Care about missing SetOfProcess business logic
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 1.2k
- Forks
- 229
- PR merge metrics
- No merged PRs in 30d
Description
The current implementation of SetOfPorcesses is correct visualization wise (double circle). But it does not model several processes internally properly I guess. (It is inheriting from Process but does not allow to model a SetOfProcesses "has" several Processes logical relationship yet):
class SetOfProcesses(Process):
"""A set of processes grouped together.
Attributes:
port (int): Default TCP port for incoming data flows
protocol (str): Default network protocol for incoming data flows
data (DataSet): pytm.Data object(s) in incoming data flows
inputs (List[Dataflow]): Incoming Dataflows
outputs (List[Dataflow]): Outgoing Dataflows
onAWS (bool): Is this asset on AWS?
handlesResources (bool): Does this asset handle resources?
usesEnvironmentVariables (bool): Does this asset use environment variables?
OS (str): Operating system
codeType (str): Type of code running in this process
implementsCommunicationProtocol (bool): Does this process implement a communication protocol?
tracksExecutionFlow (bool): Does this process track execution flow?
implementsAPI (bool): Does this process implement an API?
environment (str): Environment for this process
allowsClientSideScripting (bool): Does this process allow client-side scripting?
"""
def __init__(self, name: str = None, **data):
"""Initialize a SetOfProcesses.
Args:
name (str): Name of the set of processes.
**data: Optional properties:
- port (int): Default TCP port for incoming data flows
- protocol (str): Default network protocol for incoming data flows
- data (DataSet): pytm.Data object(s) in incoming data flows
- inputs (List[Dataflow]): Incoming Dataflows
- outputs (List[Dataflow]): Outgoing Dataflows
- onAWS (bool): Is this asset on AWS?
- handlesResources (bool): Does this asset handle resources?
- usesEnvironmentVariables (bool): Does this asset use environment variables?
- OS (str): Operating system
- codeType (str): Type of code running in this process
- implementsCommunicationProtocol (bool): Does this process implement a communication protocol?
- tracksExecutionFlow (bool): Does this process track execution flow?
- implementsAPI (bool): Does this process implement an API?
- environment (str): Environment for this process
- allowsClientSideScripting (bool): Does this process allow client-side scripting?
"""
super().__init__(name, **data)
def _shape(self) -> str:
"""Get shape for DFD representation."""
return "doublecircle"
This is not dramatic because one can implement an own, patched version of SetOfProcesses in own, custom models. Nevertheless it might be worth to communicate the need to do so to pytm users.
So far no other modeling + visualization for double cicle is existing (yet). In general pytm users can come up with own classes satisfying their particular modelling needs however. Again... this is rather a communication/documentation issue instead of a fundamental functional issue.
To prevent from confusion (probably especially related to people having experience with other threat modelling tools) it might be better to remove the SetOfProcesses completely.
The communication related part of this topic should be resolved with https://github.com/OWASP/pytm/issues/352 .
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the SetOfProcesses implementation and the Process relationship logic, then read issue #352 for the related communication work. Compare the existing double-circle visualization with how grouped model relationships are represented elsewhere. Before coding, resolve whether the goal is to add logical containment or remove SetOfProcesses; done should include an agreed behavior and corresponding tests or documentation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- devtools
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100