web = Server("Web Server")
func = Lambda("Lambda func")
worker = Process("Task queue worker")
db = Datastore("SQL Database", inBoundary=server_db)
cookie = Data(
name="auth cookie",
description="auth cookie description",
classification=Classification.PUBLIC,
)
Dataflow(user,
web,
"User enters comments (*)",
note="bbb",
data=cookie)
Dataflow(web, db, "Insert query with comments", note="ccc")
Dataflow(web, func, "Call func")
Dataflow(db, web, "Retrieve comments")
Dataflow(web, user, "Show comments (*)")
Dataflow(worker, db, "Query for tasks")
self.assertTrue(tm.check())
output = json.dumps(tm,
default=to_serializable,
sort_keys=True,
indent=4)
with open(os.path.join(dir_path, "output_current.json"), "w") as x:
x.write(output)
self.maxDiff = None
self.assertEqual(output, expected)
