OWASP / OWASP/pytm

Care about missing SetOfProcess business logic

Open
#363 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
1.2k
Forks
229
PR merge metrics
No merged PRs in 30d

Description

The current implementation of SetOfPorcesses is correct visualization wise (double circle). But it does not model several processes internally properly I guess. (It is inheriting from Process but does not allow to model a SetOfProcesses "has" several Processes logical relationship yet):

class SetOfProcesses(Process):
    """A set of processes grouped together.

    Attributes:
        port (int): Default TCP port for incoming data flows
        protocol (str): Default network protocol for incoming data flows
        data (DataSet): pytm.Data object(s) in incoming data flows
        inputs (List[Dataflow]): Incoming Dataflows
        outputs (List[Dataflow]): Outgoing Dataflows
        onAWS (bool): Is this asset on AWS?
        handlesResources (bool): Does this asset handle resources?
        usesEnvironmentVariables (bool): Does this asset use environment variables?
        OS (str): Operating system
        codeType (str): Type of code running in this process
        implementsCommunicationProtocol (bool): Does this process implement a communication protocol?
        tracksExecutionFlow (bool): Does this process track execution flow?
        implementsAPI (bool): Does this process implement an API?
        environment (str): Environment for this process
        allowsClientSideScripting (bool): Does this process allow client-side scripting?
    """

    def __init__(self, name: str = None, **data):
        """Initialize a SetOfProcesses.

        Args:
            name (str): Name of the set of processes.
            **data: Optional properties:
                - port (int): Default TCP port for incoming data flows
                - protocol (str): Default network protocol for incoming data flows
                - data (DataSet): pytm.Data object(s) in incoming data flows
                - inputs (List[Dataflow]): Incoming Dataflows
                - outputs (List[Dataflow]): Outgoing Dataflows
                - onAWS (bool): Is this asset on AWS?
                - handlesResources (bool): Does this asset handle resources?
                - usesEnvironmentVariables (bool): Does this asset use environment variables?
                - OS (str): Operating system
                - codeType (str): Type of code running in this process
                - implementsCommunicationProtocol (bool): Does this process implement a communication protocol?
                - tracksExecutionFlow (bool): Does this process track execution flow?
                - implementsAPI (bool): Does this process implement an API?
                - environment (str): Environment for this process
                - allowsClientSideScripting (bool): Does this process allow client-side scripting?
        """
        super().__init__(name, **data)

    def _shape(self) -> str:
        """Get shape for DFD representation."""
        return "doublecircle"

This is not dramatic because one can implement an own, patched version of SetOfProcesses in own, custom models. Nevertheless it might be worth to communicate the need to do so to pytm users.

So far no other modeling + visualization for double cicle is existing (yet). In general pytm users can come up with own classes satisfying their particular modelling needs however. Again... this is rather a communication/documentation issue instead of a fundamental functional issue.

To prevent from confusion (probably especially related to people having experience with other threat modelling tools) it might be better to remove the SetOfProcesses completely.

The communication related part of this topic should be resolved with https://github.com/OWASP/pytm/issues/352 .

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the SetOfProcesses implementation and the Process relationship logic, then read issue #352 for the related communication work. Compare the existing double-circle visualization with how grouped model relationships are represented elsewhere. Before coding, resolve whether the goal is to add logical containment or remove SetOfProcesses; done should include an agreed behavior and corresponding tests or documentation.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
devtools
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.