dehydr8/elevation-of-privilege

Using Cornucopia, wrong attributes are included in the downloadable model file

ChristophNiehoff opened this issue · 1 comments

In the gameMode Cornucopia and when downloading the model JSON file, a threats have attributes like the following:

"methodology": "Data, Crypt, Sessn, AuthZ, AuthN, Cornu",
"type": "Tampering"

The methodology should maybe better be "Cornucopia" (although I am not sure what will happen when this is loaded with OWASP threat dragon....)

The type actually is the STRIDE type, i.e. it is the corresponding Elevation of Privilege category. So, this is wrong and probably comes from an incorrect mapping of the category names.

I suppose whatever we put won't work with threat dragon, maybe we write somewhere that models generated when playing cornucopia may behave strangely/cannot be used in threat-dragon