Threat Dragon 2.0 - Breaking Changes in Drawing Package

[lreading]

Hello!

I'm one of the Threat Dragon maintainers, and just learned of this awesome tool through an OWASP Kyiv video on YouTube. Threat Dragon is ramping up for it's 2.0 release, which will be using an entirely different drawing package (moving from JoinJS to Antv/x6). To date, we've been working hard to ensure that there aren't breaking changes in the JSON models, except for the drawing parts. Unfortunately, this looks like it will be a breaking change for this project. We do not have an exact ETA for the version 2 release at this time, but development has been underway for a while. The exact schema for the 2.0 models isn't finalized yet, however, they will likely have a version tag at the top level to help identify them from the 1.x versions.

My goal is to start a conversation and see if there's anything we can do to help the transition to 2.0 models. There will be a couple new shapes introduced in 2.0, possibly more in the future. The first thing that comes to mind as far as things we could do that might be helpful is possibly publishing Threat Dragon's shape definitions as a separate NPM package?

I'm very open to discussion and am here to help! Cheers!

[ChristophNiehoff]

Hi @lreading

thank you very much for letting us know about the breaking changes. This is a great service of you as we haven't been aware of this! ❤️

I believe it would help us most if we could get an example JSON (and maybe a list of the changes) as soon as the schema is somehow stable.
I am not sure whether I understand the part about the new drawing package: Is the new JSON schema coupled to the drawing package? I.e. do we have to change to x6 as well?

Thank you very much!

[lreading]

The new JSON schema will be tightly coupled to the drawing package. (It currently is tightly coupled to JointJS). I think the easiest path forward would be using X6 as well, as the properties are just slightly different.

We don't have an example quite yet though, but I will be sure to post one when we have it, along with some specific references to how we're handling the conversion of v1 -> v2 models. V2 is still in development, so we will be sure to stay in contact.

Thanks again!

[sNiXx]

Hey everyone, is there anything going on here? Threat Dragon 2.0.0 was released a few months ago 👍 😁

[T3CHKOMMIE]

2.X got rid of the diagramJSON attribute, seems to have moved "data" seems to be the new attrs and attrs has been made to reflected what looks like visualization attributes for the element.

Ive been trying to figure out how to edit the client code to parse the new JSON format for TD 2.X but its a lot of eye-bleeding debugs. dia doesnt like that my cell types arent strings

[gh0st42]

Just wanted to check if there is any progress on this issue or if maybe help in testing is needed?
Unfortunately, we have a bunch of models in threat dragon 2 format and using images as a basis for EoP is not nearly as nice as having the models directly in the game.

And thank you for making this awesome digital version of EoP!

[dehydr8]

Hi @gh0st42

@ChristophNiehoff and the folks at TNG maintain a fork with additional features at https://github.com/TNG/elevation-of-privilege. I haven't been actively involved in the development/maintenance lately, but I can spare some time to add support for it if needed.