Skip to content

Fix JSON round-trip: loads() couldn't read dumps() output#340

Open
NoodlesNZ wants to merge 1 commit into
OWASP:masterfrom
NoodlesNZ:bug/json_round_trip
Open

Fix JSON round-trip: loads() couldn't read dumps() output#340
NoodlesNZ wants to merge 1 commit into
OWASP:masterfrom
NoodlesNZ:bug/json_round_trip

Conversation

@NoodlesNZ

Copy link
Copy Markdown
Contributor

The JSON produced by --json couldn't be loaded back with pytm.loads(). The dump writes enums as str(member) ("Classification.SECRET") while the loader expected bare member names, it writes "inBoundary": null which the loader treated as a real reference, and it serializes derived state (findings, inputs/outputs, carriedBy) as name strings that blow up when passed into typed fields.

Changes:

  • Added a _missing_ hook to the pytm enums so both "SECRET" and "Classification.SECRET" resolve. This covers every enum field in one place, including Pydantic validation on elements. The dump format itself is unchanged.
  • The loader now skips derived attributes — they're rebuilt by check()/resolve() anyway — and ignores null boundary refs.
  • Flow response/responseTo references are linked in a second pass once all flows exist, so request/response pairs survive a reload.
  • Asset data name references now resolve against the decoded data section, same as flows.

Added test_json_round_trip, which dumps a model with nested boundaries, classified data and a response flow, reloads it, and checks the relationships survive. Existing hand-written JSON fixtures still load as before.

@NoodlesNZ NoodlesNZ requested a review from izar as a code owner July 10, 2026 23:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant