This repository was archived by the owner on Jun 17, 2019. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 2
/
Copy pathpythreatspec.html
730 lines (669 loc) · 46.8 KB
/
pythreatspec.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html><head><title>Python: module pythreatspec</title>
<meta charset="utf-8">
</head><body bgcolor="#f0f0f8">
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="heading">
<tr bgcolor="#7799ee">
<td valign=bottom> <br>
<font color="#ffffff" face="helvetica, arial"> <br><big><big><strong>pythreatspec</strong></big></big></font></td
><td align=right valign=bottom
><font color="#ffffff" face="helvetica, arial"><a href=".">index</a><br><a href="file:/Users/dqm890/src/threatspec/pythreatspec/pythreatspec/pythreatspec.py">/Users/dqm890/src/threatspec/pythreatspec/pythreatspec/pythreatspec.py</a></font></td></tr></table>
<p><tt>Reference implementation of ThreatSpec in Python.<br>
<br>
ThreatSpec is a tool for continuous threat modelling through code. This is<br>
the Python reference implementation that can be used to parse Python source files<br>
using the main script, but also source files from any language using the universal.py<br>
script.<br>
<br>
The output of this tool is an intermediate representation JSON file that can be parsed<br>
by reporting or visualisation tools. These can be combined with other intermediate <br>
representation JSON files, even from different languages, to create a Threat Model for<br>
larger projects.<br>
<br>
See https://threatspec.org for details.<br>
<br>
Copyright (c) 2017 ThreatSpec<br>
<br>
This software may be modified and distributed under the terms<br>
of the MIT license. See the LICENSE file for details.</tt></p>
<p>
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
<tr bgcolor="#aa55cc">
<td colspan=3 valign=bottom> <br>
<font color="#ffffff" face="helvetica, arial"><big><strong>Modules</strong></big></font></td></tr>
<tr><td bgcolor="#aa55cc"><tt> </tt></td><td> </td>
<td width="100%"><table width="100%" summary="list"><tr><td width="25%" valign=top><a href="ast.html">ast</a><br>
</td><td width="25%" valign=top><a href="os.html">os</a><br>
</td><td width="25%" valign=top><a href="re.html">re</a><br>
</td><td width="25%" valign=top><a href="time.html">time</a><br>
</td></tr></table></td></tr></table><p>
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
<tr bgcolor="#ee77aa">
<td colspan=3 valign=bottom> <br>
<font color="#ffffff" face="helvetica, arial"><big><strong>Classes</strong></big></font></td></tr>
<tr><td bgcolor="#ee77aa"><tt> </tt></td><td> </td>
<td width="100%"><dl>
<dt><font face="helvetica, arial"><a href="__builtin__.html#object">__builtin__.object</a>
</font></dt><dd>
<dl>
<dt><font face="helvetica, arial"><a href="pythreatspec.html#PTSDfd">PTSDfd</a>
</font></dt><dt><font face="helvetica, arial"><a href="pythreatspec.html#PTSDfdEdge">PTSDfdEdge</a>
</font></dt><dt><font face="helvetica, arial"><a href="pythreatspec.html#PTSElement">PTSElement</a>
</font></dt><dd>
<dl>
<dt><font face="helvetica, arial"><a href="pythreatspec.html#PTSAcceptance">PTSAcceptance</a>
</font></dt><dt><font face="helvetica, arial"><a href="pythreatspec.html#PTSExposure">PTSExposure</a>
</font></dt><dt><font face="helvetica, arial"><a href="pythreatspec.html#PTSMitigation">PTSMitigation</a>
</font></dt><dt><font face="helvetica, arial"><a href="pythreatspec.html#PTSTransfer">PTSTransfer</a>
</font></dt></dl>
</dd>
<dt><font face="helvetica, arial"><a href="pythreatspec.html#PTSProperty">PTSProperty</a>
</font></dt><dd>
<dl>
<dt><font face="helvetica, arial"><a href="pythreatspec.html#PTSBoundary">PTSBoundary</a>
</font></dt><dt><font face="helvetica, arial"><a href="pythreatspec.html#PTSComponent">PTSComponent</a>
</font></dt><dt><font face="helvetica, arial"><a href="pythreatspec.html#PTSThreat">PTSThreat</a>
</font></dt></dl>
</dd>
<dt><font face="helvetica, arial"><a href="pythreatspec.html#PTSReference">PTSReference</a>
</font></dt><dt><font face="helvetica, arial"><a href="pythreatspec.html#PTSReview">PTSReview</a>
</font></dt><dt><font face="helvetica, arial"><a href="pythreatspec.html#PTSSourceTag">PTSSourceTag</a>
</font></dt><dt><font face="helvetica, arial"><a href="pythreatspec.html#PyThreatspecParser">PyThreatspecParser</a>
</font></dt><dt><font face="helvetica, arial"><a href="pythreatspec.html#PyThreatspecReporter">PyThreatspecReporter</a>
</font></dt></dl>
</dd>
</dl>
<p>
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
<tr bgcolor="#ffc8d8">
<td colspan=3 valign=bottom> <br>
<font color="#000000" face="helvetica, arial"><a name="PTSAcceptance">class <strong>PTSAcceptance</strong></a>(<a href="pythreatspec.html#PTSElement">PTSElement</a>)</font></td></tr>
<tr bgcolor="#ffc8d8"><td rowspan=2><tt> </tt></td>
<td colspan=2><tt>Represents an @accepts tag.<br> </tt></td></tr>
<tr><td> </td>
<td width="100%"><dl><dt>Method resolution order:</dt>
<dd><a href="pythreatspec.html#PTSAcceptance">PTSAcceptance</a></dd>
<dd><a href="pythreatspec.html#PTSElement">PTSElement</a></dd>
<dd><a href="__builtin__.html#object">__builtin__.object</a></dd>
</dl>
<hr>
Methods defined here:<br>
<dl><dt><a name="PTSAcceptance-__init__"><strong>__init__</strong></a>(self, boundary, component, threat, acceptance, refs<font color="#909090">=[]</font>)</dt><dd><tt>Initialise the <a href="#PTSAcceptance">PTSAcceptance</a> class.</tt></dd></dl>
<dl><dt><a name="PTSAcceptance-export_to_json"><strong>export_to_json</strong></a>(self)</dt><dd><tt>Return a JSON representation of this class.</tt></dd></dl>
<hr>
Data descriptors inherited from <a href="pythreatspec.html#PTSElement">PTSElement</a>:<br>
<dl><dt><strong>__dict__</strong></dt>
<dd><tt>dictionary for instance variables (if defined)</tt></dd>
</dl>
<dl><dt><strong>__weakref__</strong></dt>
<dd><tt>list of weak references to the object (if defined)</tt></dd>
</dl>
</td></tr></table> <p>
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
<tr bgcolor="#ffc8d8">
<td colspan=3 valign=bottom> <br>
<font color="#000000" face="helvetica, arial"><a name="PTSBoundary">class <strong>PTSBoundary</strong></a>(<a href="pythreatspec.html#PTSProperty">PTSProperty</a>)</font></td></tr>
<tr bgcolor="#ffc8d8"><td rowspan=2><tt> </tt></td>
<td colspan=2><tt>A ThreatSpec boundary.<br>
<br>
This is a property class that holds a trust boundary. In the intermediate<br>
JSON output files these are grouped together and can be shared between source<br>
files or even projects. For example:<br>
<br>
"boundaries": {<br>
"@auth": {<br>
"name": "Authentication / EC2"<br>
},<br>
"@external": {<br>
"name": "External"<br>
}, <br>
<br>
Attributes are inherited from <a href="#PTSProperty">PTSProperty</a>.<br> </tt></td></tr>
<tr><td> </td>
<td width="100%"><dl><dt>Method resolution order:</dt>
<dd><a href="pythreatspec.html#PTSBoundary">PTSBoundary</a></dd>
<dd><a href="pythreatspec.html#PTSProperty">PTSProperty</a></dd>
<dd><a href="__builtin__.html#object">__builtin__.object</a></dd>
</dl>
<hr>
Methods defined here:<br>
<dl><dt><a name="PTSBoundary-__init__"><strong>__init__</strong></a>(self, name, desc<font color="#909090">=''</font>)</dt><dd><tt>Initiate the <a href="#PTSBoundary">PTSBoundary</a> class.</tt></dd></dl>
<hr>
Methods inherited from <a href="pythreatspec.html#PTSProperty">PTSProperty</a>:<br>
<dl><dt><a name="PTSBoundary-export_to_json"><strong>export_to_json</strong></a>(self)</dt><dd><tt>Return a JSON representation of this class.</tt></dd></dl>
<dl><dt><a name="PTSBoundary-inner_rep"><strong>inner_rep</strong></a>(self)</dt><dd><tt>Return the inner representation of this <a href="__builtin__.html#object">object</a>.</tt></dd></dl>
<hr>
Data descriptors inherited from <a href="pythreatspec.html#PTSProperty">PTSProperty</a>:<br>
<dl><dt><strong>__dict__</strong></dt>
<dd><tt>dictionary for instance variables (if defined)</tt></dd>
</dl>
<dl><dt><strong>__weakref__</strong></dt>
<dd><tt>list of weak references to the object (if defined)</tt></dd>
</dl>
</td></tr></table> <p>
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
<tr bgcolor="#ffc8d8">
<td colspan=3 valign=bottom> <br>
<font color="#000000" face="helvetica, arial"><a name="PTSComponent">class <strong>PTSComponent</strong></a>(<a href="pythreatspec.html#PTSProperty">PTSProperty</a>)</font></td></tr>
<tr bgcolor="#ffc8d8"><td rowspan=2><tt> </tt></td>
<td colspan=2><tt>A ThreatSpec component.<br>
<br>
This is a property class that holds a component which exists within <br>
a trust boundary (<a href="#PTSBoundary">PTSBoundary</a>). In the intermediate JSON output files<br>
these are grouped together and can be shared between source files or<br>
even projects. For example:<br>
<br>
"components": {<br>
"@auth": {<br>
"@session": {<br>
"name": "Session API"<br>
}<br>
},<br>
"@external": {<br>
"@user": {<br>
"name": "User"<br>
}<br>
},<br>
<br>
Attributes are inherited from <a href="#PTSProperty">PTSProperty</a>.<br> </tt></td></tr>
<tr><td> </td>
<td width="100%"><dl><dt>Method resolution order:</dt>
<dd><a href="pythreatspec.html#PTSComponent">PTSComponent</a></dd>
<dd><a href="pythreatspec.html#PTSProperty">PTSProperty</a></dd>
<dd><a href="__builtin__.html#object">__builtin__.object</a></dd>
</dl>
<hr>
Methods defined here:<br>
<dl><dt><a name="PTSComponent-__init__"><strong>__init__</strong></a>(self, name, desc<font color="#909090">=''</font>)</dt><dd><tt>Initiate the <a href="#PTSComponent">PTSComponent</a> class.</tt></dd></dl>
<hr>
Methods inherited from <a href="pythreatspec.html#PTSProperty">PTSProperty</a>:<br>
<dl><dt><a name="PTSComponent-export_to_json"><strong>export_to_json</strong></a>(self)</dt><dd><tt>Return a JSON representation of this class.</tt></dd></dl>
<dl><dt><a name="PTSComponent-inner_rep"><strong>inner_rep</strong></a>(self)</dt><dd><tt>Return the inner representation of this <a href="__builtin__.html#object">object</a>.</tt></dd></dl>
<hr>
Data descriptors inherited from <a href="pythreatspec.html#PTSProperty">PTSProperty</a>:<br>
<dl><dt><strong>__dict__</strong></dt>
<dd><tt>dictionary for instance variables (if defined)</tt></dd>
</dl>
<dl><dt><strong>__weakref__</strong></dt>
<dd><tt>list of weak references to the object (if defined)</tt></dd>
</dl>
</td></tr></table> <p>
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
<tr bgcolor="#ffc8d8">
<td colspan=3 valign=bottom> <br>
<font color="#000000" face="helvetica, arial"><a name="PTSDfd">class <strong>PTSDfd</strong></a>(<a href="__builtin__.html#object">__builtin__.object</a>)</font></td></tr>
<tr bgcolor="#ffc8d8"><td rowspan=2><tt> </tt></td>
<td colspan=2><tt>Contains the Data Flow Diagram (DFD) tree structure.<br>
<br>
Data flow diagrams are a core part of threat modelling and ThreatSpec allows<br>
the creation of DFDs through code using @connects tags (and in future using<br>
language callgraphs). We basically store the connections (edges) between<br>
components plus a little bit of metadata.<br>
<br>
The structure is a series of nested dicts with the following hierarchy:<br>
<br>
source boundary -> source component -> destination boundary -> destination component -> details<br> </tt></td></tr>
<tr><td> </td>
<td width="100%">Methods defined here:<br>
<dl><dt><a name="PTSDfd-__init__"><strong>__init__</strong></a>(self)</dt><dd><tt>Initialise the <a href="#PTSDfd">PTSDfd</a> class.</tt></dd></dl>
<dl><dt><a name="PTSDfd-add_edge"><strong>add_edge</strong></a>(self, edge)</dt><dd><tt>Add an DFD edge to the tree.</tt></dd></dl>
<dl><dt><a name="PTSDfd-export_to_json"><strong>export_to_json</strong></a>(self)</dt><dd><tt>Return a JSON representation of this class.</tt></dd></dl>
<hr>
Data descriptors defined here:<br>
<dl><dt><strong>__dict__</strong></dt>
<dd><tt>dictionary for instance variables (if defined)</tt></dd>
</dl>
<dl><dt><strong>__weakref__</strong></dt>
<dd><tt>list of weak references to the object (if defined)</tt></dd>
</dl>
</td></tr></table> <p>
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
<tr bgcolor="#ffc8d8">
<td colspan=3 valign=bottom> <br>
<font color="#000000" face="helvetica, arial"><a name="PTSDfdEdge">class <strong>PTSDfdEdge</strong></a>(<a href="__builtin__.html#object">__builtin__.object</a>)</font></td></tr>
<tr bgcolor="#ffc8d8"><td rowspan=2><tt> </tt></td>
<td colspan=2><tt>Represents a DFD edge.<br>
<br>
An edge is a connection between two components, which are themselves contained within a trust boundary. The<br>
edges can be between components within a trust boudnary, or between boundaries. An edge can also be<br>
unidirectional or bidirectional.<br>
<br>
Attributes:<br>
source_boundary_id: Source boundary ID string.<br>
source_component_id: Source component ID string.<br>
dest_boundary_id: Destination boundary ID string.<br>
dest_component_id: Destination component ID string.<br>
connection_type: A string that represent the direction of the connection. Either "uni" for unidirectional, or<br>
or "bi" for bidirectional.<br>
tag: A <a href="#PTSSourceTag">PTSSourceTag</a> <a href="__builtin__.html#object">object</a>.<br> </tt></td></tr>
<tr><td> </td>
<td width="100%">Methods defined here:<br>
<dl><dt><a name="PTSDfdEdge-__init__"><strong>__init__</strong></a>(self, source_boundary_id, source_component_id, dest_boundary_id, dest_component_id, connection_type, tag)</dt><dd><tt>Initialise the <a href="#PTSDfdEdge">PTSDfdEdge</a> class</tt></dd></dl>
<hr>
Data descriptors defined here:<br>
<dl><dt><strong>__dict__</strong></dt>
<dd><tt>dictionary for instance variables (if defined)</tt></dd>
</dl>
<dl><dt><strong>__weakref__</strong></dt>
<dd><tt>list of weak references to the object (if defined)</tt></dd>
</dl>
</td></tr></table> <p>
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
<tr bgcolor="#ffc8d8">
<td colspan=3 valign=bottom> <br>
<font color="#000000" face="helvetica, arial"><a name="PTSElement">class <strong>PTSElement</strong></a>(<a href="__builtin__.html#object">__builtin__.object</a>)</font></td></tr>
<tr bgcolor="#ffc8d8"><td rowspan=2><tt> </tt></td>
<td colspan=2><tt>A ThreatSpec element.<br>
<br>
An element in this case is anything that is tied to a threat and<br>
boundary / component combination. In the intermediate JSON files<br>
these for the exposures, mitigations etc. For example:<br>
<br>
"mitigations": {<br>
"@use_of_tls": [<br>
{<br>
"refs": [],<br>
"component": "@loadbalancers",<br>
"source": {<br>
"function": "universal",<br>
"line": 32,<br>
"file": "../report_dfd/example.py"<br>
},<br>
"mitigation": "use of TLS",<br>
"threat": "@information_disclosure_in_transit",<br>
"boundary": "@web"<br>
},<br>
<br>
Attributes:<br>
boundary: A boundary ID string.<br>
component: A component ID string.<br>
threat: A threat ID string.<br>
refs: An optional array of references strings.<br> </tt></td></tr>
<tr><td> </td>
<td width="100%">Methods defined here:<br>
<dl><dt><a name="PTSElement-__init__"><strong>__init__</strong></a>(self, boundary, component, threat, refs<font color="#909090">=[]</font>)</dt><dd><tt>Initialise the <a href="#PTSElement">PTSElement</a> class.</tt></dd></dl>
<dl><dt><a name="PTSElement-export_to_json"><strong>export_to_json</strong></a>(self)</dt><dd><tt>Return a JSON representation of this class.</tt></dd></dl>
<hr>
Data descriptors defined here:<br>
<dl><dt><strong>__dict__</strong></dt>
<dd><tt>dictionary for instance variables (if defined)</tt></dd>
</dl>
<dl><dt><strong>__weakref__</strong></dt>
<dd><tt>list of weak references to the object (if defined)</tt></dd>
</dl>
</td></tr></table> <p>
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
<tr bgcolor="#ffc8d8">
<td colspan=3 valign=bottom> <br>
<font color="#000000" face="helvetica, arial"><a name="PTSExposure">class <strong>PTSExposure</strong></a>(<a href="pythreatspec.html#PTSElement">PTSElement</a>)</font></td></tr>
<tr bgcolor="#ffc8d8"><td rowspan=2><tt> </tt></td>
<td colspan=2><tt>Represents a @exposes tag.<br> </tt></td></tr>
<tr><td> </td>
<td width="100%"><dl><dt>Method resolution order:</dt>
<dd><a href="pythreatspec.html#PTSExposure">PTSExposure</a></dd>
<dd><a href="pythreatspec.html#PTSElement">PTSElement</a></dd>
<dd><a href="__builtin__.html#object">__builtin__.object</a></dd>
</dl>
<hr>
Methods defined here:<br>
<dl><dt><a name="PTSExposure-__init__"><strong>__init__</strong></a>(self, boundary, component, threat, exposure, refs<font color="#909090">=[]</font>)</dt><dd><tt>Initialises the <a href="#PTSExposure">PTSExposure</a> class.</tt></dd></dl>
<dl><dt><a name="PTSExposure-export_to_json"><strong>export_to_json</strong></a>(self)</dt><dd><tt>Return a JSON representation of this class.</tt></dd></dl>
<hr>
Data descriptors inherited from <a href="pythreatspec.html#PTSElement">PTSElement</a>:<br>
<dl><dt><strong>__dict__</strong></dt>
<dd><tt>dictionary for instance variables (if defined)</tt></dd>
</dl>
<dl><dt><strong>__weakref__</strong></dt>
<dd><tt>list of weak references to the object (if defined)</tt></dd>
</dl>
</td></tr></table> <p>
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
<tr bgcolor="#ffc8d8">
<td colspan=3 valign=bottom> <br>
<font color="#000000" face="helvetica, arial"><a name="PTSMitigation">class <strong>PTSMitigation</strong></a>(<a href="pythreatspec.html#PTSElement">PTSElement</a>)</font></td></tr>
<tr bgcolor="#ffc8d8"><td rowspan=2><tt> </tt></td>
<td colspan=2><tt>Represents a @mitigates tag.<br> </tt></td></tr>
<tr><td> </td>
<td width="100%"><dl><dt>Method resolution order:</dt>
<dd><a href="pythreatspec.html#PTSMitigation">PTSMitigation</a></dd>
<dd><a href="pythreatspec.html#PTSElement">PTSElement</a></dd>
<dd><a href="__builtin__.html#object">__builtin__.object</a></dd>
</dl>
<hr>
Methods defined here:<br>
<dl><dt><a name="PTSMitigation-__init__"><strong>__init__</strong></a>(self, boundary, component, threat, mitigation, refs<font color="#909090">=[]</font>)</dt><dd><tt>Initialise the <a href="#PTSMitigation">PTSMitigation</a> class.</tt></dd></dl>
<dl><dt><a name="PTSMitigation-export_to_json"><strong>export_to_json</strong></a>(self)</dt><dd><tt>Return a JSON representation of this class.</tt></dd></dl>
<hr>
Data descriptors inherited from <a href="pythreatspec.html#PTSElement">PTSElement</a>:<br>
<dl><dt><strong>__dict__</strong></dt>
<dd><tt>dictionary for instance variables (if defined)</tt></dd>
</dl>
<dl><dt><strong>__weakref__</strong></dt>
<dd><tt>list of weak references to the object (if defined)</tt></dd>
</dl>
</td></tr></table> <p>
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
<tr bgcolor="#ffc8d8">
<td colspan=3 valign=bottom> <br>
<font color="#000000" face="helvetica, arial"><a name="PTSProperty">class <strong>PTSProperty</strong></a>(<a href="__builtin__.html#object">__builtin__.object</a>)</font></td></tr>
<tr bgcolor="#ffc8d8"><td rowspan=2><tt> </tt></td>
<td colspan=2><tt>An abstract parent class<br>
<br>
Used by anything that needs to store a name and description.<br>
<br>
Attributes:<br>
name: A string containing the property name.<br>
desc: An optional description of the property instance.<br> </tt></td></tr>
<tr><td> </td>
<td width="100%">Methods defined here:<br>
<dl><dt><a name="PTSProperty-__init__"><strong>__init__</strong></a>(self, name, desc<font color="#909090">=''</font>)</dt><dd><tt>Initiate the <a href="#PTSProperty">PTSProperty</a> class.</tt></dd></dl>
<dl><dt><a name="PTSProperty-export_to_json"><strong>export_to_json</strong></a>(self)</dt><dd><tt>Return a JSON representation of this class.</tt></dd></dl>
<dl><dt><a name="PTSProperty-inner_rep"><strong>inner_rep</strong></a>(self)</dt><dd><tt>Return the inner representation of this <a href="__builtin__.html#object">object</a>.</tt></dd></dl>
<hr>
Data descriptors defined here:<br>
<dl><dt><strong>__dict__</strong></dt>
<dd><tt>dictionary for instance variables (if defined)</tt></dd>
</dl>
<dl><dt><strong>__weakref__</strong></dt>
<dd><tt>list of weak references to the object (if defined)</tt></dd>
</dl>
</td></tr></table> <p>
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
<tr bgcolor="#ffc8d8">
<td colspan=3 valign=bottom> <br>
<font color="#000000" face="helvetica, arial"><a name="PTSReference">class <strong>PTSReference</strong></a>(<a href="__builtin__.html#object">__builtin__.object</a>)</font></td></tr>
<tr bgcolor="#ffc8d8"><td rowspan=2><tt> </tt></td>
<td colspan=2><tt>Represents a reference.<br>
<br>
References are used as pointers to documentation, bug tracking issues etc.<br>
<br>
Attributes:<br>
ref: A string representing a reference<br> </tt></td></tr>
<tr><td> </td>
<td width="100%">Methods defined here:<br>
<dl><dt><a name="PTSReference-__init__"><strong>__init__</strong></a>(self, ref)</dt><dd><tt>Initialise the <a href="#PTSReference">PTSReference</a> class</tt></dd></dl>
<hr>
Data descriptors defined here:<br>
<dl><dt><strong>__dict__</strong></dt>
<dd><tt>dictionary for instance variables (if defined)</tt></dd>
</dl>
<dl><dt><strong>__weakref__</strong></dt>
<dd><tt>list of weak references to the object (if defined)</tt></dd>
</dl>
</td></tr></table> <p>
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
<tr bgcolor="#ffc8d8">
<td colspan=3 valign=bottom> <br>
<font color="#000000" face="helvetica, arial"><a name="PTSReview">class <strong>PTSReview</strong></a>(<a href="__builtin__.html#object">__builtin__.object</a>)</font></td></tr>
<tr bgcolor="#ffc8d8"><td rowspan=2><tt> </tt></td>
<td colspan=2><tt>Represents a @review tag.<br>
<br>
Review tags are slightly different to @mitigates and @exposes tags etc. because<br>
it isn't related to a threat, but is otherwise very similar.<br>
<br>
Attributes:<br>
boundary: A boundary ID string.<br>
component: A component ID string.<br>
review: A string containing the review statement.<br>
refs: An optional array of references strings.<br> </tt></td></tr>
<tr><td> </td>
<td width="100%">Methods defined here:<br>
<dl><dt><a name="PTSReview-__init__"><strong>__init__</strong></a>(self, boundary, component, review, refs<font color="#909090">=[]</font>)</dt><dd><tt>Initialise the <a href="#PTSReview">PTSReview</a> class.</tt></dd></dl>
<dl><dt><a name="PTSReview-export_to_json"><strong>export_to_json</strong></a>(self)</dt><dd><tt>Return a JSON representation of this class.</tt></dd></dl>
<hr>
Data descriptors defined here:<br>
<dl><dt><strong>__dict__</strong></dt>
<dd><tt>dictionary for instance variables (if defined)</tt></dd>
</dl>
<dl><dt><strong>__weakref__</strong></dt>
<dd><tt>list of weak references to the object (if defined)</tt></dd>
</dl>
</td></tr></table> <p>
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
<tr bgcolor="#ffc8d8">
<td colspan=3 valign=bottom> <br>
<font color="#000000" face="helvetica, arial"><a name="PTSSourceTag">class <strong>PTSSourceTag</strong></a>(<a href="__builtin__.html#object">__builtin__.object</a>)</font></td></tr>
<tr bgcolor="#ffc8d8"><td rowspan=2><tt> </tt></td>
<td colspan=2><tt>A container for source code metadata.<br>
<br>
As ThreatSpec tags are found, the source file metadata is captured to provide<br>
context for those tags. This can be used to determine relationships between<br>
components when used with a callgraph, or it can be used to report on exactly<br>
where migitations, exposures etc. have been found in the code.<br>
<br>
Attributes:<br>
fname: A string containing the current source file's file name.<br>
lineno: An integer with the current line number.<br>
function: A string that represents the current class, function or module.<br> </tt></td></tr>
<tr><td> </td>
<td width="100%">Methods defined here:<br>
<dl><dt><a name="PTSSourceTag-__init__"><strong>__init__</strong></a>(self, fname<font color="#909090">=''</font>, lineno<font color="#909090">=0</font>, function<font color="#909090">=''</font>)</dt><dd><tt>Initiate the <a href="#PTSSourceTag">PTSSourceTag</a> class.</tt></dd></dl>
<dl><dt><a name="PTSSourceTag-__str__"><strong>__str__</strong></a>(self)</dt><dd><tt>Return the string representation of this class.</tt></dd></dl>
<dl><dt><a name="PTSSourceTag-export_to_json"><strong>export_to_json</strong></a>(self)</dt><dd><tt>Return a JSON representation of this class.</tt></dd></dl>
<hr>
Data descriptors defined here:<br>
<dl><dt><strong>__dict__</strong></dt>
<dd><tt>dictionary for instance variables (if defined)</tt></dd>
</dl>
<dl><dt><strong>__weakref__</strong></dt>
<dd><tt>list of weak references to the object (if defined)</tt></dd>
</dl>
</td></tr></table> <p>
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
<tr bgcolor="#ffc8d8">
<td colspan=3 valign=bottom> <br>
<font color="#000000" face="helvetica, arial"><a name="PTSThreat">class <strong>PTSThreat</strong></a>(<a href="pythreatspec.html#PTSProperty">PTSProperty</a>)</font></td></tr>
<tr bgcolor="#ffc8d8"><td rowspan=2><tt> </tt></td>
<td colspan=2><tt>A ThreatSpec threat.<br>
<br>
This is a property class that holds a threat. In the intermediate JSON<br>
output files these are grouped together and can be shared between source<br>
files or even projects. For example:<br>
<br>
"threats": {<br>
"@manipulation_of_data_in_transit": {<br>
"name": "manipulation of data in transit"<br>
},<br>
"@malicious_requests": {<br>
"name": "malicious requests"<br>
},<br>
<br>
Attributes are inherited from <a href="#PTSProperty">PTSProperty</a>.<br> </tt></td></tr>
<tr><td> </td>
<td width="100%"><dl><dt>Method resolution order:</dt>
<dd><a href="pythreatspec.html#PTSThreat">PTSThreat</a></dd>
<dd><a href="pythreatspec.html#PTSProperty">PTSProperty</a></dd>
<dd><a href="__builtin__.html#object">__builtin__.object</a></dd>
</dl>
<hr>
Methods defined here:<br>
<dl><dt><a name="PTSThreat-__init__"><strong>__init__</strong></a>(self, name, desc<font color="#909090">=''</font>)</dt><dd><tt>Initiate teh <a href="#PTSThreat">PTSThreat</a> class.</tt></dd></dl>
<hr>
Methods inherited from <a href="pythreatspec.html#PTSProperty">PTSProperty</a>:<br>
<dl><dt><a name="PTSThreat-export_to_json"><strong>export_to_json</strong></a>(self)</dt><dd><tt>Return a JSON representation of this class.</tt></dd></dl>
<dl><dt><a name="PTSThreat-inner_rep"><strong>inner_rep</strong></a>(self)</dt><dd><tt>Return the inner representation of this <a href="__builtin__.html#object">object</a>.</tt></dd></dl>
<hr>
Data descriptors inherited from <a href="pythreatspec.html#PTSProperty">PTSProperty</a>:<br>
<dl><dt><strong>__dict__</strong></dt>
<dd><tt>dictionary for instance variables (if defined)</tt></dd>
</dl>
<dl><dt><strong>__weakref__</strong></dt>
<dd><tt>list of weak references to the object (if defined)</tt></dd>
</dl>
</td></tr></table> <p>
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
<tr bgcolor="#ffc8d8">
<td colspan=3 valign=bottom> <br>
<font color="#000000" face="helvetica, arial"><a name="PTSTransfer">class <strong>PTSTransfer</strong></a>(<a href="pythreatspec.html#PTSElement">PTSElement</a>)</font></td></tr>
<tr bgcolor="#ffc8d8"><td rowspan=2><tt> </tt></td>
<td colspan=2><tt>Represents a @transfer tag.<br> </tt></td></tr>
<tr><td> </td>
<td width="100%"><dl><dt>Method resolution order:</dt>
<dd><a href="pythreatspec.html#PTSTransfer">PTSTransfer</a></dd>
<dd><a href="pythreatspec.html#PTSElement">PTSElement</a></dd>
<dd><a href="__builtin__.html#object">__builtin__.object</a></dd>
</dl>
<hr>
Methods defined here:<br>
<dl><dt><a name="PTSTransfer-__init__"><strong>__init__</strong></a>(self, boundary, component, threat, transfer, refs<font color="#909090">=[]</font>)</dt><dd><tt>Initialise the <a href="#PTSTransfer">PTSTransfer</a> class.</tt></dd></dl>
<dl><dt><a name="PTSTransfer-export_to_json"><strong>export_to_json</strong></a>(self)</dt><dd><tt>Return a JSON representation of this class.</tt></dd></dl>
<hr>
Data descriptors inherited from <a href="pythreatspec.html#PTSElement">PTSElement</a>:<br>
<dl><dt><strong>__dict__</strong></dt>
<dd><tt>dictionary for instance variables (if defined)</tt></dd>
</dl>
<dl><dt><strong>__weakref__</strong></dt>
<dd><tt>list of weak references to the object (if defined)</tt></dd>
</dl>
</td></tr></table> <p>
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
<tr bgcolor="#ffc8d8">
<td colspan=3 valign=bottom> <br>
<font color="#000000" face="helvetica, arial"><a name="PyThreatspecParser">class <strong>PyThreatspecParser</strong></a>(<a href="__builtin__.html#object">__builtin__.object</a>)</font></td></tr>
<tr bgcolor="#ffc8d8"><td rowspan=2><tt> </tt></td>
<td colspan=2><tt>The Python ThreatSpec parser class.<br>
<br>
This class is used to track the ThreatSpec data as source files are parsed, and also<br>
implements the functions used in parsing.<br> </tt></td></tr>
<tr><td> </td>
<td width="100%">Methods defined here:<br>
<dl><dt><a name="PyThreatspecParser-__init__"><strong>__init__</strong></a>(self)</dt><dd><tt>Initiates the <a href="#PyThreatspecParser">PyThreatspecParser</a> class</tt></dd></dl>
<dl><dt><a name="PyThreatspecParser-add_boundary"><strong>add_boundary</strong></a>(self, boundary)</dt><dd><tt>Add a boundary.<br>
<br>
A boundary represents a separation of trust and encompasses one or more components.<br>
In ThreatSpec, boundaries and components a linked together when either defined using<br>
the @alias tag, or when using a threat tag, for example:<br>
<br>
@alias boundary @user to User<br>
@mitigations User:@session against session hijack with use of tokens<br>
<br>
Args:<br>
boundary: boundary representing a boundary id or name.<br>
<br>
Returns<br>
A boundary id.</tt></dd></dl>
<dl><dt><a name="PyThreatspecParser-add_component"><strong>add_component</strong></a>(self, boundary_id, component)</dt><dd><tt>Add a component.<br>
<br>
A component is a part of the system that does something or is in some way<br>
acted on. It exists inside a threat boundary and is generally connected to<br>
other components. It can be defined using an @alias tag, or when using a threat<br>
tag, for example:<br>
<br>
@alias component @user:@session to Web session<br>
@exposes @user:Session to information disclosure with lack of TLS<br>
<br>
Args:<br>
boundary_id: A boundary id string.<br>
component: A component id or name string.<br>
<br>
Returns:<br>
A component id.</tt></dd></dl>
<dl><dt><a name="PyThreatspecParser-add_threat"><strong>add_threat</strong></a>(self, threat)</dt><dd><tt>Add a threat.<br>
<br>
A threat represents an potential attack against the system and can be defined<br>
using an @alias tag, or when using one of the threat tags. You can use the alias<br>
tag to group together threats into an attack library that can be shared between<br>
projects. For example:<br>
<br>
@alias threat @cwe_123_information_disclosure to CWE123 Information Disclosure<br>
@transfer @cwe_123_information_disclosure to @external:@user with acceptance of terms<br>
<br>
Args:<br>
threat: A threat id or name string.<br>
<br>
Returns:<br>
A threat id</tt></dd></dl>
<dl><dt><a name="PyThreatspecParser-export"><strong>export</strong></a>(self)</dt><dd><tt>Exports the internal data structures.</tt></dd></dl>
<dl><dt><a name="PyThreatspecParser-parse"><strong>parse</strong></a>(self, filename)</dt><dd><tt>Parse the source file.<br>
<br>
Parses the Python source file using the AST.<br>
<br>
Args:<br>
filename: String containing the filename as given on the command line.</tt></dd></dl>
<hr>
Data descriptors defined here:<br>
<dl><dt><strong>__dict__</strong></dt>
<dd><tt>dictionary for instance variables (if defined)</tt></dd>
</dl>
<dl><dt><strong>__weakref__</strong></dt>
<dd><tt>list of weak references to the object (if defined)</tt></dd>
</dl>
</td></tr></table> <p>
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
<tr bgcolor="#ffc8d8">
<td colspan=3 valign=bottom> <br>
<font color="#000000" face="helvetica, arial"><a name="PyThreatspecReporter">class <strong>PyThreatspecReporter</strong></a>(<a href="__builtin__.html#object">__builtin__.object</a>)</font></td></tr>
<tr bgcolor="#ffc8d8"><td rowspan=2><tt> </tt></td>
<td colspan=2><tt>Represents the intermediate representation structure.<br>
<br>
This class abstracts the ultimate output of the parser, including all the metadata<br>
and ThreatSpec tags and elements.<br>
<br>
The exported JSON <a href="__builtin__.html#object">object</a> should be valid as defined in the jsonschemea specification.<br>
<br>
The output JSON file can contain multiple projects and reports can be based on<br>
multiple intermediate output files for multiple projects, bringing multiple<br>
threat reports into a single large-scale threat report.<br>
<br>
Attributes:<br>
parser: A <a href="#PyThreatspecParser">PyThreatspecParser</a> <a href="__builtin__.html#object">object</a><br>
project: Project name string<br> </tt></td></tr>
<tr><td> </td>
<td width="100%">Methods defined here:<br>
<dl><dt><a name="PyThreatspecReporter-__init__"><strong>__init__</strong></a>(self, parser, project)</dt><dd><tt>Initialise the <a href="#PyThreatspecReporter">PyThreatspecReporter</a> class.<br>
<br>
Args:<br>
parser: A <a href="#PyThreatspecParser">PyThreatspecParser</a> instance.<br>
project: A string representing the current project name.<br>
<br>
Returns:<br>
A <a href="#PyThreatspecReporter">PyThreatspecReporter</a> <a href="__builtin__.html#object">object</a>.</tt></dd></dl>
<dl><dt><a name="PyThreatspecReporter-export_to_json"><strong>export_to_json</strong></a>(self)</dt><dd><tt>Return a JSON representation of this class.<br>
<br>
For this class, the exported JSON is callled the intermediate representation file.<br>
This should be valid as per the specification and allows different projects from different<br>
languages to be merged into a single Threat Model.</tt></dd></dl>
<hr>
Data descriptors defined here:<br>
<dl><dt><strong>__dict__</strong></dt>
<dd><tt>dictionary for instance variables (if defined)</tt></dd>
</dl>
<dl><dt><strong>__weakref__</strong></dt>
<dd><tt>list of weak references to the object (if defined)</tt></dd>
</dl>
</td></tr></table></td></tr></table><p>
<table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section">
<tr bgcolor="#eeaa77">
<td colspan=3 valign=bottom> <br>
<font color="#ffffff" face="helvetica, arial"><big><strong>Functions</strong></big></font></td></tr>
<tr><td bgcolor="#eeaa77"><tt> </tt></td><td> </td>
<td width="100%"><dl><dt><a name="-current_milli_time"><strong>current_milli_time</strong></a>()</dt><dd><tt>Calculate the current time in milliseconds</tt></dd></dl>
<dl><dt><a name="-is_identifier"><strong>is_identifier</strong></a>(text)</dt><dd><tt>Check whether a string is an identifier.<br>
<br>
Args:<br>
text: A string to check<br>
<br>
Returns:<br>
Boolean of whether the string was an id.</tt></dd></dl>
<dl><dt><a name="-remove_excessive_space"><strong>remove_excessive_space</strong></a>(text)</dt><dd><tt>Remove exessive spacing.<br>
<br>
Remove all excessive spacing from the beginning, end and within a text string.<br>
<br>
Args:<br>
text: A string with excessive spaces.<br>
<br>
Returns:<br>
A string with fewer spaces.</tt></dd></dl>
<dl><dt><a name="-text_to_identifier"><strong>text_to_identifier</strong></a>(text)</dt><dd><tt>Turn a text string into an identifier.<br>
<br>
Turn the provided string into an identifier, unless it already is one.<br>
<br>
Args:<br>
text: A string<br>
<br>
Returns:<br>
A string representing the identifier. For example:<br>
"this is an example" would be turned into @this_is_an_example,<br>
but @another_example would just return as @another_example.</tt></dd></dl>
</td></tr></table>
</body></html>