def test_resolve(self): random.seed(0) TM.reset() tm = TM("my test tm", description="aaa") internet = Boundary("Internet") server_db = Boundary("Server/DB") user = Actor("User", inBoundary=internet, inScope=False) web = Server("Web Server") db = Datastore("SQL Database", inBoundary=server_db) req = Dataflow(user, web, "User enters comments (*)") query = Dataflow(web, db, "Insert query with comments") results = Dataflow(db, web, "Retrieve comments") resp = Dataflow(web, user, "Show comments (*)") TM._BagOfThreats = [ Threat(SID=klass, target=klass) for klass in ["Actor", "Server", "Datastore", "Dataflow"] ] tm.resolve() self.maxDiff = None self.assertListEqual([f.id for f in tm.findings], [ 'Server', 'Datastore', 'Dataflow', 'Dataflow', 'Dataflow', 'Dataflow' ]) self.assertListEqual([f.id for f in user.findings], []) self.assertListEqual([f.id for f in web.findings], ["Server"]) self.assertListEqual([f.id for f in db.findings], ["Datastore"]) self.assertListEqual([f.id for f in req.findings], ["Dataflow"]) self.assertListEqual([f.id for f in query.findings], ["Dataflow"]) self.assertListEqual([f.id for f in results.findings], ["Dataflow"]) self.assertListEqual([f.id for f in resp.findings], ["Dataflow"])
def test_overrides(self): random.seed(0) TM.reset() tm = TM("my test tm", description="aaa") internet = Boundary("Internet") server_db = Boundary("Server/DB") user = Actor("User", inBoundary=internet, inScope=False) web = Server( "Web Server", overrides=[ Finding(threat_id="Server", response="mitigated by adding TLS"), ], ) db = Datastore( "SQL Database", inBoundary=server_db, overrides=[ Finding( threat_id="Datastore", response="accepted since inside the trust boundary", ), ], ) req = Dataflow(user, web, "User enters comments (*)") query = Dataflow(web, db, "Insert query with comments") results = Dataflow(db, web, "Retrieve comments") resp = Dataflow(web, user, "Show comments (*)") TM._threats = [ Threat(SID="Server", target="Server", condition="False"), Threat(SID="Datastore", target="Datastore"), ] tm.resolve() self.maxDiff = None self.assertEqual( [f.threat_id for f in tm.findings], ["Server", "Datastore"], ) self.assertEqual([f.response for f in web.findings], ["mitigated by adding TLS"]) self.assertEqual( [f.response for f in db.findings], ["accepted since inside the trust boundary"], )
def test_exclude_threats_ignore(self): random.seed(0) TM.reset() excluded_threat = "INP03" remaining_threat = "AA01" TM._threatsExcluded = [excluded_threat] tm = TM("my test tm", description="aaa") web = Server("Web") web.sanitizesInput = False web.encodesOutput = False self.assertTrue(threats[excluded_threat].apply(web)) self.assertTrue(threats[remaining_threat].apply(web)) tm.resolve() self.assertNotIn(excluded_threat, [t.threat_id for t in tm.findings]) self.assertIn(remaining_threat, [t.threat_id for t in tm.findings])