cairis-platform / cairis Goto Github PK
View Code? Open in Web Editor NEWComputer Aided Integration of Requirements and Information Security - Server
Home Page: https://cairis.org
License: Apache License 2.0
Computer Aided Integration of Requirements and Information Security - Server
Home Page: https://cairis.org
License: Apache License 2.0
Within the View Asset Model: The corresponding asset options are not appearing correctly. Asset options are either empty or not corresponding with the asset that was selected.
I've found a few problems installing CAIRIS on Ubuntu 14.04 LTS - fixes inline.
sudo apt-get install python-wxglade python-glade2 python-wxgtk2.8 python-dev build-essential mysql-server mysql-client graphviz docbook dblatex python- pip git libmysqlclient-dev --no-install-recommends texlive-latex-extra docbook-utils
Should be python-pip. Also we have an unsatisfied dependency on python-numpy. Pip installation fails without it's own dependencies, so we should just install the package.
$ sudo chown -R $CAIRIS_USER:$CAIRIS_USER $CAIRIS_DIR $ sudo chmod -R 775 $CAIRIS_DIR
Needs to be split at the $
$ mysql –u cairis –p –database=cairis < $CAIRIS_SQL/procs.sql
$ mysql –u cairis –p –database=cairis < $CAIRIS_SQL/init.sql
Should be
$ mysql –u cairis –p cairis < $CAIRIS_SQL/procs.sql
$ mysql –u cairis –p cairis < $CAIRIS_SQL/init.sql
Create new goal. Click on close button. List of goals should be displayed
Dialog remains unchanged
Follow expected behaviour instructions
All versions of the web app
All
Countermeasure-generated assets should appear in classModelElements stored procedure.
Countermeasure-generated assets don't appear in classModelElements stored procedure.
Generate asset from countermeasure. View asset model.
All
All
Currently supported in desktop application. Not supported in web app.
To implement this:
The architectural pattern API needs to be revised to:
(i) GET a weakness analysis for an architectural pattern.
(ii) POST a pattern situate operation
It should be possible to right-click an architectural pattern from the web app, and have this open up a weakness analysis dialog box showing threats, vulnerabilities, persona impact and obstacles.
When adding a Threat in CAIRIS, leaving the Tags field blank, it will be assigned "". If another threat is created it will also be assigned the same tag. This causes a primary key error when importing the model.
Apologies if this has been addressed in a newer version.
It should be possible to find CAIRIS objects based on tags.
When deleting an object in the web app, a warning about the consequences of the deletion should be displayed.
A warning is displayed, but only if there are dependencies on the object.
1.2.10
All
When importing model files, it's possible that people might erroneously add the same label to different requirements, e.g.
Telemetry software shall be pulled in from an outstation after contacting Telemetry Support. None None Goal model The software suite dependencies, associated with site specific programs shall be downloadable. None None Goal modelThese sort of errors should be caught when importing models. Moreover, it shouldn't be possible to add requirements to the database if the same label already exists for the same asset or environment.
Obstacle probability are defined in obstacle database objects, and can be visualised. However, these currently can't be edited - either from the XML model files or from the GUI.
In the stored procedure 'delete_vulnerability' there is an SQL statement which refers to a non-existing column in the database. This makes it impossible to delete any vulnerability.
The SQL statement which contains the invalid reference is the following:
delete from component_vulnerability_target where threat_id = threatId;
...where threat_id is the non-existing column.
To generate GRL models, it's necessary to add additional information to a few model elements, e.g. document references, persona characteristics, elements of use cases.
This entails updating the model definitions to include the additional information, and UI updates to facilitate adding/updating them.
The problem mostly occurs when there are some tension fields in the last column are " ". When you update these tensions and reopen them, they don't have the same values.
This is an example of what happens.
After updating the environment and closing all of the environment windows, I reopen the window and the tensions values are changed to the following sequence.
It seems that the third column is copied to the last column.
the risk table within the cairis database, seems to contain an environment_id that always defaults to the default value.
Removing goal/sub-goal refinements from goal dialog should remove refinements from the goal object, such that these aren't visible when updating goals.
This isn't happening due to some faulty logic where the refinement list continues to be iterated after refinements are spliced from the list.
Open goal with refinements. Remove refinement from the list. Update the goal. Open the goal again - the refinement is still visible.
All versions of the web app
All
Obstacles in KAOS model are coloured based on their probability, but this isn't currently the case with obstacles in risk models.
Clicking create when defining a new asset should add a new entry to the asset table.
It doesn't. You need to click on the Assets breadcrumb to update the list
See expected behaviour.
Current version of web app
All
Importing CAIRIS model containing tasks and task characteristic based on non-document references should be successful
Import fails with database errors.
All
All
Clicking on a dependency object in web app loads up dependency details in a modal dialog.
They don't
Add a dependency. Try and edit it
Latest of web app
All
Web app should be blocked and/or some sort of progress indication should be given.
Possible to interact with web app while model is being imported
Once logged in.
1.2.10
All
Database conflict: Cannot remove vulnerability_type due to dependent data (id:1451,message:Cannot delete or update a parent row: a foreign key constraint fails (
arm.
vulnerability, CONSTRAINT
vulnerability_ibfk_1 FOREIGN KEY (
vulnerability_type_id) REFERENCES
vulnerability_type (
id)))
1.2.1
Debian 8
If threat or vulnerability types haven't been imported, it shouldn't be possible to open threat and vulnerability tables.
It is :-)
Create an empty project. Add an environment, asset, and attacker. Click on Risk/Threats or Risk/Vulnerabilities menu
All versions of the web app
All
While much of the CAIRIS GUI is available in the CAIRIS web app, this issue keeps track of the various tasks that need to be complete before the web app (and web services API) is functionality complete.
When we've ticked off all these boxes, we can say that the core of 'CAIRIS Web' is functionally complete.
When import a new model, the breadcrumb should reset to the home settings.
The breadcrumb settings are based on the form open when the model was imported.
All
All
Test issue body
In the CAIRIS GUI, it's possible to see the details behind a particular risk's score. This can be useful if a risk has an unexpectedly high or low score. These details are accessible via the API, so it's just a case of making sure these are displayed in the web app.
When trying to export a model I get the following error message:
{
"code": 400,
"message": "One or more parameters are missing or invalid. Please check your request if it contains all the required parameters.\nRequired parameters:\n* session_id",
"status": 400
}
It seems to happen when I add a persona and or roles.
The error message doesn't always come up after a persona or role is added and will allow my to export the model.xml file however when trying to import that very same file later it never gets past the loading screen.
I have looked at the model.xml file that it allowed me to download and when deleting everything in between the usability tags it is able to load the model.
Any help would be greatly appreciated
Attempting to install the Debian package on Debian 8.4.0 does not run the postInst script.
Installation steps to reproduce:
sudo dpkg -i cairis_package.deb
sudo apt-get install -f
When trying to create any model on Ubuntu 14.04, the function read_number(self) at line 490 in xdot.py renders an exception because it is unable to convert a float declared as a string into an integer. A simple fix would be to change the line of code to first convert it to a float number, then use the round() method to make it a round number and then finally convert it to an integer.
The following code...
def read_number(self):
return int(self.read_code())
...would become...
def read_number(self):
return int(round(float(self.read_code())))
because, for example,...
int("12.8")
... is not supported in Python 2.7.
I have tested this on my version of Linux and apparently I have been using this fix on my Lubuntu 12.04 virtual machine for a while, so this solution should work. But I was wondering if you experienced the same problem on Debian as well.
Clicking on the update button when updating properties should return to the home screen.
Clicking on the update button indicates a successful update, but the properties form is still displayed.
All versions of the web app
All
If you click on File/Export from the web app, a new [XML] file should be downloaded containing an XML model export
If you click on File/Export from the web app, a new window is opened with the text of the exported XML model
1.2.0
All
It should be helpful to simplify the current install process, as there are myriad of little dependencies that need to be setup with the current install.
I have setup a simple puppet script with dependencies to setup a VM machine.
See https://github.com/nigel-v-thomas/Vagrant_CAIRIS
When creating a mitigation response, it's possible to select an environment for mitigating a risk that is not associated with the risk. By default, the environment panel should be disabled until a risk is selected and when it is, only environments specific to the selected risk should be available for selection.
Import model file in web app. Environments not updated in environment comboxbox in requirements form.
Requirements should be updated in all comboboxes. Logging out and logging back in fixes the problem, but it's an unnecessary hack :-)
Start with an empty model, import a model, environments in that model aren't shown
All versions
All
The desktop application supports the association of use case steps with exceptions, and the ability to generate obstacles associated with exceptions.
This should be added to the web app as well. While this entails some modest changes to the model definitions, the changes are mainly to the front end (HTML and JavaScript).
From the test case :
================================================================ FAILURES ================================================================
__________________________________________________ ComponentViewTest.testComponentView ___________________________________________________
self = <cairis.test.test_ComponentView.ComponentViewTest testMethod=testComponentView>
def testComponentView(self):
cvName = self.iComponentViews[0]["theName"]
cvSyn = self.iComponentViews[0]["theSynopsis"]
theComponents = []
for c in self.iComponentViews[0]["theComponents"]:
cName = c["theName"]
cDesc = c["theDescription"]
cInts = []
for i in c["theInterfaces"]:
cInts.append((i["theName"],i["theType"],i["theAccessRight"],i["thePrivilege"]))
cStructs = []
for cs in c["theStructure"]:
cStructs.append((cs["theHeadAsset"],cs["theHeadAdornment"],cs["theHeadNav"],cs["theHeadNry"],cs["theHeadRole"],cs["theTailRole"],cs["theTailNry"],cs["theTailNav"],cs["theTailAdornment"],cs["theTailAsset"]))
cReqs = []
cGoals = []
for i in c["theComponentGoals"]:
cGoals.append(i)
cGoalAssocs = []
for cga in c["theComponentGoalAssociations"]:
cGoalAssocs.append((cga["theGoalName"],cga["theSubGoalName"],cga["theRefType"],'None'))
theComponents.append(ComponentParameters(cName,cDesc,cInts,cStructs,cReqs,cGoals,cGoalAssocs))
theConnectors = []
for conn in self.iComponentViews[0]["theConnectors"]:
theConnectors.append(ConnectorParameters(conn["theName"],cvName,conn["theFromComponent"],conn["theFromRole"],conn["theFromInterface"],conn["theToComponent"],conn["theToInterface"],conn["theToRole"],conn["theAssetName"],conn["theProtocol"],conn["theAccessRight"]))
icvp = ComponentViewParameters(cvName,cvSyn,self.theMetricTypes,self.theRoles,self.theAssets,self.theRequirements,self.theGoals,theComponents,theConnectors)
b = Borg()
b.dbProxy.addComponentView(icvp)
ocvps = b.dbProxy.getComponentViews()
ocvp = ocvps[cvName]
self.assertEqual(icvp.name(), ocvp.name())
self.assertEqual(icvp.synopsis(), ocvp.synopsis())
b.dbProxy.deleteComponentView(ocvp.id())
test_ComponentView.py:116:
../core/MySQLDatabaseProxy.py:9468: in deleteComponentView
self.deleteObject(cvId,'component_view')
self = <cairis.core.MySQLDatabaseProxy.MySQLDatabaseProxy instance at 0xac2cdac>, objtId = 104L, tableName = 'component_view'
def deleteObject(self,objtId,tableName):
try:
curs = self.conn.cursor()
sqlTxt = 'call delete_' + tableName + '(%s)'
curs.execute(sqlTxt,[objtId])
if (curs.rowcount == -1):
exceptionText = 'Error deleting ' + tableName + ' id ' + str(objtId)
raise DatabaseProxyException(exceptionText)
curs.close()
except _mysql_exceptions.IntegrityError, e:
id,msg = e
exceptionText = 'Cannot remove ' + tableName + ' due to dependent data (id:' + str(id) + ',message:' + msg + ').'
raise IntegrityException(exceptionText)
E IntegrityException: 'Cannot remove component_view due to dependent data (id:1451,message:Cannot delete or update a parent row: a foreign key constraint fails (
arm
.connector
, CONSTRAINTconnector_ibfk_4
FOREIGN KEY (to_component_id
) REFERENCEScomponent
(id
))).'
../core/MySQLDatabaseProxy.py:1014: IntegrityException
---------------------------------------------------------- Captured stderr call ----------------------------------------------------------
/home/cairisuser/cairis/cairis/core/MySQLDatabaseProxy.py:9132: Warning: Incorrect integer value: 'provided' for column 'reqId' at row 1
curs.execute('call addComponentInterface(%s,%s,%s,%s,%s)',[componentId,ifName,ifType,arName,pName])
/home/cairisuser/cairis/cairis/core/MySQLDatabaseProxy.py:9132: Warning: Incorrect integer value: 'required' for column 'reqId' at row 1
curs.execute('call addComponentInterface(%s,%s,%s,%s,%s)',[componentId,ifName,ifType,arName,pName])
/usr/local/lib/python2.7/dist-packages/MySQLdb/cursors.py:91: Warning: No data - zero rows fetched, selected, or processed
When viewing concept maps in requirements, it should be possible to see all requirements with manual traceability relations with other requirements.
Currently these models are only visible if requirements are explicitly assigned to environments.
All
all
What it says on the tin!
At the moment, only security/privacy properties and their values are displayed when clicking on an asset node. There is no obvious reason rationale can't be displayed as well though.
If there are blank lines in cairis.cnf an IndexError is thrown.
When in Asset, when selecting Association tab, then hovering over existing association (e.g. from "Smartphone Capability" Asset to "Smartphone Battery"), then clicking the minus symbol to delete the entry, the entry should appear to be deleted and actually be deleted when clicking "Update", then "Update" Asset and receive the "Success" message.
When in Asset, when selecting Association tab, then hovering over existing association (e.g. from "Smartphone Capability" Asset to "Smartphone Battery"), then clicking the minus symbol to delete the entry, the entry appears to be deleted when clicking "Update", then "Update" Asset and the "Success" message is displayed. However, I then check to make sure it looks ok in the Asset Model view, OR go back in to the Asset and its Association tab, and notice "Smartphone Battery" did not actually get deleted and instead another asset (e.g. "Smartphone Storage") got deleted instead, despite it not being the original one selected. This means the association needs to be re-entered in the Association tab.
As noted, when in Asset, when selecting Association tab, then hovering over existing association (e.g. from "Smartphone Capability" Asset to "Smartphone Battery"), then clicking the minus symbol to delete the entry, the entry appears to be deleted when clicking "Update", then "Update" Asset and the "Success" message is displayed. I didn't really notice this as an issue at first, because you think it worked, but as I had quite a few to update, this problem became noticeably worse to at least 50% or more of the time, meaning there was quite a few to re-fix. That said, under normal circumstances (where these may be edited in small batches), it's difficult to tell if this issue would happen occasionally, or get progressively worse?
Current CAIRIS Web App (V?)
In Firefox on Ubuntu 14 Linux, in VMWare on Windows 7.
Could it be possible to adapt Cairis to load more than one exemplar at a time?
Assets should display the security properties even if they are null. In practice this means that assets with e.g. no confidentiality should display an empty row.
Security properties that have no value are not displayed visually. This means that you need to rely on the colour of the boxes to determine whether it is a confidentiality, integrity, availability, or accountability property.
Look at the risk model.
The desktop application supports the import, specification, and situation of security patterns. Security patterns can act as a response to a countermeasure, so adding one to an environment adds the associated assets and goals/requirements as well.
This functionality would be useful for the web app as well.
When in Asset, when selecting Association tab, then selecting an existing association (e.g. from Asset to "Smartphone Battery"), the next window where you adjust the association types should display "Smartphone Battery" in the lower field of the associated asset.
When in Asset, when selecting Association tab, then selecting an existing association (e.g. from Asset to "Smartphone Battery"), the next window where you adjust the association types does not display "Smartphone Battery" in the lower field of the associated asset. Instead it shows a different asset (which was actually the last new asset added to the database and has nothing to do with this association), meaning you have to re-enter "Smartphone Battery", otherwise it will save incorrectly when "Update" is clicked.
This issue occurs every time following the noted steps of editing an association of an asset.
Current Web App (V?)
Firefox in Ubuntu 14, Linux, in VMWare on Windows 7
Produces a serialized error.
{
"code": 404,
"message": "The provided role name could not be found in the database. You have requested this URI [/api/roles/name/attacker] but did you mean /api/roles/name/string:name or /api/roles/name/string:name/properties or /api/goals/name/string:name ?",
"status": "Object not found"
}
When you view the risk model and click the line between two elements (in this case the role and the attacker) it produces an error.
Ubuntu VPS (2gb RAM)
Create a new object (e.g. asset or goal) in an empty model. Add an environment. When clicking ok, there should be a warning that no environment exist.
A null environment is added.
Follow instructions in the expected behaviour
All versions of the web app
All
New empty model created.
Program hangs, then once the sql query is killed produces:
`sqlalchemy.exc.ProgrammingError
ProgrammingError: (_mysql_exceptions.ProgrammingError) (1146, "Table 'cairis.roles_users' doesn't exist") [SQL: u'SELECT auth_role.id AS auth_role_id, auth_role.name AS auth_role_name, auth_role.description AS auth_role_description \nFROM auth_role, roles_users \nWHERE %s = roles_users.user_id AND auth_role.id = roles_users.role_id'] [parameters: (1L,)]
`
All versions
All except when using docker
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.