Skip to content

Fix out-of-scope elements inheriting other elements' findings in resolve()#338

Open
NoodlesNZ wants to merge 1 commit into
OWASP:masterfrom
NoodlesNZ:bug/scoped_findings
Open

Fix out-of-scope elements inheriting other elements' findings in resolve()#338
NoodlesNZ wants to merge 1 commit into
OWASP:masterfrom
NoodlesNZ:bug/scoped_findings

Conversation

@NoodlesNZ

Copy link
Copy Markdown
Contributor

TM.resolve() was assigning the in-progress findings list to out-of-scope elements instead of skipping them:

  if not getattr(e, "inScope", True):
      e.findings = findings
      continue

Since findings accumulates as the element loop runs, any element with inScope=False ended up with a copy of every finding generated for elements processed before it. Reports then showed findings against the exact elements that were declared out of scope, targeting completely different parts of the model.

The existing test_resolve didn't catch this because its out-of-scope actor happened to be created before any finding-producing elements, so the leaked list was still empty at that point. Element creation order determines iteration order in resolve(), so the bug only shows up when an out-of-scope element is defined after in-scope ones.

Changes:

  • resolve() now sets findings to an empty list for out-of-scope elements. This also clears stale findings if a model is resolved again after flipping an element out of scope.
  • Parametrised test_resolve to cover both creation orders (out-of-scope element defined first and last), so the leaking variant stays covered.

@NoodlesNZ NoodlesNZ requested a review from izar as a code owner July 10, 2026 22:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant