Cannot override findings, threats remain, DFD impacted, exception thrown for overrides len > 1 #222
Description
Using the included tm.py as an example here, not the code snippet from the README under 'creating a threat model'.
When I use tm.py to build an example report and DFD everything is fine. When I try to add a single override as demonstrated in the README section overrides the threat is still listed under the dataflow for user_to_web, it is not overridden.
The DFD generated from this threat model now has an invalid element because the Finding does not realise what element is referring to when it is initialised. Given the Finding is listed in the overrides for the dataflow it should know what element it is referring to.
In addition to this, if an attempt is made to list more than one Finding in overrides, which expects a list of Findings in varFindings(), an exception is thrown:
❯ ./tm.py --report docs/advanced_template.md | pandoc -f markdown -t html > tm/report.html
Traceback (most recent call last):
File "/Users/dev_user/PythonLibs/pytm/./tm.py", line 154, in <module>
tm.process()
File "/Users/dev_user/PythonLibs/pytm/pytm/pytm.py", line 1030, in process
self.check()
File "/Users/dev_user/PythonLibs/pytm/pytm/pytm.py", line 839, in check
raise ValueError(
ValueError: Finding have more than one override in Dataflow(User enters comments (*))
The example provided in the README uses threat SID INP02 which isn't a threat identified for that dataflow, I have used DE01 on its own to get the result above with invalid element in the DFD and remains as an active threat in the generated report.
When overriding multiple threats I used threats identified in the report to ensure relevance and uniqueness. The user_to_web overrides is as follows in my altered tm.py:
user_to_web = Dataflow(user, web, "User enters comments (*)")
user_to_web.protocol = "HTTP"
user_to_web.dstPort = 80
user_to_web.data = comments_in_text
user_to_web.note = "This is a simple web app\nthat stores and retrieves user comments."
user_to_web.overrides = [
Finding(
id="DE01",
CVSS="9.1",
response="""**To Mitigate**: run a memory sanitizer to validate the binary""",
),
Finding(
id="AC05",
CVSS="9.2",
response="""**To Mitigate**: run a memory sanitizer to validate the binary""",
),
Finding(
id="DE03",
CVSS="9.3",
response="""**To Mitigate**: run a memory sanitizer to validate the binary""",
),
Finding(
id="CR06",
CVSS="9.4",
response="""**To Mitigate**: run a memory sanitizer to validate the binary""",
)
]