Refine pre-process taint check to include data flow assets (Issue
@@ -31066,13 +31066,13 @@ begin
end
//
-create procedure checkPreProcessTaint(in envId int, in ucId int, in entName longtext, in dfSeq longtext)
+create procedure checkPreProcessTaint(in dfId int, in envId int, in ucId int, in entName longtext, in dfSeq longtext)
begin
declare done int default 0;
declare ucName varchar(200);
declare taskName varchar(200);
declare attackerName varchar(200);
- declare tpCursor cursor for select t.name,a.name from task t, task_persona tp, persona_role pr, attacker_role ar, attacker_motivation am, attacker_capability ac, usecase_task ut, motivation m, capability c, attacker a, usecase_role ur where ut.usecase_id = ucId and ut.task_id = tp.task_id and tp.environment_id = envId and (tp.demands_id >= 2 or tp.goalsupport_id >= 2) and tp.task_id = t.id and tp.persona_id = pr.persona_id and tp.environment_id = pr.environment_id and pr.role_id = ar.role_id and pr.environment_id = ar.environment_id and ar.attacker_id = a.id and ar.attacker_id = am.attacker_id and ar.environment_id = am.environment_id and am.motivation_id = m.id and m.name = 'Productivity' and ar.attacker_id = ac.attacker_id and ar.environment_id = ac.environment_id and ac.capability_id = c.id and c.name like ('Resources/%') and ac.capability_value_id = 1 and ut.usecase_id = ur.usecase_id and ur.role_id = ar.role_id;
+ declare tpCursor cursor for select t.name,a.name from task t, task_persona tp, persona_role pr, attacker_role ar, attacker_motivation am, attacker_capability ac, usecase_task ut, motivation m, capability c, attacker a, usecase_role ur, task_asset ta where ut.usecase_id = ucId and ut.task_id = tp.task_id and tp.environment_id = envId and (tp.demands_id >= 2 or tp.goalsupport_id >= 2) and tp.task_id = t.id and tp.persona_id = pr.persona_id and tp.environment_id = pr.environment_id and pr.role_id = ar.role_id and pr.environment_id = ar.environment_id and ar.attacker_id = a.id and ar.attacker_id = am.attacker_id and ar.environment_id = am.environment_id and am.motivation_id = m.id and m.name in ('Productivity','Accident') and ar.attacker_id = ac.attacker_id and ar.environment_id = ac.environment_id and ac.capability_id = c.id and c.name like ('Resources/%') and ac.capability_value_id = 1 and ut.usecase_id = ur.usecase_id and ur.role_id = ar.role_id and tp.task_id = ta.task_id and tp.environment_id = ta.environment_id and ta.asset_id in (select asset_id from dataflow_asset where dataflow_id = dfId);
declare continue handler for not found set done = 1;
select name into ucName from usecase where id = ucId limit 1;
@@ -31152,7 +31152,7 @@ begin
if (ucId is not null)
then
- call checkPreProcessTaint(envId,ucId,entName,dfSeq);
+ call checkPreProcessTaint(dfId,envId,ucId,entName,dfSeq);
end if;
set done = 0;
