Repository: OWASP/threat-dragon
Pull request #819 (2023-12-14 16:58:25)

Update env var handling
**Summary**:
This updates environment variable handling:
* get them into alphbetical order
* ensure defaults are correctly applied

**Description for the changelog**:
update env var handling

**Other info**:




Patch:
diff --git a/.github/workflows/housekeeping.yaml b/.github/workflows/housekeeping.yaml
index 85df6eea..1ab6ea80 100644
--- a/.github/workflows/housekeeping.yaml
+++ b/.github/workflows/housekeeping.yaml
@@ -39,7 +39,7 @@ jobs:
           ref: main
 
       - name: Run vulnerability scanner
-        uses: aquasecurity/trivy-action@0.15.0
+        uses: aquasecurity/trivy-action@0.16.0
         with:
           image-ref: '${{ env.IMAGE_NAME }}:latest'
           format: 'template'
@@ -47,7 +47,7 @@ jobs:
           output: 'trivy-results.sarif'
 
       - name: Upload scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v2.22.1
+        uses: github/codeql-action/upload-sarif@v3.22.11
         with:
           sarif_file: 'trivy-results.sarif'
 
@@ -65,7 +65,7 @@ jobs:
           ref: main
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2.22.1
+        uses: github/codeql-action/init@v3.22.11
         with:
           languages: 'javascript'
           config-file: ./.github/codeql/codeql-config.yml
@@ -74,10 +74,10 @@ jobs:
           # Prefix the list here with "+" to use these queries and those in the config file.
 
       - name: CodeQL autobuild
-        uses: github/codeql-action/autobuild@v2.22.1
+        uses: github/codeql-action/autobuild@v3.22.11
 
       - name: Perform vulnerability analysis
-        uses: github/codeql-action/analyze@v2.22.1
+        uses: github/codeql-action/analyze@v3.22.11
 
   link_checker:
     name: Link checker
diff --git a/.github/workflows/pull_request.yaml b/.github/workflows/pull_request.yaml
index 7aa850b2..7da2be79 100644
--- a/.github/workflows/pull_request.yaml
+++ b/.github/workflows/pull_request.yaml
@@ -150,7 +150,7 @@ jobs:
       # ubuntu does not find this chrome driver
       # so until this is fixed, use only windows-latest
       - name: Setup Chrome
-        uses: browser-actions/setup-chrome@v1.3.0
+        uses: browser-actions/setup-chrome@v1.4.0
 
       - name: Use Node.js 18.x
         uses: actions/setup-node@v4.0.0
@@ -233,11 +233,11 @@ jobs:
         run: |
           docker run -d \
             -p 3000:3000 \
-            -e GITHUB_CLIENT_ID='${{ secrets.CI_GITHUB_CLIENT_ID }}' \
-            -e GITHUB_CLIENT_SECRET='${{ secrets.CI_GITHUB_CLIENT_SECRET }}' \
             -e ENCRYPTION_JWT_REFRESH_SIGNING_KEY='${{ secrets.CI_JWT_REFRESH_SIGNING_KEY }}' \
             -e ENCRYPTION_JWT_SIGNING_KEY='${{ secrets.CI_JWT_SIGNING_KEY }}' \
             -e ENCRYPTION_KEYS='${{ secrets.CI_SESSION_ENCRYPTION_KEYS }}' \
+            -e GITHUB_CLIENT_ID='${{ secrets.CI_GITHUB_CLIENT_ID }}' \
+            -e GITHUB_CLIENT_SECRET='${{ secrets.CI_GITHUB_CLIENT_SECRET }}' \
             -e NODE_ENV='development' \
             -e SERVER_API_PROTOCOL='http' \
             ${{ env.IMAGE_NAME }}
@@ -375,7 +375,7 @@ jobs:
         uses: actions/checkout@v4.1.1
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.15.0
+        uses: aquasecurity/trivy-action@0.16.0
         with:
           image-ref: '${{ env.IMAGE_NAME }}'
           format: 'table'
diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml
index 19c664f5..44a7dec7 100644
--- a/.github/workflows/push.yaml
+++ b/.github/workflows/push.yaml
@@ -53,7 +53,7 @@ jobs:
         uses: actions/checkout@v4.1.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2.22.1
+        uses: github/codeql-action/init@v3.22.11
         with:
           languages: 'javascript'
           config-file: ./.github/codeql/codeql-config.yml
@@ -62,10 +62,10 @@ jobs:
           # Prefix the list here with "+" to use these queries and those in the config file.
 
       - name: CodeQL autobuild
-        uses: github/codeql-action/autobuild@v2.22.1
+        uses: github/codeql-action/autobuild@v3.22.11
 
       - name: Perform vulnerability analysis
-        uses: github/codeql-action/analyze@v2.22.1
+        uses: github/codeql-action/analyze@v3.22.11
 
   server_unit_tests:
     name: Server unit tests
@@ -177,7 +177,7 @@ jobs:
       # ubuntu does not find this chrome driver
       # so until this is fixed, use only windows-latest
       - name: Setup Chrome
-        uses: browser-actions/setup-chrome@v1.3.0
+        uses: browser-actions/setup-chrome@v1.4.0
 
       - name: Use Node.js 18.x
         uses: actions/setup-node@v4.0.0
@@ -330,11 +330,11 @@ jobs:
         run: |
           docker run -d \
             -p 3000:3000 \
-            -e GITHUB_CLIENT_ID='${{ secrets.CI_GITHUB_CLIENT_ID }}' \
-            -e GITHUB_CLIENT_SECRET='${{ secrets.CI_GITHUB_CLIENT_SECRET }}' \
             -e ENCRYPTION_JWT_REFRESH_SIGNING_KEY='${{ secrets.CI_JWT_REFRESH_SIGNING_KEY }}' \
             -e ENCRYPTION_JWT_SIGNING_KEY='${{ secrets.CI_JWT_SIGNING_KEY }}' \
             -e ENCRYPTION_KEYS='${{ secrets.CI_SESSION_ENCRYPTION_KEYS }}' \
+            -e GITHUB_CLIENT_ID='${{ secrets.CI_GITHUB_CLIENT_ID }}' \
+            -e GITHUB_CLIENT_SECRET='${{ secrets.CI_GITHUB_CLIENT_SECRET }}' \
             -e NODE_ENV='development' \
             -e SERVER_API_PROTOCOL='http' \
             ${{ env.IMAGE_NAME }}
@@ -472,7 +472,7 @@ jobs:
         uses: actions/checkout@v4.1.1
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.15.0
+        uses: aquasecurity/trivy-action@0.16.0
         with:
           image-ref: '${{ env.IMAGE_NAME }}'
           format: 'table'
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 5e47192d..3587e2c2 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -124,7 +124,7 @@ jobs:
       # ubuntu does not find this chrome driver
       # so until this is fixed, use only windows-latest
       - name: Setup Chrome
-        uses: browser-actions/setup-chrome@v1.3.0
+        uses: browser-actions/setup-chrome@v1.4.0
 
       - name: Use Node.js 18.x
         uses: actions/setup-node@v4.0.0
diff --git a/example.env b/example.env
index 7e13a0b3..cefa4612 100644
--- a/example.env
+++ b/example.env
@@ -1,20 +1,18 @@
+BITBUCKET_CLIENT_ID=01234567890123456789
+BITBUCKET_CLIENT_SECRET=0123456789abcdef0123456789abcdef0123456
+BITBUCKET_SCOPE=repository:write
+BITBUCKET_WORKSPACE=workspace_name
+
+ENCRYPTION_KEYS='[{"isPrimary": true, "id": 0, "value": "11223344556677889900aabbccddeeff"}]'
+ENCRYPTION_JWT_SIGNING_KEY=asdfasdfasdf
+ENCRYPTION_JWT_REFRESH_SIGNING_KEY=fljasdlfkjadf
+
 GITHUB_CLIENT_ID=01234567890123456789
 GITHUB_CLIENT_SECRET=0123456789abcdef0123456789abcdef0123456
-GITHUB_SCOPE=public_repo
 GITHUB_ENTERPRISE_HOSTNAME=optional_if_using_enterprise
 GITHUB_ENTERPRISE_PORT=optional_if_enterprise_and_non_standard
 GITHUB_ENTERPRISE_PROTOCOL=optional_if_enterprise_and_non_standard
+GITHUB_SCOPE=public_repo
 
 NODE_ENV=development
 SERVER_API_PROTOCOL=http
-
-ENCRYPTION_KEYS='[{"isPrimary": true, "id": 0, "value": "11223344556677889900aabbccddeeff"}]'
-ENCRYPTION_JWT_SIGNING_KEY=asdfasdfasdf
-ENCRYPTION_JWT_REFRESH_SIGNING_KEY=fljasdlfkjadf
-
-
-
-BITBUCKET_WORKSPACE=workspace_name
-BITBUCKET_CLIENT_ID=01234567890123456789
-BITBUCKET_CLIENT_SECRET=0123456789abcdef0123456789abcdef0123456
-BITBUCKET_SCOPE=repository:write
\ No newline at end of file
diff --git a/td.server/src/env/Bitbucket.js b/td.server/src/env/Bitbucket.js
index d6848404..67a3adfa 100644
--- a/td.server/src/env/Bitbucket.js
+++ b/td.server/src/env/Bitbucket.js
@@ -13,11 +13,11 @@ class BitbucketEnv extends Env {
         return [
             { key: 'CLIENT_ID', required: false },
             { key: 'CLIENT_SECRET', required: false },
-            { key: 'SCOPE', required: false },
+            { key: 'SCOPE', required: false, defaultValue: 'public_repo' },
             { key: 'ENTERPRISE_HOSTNAME', required: false },
-            { key: 'ENTERPRISE_PROTOCOL', required: false },
-            { key: 'ENTERPRISE_PORT', required: false },
-            { key: 'USE_SEARCH', required: false },
+            { key: 'ENTERPRISE_PORT', required: false, defaultValue: 443 },
+            { key: 'ENTERPRISE_PROTOCOL', required: false, defaultValue: 'https' },
+            { key: 'USE_SEARCH', required: false, defaultValue: false },
             { key: 'SEARCH_QUERY', required: false },
             { key: 'WORKSPACE', required: false }
         ];
diff --git a/td.server/src/env/Github.js b/td.server/src/env/Github.js
index bd9a5b8e..d6b17578 100644
--- a/td.server/src/env/Github.js
+++ b/td.server/src/env/Github.js
@@ -13,11 +13,11 @@ class GithubEnv extends Env {
         return [
             { key: 'CLIENT_ID', required: false },
             { key: 'CLIENT_SECRET', required: false },
-            { key: 'SCOPE', required: false },
+            { key: 'SCOPE', required: false, defaultValue: 'public_repo' },
             { key: 'ENTERPRISE_HOSTNAME', required: false },
-            { key: 'ENTERPRISE_PROTOCOL', required: false },
-            { key: 'ENTERPRISE_PORT', required: false },
-            { key: 'USE_SEARCH', required: false },
+            { key: 'ENTERPRISE_PORT', required: false, defaultValue: 443 },
+            { key: 'ENTERPRISE_PROTOCOL', required: false, defaultValue: 'https' },
+            { key: 'USE_SEARCH', required: false, defaultValue: false },
             { key: 'SEARCH_QUERY', required: false }
         ];
     }
diff --git a/td.server/src/env/ThreatDragon.js b/td.server/src/env/ThreatDragon.js
index 59ca90ae..e8254b37 100644
--- a/td.server/src/env/ThreatDragon.js
+++ b/td.server/src/env/ThreatDragon.js
@@ -12,10 +12,10 @@ class ThreatDragonEnv extends Env {
     // if any  of the defaults are changed then ensure docs are updated at docs/development/environment.md
     get properties () {
         return [
-            { key: 'NODE_ENV', required: false },
-            { key: 'PORT', required: false },
+            { key: 'NODE_ENV', required: false, defaultValue:  'production'},
+            { key: 'PORT', required: false, defaultValue: 3000 },
             { key: 'LOG_MAX_FILE_SIZE', required: false, defaultValue: 24 },
-            { key: 'LOG_LEVEL', required: true, defaultValue: 'info' },
+            { key: 'LOG_LEVEL', required: false, defaultValue: 'warn' },
             { key: 'SERVER_API_PROTOCOL', required: false, defaultValue: 'https' }
         ];
     }
diff --git a/td.vue/src/i18n/ar.js b/td.vue/src/i18n/ar.js
index 0807da0c..aaad2a4c 100644
--- a/td.vue/src/i18n/ar.js
+++ b/td.vue/src/i18n/ar.js
@@ -227,6 +227,11 @@ const ara = {
         discardTitle: 'هل تريد تجاهل التغييرات؟',
         discardMessage: 'هل أنت متأكد من رغبتك في تجاهل التغييرات الخاصة بك؟',
         edit: 'تحرير',
+        exportAs: 'Export Model As',
+        exportHtml: 'تقرير HTML',
+        exportPdf: 'تقرير PDF',
+        exportTd: 'Original (Threat Dragon)',
+        exportOtm: 'Open Threat Model (OTM)',
         import: 'استيراد',
         ok: 'موافق',
         open: 'فتح',
@@ -239,10 +244,8 @@ const ara = {
         savetd: 'تنسيق Threat Dragon',
         saveotm: 'تنسيق OTM',
         saveAs: 'حفظ كـ',
-        saveHtml: 'حفظ HTML',
         saveModel: 'حفظ النموذج',
         saveModelAs: 'حفظ النموذج كـ',
-        savePdf: 'حفظ PDF',
         search: 'بحث'
     },
     threats: {
@@ -303,7 +306,7 @@ const ara = {
         confirmDeleteMessage: 'هل أنت متأكد من حذف هذا التهديد؟',
         description: 'اكتب وصفًا لهذا التهديد',
         emptyThreat: 'حدد عنصرًا على الرسم البياني لإضافة تهديد',
-        mitigation: "اكتب طرق مواجهة وتخفيف هذا التهديد أو السبب إذا كانت الحالة N/A",
+        mitigation: 'اكتب طرق مواجهة وتخفيف هذا التهديد أو السبب إذا كانت الحالة N/A',
         newThreat: 'تهديد جديد',
         newThreatByType: 'تهديد جديد حسب النوع',
         newThreatByContext: 'تهديد جديد حسب السياق',
diff --git a/td.vue/src/store/modules/threatmodel.js b/td.vue/src/store/modules/threatmodel.js
index 05e53861..3ec51a79 100644
--- a/td.vue/src/store/modules/threatmodel.js
+++ b/td.vue/src/store/modules/threatmodel.js
@@ -20,9 +20,9 @@ import {
     THREATMODEL_SET_ROLLBACK,
     THREATMODEL_UNMODIFIED,
     THREATMODEL_UPDATE
-} from '../actions/threatmodel.js';
-import save from '../../service/save.js';
-import threatmodelApi from '../../service/api/threatmodelApi.js';
+} from '@/store/actions/threatmodel.js';
+import save from '@/service/save.js';
+import threatmodelApi from '@/service/api/threatmodelApi.js';
 
 export const clearState = (state) => {
     if (isElectron()) {


Test patch:
diff --git a/td.server/test/env/ThreatDragon.spec.js b/td.server/test/env/ThreatDragon.spec.js
index aa4b5110..4d80e6cb 100644
--- a/td.server/test/env/ThreatDragon.spec.js
+++ b/td.server/test/env/ThreatDragon.spec.js
@@ -47,7 +47,7 @@ describe('env/ThreatDragon.js', () => {
         const isRequired = tdEnv.properties
             .find(x => x.key === 'LOG_LEVEL')
             .required;
-        expect(isRequired).to.be.true;
+        expect(isRequired).to.be.false;
     });
 
     it('has the optional property SERVER_API_PROTOCOL', () => {