|
| 1 | +import json |
| 2 | +from collections import defaultdict |
| 3 | +from os import linesep |
| 4 | + |
| 5 | +from dojo.models import Finding |
| 6 | + |
| 7 | + |
| 8 | +class ThreatComposerParser: |
| 9 | + """ |
| 10 | + Threat Composer JSON can be imported. See here for more info on this JSON format. |
| 11 | + """ |
| 12 | + |
| 13 | + PRIORITY_VALUES = ["Low", "Medium", "High"] |
| 14 | + STRIDE_VALUES = { |
| 15 | + "S": "Spoofing", |
| 16 | + "T": "Tampering", |
| 17 | + "R": "Repudiation", |
| 18 | + "I": "Information Disclosure", |
| 19 | + "D": "Denial of Service", |
| 20 | + "E": "Elevation of Privilege", |
| 21 | + } |
| 22 | + |
| 23 | + def get_scan_types(self): |
| 24 | + return ["ThreatComposer Scan"] |
| 25 | + |
| 26 | + def get_label_for_scan_types(self, scan_type): |
| 27 | + return "ThreatComposer Scan" |
| 28 | + |
| 29 | + def get_description_for_scan_types(self, scan_type): |
| 30 | + return "ThreatComposer report file can be imported in JSON format." |
| 31 | + |
| 32 | + def get_findings(self, file, test): |
| 33 | + data = json.load(file) |
| 34 | + findings = [] |
| 35 | + |
| 36 | + if "threats" not in data: |
| 37 | + msg = "Invalid ThreatComposer data" |
| 38 | + raise ValueError(msg) |
| 39 | + |
| 40 | + if "assumptionLinks" in data: |
| 41 | + assumptions = {assumption["id"]: assumption for assumption in data["assumptions"]} |
| 42 | + assumption_mitigation_links = defaultdict(list) |
| 43 | + assumption_threat_links = defaultdict(list) |
| 44 | + for link in data["assumptionLinks"]: |
| 45 | + linked_id = link["linkedId"] |
| 46 | + assumption_id = link["assumptionId"] |
| 47 | + assumption_type = link["type"] |
| 48 | + if assumption_id in assumptions: |
| 49 | + if assumption_type == "Threat": |
| 50 | + assumption_threat_links[linked_id].append(assumptions[assumption_id]) |
| 51 | + elif assumption_type == "Mitigation": |
| 52 | + assumption_mitigation_links[linked_id].append(assumptions[assumption_id]) |
| 53 | + |
| 54 | + if "mitigationLinks" in data: |
| 55 | + mitigations = { |
| 56 | + mitigation["id"]: { |
| 57 | + "mitigation": mitigation, |
| 58 | + "assumptions": assumption_mitigation_links[mitigation["id"]], |
| 59 | + } |
| 60 | + for mitigation in data["mitigations"] |
| 61 | + } |
| 62 | + mitigation_links = defaultdict(list) |
| 63 | + for link in data["mitigationLinks"]: |
| 64 | + linked_id = link["linkedId"] |
| 65 | + mitigation_id = link["mitigationId"] |
| 66 | + if mitigation_id in mitigations: |
| 67 | + mitigation_links[linked_id].append(mitigations[mitigation_id]) |
| 68 | + |
| 69 | + for threat in data["threats"]: |
| 70 | + |
| 71 | + if "threatAction" in threat: |
| 72 | + title = threat["threatAction"] |
| 73 | + severity, impact, comments = self.parse_threat_metadata(threat["metadata"]) |
| 74 | + description = self.to_description_text(threat, comments, assumption_threat_links[threat["id"]]) |
| 75 | + mitigation = self.to_mitigation_text(mitigation_links[threat["id"]]) |
| 76 | + unique_id_from_tool = threat["id"] |
| 77 | + vuln_id_from_tool = threat["numericId"] |
| 78 | + tags = threat["tags"] if "tags" in threat else [] |
| 79 | + |
| 80 | + finding = Finding( |
| 81 | + title=title, |
| 82 | + description=description, |
| 83 | + severity=severity, |
| 84 | + vuln_id_from_tool=vuln_id_from_tool, |
| 85 | + unique_id_from_tool=unique_id_from_tool, |
| 86 | + mitigation=mitigation, |
| 87 | + impact=impact, |
| 88 | + tags=tags, |
| 89 | + static_finding=True, |
| 90 | + dynamic_finding=False, |
| 91 | + ) |
| 92 | + |
| 93 | + match threat.get("status", "threatIdentified"): |
| 94 | + case "threatResolved": |
| 95 | + finding.active = False |
| 96 | + finding.is_mitigated = True |
| 97 | + finding.false_p = False |
| 98 | + case "threatResolvedNotUseful": |
| 99 | + finding.active = False |
| 100 | + finding.is_mitigated = True |
| 101 | + finding.false_p = True |
| 102 | + |
| 103 | + findings.append(finding) |
| 104 | + |
| 105 | + return findings |
| 106 | + |
| 107 | + def to_mitigation_text(self, mitigations): |
| 108 | + text = "" |
| 109 | + for i, current in enumerate(mitigations): |
| 110 | + mitigation = current["mitigation"] |
| 111 | + assumption_links = current["assumptions"] |
| 112 | + counti = i + 1 |
| 113 | + text += f"**Mitigation {counti} (ID: {mitigation['numericId']}, Status: {mitigation.get('status', 'Not defined')})**: {mitigation['content']}" |
| 114 | + |
| 115 | + for item in mitigation["metadata"]: |
| 116 | + if item["key"] == "Comments": |
| 117 | + text += f"\n*Comments*: {item['value'].replace(linesep, ' ')} " |
| 118 | + break |
| 119 | + |
| 120 | + for j, assumption in enumerate(assumption_links): |
| 121 | + countj = j + 1 |
| 122 | + text += f"\n- *Assumption {countj} (ID: {assumption['numericId']})*: {assumption['content'].replace(linesep, ' ')}" |
| 123 | + |
| 124 | + text += "\n" |
| 125 | + |
| 126 | + return text |
| 127 | + |
| 128 | + def parse_threat_metadata(self, metadata): |
| 129 | + severity = "Info" |
| 130 | + impact = None |
| 131 | + comments = None |
| 132 | + |
| 133 | + for item in metadata: |
| 134 | + if item["key"] == "Priority" and item["value"] in self.PRIORITY_VALUES: |
| 135 | + severity = item["value"] |
| 136 | + elif item["key"] == "STRIDE" and all(element in self.STRIDE_VALUES for element in item["value"]): |
| 137 | + impact = ", ".join([self.STRIDE_VALUES[element] for element in item["value"]]) |
| 138 | + elif item["key"] == "Comments": |
| 139 | + comments = item["value"] |
| 140 | + |
| 141 | + return severity, impact, comments |
| 142 | + |
| 143 | + def to_description_text(self, threat, comments, assumption_links): |
| 144 | + text = f"**Threat**: {threat['statement']}" |
| 145 | + if comments: |
| 146 | + text += f"\n*Comments*: {comments}" |
| 147 | + |
| 148 | + for i, assumption in enumerate(assumption_links): |
| 149 | + counti = i + 1 |
| 150 | + text += f"\n- *Assumption {counti} (ID: {assumption['numericId']})*: {assumption['content'].replace(linesep, ' ')}" |
| 151 | + |
| 152 | + return text |
0 commit comments